[bug#38182] [PATCH 3/3] services: Add pam-mount.

[Guillaume Le Vaillant <glv@posteo.net>]

[-- Attachment #1: Type: text/plain, Size: 2487 bytes --]


Ludovic Courtès skribis:

> Hi Guillaume,
>
> I’ve applied the first two patches, thanks!
>
> Guillaume Le Vaillant <glv@posteo.net> skribis:
>
>> * gnu/services/pam-mount.scm: New file.
>> * gnu/local.mk (GNU_SYSTEM_MODULES): Add it.
>> * doc/guix.texi (PAM Mount Service): New subsection.
>
> […]
>
>> +The @code{(gnu services pam-mount)} module provides a service allowing
>> +users to mount volumes when they log in.  It should be able to mount any
>> +volume format supported by the system.
>
> How does one specify what needs to be mounted upon log-in of a specific
> user?  I’m new to PAM-Mount and I’m left wondering.  :-)

I added an example in the manual.

>> Note that to automatically mount
>> +encrypted volumes using the password the user entered to log in, the
>> +@code{pam-mount} package must be added in the @code{packages} field of
>> +the @code{operating-system} definition.
>
> Should we instead arrange so that the ‘pam-mount’ command (or whatever
> it’s called) is automatically found, instead of asking users to add it
> to ‘packages’?

I found a way to have 'pam-mount' call directly
'/gnu/store/...-pam-mount-.../sbin/mount.crypt' when necessary. So
adding 'pam-mount' to 'packages' is not needed anymore.

>> +(define %pam-mount-default-configuration
>> +  (plain-file "pam_mount.conf.xml"
>> +              "<?xml version=\"1.0\" encoding=\"utf-8\" ?>
>> +<!DOCTYPE pam_mount SYSTEM \"pam_mount.conf.xml.dtd\">
>> +<pam_mount>
>> +<debug enable=\"0\" />
>> +<mntoptions
>> +allow=\"nosuid,nodev,loop,encryption,fsck,nonempty,allow_root,allow_other\" />
>> +<mntoptions require=\"nosuid,nodev\" />
>> +<logout wait=\"0\" hup=\"no\" term=\"no\" kill=\"no\" />
>> +<mkmountpoint enable=\"1\" remove=\"true\" />
>> +</pam_mount>\n"))
>
> I suggest writing SXML instead and using ‘sxml->xml’, if you don’t
> mind.  :-)

Done.

>> +(define pam-mount-service-type
>> +  (service-type
>> +   (name 'pam-mount)
>> +   (extensions (list (service-extension etc-service-type
>> +                                        pam-mount-etc-service)
>> +                     (service-extension pam-root-service-type
>> +                                        pam-mount-pam-service)))
>> +   (default-value (pam-mount-configuration))))
>
> Please also add a ‘description’ field.

Done.

> Could you send an updated patch?
>
> Thanks!
>
> Ludo’.

Updated patch attached.


[-- Attachment #2: 0001-services-Add-pam-mount.patch --]
[-- Type: text/x-patch, Size: 10341 bytes --]

From 4572adf4f28480fd891293ff2204228dbb8b41d1 Mon Sep 17 00:00:00 2001
From: Guillaume Le Vaillant <glv@posteo.net>
Date: Tue, 26 Nov 2019 21:56:44 +0100
Subject: [PATCH v2 3/3] services: Add pam-mount.

* gnu/services/pam-mount.scm: New file.
* gnu/local.mk (GNU_SYSTEM_MODULES): Add it.
* doc/guix.texi (PAM Mount Service): New subsection.
---
 doc/guix.texi              |  85 ++++++++++++++++++++++++++++
 gnu/local.mk               |   1 +
 gnu/services/pam-mount.scm | 111 +++++++++++++++++++++++++++++++++++++
 3 files changed, 197 insertions(+)
 create mode 100644 gnu/services/pam-mount.scm

diff --git a/doc/guix.texi b/doc/guix.texi
index a64b0fb84c..b293adb0b1 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -68,6 +68,7 @@ Copyright @copyright{} 2019 Ivan Petkov@*
 Copyright @copyright{} 2019 Jakob L. Kreuze@*
 Copyright @copyright{} 2019 Kyle Andrews@*
 Copyright @copyright{} 2019 Alex Griffin@*
+Copyright @copyright{} 2019 Guillaume Le Vaillant@*
 
 Permission is granted to copy, distribute and/or modify this document
 under the terms of the GNU Free Documentation License, Version 1.3 or
@@ -305,6 +306,7 @@ Services
 * Virtualization Services::     Virtualization services.
 * Version Control Services::    Providing remote access to Git repositories.
 * Game Services::               Game servers.
+* PAM Mount Service::           Service to mount volumes when logging in.
 * Miscellaneous Services::      Other services.
 
 Defining Services
@@ -11931,6 +11933,7 @@ declaration.
 * Virtualization Services::     Virtualization services.
 * Version Control Services::    Providing remote access to Git repositories.
 * Game Services::               Game servers.
+* PAM Mount Service::           Service to mount volumes when logging in.
 * Guix Services::               Services relating specifically to Guix.
 * Miscellaneous Services::      Other services.
 @end menu
@@ -24656,6 +24659,88 @@ The port to bind the server to.
 @end deftp
 
 
+@node PAM Mount Service
+@subsection PAM Mount Service
+@cindex pam-mount
+
+The @code{(gnu services pam-mount)} module provides a service allowing
+users to mount volumes when they log in.  It should be able to mount any
+volume format supported by the system.
+
+@defvar {Scheme Variable} pam-mount-service-type
+Service type for PAM Mount support.
+@end defvar
+
+@deftp {Data Type} pam-mount-configuration
+Data type representing the configuration of PAM Mount.
+
+It takes the following parameters:
+
+@table @asis
+@item @code{rules}
+The configuration rules that will be used to generate
+@file{/etc/security/pam_mount.conf.xml}.
+
+The configuration rules are SXML elements, and the the default ones
+don't mount anything for anyone at login:
+
+@lisp
+`((debug (@@ (enable "0")))
+  (mntoptions (@@ (allow ,(string-join
+                          '("nosuid" "nodev" "loop"
+                            "encryption" "fsck" "nonempty"
+                            "allow_root" "allow_other")
+                          ","))))
+  (mntoptions (@@ (require "nosuid,nodev")))
+  (logout (@@ (wait "0")
+             (hup "0")
+             (term "no")
+             (kill "no")))
+  (mkmountpoint (@@ (enable "1")
+                   (remove "true"))))
+@end lisp
+
+Some @code{volume} elements must be added to automatically mount volumes
+at login.  Here's an example allowing the user @code{alice} to mount her
+encrypted @code{HOME} directory and allowing the user @code{bob} to mount
+the partition where he stores his data:
+
+@lisp
+(define pam-mount-rules
+`((debug (@@ (enable "0")))
+            (volume (@@ (user "alice")
+                       (fstype "crypt")
+                       (path "/dev/sda2")
+                       (mountpoint "/home/alice")))
+            (volume (@@ (user "bob")
+                       (fstype "auto")
+                       (path "/dev/sdb3")
+                       (mountpoint "/home/bob/data")
+                       (options "defaults,autodefrag,compress")))
+            (mntoptions (@@ (allow ,(string-join
+                                    '("nosuid" "nodev" "loop"
+                                      "encryption" "fsck" "nonempty"
+                                      "allow_root" "allow_other")
+                                    ","))))
+            (mntoptions (@@ (require "nosuid,nodev")))
+            (logout (@@ (wait "0")
+                       (hup "0")
+                       (term "no")
+                       (kill "no")))
+            (mkmountpoint (@@ (enable "1")
+                             (remove "true")))))
+
+(service pam-mount-service-type
+         (pam-mount-configuration
+           (rules pam-mount-rules)))
+@end lisp
+
+The complete list of possible options can be found in the man page for
+@uref{http://pam-mount.sourceforge.net/pam_mount.conf.5.html, pam_mount.conf}.
+@end table
+@end deftp
+
+
 @node Guix Services
 @subsection Guix Services
 
diff --git a/gnu/local.mk b/gnu/local.mk
index 0129e42944..0e0c3e30e7 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -551,6 +551,7 @@ GNU_SYSTEM_MODULES =				\
   %D%/services/networking.scm			\
   %D%/services/nix.scm				\
   %D%/services/nfs.scm			\
+  %D%/services/pam-mount.scm			\
   %D%/services/security-token.scm		\
   %D%/services/shepherd.scm			\
   %D%/services/sound.scm			\
diff --git a/gnu/services/pam-mount.scm b/gnu/services/pam-mount.scm
new file mode 100644
index 0000000000..98611462c2
--- /dev/null
+++ b/gnu/services/pam-mount.scm
@@ -0,0 +1,111 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2019 Guillaume Le Vaillant <glv@posteo.net>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+(define-module (gnu services pam-mount)
+  #:use-module (gnu packages admin)
+  #:use-module (gnu services)
+  #:use-module (gnu services configuration)
+  #:use-module (gnu system pam)
+  #:use-module (guix gexp)
+  #:use-module (guix records)
+  #:export (pam-mount-configuration
+            pam-mount-configuration?
+            pam-mount-service-type))
+
+(define %pam-mount-default-configuration
+  `((debug (@ (enable "0")))
+    (mntoptions (@ (allow ,(string-join
+                            '("nosuid" "nodev" "loop"
+                              "encryption" "fsck" "nonempty"
+                              "allow_root" "allow_other")
+                            ","))))
+    (mntoptions (@ (require "nosuid,nodev")))
+    (logout (@ (wait "0")
+               (hup "0")
+               (term "no")
+               (kill "no")))
+    (mkmountpoint (@ (enable "1")
+                     (remove "true")))))
+
+(define (make-pam-mount-configuration-file config)
+  (computed-file
+   "pam_mount.conf.xml"
+   #~(begin
+       (use-modules (sxml simple))
+       (call-with-output-file #$output
+         (lambda (port)
+           (sxml->xml
+            '(*TOP*
+              (*PI* xml "version='1.0' encoding='utf-8'")
+              (pam_mount
+               #$@(pam-mount-configuration-rules config)
+               (pmvarrun
+                #$(file-append pam-mount
+                               "/sbin/pmvarrun -u '%(USER)' -o '%(OPERATION)'"))
+               (cryptmount
+                #$(file-append pam-mount
+                               (string-append
+                                "/sbin/mount.crypt"
+                                " '%(if %(CIPHER),-ocipher=%(CIPHER))'"
+                                " '%(if %(FSKEYCIPHER),"
+                                "-ofsk_cipher=%(FSKEYCIPHER))'"
+                                " '%(if %(FSKEYHASH),-ofsk_hash=%(FSKEYHASH))'"
+                                " '%(if %(FSKEYPATH),-okeyfile=%(FSKEYPATH))'"
+                                " '%(if %(OPTIONS),-o%(OPTIONS))'"
+                                " '%(VOLUME)' '%(MNTPT)'")))
+               (cryptumount
+                #$(file-append pam-mount "/sbin/umount.crypt '%(MNTPT)'"))))
+            port))))))
+
+(define-record-type* <pam-mount-configuration>
+  pam-mount-configuration
+  make-pam-mount-configuration
+  pam-mount-configuration?
+  (rules pam-mount-configuration-rules
+         (default %pam-mount-default-configuration)))
+
+(define (pam-mount-etc-service config)
+  `(("security/pam_mount.conf.xml"
+     ,(make-pam-mount-configuration-file config))))
+
+(define (pam-mount-pam-service config)
+  (define optional-pam-mount
+    (pam-entry
+     (control "optional")
+     (module #~(string-append #$pam-mount "/lib/security/pam_mount.so"))))
+  (list (lambda (pam)
+          (if (member (pam-service-name pam)
+                      '("login" "su" "slim" "gdm-password"))
+              (pam-service
+               (inherit pam)
+               (auth (append (pam-service-auth pam)
+                             (list optional-pam-mount)))
+               (session (append (pam-service-session pam)
+                                (list optional-pam-mount))))
+              pam))))
+
+(define pam-mount-service-type
+  (service-type
+   (name 'pam-mount)
+   (extensions (list (service-extension etc-service-type
+                                        pam-mount-etc-service)
+                     (service-extension pam-root-service-type
+                                        pam-mount-pam-service)))
+   (default-value (pam-mount-configuration))
+   (description "Activate PAM-Mount support.  It allows mounting volumes for
+specific users when they log in.")))
-- 
2.24.0