From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:470:142:3::10]:54774) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1iZitV-0006sV-9o for guix-patches@gnu.org; Tue, 26 Nov 2019 17:01:15 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1iZitR-0006NH-AH for guix-patches@gnu.org; Tue, 26 Nov 2019 17:01:13 -0500 Received: from debbugs.gnu.org ([209.51.188.43]:47143) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1iZitK-0006Jt-G6 for guix-patches@gnu.org; Tue, 26 Nov 2019 17:01:05 -0500 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1iZitK-0006GD-DG for guix-patches@gnu.org; Tue, 26 Nov 2019 17:01:02 -0500 Subject: [bug#38182] [PATCH 3/3] services: Add pam-mount. Resent-Message-ID: References: <87ftitas7x.fsf@yamatai> <20191112180519.9625-1-glv@posteo.net> <20191112180519.9625-3-glv@posteo.net> <87mucjtvq7.fsf@gnu.org> From: Guillaume Le Vaillant In-reply-to: <87mucjtvq7.fsf@gnu.org> Date: Tue, 26 Nov 2019 23:00:04 +0100 Message-ID: <87imn6uwm3.fsf@yamatai> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="=-=-=" List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-patches-bounces+kyle=kyleam.com@gnu.org Sender: "Guix-patches" To: Ludovic =?UTF-8?Q?Court=C3=A8s?= Cc: 38182@debbugs.gnu.org --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Ludovic Court=C3=A8s skribis: > Hi Guillaume, > > I=E2=80=99ve applied the first two patches, thanks! > > Guillaume Le Vaillant skribis: > >> * gnu/services/pam-mount.scm: New file. >> * gnu/local.mk (GNU_SYSTEM_MODULES): Add it. >> * doc/guix.texi (PAM Mount Service): New subsection. > > [=E2=80=A6] > >> +The @code{(gnu services pam-mount)} module provides a service allowing >> +users to mount volumes when they log in. It should be able to mount any >> +volume format supported by the system. > > How does one specify what needs to be mounted upon log-in of a specific > user? I=E2=80=99m new to PAM-Mount and I=E2=80=99m left wondering. :-) I added an example in the manual. >> Note that to automatically mount >> +encrypted volumes using the password the user entered to log in, the >> +@code{pam-mount} package must be added in the @code{packages} field of >> +the @code{operating-system} definition. > > Should we instead arrange so that the =E2=80=98pam-mount=E2=80=99 command= (or whatever > it=E2=80=99s called) is automatically found, instead of asking users to a= dd it > to =E2=80=98packages=E2=80=99? I found a way to have 'pam-mount' call directly '/gnu/store/...-pam-mount-.../sbin/mount.crypt' when necessary. So adding 'pam-mount' to 'packages' is not needed anymore. >> +(define %pam-mount-default-configuration >> + (plain-file "pam_mount.conf.xml" >> + " >> + >> + >> + >> +> +allow=3D\"nosuid,nodev,loop,encryption,fsck,nonempty,allow_root,allow_o= ther\" /> >> + >> + >> + >> +\n")) > > I suggest writing SXML instead and using =E2=80=98sxml->xml=E2=80=99, if = you don=E2=80=99t > mind. :-) Done. >> +(define pam-mount-service-type >> + (service-type >> + (name 'pam-mount) >> + (extensions (list (service-extension etc-service-type >> + pam-mount-etc-service) >> + (service-extension pam-root-service-type >> + pam-mount-pam-service))) >> + (default-value (pam-mount-configuration)))) > > Please also add a =E2=80=98description=E2=80=99 field. Done. > Could you send an updated patch? > > Thanks! > > Ludo=E2=80=99. Updated patch attached. --=-=-= Content-Type: text/x-patch; charset=utf-8 Content-Disposition: attachment; filename=0001-services-Add-pam-mount.patch Content-Transfer-Encoding: quoted-printable >From 4572adf4f28480fd891293ff2204228dbb8b41d1 Mon Sep 17 00:00:00 2001 From: Guillaume Le Vaillant Date: Tue, 26 Nov 2019 21:56:44 +0100 Subject: [PATCH v2 3/3] services: Add pam-mount. * gnu/services/pam-mount.scm: New file. * gnu/local.mk (GNU_SYSTEM_MODULES): Add it. * doc/guix.texi (PAM Mount Service): New subsection. --- doc/guix.texi | 85 ++++++++++++++++++++++++++++ gnu/local.mk | 1 + gnu/services/pam-mount.scm | 111 +++++++++++++++++++++++++++++++++++++ 3 files changed, 197 insertions(+) create mode 100644 gnu/services/pam-mount.scm diff --git a/doc/guix.texi b/doc/guix.texi index a64b0fb84c..b293adb0b1 100644 --- a/doc/guix.texi +++ b/doc/guix.texi @@ -68,6 +68,7 @@ Copyright @copyright{} 2019 Ivan Petkov@* Copyright @copyright{} 2019 Jakob L. Kreuze@* Copyright @copyright{} 2019 Kyle Andrews@* Copyright @copyright{} 2019 Alex Griffin@* +Copyright @copyright{} 2019 Guillaume Le Vaillant@* =20 Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.3 or @@ -305,6 +306,7 @@ Services * Virtualization Services:: Virtualization services. * Version Control Services:: Providing remote access to Git repositorie= s. * Game Services:: Game servers. +* PAM Mount Service:: Service to mount volumes when logging in. * Miscellaneous Services:: Other services. =20 Defining Services @@ -11931,6 +11933,7 @@ declaration. * Virtualization Services:: Virtualization services. * Version Control Services:: Providing remote access to Git repositorie= s. * Game Services:: Game servers. +* PAM Mount Service:: Service to mount volumes when logging in. * Guix Services:: Services relating specifically to Guix. * Miscellaneous Services:: Other services. @end menu @@ -24656,6 +24659,88 @@ The port to bind the server to. @end deftp =20 =20 +@node PAM Mount Service +@subsection PAM Mount Service +@cindex pam-mount + +The @code{(gnu services pam-mount)} module provides a service allowing +users to mount volumes when they log in. It should be able to mount any +volume format supported by the system. + +@defvar {Scheme Variable} pam-mount-service-type +Service type for PAM Mount support. +@end defvar + +@deftp {Data Type} pam-mount-configuration +Data type representing the configuration of PAM Mount. + +It takes the following parameters: + +@table @asis +@item @code{rules} +The configuration rules that will be used to generate +@file{/etc/security/pam_mount.conf.xml}. + +The configuration rules are SXML elements, and the the default ones +don't mount anything for anyone at login: + +@lisp +`((debug (@@ (enable "0"))) + (mntoptions (@@ (allow ,(string-join + '("nosuid" "nodev" "loop" + "encryption" "fsck" "nonempty" + "allow_root" "allow_other") + ",")))) + (mntoptions (@@ (require "nosuid,nodev"))) + (logout (@@ (wait "0") + (hup "0") + (term "no") + (kill "no"))) + (mkmountpoint (@@ (enable "1") + (remove "true")))) +@end lisp + +Some @code{volume} elements must be added to automatically mount volumes +at login. Here's an example allowing the user @code{alice} to mount her +encrypted @code{HOME} directory and allowing the user @code{bob} to mount +the partition where he stores his data: + +@lisp +(define pam-mount-rules +`((debug (@@ (enable "0"))) + (volume (@@ (user "alice") + (fstype "crypt") + (path "/dev/sda2") + (mountpoint "/home/alice"))) + (volume (@@ (user "bob") + (fstype "auto") + (path "/dev/sdb3") + (mountpoint "/home/bob/data") + (options "defaults,autodefrag,compress"))) + (mntoptions (@@ (allow ,(string-join + '("nosuid" "nodev" "loop" + "encryption" "fsck" "nonempty" + "allow_root" "allow_other") + ",")))) + (mntoptions (@@ (require "nosuid,nodev"))) + (logout (@@ (wait "0") + (hup "0") + (term "no") + (kill "no"))) + (mkmountpoint (@@ (enable "1") + (remove "true"))))) + +(service pam-mount-service-type + (pam-mount-configuration + (rules pam-mount-rules))) +@end lisp + +The complete list of possible options can be found in the man page for +@uref{http://pam-mount.sourceforge.net/pam_mount.conf.5.html, pam_mount.co= nf}. +@end table +@end deftp + + @node Guix Services @subsection Guix Services =20 diff --git a/gnu/local.mk b/gnu/local.mk index 0129e42944..0e0c3e30e7 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -551,6 +551,7 @@ GNU_SYSTEM_MODULES =3D \ %D%/services/networking.scm \ %D%/services/nix.scm \ %D%/services/nfs.scm \ + %D%/services/pam-mount.scm \ %D%/services/security-token.scm \ %D%/services/shepherd.scm \ %D%/services/sound.scm \ diff --git a/gnu/services/pam-mount.scm b/gnu/services/pam-mount.scm new file mode 100644 index 0000000000..98611462c2 --- /dev/null +++ b/gnu/services/pam-mount.scm @@ -0,0 +1,111 @@ +;;; GNU Guix --- Functional package management for GNU +;;; Copyright =C2=A9 2019 Guillaume Le Vaillant +;;; +;;; This file is part of GNU Guix. +;;; +;;; GNU Guix is free software; you can redistribute it and/or modify it +;;; under the terms of the GNU General Public License as published by +;;; the Free Software Foundation; either version 3 of the License, or (at +;;; your option) any later version. +;;; +;;; GNU Guix is distributed in the hope that it will be useful, but +;;; WITHOUT ANY WARRANTY; without even the implied warranty of +;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +;;; GNU General Public License for more details. +;;; +;;; You should have received a copy of the GNU General Public License +;;; along with GNU Guix. If not, see . + +(define-module (gnu services pam-mount) + #:use-module (gnu packages admin) + #:use-module (gnu services) + #:use-module (gnu services configuration) + #:use-module (gnu system pam) + #:use-module (guix gexp) + #:use-module (guix records) + #:export (pam-mount-configuration + pam-mount-configuration? + pam-mount-service-type)) + +(define %pam-mount-default-configuration + `((debug (@ (enable "0"))) + (mntoptions (@ (allow ,(string-join + '("nosuid" "nodev" "loop" + "encryption" "fsck" "nonempty" + "allow_root" "allow_other") + ",")))) + (mntoptions (@ (require "nosuid,nodev"))) + (logout (@ (wait "0") + (hup "0") + (term "no") + (kill "no"))) + (mkmountpoint (@ (enable "1") + (remove "true"))))) + +(define (make-pam-mount-configuration-file config) + (computed-file + "pam_mount.conf.xml" + #~(begin + (use-modules (sxml simple)) + (call-with-output-file #$output + (lambda (port) + (sxml->xml + '(*TOP* + (*PI* xml "version=3D'1.0' encoding=3D'utf-8'") + (pam_mount + #$@(pam-mount-configuration-rules config) + (pmvarrun + #$(file-append pam-mount + "/sbin/pmvarrun -u '%(USER)' -o '%(OPERATIO= N)'")) + (cryptmount + #$(file-append pam-mount + (string-append + "/sbin/mount.crypt" + " '%(if %(CIPHER),-ocipher=3D%(CIPHER))'" + " '%(if %(FSKEYCIPHER)," + "-ofsk_cipher=3D%(FSKEYCIPHER))'" + " '%(if %(FSKEYHASH),-ofsk_hash=3D%(FSKEYH= ASH))'" + " '%(if %(FSKEYPATH),-okeyfile=3D%(FSKEYPA= TH))'" + " '%(if %(OPTIONS),-o%(OPTIONS))'" + " '%(VOLUME)' '%(MNTPT)'"))) + (cryptumount + #$(file-append pam-mount "/sbin/umount.crypt '%(MNTPT)'"))= )) + port)))))) + +(define-record-type* + pam-mount-configuration + make-pam-mount-configuration + pam-mount-configuration? + (rules pam-mount-configuration-rules + (default %pam-mount-default-configuration))) + +(define (pam-mount-etc-service config) + `(("security/pam_mount.conf.xml" + ,(make-pam-mount-configuration-file config)))) + +(define (pam-mount-pam-service config) + (define optional-pam-mount + (pam-entry + (control "optional") + (module #~(string-append #$pam-mount "/lib/security/pam_mount.so")))) + (list (lambda (pam) + (if (member (pam-service-name pam) + '("login" "su" "slim" "gdm-password")) + (pam-service + (inherit pam) + (auth (append (pam-service-auth pam) + (list optional-pam-mount))) + (session (append (pam-service-session pam) + (list optional-pam-mount)))) + pam)))) + +(define pam-mount-service-type + (service-type + (name 'pam-mount) + (extensions (list (service-extension etc-service-type + pam-mount-etc-service) + (service-extension pam-root-service-type + pam-mount-pam-service))) + (default-value (pam-mount-configuration)) + (description "Activate PAM-Mount support. It allows mounting volumes f= or +specific users when they log in."))) --=20 2.24.0 --=-=-=--