Re: Creating a service that runs a user-installed package as root

[wolf <wolf@wolfsden.cz>]

[-- Attachment #1: Type: text/plain, Size: 2374 bytes --]

On 2023-08-15 19:16:11 -0500, heat from fire via wrote:
> Hi all,
>  
> First time posting on this forum.
>  
> I am trying to set up a service that runs "sudo mullvad-daemon" upon user login. The mullvad package is installed through Nix on a user profile.
>  
> I've tried creating a user service using Shepherd in a config file at "~/.config/shepherd/init.scm", but it doesn't seem possible to run the command as root.
> Here's a snippet from the file:
>  
> (define mullvad
>   (service '(mullvad)
>     #:respawn? #t
>     #:start (make-forkexec-constructor '("mullvad-daemon" "-v"))
>     #:stop (make-kill-destructor)))
>  
> I read through here in hopes to find a solution, but to no avail:
> https://www.gnu.org/software/shepherd/manual/shepherd.html#Services
> Perhaps there is a service constructor with an option to run the command as root?

I also do not see such option, and since the user shepherd runs under the user,
I do not think it is possible without modifications to the sudoers file.

>  
> I know that I can define a Shepherd service in my system config file, which runs the command in it as root, but given that it depends on a user-installed Nix package, I'm not sure how I'll have to accommodate for that. The command is located at /home/user/.nix-profile/bin/mullvad-daemon.
> I also tried creating a regular system service using service-type, but couldn't get it to work.
>  
> My only other alternative is to run sudo mullvad-daemon in ~/.profile and make an exception in the sudoers file to not require a password. This solution is messy so I wanna try to avoid it. I could also put the command in the Guix equivalent of "/etc/rc.local", but I don't think there is one in Guix.
>  
> Any ideas on how I can create a service that runs a command installed in a user profile as root? Or alternatively, a better way to run a command as root without password on user login, after sourcing ~/.profile?

I do not have much experience with shepherd (yet!), but cannot you just use
'("sudo" "mullvad-daemon" "-v")?  While still requiring an entry in sudoers
file, I would say it is cleaner than sudo ... in the ~/.profile, and it you
could still start/stop it via the herd command.

>  
> Thanks!

-- 
There are only two hard things in Computer Science:
cache invalidation, naming things and off-by-one errors.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]