From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mp1 ([2001:41d0:2:bcc0::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by ms0.migadu.com with LMTPS id 0B3iNIEpW2G/mwAAgWs5BA (envelope-from ) for ; Mon, 04 Oct 2021 18:19:13 +0200 Received: from aspmx1.migadu.com ([2001:41d0:2:bcc0::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by mp1 with LMTPS id 0NxyMIEpW2EmJwAAbx9fmQ (envelope-from ) for ; Mon, 04 Oct 2021 16:19:13 +0000 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by aspmx1.migadu.com (Postfix) with ESMTPS id 73079344C0 for ; Mon, 4 Oct 2021 18:19:13 +0200 (CEST) Received: from localhost ([::1]:50152 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1mXQgK-00059m-Iz for larch@yhetil.org; Mon, 04 Oct 2021 12:19:12 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:51008) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1mXQc3-0008NW-6G for guix-devel@gnu.org; Mon, 04 Oct 2021 12:14:48 -0400 Received: from albert.telenet-ops.be ([2a02:1800:110:4::f00:1a]:45060) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1mXQc1-0005nZ-3O for guix-devel@gnu.org; Mon, 04 Oct 2021 12:14:46 -0400 Received: from ptr-bvsjgyjmffd7q9timvx.18120a2.ip6.access.telenet.be ([IPv6:2a02:1811:8c09:9d00:aaf1:9810:a0b8:a55d]) by albert.telenet-ops.be with bizsmtp id 1sEh2600A0mfAB406sEhfs; Mon, 04 Oct 2021 18:14:41 +0200 Message-ID: <129eb4ca6dd24e150f360df431e294413e238ac8.camel@telenet.be> Subject: Re: Code sharing between system and home services (was Re: On the naming of System and Home services modules.) From: Maxime Devos To: Ludovic =?ISO-8859-1?Q?Court=E8s?= Date: Mon, 04 Oct 2021 18:14:35 +0200 In-Reply-To: <87k0isoo6o.fsf@gnu.org> References: <87tuiajdv1.fsf@yoctocell.xyz> <87a6k2ng48.fsf@dismail.de> <875yukdh6a.fsf@gnu.org> <87zgrrwlgy.fsf@gnu.org> <87k0isoo6o.fsf@gnu.org> Content-Type: multipart/signed; micalg="pgp-sha512"; protocol="application/pgp-signature"; boundary="=-SKouE4/eOMAN7iwlqUkO" User-Agent: Evolution 3.34.2 MIME-Version: 1.0 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=telenet.be; s=r21; t=1633364081; bh=4pVURkZiqfdRAlWSZtR50vuFtJJssGAXind38oCpUik=; h=Subject:From:To:Cc:Date:In-Reply-To:References; b=DWWLN7h4dNTQRdYmR8Sc3ssLeC//pD4FkaX9ossj5NsOiXlEAd2RqY3pOYoxFiMlp DVsK8H8jpMZ9W7fOFFguFFF4rl1rwQBFOspVI6U5N3817SHV3dzC16QeYtGw8r2pe1 5lUPYtzdRVe+DS/8z9VXv4eQ7rAgA/Doa3zCCGsIaa8swOFASL1+14IIIrTN5ZA6nI ZbTaZi6ZeCbcvDBokpH2EL7w0nPH+wijqgeZuY7JgAO91CixJ3sRNR8L/EcgUlH5ad c5y9k4fLZDNpyqwP2iuhzqv0RMuJPH+bOYo+eKIENSIJ7ORv1AYyglzDEBIwtOklt3 IKj2q16D1pgsQ== Received-SPF: pass client-ip=2a02:1800:110:4::f00:1a; envelope-from=maximedevos@telenet.be; helo=albert.telenet-ops.be X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: guix-devel@gnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: guix-devel@gnu.org, Xinglu Chen , Maxim Cournoyer , Andrew Tropin Errors-To: guix-devel-bounces+larch=yhetil.org@gnu.org Sender: "Guix-devel" X-Migadu-Flow: FLOW_IN ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=yhetil.org; s=key1; t=1633364353; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:in-reply-to:in-reply-to: references:references:list-id:list-help:list-unsubscribe: list-subscribe:list-post:dkim-signature; bh=4pVURkZiqfdRAlWSZtR50vuFtJJssGAXind38oCpUik=; b=QIjQsPEeFbIoZ0PbcJHWDeMo8OktTrsudT9LoH7qrwXuWrPLP9gOu7xDucb1t684AMleN6 6LwTRgSztefZ4NKlEI9ZRX1KzNdKDM9DdSCXkiCN2CZKbJcpDHU//ZDOBF4i5yxVbQHzyB l8PGdlK9hWNLEAqtVTkbM0P8/PbcgIcFWObHCypWl6QJoZDhOrWqPxq9lBQDN4Sz5RGQ8w 9v1+r3XbTWH8q9qF0r7FgILsmVNauEXwOuLpkK/4zEk2GtntkqOxd+tzTOLbTLW+VGKig4 EgrIdn8fjEIFQ2go5Dwe3bDNuwxu4l3W6OZW5IsDhXlxW+ZvLQBFoEv9ZLUyNw== ARC-Seal: i=1; s=key1; d=yhetil.org; t=1633364353; a=rsa-sha256; cv=none; b=WeUpFr5HSXGmqaHidAf7vkMzf9ONDbrCe2Twrx8t21IALrt9rwfpN+di7cY6yyvmrWbKDs ViEUIzppof2wMjjnX01XTqPrJKetv8ifhsPkBlVOEL4Cp6LqpdqbalHMSzRB+5++B/uZ00 4ji7/G+giNQGJ/7tF81Z3RUOO2ZX0qVhqwOSdHwrsdXcysQtz24qHWxSpH57BUC+i9bRIQ fTuFq3n9nw+bHYVjZlnfBySyhVcmJ6zj76vi8cN39fT80rmQiLz8awf/YcGfFEfzeSYSwk /yBStvogsQ0fx08NXxYEFJDCEb7ilavXjoTdEyNXKozCauPSQ/JcrTXOkM1/6A== ARC-Authentication-Results: i=1; aspmx1.migadu.com; dkim=fail ("headers rsa verify failed") header.d=telenet.be header.s=r21 header.b=DWWLN7h4; spf=pass (aspmx1.migadu.com: domain of guix-devel-bounces@gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=guix-devel-bounces@gnu.org X-Migadu-Spam-Score: -2.41 Authentication-Results: aspmx1.migadu.com; dkim=fail ("headers rsa verify failed") header.d=telenet.be header.s=r21 header.b=DWWLN7h4; dmarc=fail reason="SPF not aligned (relaxed)" header.from=telenet.be (policy=none); spf=pass (aspmx1.migadu.com: domain of guix-devel-bounces@gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=guix-devel-bounces@gnu.org X-Migadu-Queue-Id: 73079344C0 X-Spam-Score: -2.41 X-Migadu-Scanner: scn1.migadu.com X-TUID: 6Q+B0YzHMen/ --=-SKouE4/eOMAN7iwlqUkO Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Ludovic Court=C3=A8s schreef op ma 04-10-2021 om 16:32 [+0200]: > Maxime Devos skribis: >=20 > > Ludovic Court=C3=A8s schreef op za 02-10-2021 om 16:27 [+0200]: > > > Maxime Devos skribis: > > >=20 > > > > Ludovic Court=C3=A8s schreef op di 28-09-2021 om 14:21 [+0200]: > > > > > Hi, > > > > >=20 > > > > > Joshua Branson skribis: > > > > >=20 > > > > > > Apologies if I'm speaking for something I know very little > > > > > > about...Wouldn't it be nice if guix home services would accept = a user > > > > > > and a group field? For the syncthing service, perhaps the user= wants to > > > > > > limit Syncthing's runtime permissions. So instead of running a= s the > > > > > > user, the user would run synthing as a different user with less= permissions? > > > > >=20 > > > > > That=E2=80=99s not possible unless the calling user is root, sinc= e you=E2=80=99d need > > > > > the ability to switch users somehow. > > > >=20 > > > > On Debian, a user has a list of =E2=80=98subordinate user IDs=E2=80= =99 which can be switched > > > > to without root: ;;. > > > >=20 > > > > Maybe "guix home" could use that mechanism, and this mechanism coul= d be implemented > > > > on Guix System as well? > > >=20 > > > Yes but that requires unprivileged user namespaces, which may or may = not > > > be supported=E2=80=94e.g., likely unsupported when using Home on a fo= reign > > > distro. > >=20 > > I don't recall newuidmap requiring unprivileged user namespaces -- it's= a setuid binary. >=20 > Ah right. But we=E2=80=99re not call do (system* "/usr/sbin/newuidmap") = in > service code, so that=E2=80=99s still a problem, no? It might be possible to modify 'make-forkexec-constructor/container' to cal= l (exec-command (cons* newuidmap ARGUMENTS-TO-NEWUIDMAP command) ...), where newuidmap is (search-input-file "newuidmap" '("/run/setuid-programs" = "/usr/sbin" "/sbin")). That path should work on Guix System and many foreign distro, presuming the= distro is configured to make "newuidmap" setuid. There might be complications w.r.t. bind mounts though (presumably setuid b= inaries don't like being called if the (unprivileged) parent process has created so= me bind mounts?), so the bind mounting code might need to be performed as a child process of = newuidmap, but in principle, everything should be implemented I think. I'm not volunteering to write this code though. Greetings, Maxime. --=-SKouE4/eOMAN7iwlqUkO Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNATURE----- iI0EABYKADUWIQTB8z7iDFKP233XAR9J4+4iGRcl7gUCYVsoaxccbWF4aW1lZGV2 b3NAdGVsZW5ldC5iZQAKCRBJ4+4iGRcl7ioSAQChhGVEoqGbphyhwtVtjgjREgcX wDwxqxct+IJx8AEYdwD/QQKVKOr79UwtSY7h6GMTvDq+HU03UtGPxdj2c3l4LAI= =d4e7 -----END PGP SIGNATURE----- --=-SKouE4/eOMAN7iwlqUkO--