bug#35341: Guix System installer does not set up passwords and profile directories

bug#35341: Guix System installer does not set up passwords and profile directories

[pelzflorian (Florian Pelz)]

I installed Guix System from a USB flash drive from the current git
master.  The manual describes I should set up a password with passwd.
I think the installer should automate this, so users do not need to
know the passwd command.

After setting a password with `passwd florian` and logging in
as florian, I run `guix pull`.  This yields the following error:

pull: error: while creating directory `/var/guix/profiles/per-user/florian': Permission denied
hint: Please create the `/var/guix/profiles/per-user/florian' directory, with you
as the owner.

This persists after a reboot.

sudo mkdir /var/guix/profiles/per-user/florian
sudo chown florian:users /var/guix/profiles/per-user/florian

fixes the issue, but the installer should do this automatically.

Regards,
Florian

bug#35341: Guix System installer does not set up passwords and profile directories

[Ludovic Courtès]

Hello Florian,

"pelzflorian (Florian Pelz)" <pelzflorian@pelzflorian.de> skribis:

> I installed Guix System from a USB flash drive from the current git
> master.  The manual describes I should set up a password with passwd.
> I think the installer should automate this, so users do not need to
> know the passwd command.

I’ll open a separate bug for that.

> After setting a password with `passwd florian` and logging in
> as florian, I run `guix pull`.  This yields the following error:
>
> pull: error: while creating directory `/var/guix/profiles/per-user/florian': Permission denied
> hint: Please create the `/var/guix/profiles/per-user/florian' directory, with you
> as the owner.

Oh, got it.

On a fresh system (one can check with ‘guix system vm bare-bones.tmpl’
for instance), /var/guix/profiles/per-user is 555 and root-owned, so not
writable.

Then, the first time a client such as ‘guix package’ connects to the
daemon, the daemon chmods /var/guix/profiles/per-user to 777
(world-writable), see local-store.cc:89.

Next, ‘guix package’ calls ‘ensure-default-profile’, which creates
/var/guix/profiles/per-user/$USER.

The problem with ‘guix pull’ is that it would call
‘ensure-default-profile’ before it has connected to the daemon.

Fixed in a06a95baffc2005ad1a64c4c3f82fc328e0d0009.

Thanks,
Ludo’.

bug#35341: Guix System installer does not set up passwords and profile directories

[Ludovic Courtès]

Hi,

"pelzflorian (Florian Pelz)" <pelzflorian@pelzflorian.de> skribis:

> I installed Guix System from a USB flash drive from the current git
> master.  The manual describes I should set up a password with passwd.
> I think the installer should automate this, so users do not need to
> know the passwd command.

I think it’d be nice if the installer would initialize the user
password, and also root’s password (which is empty by default).

The obvious approach would be to add a dialog box in the installer and
then set the ‘password’ field of each <user-account>, and also add a
<user-account> for root itself with the ‘password’ field set.

The problem with this approach is that password hashes would end
world-readable in the store, so we would need to add warnings asking
users to change passwords after logging in.  Not great.

Another option would be to have an activation snippet that runs when
booting the newly installed system: if would check for a flag or
something (it could check for uninitialized passwords), and if it
determines it’s a first boot, open a dialog box asking for passwords.
We’d need to add a “post-install” service in the OS config that would do
just that.

That would be the most robust approach, but it’s also a bit more work I
guess.  It’s also not so nice that users will see this extra service in
their config.

Thoughts?

Ludo’.

bug#35341: Guix System installer does not set up passwords and profile directories

[pelzflorian (Florian Pelz)]

Why can’t the installer just chroot into the new system and call
passwd?

Regards,
Florian

bug#35341: Guix System installer does not set up passwords and profile directories

[Ludovic Courtès]

Password issue moved to <https://issues.guix.info/issue/35399>.