From: Mark H Weaver <mhw@netris.org>
To: "Ludovic Courtès" <ludo@gnu.org>
Cc: guix-devel@gnu.org
Subject: Re: permission denied: /gnu/store/...guile...
Date: Sat, 23 May 2015 12:26:58 -0400 [thread overview]
Message-ID: <878ucfmf8t.fsf@netris.org> (raw)
In-Reply-To: <87mw0ve5ln.fsf@gnu.org> ("Ludovic \=\?utf-8\?Q\?Court\=C3\=A8s\=22'\?\= \=\?utf-8\?Q\?s\?\= message of "Sat, 23 May 2015 16:22:28 +0200")
ludo@gnu.org (Ludovic Courtès) writes:
> Mark H Weaver <mhw@netris.org> skribis:
>
>> The problem turned out to be that on rekado's system, / was owned by
>> user "rekado" with mode 700.
>
> Oh, I see. I would never have thought of this!
>
>> Perhaps 'guix system init' should explicitly set the ownership and
>> permissions on the target root directory?
>
> Here’s a tentative patch.
[...]
> diff --git a/guix/scripts/system.scm b/guix/scripts/system.scm
> index 8d5fbe5..2cf6a43 100644
> --- a/guix/scripts/system.scm
> +++ b/guix/scripts/system.scm
> @@ -145,6 +145,14 @@ When GRUB? is true, install GRUB on DEVICE, using GRUB.CFG."
> ;; Copy items to the new store.
> (copy-closure to-copy target #:log-port log-port)))))
>
> + ;; Make sure TARGET is root-owned when running as root, but still allow
> + ;; non-root uses (useful for testing.)
> + (if (zero? (getuid))
> + (chown target 0 0)
I would suggest using (geteuid) instead. Also, we should set the mode.
In this particular case, if we had changed the owner without also
changing the mode, rekado's system still would have been quite broken.
> I wonder if the activation code shouldn’t systematically do
> (chown "/" 0 0) as well.
>
> Thoughts?
I'm not sure. Trying to fix individual things during activation that
might have been broken is a slippery slope. We cannot hope to fix
everything that might have been broken using this approach, and on the
other hand we might undo some change that the user made intentionally.
For now, I would probably do this only from 'guix system init', but I
don't feel strongly either way.
Thanks!
Mark
next prev parent reply other threads:[~2015-05-23 16:27 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-05-20 7:06 permission denied: /gnu/store/...guile rekado
2015-05-20 8:17 ` Andreas Enge
2015-05-20 11:24 ` Daniel Pimentel
2015-05-20 12:24 ` Ludovic Courtès
2015-05-20 13:12 ` Daniel Pimentel
2015-05-20 17:24 ` Alex Kost
2015-05-21 20:40 ` Synaptics & libinput driver Ludovic Courtès
2015-05-20 12:18 ` permission denied: /gnu/store/...guile Ludovic Courtès
2015-05-20 20:56 ` rekado
2015-05-21 8:03 ` Ludovic Courtès
2015-05-22 20:15 ` Mark H Weaver
2015-05-22 20:21 ` Mark H Weaver
2015-05-23 9:41 ` rekado
2015-05-23 14:22 ` Ludovic Courtès
2015-05-23 16:26 ` Mark H Weaver [this message]
2015-05-23 22:28 ` Ludovic Courtès
-- strict thread matches above, loose matches on Subject: below --
2015-05-21 20:06 rekado
2015-05-21 21:53 ` Ludovic Courtès
2015-05-22 8:33 ` rekado
2015-05-22 13:33 ` Ludovic Courtès
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=878ucfmf8t.fsf@netris.org \
--to=mhw@netris.org \
--cc=guix-devel@gnu.org \
--cc=ludo@gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/guix.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.