bug#28772: guix system reconfigure after kernel panic user or group not created

[Oleg Pykhalov <go.wigust@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 525 bytes --]

Hello Ludovic,

Apologies for the late reply.

ludo@gnu.org (Ludovic Courtès) writes:

[...]

> Did you eventually gather more info?

Yes, I got an undefined %iptables-rst variable in reconfigure output
at first run.

But at second run substitutions didn't work.  GuixSD rebuilds the world.
I didn't wait for this.

I also didn't make guix pull.

/tmp/guixsd
├── bootstrap.sh
├── iptables
│   └── iptables.scm
├── panic.sh
└── vm-image.scm

1 directory, 4 files


[-- Attachment #2: bootstrap.sh --]
[-- Type: application/x-sh, Size: 873 bytes --]

[-- Attachment #3: panic.sh --]
[-- Type: application/x-sh, Size: 242 bytes --]

[-- Attachment #4: vm-image.scm --]
[-- Type: application/octet-stream, Size: 1657 bytes --]

(use-modules (gnu)
             (iptables))

(use-service-modules shepherd)
(use-package-modules linux)

(define start-firewall
  #~(let ((iptables
           (lambda (str)
             (zero? (system (string-join `(,#$(file-append iptables
                                                           "/sbin/iptables")
                                           ,str) " "))))))
      (format #t "Install iptables rules.~%")
      (and
       (iptables %iptables-rst))))

(define firewall-service
  (simple-service 'firewall shepherd-root-service-type
                  (list
                   (shepherd-service
                    (provision '(firewall))
                    (requirement '())
                    (start #~(lambda _
                               #$start-firewall))
                    (respawn? #f)
                    (stop #~(lambda _
                              (zero?
                               (system* #$(file-append iptables
                                                       "/sbin/iptables")
                                        "-F"))))))))

(operating-system
  (host-name "gnu")
  (timezone "Etc/UTC")
  (locale "en_US.utf8")
  (bootloader (grub-configuration (device "/dev/sda")
                                  (terminal-outputs '(console))))
  (file-systems (cons (file-system
                        (device "my-root")
                        (title 'label)
                        (mount-point "/")
                        (type "ext4"))
                      %base-file-systems))
  (users %base-user-accounts)
  (packages %base-packages)
  (services (cons firewall-service
                  %base-services)))

[-- Attachment #5: iptables.scm --]
[-- Type: application/octet-stream, Size: 378 bytes --]

(define-module (iptables)
  #:use-module (guix packages)
  #:use-module (guix gexp)
  #:use-module (guix monads)
  #:use-module (guix store)
  #:use-module (gnu packages)
  #:use-module (gnu packages linux)
  #:use-module (guix utils)
  #:use-module (srfi srfi-1)
  #:use-module (ice-9 match))

(define %iptables-rst
  "-A INPUT -p tcp --sport 443 --tcp-flags RST RST -j DROP")