From: "Thompson, David" <dthompson2@worcester.edu>
To: 67288@debbugs.gnu.org
Subject: [bug#67288] [PATCH] services: laminar: Add configuration option for supplementary groups
Date: Sun, 19 Nov 2023 14:58:30 -0500 [thread overview]
Message-ID: <CAJ=RwfaSXfTeFn_H9Jme10hdYzeQnxTMakbJb2ksTZ+3km_aiA@mail.gmail.com> (raw)
[-- Attachment #1: Type: text/plain, Size: 431 bytes --]
Hey everyone,
I started using Laminar CI for my personal server, but I had trouble
with the current system service. My server is configured to only allow
members of the "git" group access to the Git repositories, so the CI
job running as the "laminar" user couldn't do anything useful. This
patch adds a new configuration field for a list of supplementary
groups to be used for the "laminar" user and the service process.
- Dave
[-- Attachment #2: 0001-services-laminar-Add-configuration-option-for-supple.patch --]
[-- Type: text/x-patch, Size: 4964 bytes --]
From ed62d885a5493f64779bc9c2a9b9978af8f61824 Mon Sep 17 00:00:00 2001
Message-ID: <ed62d885a5493f64779bc9c2a9b9978af8f61824.1700423610.git.dthompson2@worcester.edu>
From: David Thompson <dthompson2@worcester.edu>
Date: Sun, 19 Nov 2023 14:46:52 -0500
Subject: [PATCH] services: laminar: Add configuration option for supplementary
groups.
* gnu/services/ci (<laminar-configuration>)[supplemental-groups]: New field.
(laminar-shepherd-service): Exec laminard with supplementary groups.
(laminar-account): Add supplementary groups to laminar user.
* doc/guix.texi (Laminar): Document new configuration field.
Change-Id: Iebfdbb58ea8c6dfa22bb8f64f6463e3ad133d2f9
---
doc/guix.texi | 3 +++
gnu/services/ci.scm | 42 ++++++++++++++++++++++++------------------
2 files changed, 27 insertions(+), 18 deletions(-)
diff --git a/doc/guix.texi b/doc/guix.texi
index 94903fb5e2..854486c3ea 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -33955,6 +33955,9 @@ Continuous Integration
@item @code{home-directory} (default: @code{"/var/lib/laminar"})
The directory for job configurations and run directories.
+@item @code{supplementary-groups} (default: @code{()})
+Supplementary groups for the Laminar user account.
+
@item @code{bind-http} (default: @code{"*:8080"})
The interface/port or unix socket on which laminard should listen for
incoming connections to the web frontend.
diff --git a/gnu/services/ci.scm b/gnu/services/ci.scm
index 172f85fe8e..01cc7c7d86 100644
--- a/gnu/services/ci.scm
+++ b/gnu/services/ci.scm
@@ -31,6 +31,7 @@ (define-module (gnu services ci)
#:export (laminar-configuration
laminar-configuration?
laminar-configuration-home-directory
+ laminar-configuration-supplementary-groups
laminar-configuration-bind-http
laminar-configuration-bind-rpc
laminar-configuration-title
@@ -50,26 +51,28 @@ (define-module (gnu services ci)
(define-record-type* <laminar-configuration>
laminar-configuration make-laminar-configuration
laminar-configuration?
- (laminar laminars-configuration-laminar
- (default laminar))
- (home-directory laminar-configuration-home-directory
- (default "/var/lib/laminar"))
- (bind-http laminar-configuration-bind-http
- (default "*:8080"))
- (bind-rpc laminar-configuration-bind-rpc
- (default "unix-abstract:laminar"))
- (title laminar-configuration-title
- (default "Laminar"))
- (keep-rundirs laminar-keep-rundirs
- (default 0))
- (archive-url laminar-archive-url
- (default #f))
- (base-url laminar-base-url
- (default #f)))
+ (laminar laminars-configuration-laminar
+ (default laminar))
+ (home-directory laminar-configuration-home-directory
+ (default "/var/lib/laminar"))
+ (supplementary-groups laminar-configuration-supplementary-groups
+ (default '()))
+ (bind-http laminar-configuration-bind-http
+ (default "*:8080"))
+ (bind-rpc laminar-configuration-bind-rpc
+ (default "unix-abstract:laminar"))
+ (title laminar-configuration-title
+ (default "Laminar"))
+ (keep-rundirs laminar-keep-rundirs
+ (default 0))
+ (archive-url laminar-archive-url
+ (default #f))
+ (base-url laminar-base-url
+ (default #f)))
(define laminar-shepherd-service
(match-lambda
- (($ <laminar-configuration> laminar home-directory
+ (($ <laminar-configuration> laminar home-directory supplementary-groups
bind-http bind-rpc
title keep-rundirs archive-url
base-url)
@@ -102,7 +105,8 @@ (define laminar-shepherd-service
#$base-url))
'()))
#:user "laminar"
- #:group "laminar"))
+ #:group "laminar"
+ #:supplementary-groups '#$supplementary-groups))
(stop #~(make-kill-destructor)))))))
(define (laminar-account config)
@@ -113,6 +117,8 @@ (define (laminar-account config)
(user-account
(name "laminar")
(group "laminar")
+ (supplementary-groups
+ (laminar-configuration-supplementary-groups config))
(system? #t)
(comment "Laminar privilege separation user")
(home-directory (laminar-configuration-home-directory config))
base-commit: 2ab5e449246f98b049888dde3c310f5b4a0a64a2
prerequisite-patch-id: 20e0bd5d1f3c88351c4991ef9c652dbded53bf9a
--
2.41.0
next reply other threads:[~2023-11-19 19:59 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-11-19 19:58 Thompson, David [this message]
2023-11-25 15:25 ` [bug#67288] [PATCH] services: laminar: Add configuration option for supplementary groups Ludovic Courtès
2023-11-26 0:00 ` Arun Isaac
2023-11-26 0:16 ` Thompson, David
2023-11-26 15:47 ` Arun Isaac
2023-12-06 13:19 ` Arun Isaac
2023-12-28 17:58 ` bug#67288: [EXT] Re: [bug#67288] " Thompson, David
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAJ=RwfaSXfTeFn_H9Jme10hdYzeQnxTMakbJb2ksTZ+3km_aiA@mail.gmail.com' \
--to=dthompson2@worcester.edu \
--cc=67288@debbugs.gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/guix.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.