all messages for Guix-related lists mirrored at yhetil.org
 help / color / mirror / code / Atom feed
From: Attila Lendvai <attila@lendvai.name>
To: guix-devel <guix-devel@gnu.org>
Subject: shepherd service, unexplained permission errors
Date: Wed, 28 Jun 2023 20:27:14 +0000	[thread overview]
Message-ID: <xAeYA3uQx4VxLH1SUk_4phLjrDjAQaIMpEsidlPhJesVA4v9vTY1RUHnz4G-lJ1G7N7cK2aD69MdPWdjCa_ondu-hxuWvNFA39Q2skQ4fvw=@lendvai.name> (raw)

dear Guix,

i have a daemon that i (try to) run/start through Shepherd's fork+exec-command, with a specific user and group. i can start it up using su or sudo, both work:

$ sudo --user zigbee2mqtt bash -c "guix shell node gcc-toolchain make python libuv -- bash -c 'cd /srv/zigbee2mqtt && npm start'"

# su zigbee2mqtt --command "guix shell node gcc-toolchain make python libuv -- bash -c 'cd /srv/zigbee2mqtt && npm start'"

but through Shepherd the daemon fails while starting up due to a permission denied error:

"Error: Permission denied, cannot open /dev/ttyUSB0"

$ ls -l /dev/ttyUSB0 
crw-rw---- 1 root dialout 188, 0 Jun 28 21:04 /dev/ttyUSB0

i created a user for that daemon, and added dialout as a supplementary group:

(user-account
 (name "zigbee2mqtt")
 (comment "zigbee2mqtt service")
 (group "homeaut")
 (supplementary-groups '("dialout"))
 (system? #true))

(user-group
 (name "homeaut")
 (system? #true))

i start the service like this:

(simple-service
  'zigbee2mqtt
  shepherd-root-service-type
  (list
   (shepherd-service
    (requirement '(...))
    (provision '(...))
    (documentation "")
    (start
     #~(lambda _
         (let* ((cmd (list
                      "guix" "shell"
                      "node" "gcc-toolchain" "make" "python" "libuv"
                      "--"
                      "bash" "-c" "cd /srv/zigbee2mqtt && npm start")))
           (fork+exec-command
            cmd
            #:log-file "/var/log/zigbee2mqtt.log"
            #:user "zigbee2mqtt"
            #:group "homeaut")))))))

so, my question boils down to this:

what is different in the two environments? what am i missing?

PS: i have another daemon where i have a very similar issue, so it's probably not a daemon-specific issue.

PS2: i know that i should package zigbee2mqtt, but i'm taking this shortcut because life is short.

-- 
• attila lendvai
• PGP: 963F 5D5F 45C7 DFCD 0A39
--
“The trouble is, you think you have time.”
	— Siddhartha Gutama, aka Buddha (c. 5th century BC)



             reply	other threads:[~2023-06-28 20:28 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-06-28 20:27 Attila Lendvai [this message]
2023-06-28 20:56 ` shepherd service, unexplained permission errors Felix Lechner via Development of GNU Guix and the GNU System distribution.
2023-06-29  7:42   ` Attila Lendvai

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to='xAeYA3uQx4VxLH1SUk_4phLjrDjAQaIMpEsidlPhJesVA4v9vTY1RUHnz4G-lJ1G7N7cK2aD69MdPWdjCa_ondu-hxuWvNFA39Q2skQ4fvw=@lendvai.name' \
    --to=attila@lendvai.name \
    --cc=guix-devel@gnu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
Code repositories for project(s) associated with this external index

	https://git.savannah.gnu.org/cgit/guix.git

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.