me
/
guix
Archived
1
0
Fork 0
Commit Graph

40 Commits (b48d77fcf66a7fd41ea281afdfb9a56794a0083e)

Author SHA1 Message Date
Ludovic Courtès d497b6ab39
activation: Lock /etc/.pwd.lock before accessing databases.
Suggested by Florian Pelz <pelzflorian@pelzflorian.de>
in <http://bugs.gnu.org/35996>.

* gnu/build/accounts.scm (%password-lock-file): New variable.
* gnu/build/activation.scm (activate-users+groups): Wrap calls to
'user+group-databases', 'write-group', etc. into 'with-file-lock'.
2019-06-05 23:10:36 +02:00
Ludovic Courtès d429878daf
activation: Shared system home directories are now 555 and root-owned.
Fixes <https://bugs.gnu.org/34788>.
Reported by Jack Hill <jackhill@jackhill.us>.

Regression introduced by the combination of
8bb76f3d44 and
0ae735bcc8ff7fdc89d67b492bdee9091ee19e86: /var/empty would be 700 and
owned by one of the system accounts (thus inaccessible to others), and
/var/run/dbus would be 700 as well, thereby preventing D-Bus clients
from connecting to the daemon.

* gnu/build/activation.scm (duplicates): New procedure.
(activate-users+groups)[system-accounts]: New variable.
Use it.  Make shared system account home directories #o555 and
root-owned.
* gnu/services/dbus.scm (dbus-activation): Make /var/run/dbus #o755.
* gnu/tests/base.scm (run-basic-test): Test the ownership and
permissions of /var/empty.
2019-03-08 23:21:59 +01:00
Ludovic Courtès 0ae735bcc8
activation: Build account databases with (gnu build accounts).
* gnu/build/activation.scm (enumerate, current-users, current-groups)
(add-group, add-user, modify-user, ensure-user): Remove.
(activate-users+groups)[touch, activate-user]: Remove.
[make-home-directory]: New procedure.
Rewrite in terms of 'user+group-databases', 'write-group', etc.
* gnu/build/install.scm (directives): Remove "/root".
* gnu/system/shadow.scm (account-activation): Remove (setenv "PATH" ...)
expression, which is now unneeded.
2019-03-07 20:05:09 +01:00
Ludovic Courtès 6061d01512
activation: Operate on <user-account> and <user-group> records.
* gnu/system/accounts.scm (sexp->user-group, sexp->user-account): New
procedures.
* gnu/system/shadow.scm (account-activation): Call them in the arguments
to 'activate-users+groups'.
(account-shepherd-service): Likewise.
* gnu/build/activation.scm (activate-users+groups): Expect a list of
<user-account> and a list of <user-group>.  Replace uses of 'match' on
tuples with calls to record accessors.
(activate-user-home): Likewise.
2019-03-07 20:05:09 +01:00
Ludovic Courtès 8bb76f3d44
activation: Make home directories #o700 by default.
Until now they'd be #o755, except for /root, which is treated specially
in (gnu build install).

* gnu/build/activation.scm (activate-user-home): Chmod HOME to #o700.
Remove redundant 'unless system?'.
2019-03-04 15:22:58 +01:00
Ludovic Courtès b297934437
activation: Aways pass '-d HOME' to 'useradd'.
Fixes <https://bugs.gnu.org/33422>.
Reported by fps.

* gnu/build/activation.scm (add-user): Always pass "-d HOME" when HOME
is true.  Pass "--create-home" only when HOME, CREATE-HOME?, and SYSTEM?
are true.
(activate-users+groups): Pass #:create-home? create-home? to
'ensure-user'.
* gnu/tests/base.scm (run-basic-test)["accounts"]: Test 'passwd:dir' as
well.
2018-11-18 23:37:25 +01:00
Ludovic Courtès 82b71ac366
activation: Pass '-d HOME' to 'usermod'.
Fixes a bug whereby changes to user home directories in the OS config
would never be effective.

Reported by Pierre Neidhardt <ambrevar@gmail.com>.

* gnu/build/activation.scm (modify-user): Pass '-d HOME'.
2018-03-27 14:51:44 +02:00
Ludovic Courtès 5e66574a12
activation: Do not create setuid binaries in the store [security fix].
Fixes <https://bugs.gnu.org/28751>.

* gnu/build/activation.scm (activate-setuid-programs)[link-or-copy]: Remove.
Use 'copy-file' instead.
2017-10-08 21:27:48 +02:00
Ludovic Courtès 49962b15a1
activation: Make sure /etc exists.
Fixes <http://bugs.gnu.org/27146>.
Reported by ng0 <ng0@pragmatique.xyz>.

* gnu/build/activation.scm (activate-etc): Add call to 'mkdir-p'.
2017-08-03 00:35:59 +02:00
Ludovic Courtès 41db5a7563
activation: Change permissions on /root to #o700.
Reported by Alex Griffin <a@ajgrf.com>.
Fixes <http://bugs.gnu.org/27135>.

* gnu/build/activation.scm (add-user): When UID is zero, add 'chmod'
call.
* gnu/tests/base.scm (run-basic-test)["permissions on /root"]: New test.
2017-05-30 18:08:37 +02:00
Ludovic Courtès 41f76ae08a
services: user-homes: Do not create home directories marked as no-create.
Fixes a bug whereby GuixSD would create the /nonexistent directory, from
user 'nobody', even though it has 'create-home-directory?' set to #f.

* gnu/build/activation.scm (activate-users+groups): Add comment for
\#:create-home?.
(activate-user-home)[ensure-user-home]: Skip when CREATE-HOME? is #f or
SYSTEM? is #t.
* gnu/tests/base.scm (run-basic-test)["no extra home directories"]: New
tests.
2017-05-18 10:55:16 +02:00
Ludovic Courtès 768f0ac9dd
Merge branch 'master' into core-updates 2017-02-10 17:40:25 +01:00
Ludovic Courtès 387e175492
services: Add 'special-files-service-type'.
* gnu/build/activation.scm (activate-/bin/sh): Remove.
(activate-special-files): New procedure.
* gnu/services.scm (activation-script): Remove call to
'activate-/bin/sh'.
(special-files-service-type): New variable.
(extra-special-file): New procedure.
* gnu/services/base.scm (%base-services): Add SPECIAL-FILES-SERVICE-TYPE
instance.
* gnu/tests/base.scm (run-basic-test)[special-files]: New variables.
["special files"]: New test.
2017-02-08 16:17:05 +01:00
Ludovic Courtès cf98d342b0
activation: Set the right owner for home directories.
This fixes a regression introduced in
ae763b5b0b whereby home directories and
skeletons would be root-owned.

* gnu/build/activation.scm (copy-account-skeletons): Make 'directory' a
keyword parameter.  Add #:uid and #:gid and honor them.
[set-owner]: New procedure.
(activate-user-home): Add call to 'getpw' and 'chown'.  Pass UID and GID
to 'copy-account-skeletons'.
* gnu/tests/base.scm (run-basic-test)["skeletons in home directories"]:
Test file ownership under HOME.
2017-02-04 02:13:43 +01:00
Leo Famulari e8c83d04e1
Merge branch 'master' into core-updates 2017-02-02 10:52:24 -05:00
Ludovic Courtès ae763b5b0b
system: Create home directories once 'file-systems' is up.
Fixes <http://bugs.gnu.org/21108>.
Reported by Andy Patterson <ajpatter@uwaterloo.ca>
and Leo Famulari <leo@famulari.name>.

* gnu/build/activation.scm (activate-users+groups)[activate-user]: Pass
  #:create-home? #t iff CREATE-HOME? and SYSTEM?.
(activate-user-home): New procedure.
* gnu/system/shadow.scm (account-shepherd-service): New procedure.
(account-service-type)[extensions]: Add SHEPHERD-ROOT-SERVICE-TYPE
extension.
* gnu/tests/base.scm (run-basic-test)["home"]
["skeletons in home directories"]: New tests.
* gnu/tests/install.scm (%separate-home-os, %separate-home-os-source)
(%test-separate-home-os): New variables.
2017-02-01 12:36:41 +01:00
Marius Bakke 5a64a79131
utils: Add helper method to make files writable.
* gnu/build/activation.scm (make-file-writable): Move this to ...
* guix/build/utils.scm (make-file-writable): ... here. Export it.
* guix/build/gnu-build-system.scm (strip): Use it.
2017-01-26 22:19:16 +01:00
Leo Famulari a7199b7d99
activation: Don't fail if /var/lib exists.
This is a followup to commit 6526d43ea4.

* gnu/build/activation.scm (activate-user+groups): Use mkdir-p to create
/var/lib.
2016-09-06 14:41:48 -04:00
David Craven 6526d43ea4
activation: Allow home directories to be created under /var/lib.
* gnu/build/activation.scm (activate-user+groups): Make sure /var/lib
  exists.
2016-09-06 17:48:59 +02:00
Ludovic Courtès eb56ee027b
system: Add 'create-home-directory?' field to <user-account>.
* gnu/system/shadow.scm (<user-account>)[create-home-directory?]: New
field.
(user-account->gexp): Serialize it.
* gnu/build/activation.scm (activate-users+groups)[activate-user]:
Update 'match-lambda' pattern accordingly.  Pass #:create-home? to
'ensure-user'.
(add-user, modify-user, ensure-user): Add #:create-home? parameter and
honor it.
* doc/guix.texi (User Accounts): Document it.
2016-08-28 15:11:18 +02:00
Ludovic Courtès 2fa909b27b activation: Copy account skeletons silently.
* gnu/build/activation.scm (copy-account-skeletons): Pass #:log to
'copy-recursively'.
2016-03-24 22:47:15 +01:00
Ludovic Courtès 4e8b7502e3 system: Allow account skeletons to be directories.
* gnu/system/shadow.scm (skeleton-directory): Use 'copy-recursively'
instead of 'copy-file'.
* gnu/build/activation.scm (copy-account-skeletons): Likewise.
2016-03-20 15:02:38 +01:00
Mark H Weaver 15f0de0581 system: activate-ptrace-attach: Handle kernels without YAMA support.
* gnu/build/activation.scm (activate-ptrace-attach): Check for the existence
  of /proc/sys/kernel/yama/ptrace_scope before trying to write to it.
2015-05-09 13:14:31 -04:00
Ludovic Courtès 356a62b8e6 activation: Make user copies of the skeletons writable.
* gnu/build/activation.scm (make-file-writable,
  make-skeletons-writable): New procedures.
  (copy-account-skeletons): Call 'make-file-writable' after 'copy-file'.
  (add-user): Add call to 'make-skeletons-writable'.
2015-05-05 23:46:54 +02:00
Ludovic Courtès b158f1d751 system: Allow users to PTRACE_ATTACH to their own processes.
* gnu/build/activation.scm (activate-ptrace-attach): New procedure.
* gnu/system.scm (operating-system-activation-script): Use it.
2015-04-12 15:33:42 +02:00
Ludovic Courtès 9bea87a542 activation: Remove undeclared user accounts and groups.
Fixes <http://bugs.gnu.org/19795>.
Reported by David Thompson <dthompson2@worcester.edu>.

* gnu/build/activation.scm (enumerate, current-users, current-groups,
  delete-user, delete-group): New procedures.
  (activate-users+groups): Add calls to 'delete-user' and
  'delete-group'.
* doc/guix.texi (User Accounts): Add a paragraph about statelessness.
  Explain that passwords are preserved.
2015-04-08 21:41:04 +02:00
Mark H Weaver 78ab0746a5 system: Add /etc/ssl symlink; set needed variables in /etc/profile.
* gnu/build/activation.scm (activate-etc): Create /etc/ssl symlink.
* gnu/system.scm (etc-directory): Set SSL_CERT_DIR, SSL_CERT_FILE,
  and GIT_SSL_CAINFO in /etc/profile.

Co-Authored-By: Ludovic Courtès <ludo@gnu.org>
2015-03-03 13:49:12 -05:00
Ludovic Courtès 45c5b47b96 activation: Copy the account skeletons when creating the 'root' account.
* gnu/build/activation.scm (%skeleton-directory): New variable.
  (dot-or-dot-dot?, copy-account-skeletons): New procedure.
  (add-user): Use 'copy-account-skeletons'.
  (activate-etc): Use 'dot-or-dot-dot?'.
2014-12-13 22:31:08 +01:00
Ludovic Courtès 6496de9bc2 activation: Don't create unneeded "/var/guix/gcroots/etc-directory".
* gnu/build/activation.scm (activate-etc): Don't create
  "/var/guix/gcroots/etc-directory".
2014-12-06 16:03:49 +01:00
Ludovic Courtès f34c56be3a activation: Set the firmware search path.
* gnu/build/activation.scm (activate-firmware): New procedure.
* gnu/system.scm (<operating-system>)[firmware]: New field.
  (directory-union): New procedure.
  (%base-firmware): New variable.
  (operating-system-activation-script): Use 'directory-union', and call
  'activate-firmware'.
* doc/guix.texi (operating-system Reference): Document 'firmware'.
2014-11-11 22:42:39 +01:00
Ludovic Courtès d460204f2e system: Allow Linux-libre to find our 'modprobe' command.
Fixes <http://bugs.gnu.org/18525>.
Reported by Mark H Weaver <mhw@netris.org>.

* gnu/build/activation.scm (activate-modprobe): New procedure.
* gnu/system.scm (modprobe-wrapper): New procedure.
  (operating-system-activation-script): Use both.
2014-11-02 23:06:17 +01:00
Ludovic Courtès e2b464b7f4 activation: Ensure existing user accounts have the right settings.
* gnu/build/activation.scm (modify-user, ensure-user): New procedures.
  (activate-users+groups): Systematically call 'ensure-user'.
2014-09-22 10:10:08 +02:00
Ludovic Courtès 6d49355d8b activation: Honor $GUIX_NEW_SYSTEM for use by 'guix system reconfigure'.
* gnu/build/activation.scm (activate-current-system): Honor
  $GUIX_NEW_SYSTEM by default.
* guix/scripts/system.scm (switch-to-system): Set $GUIX_NEW_SYSTEM
  before loading SCRIPT.
2014-09-12 22:13:52 +02:00
Ludovic Courtès ee7bae3bbd activation: Set the permissions of /etc/sudoers to 440.
* gnu/build/activation.scm (activate-etc): Move 'rm-f' to a local
  'define'.  When TARGET is "sudoers", make it 440.
2014-09-12 00:14:52 +02:00
Ludovic Courtès ee248b6a70 activation: Make the /bin/sh symlink at activation time.
* gnu/build/install.scm (directives): Remove "/bin/sh".
* gnu/build/activation.scm (activate-/bin/sh): New procedure.
* gnu/system.scm (operating-system-activation-script): Use it.
2014-09-12 00:14:52 +02:00
Ludovic Courtès c6a0536d08 activation: Make sure /etc/sudoers & co. are regular files.
Before that, 'sudo' would exit with:

  sudo: /etc/sudoers is not a regular file
  sudo: no valid sudoers sources found, quitting

* gnu/build/activation.scm (activate-etc): Check if SOURCE matches
  'file-is-directory?'.  If not, use 'copy-file' instead of 'symlink'.
2014-09-12 00:14:52 +02:00
Ludovic Courtès 286cacaded activation: Remove outdated comment.
* gnu/build/activation.scm (activate-etc): Remove outdated comment.
2014-09-12 00:14:52 +02:00
Ludovic Courtès 095f4deb4b activation: Factorize the link-or-copy trick.
* gnu/build/activation.scm (link-or-copy): New procedure.
  (activate-setuid-programs): Use it.
2014-09-12 00:14:52 +02:00
Ludovic Courtès 8a9e21d1f7 Rename (gnu build linux-initrd) to (gnu build linux-boot).
* gnu/build/linux-initrd.scm: Rename to...
* gnu/build/linux-boot.scm: ... this.
* gnu-system.am (GNU_SYSTEM_MODULES): Adjust accordingly.
* gnu/build/activation.scm, gnu/build/vm.scm, gnu/services/base.scm,
  gnu/services/dmd.scm, gnu/system.scm, gnu/system/linux-initrd.scm,
  gnu/system/vm.scm: Adjust accordingly.
2014-09-03 15:43:07 +02:00
Ludovic Courtès 548f7a8fa2 Move operating system helpers from (guix build …) to (gnu build …).
* guix/build/activation.scm, guix/build/install.scm,
  guix/build/linux-initrd.scm, guix/build/vm.scm: Move to...
* gnu/build: ... here.
* Makefile.am (MODULES): Remove the above guix/build/ files.
* gnu-system.am (GNU_SYSTEM_MODULES): Add the above gnu/build/ files
  here.
* gnu/services/base.scm, gnu/services/dmd.scm, gnu/system.scm,
  gnu/system/linux-initrd.scm, gnu/system/vm.scm,
  guix/scripts/system.scm: Adjust to the new module names.
2014-09-03 15:43:07 +02:00