GNU bug report logs - #52454
[PATCH 0/4] Ensure correct ownership of directory trees in services.Hello Guix,

Please note: This is a static page, with minimal formatting, updated once a day.
Click here to see this page with the latest information and nicer formatting.

Package: guix-patches; Reported by: Brice Waegeneire <brice@HIDDEN>; Keywords: patch; merged with #52712, #52713, #52714, #52715; dated Sun, 12 Dec 2021 18:29:01 UTC; Maintainer for guix-patches is guix-patches@HIDDEN.
Merged 52454 52712 52713 52714 52715. Request was from Brice Waegeneire <brice@HIDDEN> to control <at> debbugs.gnu.org. Full text available.
Merged 52454 52713 52714 52715. Request was from Brice Waegeneire <brice@HIDDEN> to control <at> debbugs.gnu.org. Full text available.
Merged 52454 52714 52715. Request was from Brice Waegeneire <brice@HIDDEN> to control <at> debbugs.gnu.org. Full text available.
Merged 52454 52715. Request was from Brice Waegeneire <brice@HIDDEN> to control <at> debbugs.gnu.org. Full text available.

Message received at 52454 <at> debbugs.gnu.org:


Received: (at 52454) by debbugs.gnu.org; 21 Dec 2021 19:30:25 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Tue Dec 21 14:30:24 2021
Received: from localhost ([127.0.0.1]:55682 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1mzkq8-00057f-K7
	for submit <at> debbugs.gnu.org; Tue, 21 Dec 2021 14:30:24 -0500
Received: from relay1-d.mail.gandi.net ([217.70.183.193]:36885)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <brice@HIDDEN>) id 1mzkq6-0004yI-CU
 for 52454 <at> debbugs.gnu.org; Tue, 21 Dec 2021 14:30:23 -0500
Received: (Authenticated sender: brice@HIDDEN)
 by relay1-d.mail.gandi.net (Postfix) with ESMTPSA id 1B0D9240005;
 Tue, 21 Dec 2021 19:30:15 +0000 (UTC)
From: Brice Waegeneire <brice@HIDDEN>
To: Ludovic =?utf-8?Q?Court=C3=A8s?= <ludo@HIDDEN>
Subject: [PATCH v2 0/4] Ensure correct ownership of directory trees in services
In-Reply-To: <87zgoxmway.fsf_-_@HIDDEN> ("Ludovic =?utf-8?Q?Court=C3=A8s?=
 =?utf-8?Q?=22's?= message of "Sat, 18 Dec 2021 22:34:45 +0100")
References: <87h7bdad9o.fsf@HIDDEN>
 <20211212183614.19730-1-brice@HIDDEN> <87zgoxmway.fsf_-_@HIDDEN>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/28.0.90 (gnu/linux)
Date: Tue, 21 Dec 2021 20:30:11 +0100
Message-ID: <8735mleoxo.fsf_-_@HIDDEN>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
X-Spam-Score: -0.7 (/)
X-Debbugs-Envelope-To: 52454
Cc: 52454 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -1.7 (-)

Hello Ludo=E2=80=99,

Here is a second version of the patch set.

Ludovic Court=C3=A8s <ludo@HIDDEN> writes:

> [...]
>
> This has been discussed a few times: I wonder if we should simply chown
> service home directories systematically?

#45571=C2=B9 is one of such discussion. For services' home, I guess that's =
what we
 should do, but it probably won't be sufficient as log or chache directories
 usualy aren't in a home, but still need to chowned. The easiest and probab=
ly
 least controversion would be to just replace current `chown` calls on
 directories by `lchown-recursive`.

Seeing that we don't want static UID/GID mapping, like most other distros d=
o, we
could try to implement something like systemd's dynamic users=C2=B2 approch.

> Brice Waegeneire <brice@HIDDEN> skribis:
>
>> * guix/build/syscalls.scm (lchown): New procedure.
>
> Would be nice to add even trivial tests to tests/syscalls.scm.

I wrote 4 tests, however the last two, the ones actually testing 'lchown' f=
ail
bescause "/tmp" has it's sticky bit set, which prevent changing ownership of
files there.  I tried to workaround this but didn't managed to.

> Unfortunately, this doesn=E2=80=99t work for service activation because w=
hen
> booting, activation snippets are run from the initrd=E2=80=99s Guile, whi=
ch is
> statically linked and lacks dlopen.
>
> [...]
>
> For this strategy to work, you need to add =E2=80=98lchown=E2=80=99 in
> =E2=80=98guile-3.0-linux-syscalls.patch=E2=80=99 and to use =E2=80=98defi=
ne-as-needed=E2=80=99 in (guix
> build syscalls).

Done and it fixes the check system for postgresql service.

=C2=B9 <https://issues.guix.gnu.org/45571>
=C2=B2 <https://0pointer.net/blog/dynamic-users-with-systemd.html>

Cheers,
- Brice

Brice Waegeneire (4):
  syscalls: Add 'lchown'.
  activation: Add 'lchown-recursive'.
  services: postgresql: Ensure correct ownership of directory trees.
  services: cuirass: Ensure correct ownership of directory trees.

 gnu/build/activation.scm                      | 20 +++++-
 .../patches/guile-3.0-linux-syscalls.patch    | 33 ++++++++++
 gnu/services/cuirass.scm                      | 18 +++---
 gnu/services/databases.scm                    | 14 +++--
 guix/build/syscalls.scm                       | 16 +++++
 tests/syscalls.scm                            | 62 +++++++++++++++++++
 6 files changed, 150 insertions(+), 13 deletions(-)


base-commit: 87e5502d406bfb44b61f7577b241602e02a3498e
--=20
2.34.0




Information forwarded to guix-patches@HIDDEN:
bug#52454; Package guix-patches. Full text available.

Message received at 52454 <at> debbugs.gnu.org:


Received: (at 52454) by debbugs.gnu.org; 18 Dec 2021 21:34:56 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Sat Dec 18 16:34:56 2021
Received: from localhost ([127.0.0.1]:44321 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1myhM0-0005zK-6I
	for submit <at> debbugs.gnu.org; Sat, 18 Dec 2021 16:34:56 -0500
Received: from eggs.gnu.org ([209.51.188.92]:56312)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <ludo@HIDDEN>) id 1myhLz-0005z7-9k
 for 52454 <at> debbugs.gnu.org; Sat, 18 Dec 2021 16:34:55 -0500
Received: from [2001:470:142:3::e] (port=40014 helo=fencepost.gnu.org)
 by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)
 (Exim 4.90_1) (envelope-from <ludo@HIDDEN>)
 id 1myhLs-0003kU-Nc; Sat, 18 Dec 2021 16:34:48 -0500
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org;
 s=fencepost-gnu-org; h=MIME-Version:In-Reply-To:Date:References:Subject:To:
 From; bh=efKrxVc+jSDDihal86njLlePsclQmACMAubONRbdwWI=; b=DxIel6hhzkmHJbEiGkU4
 KMkkl3sP/uzqGeVPBNI8ZIaNfdncisjjyHXH8b5y/pKEGXBNclWAnHP3p5nb/b3dCt1VfRh5KASvR
 Bka3ag2tzbozR4ngVcZdGVY3XuF6D1jtyybWlmZzSqgIRArD7wcL0dbmj5dXit3wazxQsCuBdcoHv
 tsazSz/H9ITS8Q0R4Iw0PlzLkEUl2tWulRmL/CU799B3TnEpLavCPD5DAKwvQIKXAavaSxi1+NbnV
 RcthAPvVn7MhwWJlL8/DGVlWMebOb/c70rbQLgUzSbjowF3tGdAC9OtKhDgy1+6fL4YO7Ei8XshlD
 aDyiBLn44WitiQ==;
Received: from 91-160-117-201.subs.proxad.net ([91.160.117.201]:59409
 helo=ribbon)
 by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)
 (Exim 4.90_1) (envelope-from <ludo@HIDDEN>)
 id 1myhLs-0006ep-Kk; Sat, 18 Dec 2021 16:34:48 -0500
From: =?utf-8?Q?Ludovic_Court=C3=A8s?= <ludo@HIDDEN>
To: Brice Waegeneire <brice@HIDDEN>
Subject: Re: bug#52454: [PATCH 0/4] Ensure correct ownership of directory
 trees in services.Hello Guix,
References: <87h7bdad9o.fsf@HIDDEN>
 <20211212183614.19730-1-brice@HIDDEN>
Date: Sat, 18 Dec 2021 22:34:45 +0100
In-Reply-To: <20211212183614.19730-1-brice@HIDDEN> (Brice Waegeneire's
 message of "Sun, 12 Dec 2021 19:36:11 +0100")
Message-ID: <87zgoxmway.fsf_-_@HIDDEN>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.2 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
X-Spam-Score: -2.3 (--)
X-Debbugs-Envelope-To: 52454
Cc: 52454 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -3.3 (---)

Hi!

Great patch series!

This has been discussed a few times: I wonder if we should simply chown
service home directories systematically?

Brice Waegeneire <brice@HIDDEN> skribis:

> * guix/build/syscalls.scm (lchown): New procedure.

Would be nice to add even trivial tests to tests/syscalls.scm.

Unfortunately, this doesn=E2=80=99t work for service activation because when
booting, activation snippets are run from the initrd=E2=80=99s Guile, which=
 is
statically linked and lacks dlopen.

This leads to failures like:

--8<---------------cut here---------------start------------->8---
$ make check-system TESTS=3D"postgresql" -j4

[...]

populating /etc from /gnu/store/bchxln4wkfmdbsxww9jaxafsyvlpdbmg-etc...
Please wait while gathering entropy to generate the key pair;
this may take time...
warning: failed to chown "/var/lib/postgresql/data": Function not implement=
ed
warning: failed to chown "/var/run/postgresql": Function not implemented
warning: failed to chown "/var/log/postgresql": Function not implemented
The files belonging to this database system will be owned by user "postgres=
".
This user must also own the server process.

[...]

fixing permissions on existing directory /var/lib/postgresql/data ... initd=
b: could not change permissions of directory "/var/lib/postgresql/data": Op=
eration not permitted
--8<---------------cut here---------------end--------------->8---

(The ENOSYS error above comes from the =E2=80=98lchown=E2=80=99 wrapper.)

For this strategy to work, you need to add =E2=80=98lchown=E2=80=99 in
=E2=80=98guile-3.0-linux-syscalls.patch=E2=80=99 and to use =E2=80=98define=
-as-needed=E2=80=99 in (guix
build syscalls).

(I=E2=80=99m surprised we didn=E2=80=99t already have recursive chown.)

With this in place, we should be all set!

Thanks,
Ludo=E2=80=99.




Information forwarded to guix-patches@HIDDEN:
bug#52454; Package guix-patches. Full text available.

Message received at 52454 <at> debbugs.gnu.org:


Received: (at 52454) by debbugs.gnu.org; 12 Dec 2021 18:36:41 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Sun Dec 12 13:36:41 2021
Received: from localhost ([127.0.0.1]:53107 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1mwTiC-0003q4-UI
	for submit <at> debbugs.gnu.org; Sun, 12 Dec 2021 13:36:41 -0500
Received: from relay9-d.mail.gandi.net ([217.70.183.199]:37225)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <brice@HIDDEN>) id 1mwTi8-0003pG-SI
 for 52454 <at> debbugs.gnu.org; Sun, 12 Dec 2021 13:36:37 -0500
Received: (Authenticated sender: brice@HIDDEN)
 by relay9-d.mail.gandi.net (Postfix) with ESMTPSA id F0BFCFF802
 for <52454 <at> debbugs.gnu.org>; Sun, 12 Dec 2021 18:36:30 +0000 (UTC)
From: Brice Waegeneire <brice@HIDDEN>
To: 52454 <at> debbugs.gnu.org
Subject: [PATCH 4/4] services: cuirass: Ensure correct ownership of directory
 trees.
Date: Sun, 12 Dec 2021 19:36:14 +0100
Message-Id: <20211212183614.19730-4-brice@HIDDEN>
X-Mailer: git-send-email 2.34.0
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-Spam-Score: -0.7 (/)
X-Debbugs-Envelope-To: 52454
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -1.7 (-)

* gnu/services/cuirass.scm (cuirass-activation): Replace 'chown'
  calls by 'lchown-recursive'.
---
 gnu/services/cuirass.scm | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/gnu/services/cuirass.scm b/gnu/services/cuirass.scm
index a69c20adb8..116c12063e 100644
--- a/gnu/services/cuirass.scm
+++ b/gnu/services/cuirass.scm
@@ -5,6 +5,7 @@
 ;;; Copyright © 2017 Jan Nieuwenhuizen <janneke@HIDDEN>
 ;;; Copyright © 2018, 2019 Ricardo Wurmus <rekado@HIDDEN>
 ;;; Copyright © 2018 Clément Lassieur <clement@HIDDEN>
+;;; Copyright © 2021 Brice Waegeneire <brice@HIDDEN>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -24,6 +25,7 @@
 (define-module (gnu services cuirass)
   #:use-module (guix channels)
   #:use-module (guix gexp)
+  #:use-module (guix modules)
   #:use-module (guix records)
   #:use-module (guix store)
   #:use-module (guix utils)
@@ -278,9 +280,11 @@ (define (cuirass-activation config)
          (profile        (string-append "/var/guix/profiles/per-user/" user))
          (roots          (string-append profile "/cuirass"))
          (group          (cuirass-configuration-group config)))
-    (with-imported-modules '((guix build utils))
+    (with-imported-modules (source-module-closure
+                            '((gnu build activation)))
       #~(begin
-          (use-modules (guix build utils))
+          (use-modules (guix build utils)
+                       (gnu build activation))
 
           (mkdir-p #$cache)
           (mkdir-p #$log)
@@ -291,13 +295,13 @@ (define (cuirass-activation config)
 
           (let ((uid (passwd:uid (getpw #$user)))
                 (gid (group:gid (getgr #$group))))
-            (chown #$cache uid gid)
-            (chown #$log uid gid)
-            (chown #$roots uid gid)
-            (chown #$profile uid gid)
+            (lchown-recursive #$cache uid gid)
+            (lchown-recursive #$log uid gid)
+            (lchown-recursive #$profile uid gid)
+            (lchown-recursive (passwd:dir (getpw #$user)) uid gid)
 
             (when #$remote-cache
-              (chown #$remote-cache uid gid)))))))
+              (lchown-recursive #$remote-cache uid gid)))))))
 
 (define (cuirass-log-rotations config)
   "Return the list of log rotations that corresponds to CONFIG."
-- 
2.34.0





Information forwarded to guix-patches@HIDDEN:
bug#52454; Package guix-patches. Full text available.

Message received at 52454 <at> debbugs.gnu.org:


Received: (at 52454) by debbugs.gnu.org; 12 Dec 2021 18:36:41 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Sun Dec 12 13:36:40 2021
Received: from localhost ([127.0.0.1]:53105 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1mwTiB-0003pw-Q2
	for submit <at> debbugs.gnu.org; Sun, 12 Dec 2021 13:36:40 -0500
Received: from relay3-d.mail.gandi.net ([217.70.183.195]:55661)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <brice@HIDDEN>) id 1mwTi8-0003pD-RE
 for 52454 <at> debbugs.gnu.org; Sun, 12 Dec 2021 13:36:37 -0500
Received: (Authenticated sender: brice@HIDDEN)
 by relay3-d.mail.gandi.net (Postfix) with ESMTPSA id B3F7960006
 for <52454 <at> debbugs.gnu.org>; Sun, 12 Dec 2021 18:36:29 +0000 (UTC)
From: Brice Waegeneire <brice@HIDDEN>
To: 52454 <at> debbugs.gnu.org
Subject: [PATCH 2/4] activation: Add 'lchown-recursive'.
Date: Sun, 12 Dec 2021 19:36:12 +0100
Message-Id: <20211212183614.19730-2-brice@HIDDEN>
X-Mailer: git-send-email 2.34.0
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
X-Spam-Score: -0.7 (/)
X-Debbugs-Envelope-To: 52454
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -1.7 (-)

* gnu/build/activation.scm (lchown-recursive): New procedure.
---
 gnu/build/activation.scm | 22 ++++++++++++++++++++--
 1 file changed, 20 insertions(+), 2 deletions(-)

diff --git a/gnu/build/activation.scm b/gnu/build/activation.scm
index 9f6126023c..79c835a045 100644
--- a/gnu/build/activation.scm
+++ b/gnu/build/activation.scm
@@ -30,7 +30,7 @@ (define-module (gnu build activation)
   #:use-module (gnu build accounts)
   #:use-module (gnu build linux-boot)
   #:use-module (guix build utils)
-  #:use-module ((guix build syscalls) #:select (with-file-lock))
+  #:use-module ((guix build syscalls) #:select (with-file-lock lchown))
   #:use-module (ice-9 ftw)
   #:use-module (ice-9 match)
   #:use-module (ice-9 vlist)
@@ -46,7 +46,8 @@ (define-module (gnu build activation)
             activate-firmware
             activate-ptrace-attach
             activate-current-system
-            mkdir-p/perms))
+            mkdir-p/perms
+            lchown-recursive))
 
 ;;; Commentary:
 ;;;
@@ -105,6 +106,23 @@ (define (mkdir-p/perms directory owner bits)
   (chown directory (passwd:uid owner) (passwd:gid owner))
   (chmod directory bits))
 
+(define (lchown-recursive file owner group)
+  "As 'lchown' but recursively, change ownership of FILE to the integer values
+OWNER and GROUP without dereferencing symbolic links it encounter."
+  (nftw file
+        (lambda (filename statinfo flag base level)
+          (catch 'system-error
+            (lambda ()
+              (when (member flag '(regular directory symlink))
+                (lchown filename owner group)))
+            (lambda args
+              (format (current-error-port)
+                      "warning: failed to chown ~s: ~a~%"
+                      filename
+                      (strerror (system-error-errno args)))))
+          #t)
+        'physical))
+
 (define* (copy-account-skeletons home
                                  #:key
                                  (directory %skeleton-directory)
-- 
2.34.0





Information forwarded to guix-patches@HIDDEN:
bug#52454; Package guix-patches. Full text available.

Message received at 52454 <at> debbugs.gnu.org:


Received: (at 52454) by debbugs.gnu.org; 12 Dec 2021 18:36:39 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Sun Dec 12 13:36:39 2021
Received: from localhost ([127.0.0.1]:53103 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1mwTiB-0003ps-Fv
	for submit <at> debbugs.gnu.org; Sun, 12 Dec 2021 13:36:39 -0500
Received: from relay9-d.mail.gandi.net ([217.70.183.199]:53299)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <brice@HIDDEN>) id 1mwTi8-0003pF-QG
 for 52454 <at> debbugs.gnu.org; Sun, 12 Dec 2021 13:36:37 -0500
Received: (Authenticated sender: brice@HIDDEN)
 by relay9-d.mail.gandi.net (Postfix) with ESMTPSA id 731FAFF807
 for <52454 <at> debbugs.gnu.org>; Sun, 12 Dec 2021 18:36:30 +0000 (UTC)
From: Brice Waegeneire <brice@HIDDEN>
To: 52454 <at> debbugs.gnu.org
Subject: [PATCH 3/4] services: postgresql: Ensure correct ownership of
 directory trees.
Date: Sun, 12 Dec 2021 19:36:13 +0100
Message-Id: <20211212183614.19730-3-brice@HIDDEN>
X-Mailer: git-send-email 2.34.0
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-Spam-Score: 1.3 (+)
X-Spam-Report: Spam detection software, running on the system "debbugs.gnu.org",
 has NOT identified this incoming email as spam.  The original
 message has been attached to this so you can view it or label
 similar future email.  If you have any questions, see
 the administrator of that system for details.
 Content preview: * gnu/services/databases.scm (postgresql-activation): Replace
 'chown' calls by 'lchown-recursive'. --- gnu/services/databases.scm | 14
 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git
 a/gnu/services/databases.scm b/gnu/services/databases.scm index
 8e983ef0be..83f9fe5239
 100644 --- a/gnu/services/databases.scm +++ b/gnu/services/databases.scm
 @@ -8,6 +8,7 @@ ;;; Copyright [...] 
 Content analysis details:   (1.3 points, 10.0 required)
 pts rule name              description
 ---- ---------------------- --------------------------------------------------
 -0.0 SPF_PASS               SPF: sender matches SPF record
 -0.0 RCVD_IN_MSPIKE_H2      RBL: Average reputation (+2)
 [217.70.183.199 listed in wl.mailspike.net]
 -0.7 RCVD_IN_DNSWL_LOW      RBL: Sender listed at https://www.dnswl.org/,
 low trust [217.70.183.199 listed in list.dnswl.org]
 2.0 PDS_OTHER_BAD_TLD      Untrustworthy TLDs
 [URI: selfhosted.xyz (xyz)]
 0.0 SPF_HELO_NONE          SPF: HELO does not publish an SPF Record
X-Debbugs-Envelope-To: 52454
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 0.3 (/)

* gnu/services/databases.scm (postgresql-activation): Replace 'chown'
  calls by 'lchown-recursive'.
---
 gnu/services/databases.scm | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/gnu/services/databases.scm b/gnu/services/databases.scm
index 8e983ef0be..83f9fe5239 100644
--- a/gnu/services/databases.scm
+++ b/gnu/services/databases.scm
@@ -8,6 +8,7 @@
 ;;; Copyright © 2019 Robert Vollmert <rob@HIDDEN>
 ;;; Copyright © 2020 Marius Bakke <marius@HIDDEN>
 ;;; Copyright © 2021 David Larsson <david.larsson@HIDDEN>
+;;; Copyright © 2021 Brice Waegeneire <brice@HIDDEN>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -214,8 +215,11 @@ (define postgresql-activation
     (($ <postgresql-configuration> postgresql port locale config-file
                                    log-directory data-directory
                                    extension-packages)
-     #~(begin
+     (with-imported-modules (source-module-closure
+                             '((gnu build activation)))
+       #~(begin
          (use-modules (guix build utils)
+                      (gnu build activation)
                       (ice-9 match))
 
          (let ((user (getpwnam "postgres"))
@@ -230,19 +234,19 @@ (define postgresql-activation
                      '()))))
            ;; Create db state directory.
            (mkdir-p #$data-directory)
-           (chown #$data-directory (passwd:uid user) (passwd:gid user))
+           (lchown-recursive #$data-directory (passwd:uid user) (passwd:gid user))
 
            ;; Create the socket directory.
            (let ((socket-directory
                   #$(postgresql-config-file-socket-directory config-file)))
              (when (string? socket-directory)
                (mkdir-p socket-directory)
-               (chown socket-directory (passwd:uid user) (passwd:gid user))))
+               (lchown-recursive socket-directory (passwd:uid user) (passwd:gid user))))
 
            ;; Create the log directory.
            (when (string? #$log-directory)
              (mkdir-p #$log-directory)
-             (chown #$log-directory (passwd:uid user) (passwd:gid user)))
+             (lchown-recursive #$log-directory (passwd:uid user) (passwd:gid user)))
 
            ;; Drop privileges and init state directory in a new
            ;; process.  Wait for it to finish before proceeding.
@@ -262,7 +266,7 @@ (define postgresql-activation
                           initdb-args)))
                 (lambda ()
                   (primitive-exit 1))))
-             (pid (waitpid pid))))))))
+             (pid (waitpid pid)))))))))
 
 (define postgresql-shepherd-service
   (match-lambda
-- 
2.34.0





Information forwarded to guix-patches@HIDDEN:
bug#52454; Package guix-patches. Full text available.

Message received at 52454 <at> debbugs.gnu.org:


Received: (at 52454) by debbugs.gnu.org; 12 Dec 2021 18:36:36 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Sun Dec 12 13:36:36 2021
Received: from localhost ([127.0.0.1]:53098 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1mwTi8-0003pS-6f
	for submit <at> debbugs.gnu.org; Sun, 12 Dec 2021 13:36:36 -0500
Received: from relay1-d.mail.gandi.net ([217.70.183.193]:44385)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <brice@HIDDEN>) id 1mwTi6-0003pB-IU
 for 52454 <at> debbugs.gnu.org; Sun, 12 Dec 2021 13:36:35 -0500
Received: (Authenticated sender: brice@HIDDEN)
 by relay1-d.mail.gandi.net (Postfix) with ESMTPSA id E5329240005
 for <52454 <at> debbugs.gnu.org>; Sun, 12 Dec 2021 18:36:28 +0000 (UTC)
From: Brice Waegeneire <brice@HIDDEN>
To: 52454 <at> debbugs.gnu.org
Subject: [PATCH 1/4] syscalls: Add 'lchown'.
Date: Sun, 12 Dec 2021 19:36:11 +0100
Message-Id: <20211212183614.19730-1-brice@HIDDEN>
X-Mailer: git-send-email 2.34.0
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-Spam-Score: -0.7 (/)
X-Debbugs-Envelope-To: 52454
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -1.7 (-)

* guix/build/syscalls.scm (lchown): New procedure.
---
 guix/build/syscalls.scm | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/guix/build/syscalls.scm b/guix/build/syscalls.scm
index 63bd017d1d..1c432507c3 100644
--- a/guix/build/syscalls.scm
+++ b/guix/build/syscalls.scm
@@ -8,6 +8,7 @@
 ;;; Copyright © 2020 Jan (janneke) Nieuwenhuizen <janneke@HIDDEN>
 ;;; Copyright © 2021 Chris Marusich <cmmarusich@HIDDEN>
 ;;; Copyright © 2021 Tobias Geerinckx-Rice <me@HIDDEN>
+;;; Copyright © 2021 Brice Waegeneire <brice@HIDDEN>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -118,6 +119,7 @@ (define-module (guix build syscalls)
             scandir*
             getxattr
             setxattr
+            lchown
 
             fcntl-flock
             lock-file
@@ -1275,6 +1277,20 @@ (define* (scandir* name #:optional
       (lambda ()
         (closedir* directory)))))
 
+(define lchown
+  (let ((proc (syscall->procedure int "lchown" (list '* int int))))
+    (lambda (file owner group)
+      "As 'chown', change the ownership and group of the file referred to by
+FILE to the integer values OWNER and GROUP but doesn't dereference symbolic
+links.  Unlike 'chown' this doesn't support port or integer file descriptor
+via 'fchown'."
+      (let-values (((ret err)
+                    (proc (string->pointer file) owner group)))
+        (unless (zero? ret)
+          (throw 'system-error "lchown" "~S: ~A"
+                 (list file (strerror err))
+                 (list err)))))))
+
 
 ;;;
 ;;; Advisory file locking.
-- 
2.34.0





Information forwarded to guix-patches@HIDDEN:
bug#52454; Package guix-patches. Full text available.

Message received at submit <at> debbugs.gnu.org:


Received: (at submit) by debbugs.gnu.org; 12 Dec 2021 18:28:50 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Sun Dec 12 13:28:50 2021
Received: from localhost ([127.0.0.1]:53074 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1mwTac-0003bd-2O
	for submit <at> debbugs.gnu.org; Sun, 12 Dec 2021 13:28:50 -0500
Received: from lists.gnu.org ([209.51.188.17]:45562)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <brice@HIDDEN>) id 1mwTaa-0003bV-Bu
 for submit <at> debbugs.gnu.org; Sun, 12 Dec 2021 13:28:48 -0500
Received: from eggs.gnu.org ([209.51.188.92]:56358)
 by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)
 (Exim 4.90_1) (envelope-from <brice@HIDDEN>) id 1mwTaa-0000hR-5y
 for guix-patches@HIDDEN; Sun, 12 Dec 2021 13:28:48 -0500
Received: from relay10.mail.gandi.net ([217.70.178.230]:51521)
 by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)
 (Exim 4.90_1) (envelope-from <brice@HIDDEN>) id 1mwTaY-0007jv-7Z
 for guix-patches@HIDDEN; Sun, 12 Dec 2021 13:28:47 -0500
Received: (Authenticated sender: brice@HIDDEN)
 by relay10.mail.gandi.net (Postfix) with ESMTPSA id AA6E3240003
 for <guix-patches@HIDDEN>; Sun, 12 Dec 2021 18:28:40 +0000 (UTC)
From: Brice Waegeneire <brice@HIDDEN>
To: guix-patches@HIDDEN
Subject: [PATCH 0/4] Ensure correct ownership of directory trees in
 services.Hello Guix,
Date: Sun, 12 Dec 2021 19:28:35 +0100
Message-ID: <87h7bdad9o.fsf@HIDDEN>
MIME-Version: 1.0
Content-Type: text/plain
Received-SPF: pass client-ip=217.70.178.230; envelope-from=brice@HIDDEN;
 helo=relay10.mail.gandi.net
X-Spam_score_int: -25
X-Spam_score: -2.6
X-Spam_bar: --
X-Spam_report: (-2.6 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7,
 RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001,
 SPF_PASS=-0.001 autolearn=ham autolearn_force=no
X-Spam_action: no action
X-Spam-Score: -1.6 (-)
X-Debbugs-Envelope-To: submit
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -2.6 (--)

Hello Guix,

A number of times I got hit by newly configured service not starting because
of wrong ownership for files they ought to own.  This appear when
reconfiguring a operating system with a service that was unsed in the past,
but not present in previous generation.  For example, this time, cuirass and
postgresql service wouldn't start because that system had them running before,
but a few weeks ago I reconfigured the operating system without them and now
that I want to have these services running again they won't start because the
activation scripts were only changing the ownership of the runtime, data, log
and co. directories but not their content.  Concretely
/var/lib/postgresql/data/PG_VERSION (and others) wasn't owned by
postgresql:postgresql but by an other pair of UID/GID, however
/var/lib/postgresql had the correct ownership

This patch fix such UID/GID mismatch for the cuirass and postgresql service by
recusrivly changing the owner and group of the whole tree these services
need. And not just the root directories of theses trees. It is related to the issue
<https://issues.guix.gnu.org/45571> about stable UID/GID in Guix's containers.

Cheers,
- Brice

Brice Waegeneire (4):
  syscalls: Add 'lchown'.
  activation: Add 'lchown-recursive'.
  services: postgresql: Ensure correct ownership of directory trees.
  services: cuirass: Ensure correct ownership of directory trees.

 gnu/build/activation.scm   | 22 ++++++++++++++++++++--
 gnu/services/cuirass.scm   | 18 +++++++++++-------
 gnu/services/databases.scm | 14 +++++++++-----
 guix/build/syscalls.scm    | 16 ++++++++++++++++
 4 files changed, 56 insertions(+), 14 deletions(-)


base-commit: 604880ae22e1a7662acb1d3f282242470de0cd03
-- 
2.34.0






Acknowledgement sent to Brice Waegeneire <brice@HIDDEN>:
New bug report received and forwarded. Copy sent to guix-patches@HIDDEN. Full text available.
Report forwarded to guix-patches@HIDDEN:
bug#52454; Package guix-patches. Full text available.
Please note: This is a static page, with minimal formatting, updated once a day.
Click here to see this page with the latest information and nicer formatting.
Last modified: Tue, 21 Dec 2021 20:15:02 UTC

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997 nCipher Corporation Ltd, 1994-97 Ian Jackson.