GNU bug report logs - #73966
'guix deploy' fails when adding 'elogind-service-type'

Please note: This is a static page, with minimal formatting, updated once a day.
Click here to see this page with the latest information and nicer formatting.

Package: guix; Reported by: Fabio Natali <me@HIDDEN>; dated Wed, 23 Oct 2024 15:06:02 UTC; Maintainer for guix is bug-guix@HIDDEN.

Message received at submit <at> debbugs.gnu.org:


Received: (at submit) by debbugs.gnu.org; 23 Oct 2024 15:05:11 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Wed Oct 23 11:05:11 2024
Received: from localhost ([127.0.0.1]:60397 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1t3cv9-00006S-AS
	for submit <at> debbugs.gnu.org; Wed, 23 Oct 2024 11:05:11 -0400
Received: from lists.gnu.org ([209.51.188.17]:44044)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <me@HIDDEN>) id 1t3cv7-00006K-Mj
 for submit <at> debbugs.gnu.org; Wed, 23 Oct 2024 11:05:10 -0400
Received: from eggs.gnu.org ([2001:470:142:3::10])
 by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)
 (Exim 4.90_1) (envelope-from <me@HIDDEN>)
 id 1t3cud-0005G3-V9
 for bug-guix@HIDDEN; Wed, 23 Oct 2024 11:04:39 -0400
Received: from relay1-d.mail.gandi.net ([2001:4b98:dc4:8::221])
 by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)
 (Exim 4.90_1) (envelope-from <me@HIDDEN>)
 id 1t3cuZ-00020t-Az
 for bug-guix@HIDDEN; Wed, 23 Oct 2024 11:04:39 -0400
Received: by mail.gandi.net (Postfix) with ESMTPSA id 71CEF24000C
 for <bug-guix@HIDDEN>; Wed, 23 Oct 2024 15:04:30 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fabionatali.com;
 s=gm1; t=1729695870;
 h=from:from:reply-to:subject:subject:date:date:message-id:message-id:
 to:to:cc:mime-version:mime-version:content-type:content-type;
 bh=3Q1UrFttklwYsi8WXG5mGbvHhej6leN2qSWPgFKW4XU=;
 b=QCjFCPeg8v3GAt4dmrWL/tsl3hiO3R1Vwci5ZW6v4vUhdD8p89Nm8RFF0p+8W0dvnbqSND
 faU2lbc5hW3qCuBUBsrQweGxZAh2TbyT/0fSCLNIRsiZZPEEmsVNEoD1QcxzeG+zszflVT
 GwqVT/mKcVDpDO1xYzLhxgtuv9ebjDE0SyZ9wNILk9G379QceqkbADPXayuS1bjex1i/3y
 2MbFbF2A3FptZXchSTeTEuvBSFcJBNdPxeyYYFdxngUHlQ7+/a6YeqYbl6G34ZRWwEylK/
 5V91GZvwYaaZqJRYzhX7DKpkU69cRLrOW7QQua2KT3DzDMMD1O5dzwJIM1gXhA==
From: Fabio Natali <me@HIDDEN>
To: bug-guix@HIDDEN
Subject: 'guix deploy' fails when adding 'elogind-service-type'
Date: Wed, 23 Oct 2024 16:04:28 +0100
Message-ID: <87ed46dfnn.fsf@HIDDEN>
MIME-Version: 1.0
Content-Type: text/plain
X-GND-Sasl: me@HIDDEN
Received-SPF: pass client-ip=2001:4b98:dc4:8::221;
 envelope-from=me@HIDDEN; helo=relay1-d.mail.gandi.net
X-Spam_score_int: -27
X-Spam_score: -2.8
X-Spam_bar: --
X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1,
 DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1,
 RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_PASS=-0.001,
 SPF_PASS=-0.001 autolearn=ham autolearn_force=no
X-Spam_action: no action
X-Spam-Score: -1.6 (-)
X-Debbugs-Envelope-To: submit
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -2.6 (--)

Dear All,

This is to briefly report an issue that I encountered yesterday, while
reconfiguring one of my servers.

The machine is headless and has a minimalist system without
desktop-related software. Yesterday I had to install the elogind
service, so I add a one-liner to my configuration file and redeploy with
'guix deploy' - which fails badly.

'guix deploy' terminates with this error:

--8<---------------cut here---------------start------------->8---
guix deploy: error: failed to deploy host: remote command
'/run/setuid-programs/sudo -n --
/gnu/store/xv4cd7qz4yan93zkjisbmbpxfz78hah2-guile-3.0.9/bin/guile
--no-auto-compile -L /gnu/store/gai5i4ba2xf084big8h56q6pc0vwx2sj-module-import
-C / gnu/store/gai5i4ba2xf084big8h56q6pc0vwx2sj-module-import -c "(begin
(use-modules (guix repl)) (send-repl-response (quote (with-output-to-port
(current-error-por t) (lambda () (primitive-load
\"/gnu/store/gkh9yvyfdlnzpi9j9h8w4df0qz3jim2x-remo te-exp.scm\"))))
(current-output-port)) (force-output))"' failed with status 1
--8<---------------cut here---------------end--------------->8---

The system is left in a non-working state. Attempts at opening new
terminal sessions fail, with the user being logged out immediately, both
when connecting via SSH and when logging in from a TTY. Already
established terminal sessions start throwing errors like this:

--8<---------------cut here---------------start------------->8---
user@host ~$ sudo su -
sudo: pam_open_session: Error in service module
sudo: policy plugin failed session initialization
Segmentation fault
--8<---------------cut here---------------end--------------->8---

I have to use Magic SysRq to reboot and get back to a working system.

I initially blamed this to some quirk of this particular machine, but
then I was able to reproduce this in a VM. Here are the steps.

Start from a system definition 'server.scm', along the lines of:

--8<---------------cut here---------------start------------->8---
(use-modules (gnu)
             (gnu machine)
             (gnu machine ssh)
             (gnu services desktop)
             (gnu services networking)
             (gnu services ssh))

(define %user-authorized-key
  (plain-file
   "user-authorized-key.pub" "ssh-rsa SSH-PUBLIC-KEY"))

(define %guix-authorized-key
  (plain-file
   "guix-authorized-key.pub"
   "(public-key
(ecc (curve Ed25519) (q GUIX-AUTHORIZED-KEY)))"))

(define test-server-operating-system
  (operating-system
    (host-name "host")
    (bootloader (bootloader-configuration
                 (bootloader grub-bootloader)
                 (targets '("/dev/vda"))))
    (file-systems (cons
		   (file-system
                     (device "/dev/vda1")
                     (mount-point "/")
                     (type "ext4"))
                   %base-file-systems))

    (users
     (list (user-account
            (name "user")
            (group "users")
            (supplementary-groups '("wheel")))))

    (sudoers-file
     (plain-file
      "sudoers"
      (string-append
       (plain-file-content %sudoers-specification)
       "%wheel ALL = NOPASSWD: ALL")))

    (services
     (cons*
      (service dhcp-client-service-type)
      (service openssh-service-type
               (openssh-configuration
                (authorized-keys `(("user"
                                    ,%user-authorized-key)
                                   ("root"
                                    ,%user-authorized-key)))
                (permit-root-login 'prohibit-password)))
      ;; Enable the elogind service and redeploy to trigger the issue.
      ;; (service elogind-service-type)
      (modify-services
          %base-services
        (guix-service-type config =>
                           (guix-configuration
                            (authorized-keys
                             (cons %guix-authorized-key
                                   %default-authorized-guix-keys)))))))))

(define test-server-machine
  (machine-ssh-configuration
   (host-key "ssh-ed25519 MACHINE-PUBLIC-KEY")
   (host-name "localhost")
   (port 2222)
   (identity "/home/user/.ssh/id_rsa_guix_image")
   (system "x86_64-linux")
   (user "user")))

(list
 (machine
  (operating-system test-server-operating-system)
  (environment managed-host-environment-type)
  (configuration test-server-machine)))

test-server-operating-system
--8<---------------cut here---------------end--------------->8---

Create an image 'image.qcow2' based on the above definition:

--8<---------------cut here---------------start------------->8---
cp `guix system image \
    --image-size=20GB \
    --image-type=qcow2 \
    server.scm` image.qcow2
chmod u+w image.qcow2
--8<---------------cut here---------------end--------------->8---

The image can be run with this incantation or a variation thereof:

--8<---------------cut here---------------start------------->8---
guix shell qemu -- qemu-system-x86_64 \
    -nic user,model=virtio-net-pci,hostfwd=tcp::2222-:22 \
    -enable-kvm -m 4096 -smp 2 \
    -device virtio-blk,drive=myhd \
    -drive if=none,file=/tmp/image.qcow2,id=myhd
--8<---------------cut here---------------end--------------->8---

Everything should look fine so far. Log in as a user, take note of the
SSH public key in '/etc/ssh/ssh_host_ed25519_key.pub' which needs to be
used as the 'host-key' in the 'machine-ssh-configuration' in
'server.scm'.

Now uncomment the line with 'elogind' service and comment out the last
line 'test-server-operating-system', so that the system definition can
be fed to 'guix deploy'.

Run 'guix deploy server.scm', while the QEMU machine is still running.

BOOM.

This should have triggered the error: the deploy fails and the VM is no
longer responsive.

Note that this is only triggered if the system definition includes a
non-root user. Also note that the reconfiguration succeeds when run from
within the machine, i.e. via 'guix system reconfigure ...' (from within
the guest) as opposed to 'guix deploy' (from the host).

I just wanted to brain-dump this here. It's not blocking for me at the
moment but I guess it's good to have it reported. Any idea is welcome.
I'll also try and get back to this when time permits.

Thanks, cheers, Fabio.


-- 
Fabio Natali
https://fabionatali.com




Acknowledgement sent to Fabio Natali <me@HIDDEN>:
New bug report received and forwarded. Copy sent to bug-guix@HIDDEN. Full text available.
Report forwarded to bug-guix@HIDDEN:
bug#73966; Package guix. Full text available.
Please note: This is a static page, with minimal formatting, updated once a day.
Click here to see this page with the latest information and nicer formatting.
Last modified: Sun, 12 Jan 2025 05:45:02 UTC

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997 nCipher Corporation Ltd, 1994-97 Ian Jackson.