GNU logs - #78836, boring messages

Message sent to bug-guix@HIDDEN:

Subject: bug#78836: /var/empty permissions problems between sshd and nslcd
Resent-From: Yann Dupont <yann.dupont@HIDDEN>
Original-Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
Resent-CC: bug-guix@HIDDEN
Resent-Date: Thu, 19 Jun 2025 07:44:04 +0000
Resent-Message-ID: <handler.78836.B.175031901115862 <at> debbugs.gnu.org>
Resent-Sender: help-debbugs@HIDDEN
To: 78836 <at> debbugs.gnu.org
Content-Type: multipart/alternative;
 boundary="------------zCe9HyMgvzUIcw0a0ovPcnjx"
Message-ID: <b5a0d45a-b589-46b3-89c9-8387adba740d@HIDDEN>
Date: Thu, 19 Jun 2025 09:43:04 +0200
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Content-Language: en-US
From: Yann Dupont <yann.dupont@HIDDEN>
Received-SPF: pass client-ip=193.52.103.113;
 envelope-from=yann.dupont@HIDDEN; helo=smtp-tls.univ-nantes.fr
X-Spam_score_int: -10
X-Spam_score: -1.1
X-Spam_bar: -
X-Spam_report: (-1.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1,
 DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HEXHASH_WORD=1,
 HTML_MESSAGE=0.001, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001,
 RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001,
 SPF_PASS=-0.001 autolearn=no autolearn_force=no
X-Spam_action: no action
X-Spam-Score: 0.7 (/)
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -0.3 (/)

This is a multi-part message in MIME format.
--------------zCe9HyMgvzUIcw0a0ovPcnjx
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

Hi everyone, the patch eab097c682ed31efd8668f46fce8de8f73b92849 causes 
sshd to now use /var/empty as a chroot directory. sshd expects 
/var/empty to belong to root and with reduced write permissions.

Unfortunately, when the nslcd service is also present on the system, it 
creates a user whose home directory is also /var/empty, which in this 
case belongs to the nslcd user.

In this case, sshd refuses to start.

I think the patch eab097c682ed31efd8668f46fce8de8f73b92849 is correct, 
and that nslcd should be changed to create /var/empty with the directory 
property set to root. But I don't know if there are any side effects to 
worry about with nslcd ?

(I think the relevant code is in : services/authentication.scm), in 
(|define %nslcd-accounts)
|

|...|

|(home-directory "/var/empty")|

--------------zCe9HyMgvzUIcw0a0ovPcnjx
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 7bit

<!DOCTYPE html>
<html>
  <head>

    <meta http-equiv="content-type" content="text/html; charset=UTF-8">
  </head>
  <body>
    <p _d-id="41484"><span _d-id="43179"
        class="--l --r container-target"><span _d-id="43193"
          class="--l --r hover:bg-blue-100 hover:dark:bg-blue-600">Hi</span>
        <span _d-id="43197"
          class="--l --r hover:bg-blue-100 hover:dark:bg-blue-600">everyone</span><span
          _d-id="43200"
          class="--l --r hover:bg-blue-100 hover:dark:bg-blue-600">,</span>
        <span _d-id="43204"
          class="--l --r hover:bg-blue-100 hover:dark:bg-blue-600">the</span>
        <span _d-id="43208"
          class="--l --r hover:bg-blue-100 hover:dark:bg-blue-600">patch</span>
        <span _d-id="43212"
          class="--l --r hover:bg-blue-100 hover:dark:bg-blue-600">eab097c682ed31efd8668f46fce8de8f73b92849</span>
        <span _d-id="43216"
          class="--l --r hover:bg-blue-100 hover:dark:bg-blue-600">causes</span>
        <span _d-id="43220"
          class="--l --r hover:bg-blue-100 hover:dark:bg-blue-600">sshd</span>
        <span _d-id="43224"
          class="--l --r hover:bg-blue-100 hover:dark:bg-blue-600">to</span>
        <span _d-id="43228"
          class="--l --r hover:bg-blue-100 hover:dark:bg-blue-600">now</span>
        <span _d-id="43232"
          class="--l --r hover:bg-blue-100 hover:dark:bg-blue-600">use</span>
        <span _d-id="43236"
          class="--l --r hover:bg-blue-100 hover:dark:bg-blue-600">/</span><span
          _d-id="43239"
          class="--l --r hover:bg-blue-100 hover:dark:bg-blue-600">var</span><span
          _d-id="43242"
          class="--l --r hover:bg-blue-100 hover:dark:bg-blue-600">/</span><span
          _d-id="43245"
          class="--l --r hover:bg-blue-100 hover:dark:bg-blue-600">empty</span>
        <span _d-id="43249"
          class="--l --r hover:bg-blue-100 hover:dark:bg-blue-600">as</span>
        <span _d-id="43253"
          class="--l --r hover:bg-blue-100 hover:dark:bg-blue-600">a</span>
        <span _d-id="43257"
          class="--l --r hover:bg-blue-100 hover:dark:bg-blue-600">chroot</span>
        <span _d-id="43261"
          class="--l --r hover:bg-blue-100 hover:dark:bg-blue-600">directory</span><span
          _d-id="43264"
          class="--l --r hover:bg-blue-100 hover:dark:bg-blue-600">.</span>
        <span _d-id="43268"
          class="--l --r hover:bg-blue-100 hover:dark:bg-blue-600">sshd</span>
        <span _d-id="43272"
          class="--l --r hover:bg-blue-100 hover:dark:bg-blue-600">expects</span>
        <span _d-id="43276"
          class="--l --r hover:bg-blue-100 hover:dark:bg-blue-600">/</span><span
          _d-id="43279"
          class="--l --r hover:bg-blue-100 hover:dark:bg-blue-600">var</span><span
          _d-id="43282"
          class="--l --r hover:bg-blue-100 hover:dark:bg-blue-600">/</span><span
          _d-id="43285"
          class="--l --r hover:bg-blue-100 hover:dark:bg-blue-600">empty</span>
        <span _d-id="43289"
          class="--l --r hover:bg-blue-100 hover:dark:bg-blue-600">to</span>
        <span _d-id="43293"
          class="--l --r hover:bg-blue-100 hover:dark:bg-blue-600">belong</span>
        <span _d-id="43297"
          class="--l --r hover:bg-blue-100 hover:dark:bg-blue-600">to</span>
        <span _d-id="43301"
          class="--l --r hover:bg-blue-100 hover:dark:bg-blue-600">root</span>
        <span _d-id="43305"
          class="--l --r hover:bg-blue-100 hover:dark:bg-blue-600">and</span>
        <span _d-id="43309"
          class="--l --r hover:bg-blue-100 hover:dark:bg-blue-600">with</span>
        <span _d-id="43313"
          class="--l --r hover:bg-blue-100 hover:dark:bg-blue-600">reduced</span>
        <span _d-id="43317"
          class="--l --r hover:bg-blue-100 hover:dark:bg-blue-600">write</span>
        <span _d-id="43321"
          class="--l --r hover:bg-blue-100 hover:dark:bg-blue-600">permissions</span><span
          _d-id="43324"
          class="--l --r hover:bg-blue-100 hover:dark:bg-blue-600">.</span></span></p>
    <p _d-id="41485"><span _d-id="43181"
        class="--l --r container-target">Unfortunately, when the nslcd
        service is also present on the system, it creates a user whose
        home directory is also /var/empty, which in this case belongs to
        the nslcd user.</span></p>
    <p _d-id="41487"><span _d-id="43183"
        class="--l --r container-target">In this case, sshd refuses to
        start.</span></p>
    <p _d-id="41489"><span _d-id="43185"
        class="--l --r container-target">I think the patch
        eab097c682ed31efd8668f46fce8de8f73b92849 is correct, and that
        nslcd should be changed to create /var/empty with the directory
        property set to root.</span> <span _d-id="43189"
        class="--l --r container-target"><span _d-id="43191"
          class="--l --r bg-blue-50 text-unit-target">But I don't know
          if there are any side effects to worry about with nslcd ?<br>
        </span></span></p>
    <p _d-id="41489"><span _d-id="43189"
        class="--l --r container-target"><span _d-id="43191"
          class="--l --r bg-blue-50 text-unit-target">(I think the
          relevant code is in : </span></span>services/authentication.scm),
      in (<code>define %nslcd-accounts)<br>
      </code></p>
    <p _d-id="41489"><code>...</code></p>
    <p _d-id="41489"><code>(home-directory "/var/empty")</code></p>
  </body>
</html>

--------------zCe9HyMgvzUIcw0a0ovPcnjx--

Message sent:

Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-Mailer: MIME-tools 5.505 (Entity 5.505)
Content-Type: text/plain; charset=utf-8
X-Loop: help-debbugs@HIDDEN
From: help-debbugs@HIDDEN (GNU bug Tracking System)
To: Yann Dupont <yann.dupont@HIDDEN>
Subject: bug#78836: Acknowledgement (/var/empty permissions problems
 between sshd and nslcd)
Message-ID: <handler.78836.B.175031901115862.ack <at> debbugs.gnu.org>
References: <b5a0d45a-b589-46b3-89c9-8387adba740d@HIDDEN>
X-Gnu-PR-Message: ack 78836
X-Gnu-PR-Package: guix
Reply-To: 78836 <at> debbugs.gnu.org
Date: Thu, 19 Jun 2025 07:44:05 +0000

Thank you for filing a new bug report with debbugs.gnu.org.

This is an automatically generated reply to let you know your message
has been received.

Your message is being forwarded to the package maintainers and other
interested parties for their attention; they will reply in due course.

Your message has been sent to the package maintainer(s):
 bug-guix@HIDDEN

If you wish to submit further information on this problem, please
send it to 78836 <at> debbugs.gnu.org.

Please do not send mail to help-debbugs@HIDDEN unless you wish
to report a problem with the Bug-tracking system.

--=20
78836: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=3D78836
GNU Bug Tracking System
Contact help-debbugs@HIDDEN with problems

Message sent to bug-guix@HIDDEN:

Subject: bug#78836: /var/empty permissions problems between sshd and nslcd
Resent-From: Sergey Trofimov <sarg@HIDDEN>
Original-Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
Resent-CC: bug-guix@HIDDEN
Resent-Date: Thu, 19 Jun 2025 08:57:02 +0000
Resent-Message-ID: <handler.78836.B78836.175032340429150 <at> debbugs.gnu.org>
Resent-Sender: help-debbugs@HIDDEN
To: Yann Dupont <yann.dupont@HIDDEN>
Cc: 78836 <at> debbugs.gnu.org
From: Sergey Trofimov <sarg@HIDDEN>
In-Reply-To: <b5a0d45a-b589-46b3-89c9-8387adba740d@HIDDEN>
References: <b5a0d45a-b589-46b3-89c9-8387adba740d@HIDDEN>
User-Agent: mu4e 1.12.11; emacs 31.0.50
Date: Thu, 19 Jun 2025 10:56:28 +0200
Message-ID: <877c18xg77.fsf@HIDDEN>
MIME-Version: 1.0
Content-Type: text/plain
Precedence: list
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>

Hi Yann,

Yann Dupont <yann.dupont@HIDDEN> writes:

> Hi everyone, the patch eab097c682ed31efd8668f46fce8de8f73b92849 causes sshd to now use /var/empty as a chroot directory.
> sshd expects /var/empty to belong to root and with reduced write permissions.
>
> Unfortunately, when the nslcd service is also present on the system, it creates a user whose home directory is also /var/empty, which
> in this case belongs to the nslcd user.
>
> In this case, sshd refuses to start.
>
> I think the patch eab097c682ed31efd8668f46fce8de8f73b92849 is correct, and that nslcd should be changed to create /var/empty
> with the directory property set to root. But I don't know if there are any side effects to worry about with nslcd ?
>
> (I think the relevant code is in : services/authentication.scm), in (define %nslcd-accounts)
>
> ...
>
> (home-directory "/var/empty")

Check activate-users+groups in (gnu build activation). It should've
adjusted directory permissions and ownership on /var/empty. There are
many more accounts having /var/empty as the home dir (e.g. guixbuilder,
guix-daemon accounts). Looks quite suspicious that in your case the dir
belongs to nslcd. Could you try to reconfigure the system and see if the
permissions get fixed?

Message sent to bug-guix@HIDDEN:

Subject: bug#78836: /var/empty permissions problems between sshd and nslcd
Resent-From: Sergey Trofimov <sarg@HIDDEN>
Original-Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
Resent-CC: bug-guix@HIDDEN
Resent-Date: Thu, 19 Jun 2025 11:20:03 +0000
Resent-Message-ID: <handler.78836.B78836.175033199623780 <at> debbugs.gnu.org>
Resent-Sender: help-debbugs@HIDDEN
To: Yann Dupont <yann.dupont@HIDDEN>
Cc: 78836 <at> debbugs.gnu.org
From: Sergey Trofimov <sarg@HIDDEN>
In-Reply-To: <3f4f9d28-cfda-4689-8fc4-963d4f6360ac@HIDDEN>
References: <b5a0d45a-b589-46b3-89c9-8387adba740d@HIDDEN>
 <877c18xg77.fsf@HIDDEN>
 <3f4f9d28-cfda-4689-8fc4-963d4f6360ac@HIDDEN>
User-Agent: mu4e 1.12.11; emacs 31.0.50
Date: Thu, 19 Jun 2025 13:19:42 +0200
Message-ID: <871prgx9kh.fsf@HIDDEN>
MIME-Version: 1.0
Content-Type: text/plain
Precedence: list
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>

Hi

Yann Dupont <yann.dupont@HIDDEN> writes:

> I don't know if this is relevant information, but we encounter this problem on disposable virtual machines, freshly generated by guix
> system image for one-time use, we don't reconfigure on these machines. Maybe this function is not called in this specific case?
>
> I'll see if a reconfigure changes things, , but it's going to take some time, as our templates are a bit complex and divided into
> several files that can't be found in /running/current-system/configuration.scm.

You could simply run /run/current-system/activate and check if it fixes permissions.

Last modified: Thu, 19 Jun 2025 11:30:02 UTC

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997 nCipher Corporation Ltd, 1994-97 Ian Jackson.