GNU bug report logs - #34494
proot-based non-root setup: refusing to run with elevated privileges (UID 0)

Previous Next

Full log

Message #11 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Florian Thevissen <mail <at> florian-thevissen.de>
To: Pjotr Prins <pjotr.public12 <at> thebird.nl>
Cc: bug-Guix <at> gnu.org
Subject: Re: bug#34494: proot-based non-root setup: refusing to run with
 elevated privileges (UID 0)
Date: Sat, 16 Feb 2019 10:04:03 +0100

[Message part 1 (text/plain, inline)]

Hi pjotr,

   Did you try something like

   proot -0 -b /proc -b /dev -b /etc -r . -b etc_guix/acl:/etc/guix/acl
   gnu/store/vir3l..-guix-0.x/bin/guix-daemon —disable-chroot

Yes, this doesn’t work - with or without the -0 flag.

   That used to work. But maybe no longer?

I tried the new guix binaries (0.16.0), and the ones that were recent 
when you wrote the guide (0.13.0), and proot has not, if I see 
correctly, significantly changed since then (v.5.1.0).

To me, this looks as if the setup on my particular system had something 
special to it that would lead guix to not behave correctly. Here’s a 
#guix chat-log, where Saone (at 00:25:29) comes to the same conclusion: 
https://gnunet.org/bot/log/guix/2017-09-21 .

For the record - this happens on an Debian 4.9.130-2 x86_64 system. I'll 
try this out on other systems/VMs today...



On 16/02/19 07:34, Pjotr Prins wrote:

> Did you try something like
>
> proot -0 -b /proc -b /dev -b /etc -r . -b etc_guix/acl:/etc/guix/acl gnu/store/vir3l..-guix-0.x/bin/guix-daemon --disable-chroot
>
> (note the extra -0 and chroot switches) and you should see on a guix package install.
>
> That used to work. But maybe no longer?
>
> On Fri, Feb 15, 2019 at 09:39:21PM +0100, Florian Thevissen wrote:
>>     Hi,
>>
>>     I am trying to get guix to run on a system where I do not have root
>>     access, following a guide by pjotrp involving proot, here:
>>     [1]https://github.com/pjotrp/guix-notes/blob/master/GUIX-NO-ROOT.org .
>>
>>     All guix operations that involve the script perform-download fail with
>>     the error:
>>
>>       guix perform-download: error: refusing to run with elevated
>>       privileges (UID 0)
>>
>>     I am not sure if this hints at a bug in guix itself, but a comment in
>>     the guix sources lets me assume so. It says in
>>     package-management.scm:355
>>
>>       “Note that scripts like ‘guix perform-download’ do not run as root
>>       (…)”
>>
>>     In my setup, following this guide, however, it apparently is run as
>>     root, and (assert-low-privileges) in the script perform-download.scm:89
>>     acts accordingly by signalling the error and exiting.
>>
>>     (By the way - running guix-daemon with proot root privileges fails
>>     (-0), and running it without (no -0) fails also.)
>>
>>     Now my question: why is perform-download run as root following pjotrs
>>     guide, and is there anything that can be done about it?
>>
>>     I am a bit at a loss here, being unfamiliar with the guix sources and
>>     overall system setup.
>>
>>     Looking forward to help, thanks,
>>
>>     Florian
>>     ​
>>
>> References
>>
>>     1. https://github.com/pjotrp/guix-notes/blob/master/GUIX-NO-ROOT.org

​

[Message part 2 (text/html, inline)]

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.