From unknown Fri Jun 13 10:11:53 2025 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Mailer: MIME-tools 5.509 (Entity 5.509) Content-Type: text/plain; charset=utf-8 From: bug#49814 <49814@debbugs.gnu.org> To: bug#49814 <49814@debbugs.gnu.org> Subject: Status: [PATCH] accounts: Add . Reply-To: bug#49814 <49814@debbugs.gnu.org> Date: Fri, 13 Jun 2025 17:11:53 +0000 retitle 49814 [PATCH] accounts: Add . reassign 49814 guix-patches submitter 49814 Brice Waegeneire severity 49814 normal tag 49814 patch thanks From debbugs-submit-bounces@debbugs.gnu.org Sun Aug 01 17:24:25 2021 Received: (at submit) by debbugs.gnu.org; 1 Aug 2021 21:24:25 +0000 Received: from localhost ([127.0.0.1]:37132 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1mAIwa-0006LY-Tq for submit@debbugs.gnu.org; Sun, 01 Aug 2021 17:24:25 -0400 Received: from lists.gnu.org ([209.51.188.17]:51164) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1mAIwY-0006LQ-T7 for submit@debbugs.gnu.org; Sun, 01 Aug 2021 17:24:23 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:46694) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1mAIwY-00037W-Me for guix-patches@gnu.org; Sun, 01 Aug 2021 17:24:22 -0400 Received: from relay10.mail.gandi.net ([217.70.178.230]:33033) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1mAIwW-0001bW-9G for guix-patches@gnu.org; Sun, 01 Aug 2021 17:24:22 -0400 Received: (Authenticated sender: brice@waegenei.re) by relay10.mail.gandi.net (Postfix) with ESMTPSA id 3F375240003 for ; Sun, 1 Aug 2021 21:24:15 +0000 (UTC) From: Brice Waegeneire To: guix-patches@gnu.org Subject: [PATCH] accounts: Add . Date: Sun, 1 Aug 2021 23:24:13 +0200 Message-Id: <20210801212413.8906-1-brice@waegenei.re> X-Mailer: git-send-email 2.32.0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Received-SPF: pass client-ip=217.70.178.230; envelope-from=brice@waegenei.re; helo=relay10.mail.gandi.net X-Spam_score_int: -25 X-Spam_score: -2.6 X-Spam_bar: -- X-Spam_report: (-2.6 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-Spam-Score: -1.7 (-) X-Debbugs-Envelope-To: submit X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -2.7 (--) Support adding supplementary groups to defined users by extending 'account-service-type'. * gnu/system/accounts.scm (group-membership): New record. (additional-group-members): New procedure. * gnu/system/shadow.scm (group-memberships->users-groups): New procedure. (account-activation accounts+groups): Add additional group memberships to the defined users. --- gnu/system/accounts.scm | 19 +++++++++++++++++++ gnu/system/shadow.scm | 30 +++++++++++++++++++++++++++++- 2 files changed, 48 insertions(+), 1 deletion(-) As I was answerd on IRC, it's already possible to add groups to an already defined 'operating-system' by modifying it's 'user' field. However this isn't that practical in my point of view. I would prefer to do such change from a service to be able to keep a potential new group and its members in proximity in the code. For example when adding a sgid dumpcap binary to be used by the wireshark group members, it makes sense to keep the membership of that group close to the definition of the new group and its sgid binary: --8<---------------cut here---------------start------------->8--- (simple-service 'wireshark-account account-service-type (list (user-group (name "wireshark") (system? #t)) (additional-group-members "wireshark" %sysadmins))) (simple-service 'wireshark-dumpcap setuid-program-service-type (list (setuid-program (program (file-append wireshark "/bin/dumpcap")) (setuid? #f) (setgid? #t) (group "wireshark")))) --8<---------------cut here---------------end--------------->8--- This patch add a new record to be used as as some of the values for the 'account-service-type' which already support 3 other different types. diff --git a/gnu/system/accounts.scm b/gnu/system/accounts.scm index 586cff1842..c12f5644d0 100644 --- a/gnu/system/accounts.scm +++ b/gnu/system/accounts.scm @@ -1,5 +1,6 @@ ;;; GNU Guix --- Functional package management for GNU ;;; Copyright © 2013, 2014, 2015, 2016, 2017, 2018, 2019 Ludovic Courtès +;;; Copyright © 2021 Brice Waegeneire ;;; ;;; This file is part of GNU Guix. ;;; @@ -39,6 +40,12 @@ user-group-id user-group-system? + group-membership + group-membership? + group-membership-name + group-membership-additional-members + additional-group-members + sexp->user-account sexp->user-group @@ -85,6 +92,12 @@ (system? user-group-system? ; Boolean (default #f))) +(define-record-type* + group-membership make-group-membership + group-membership? + (name group-membership-name) ; string + (additional-members group-membership-additional-members)) ; list of strings + (define (default-home-directory account) "Return the default home directory for ACCOUNT." (string-append "/home/" (user-account-name account))) @@ -112,3 +125,9 @@ user-account record." (create-home-directory? create-home-directory?) (shell shell) (password password) (system? system?))))) + +(define (additional-group-members group members) + "Return a object with name GROUPS and additional +MEMEBERS." + (group-membership (name group) + (additional-members members))) diff --git a/gnu/system/shadow.scm b/gnu/system/shadow.scm index 7c57222716..273c1f6d87 100644 --- a/gnu/system/shadow.scm +++ b/gnu/system/shadow.scm @@ -3,6 +3,7 @@ ;;; Copyright © 2016 Alex Griffin ;;; Copyright © 2020 Jan (janneke) Nieuwenhuizen ;;; Copyright © 2020 Efraim Flashner +;;; Copyright © 2021 Brice Waegeneire ;;; ;;; This file is part of GNU Guix. ;;; @@ -316,12 +317,39 @@ of user '~a' is undeclared") #$(user-account-password account) #$(user-account-system? account))) +(define (group-memberships->users-groups groups-memberships) + "Turn GROUP-MEMBERSHIPS, a list of object, into an alist +of users with additional group membership." + (let ((users (delete-duplicates (append-map group-membership-additional-members + groups-memberships)))) + (map (lambda (user) + (cons user + (filter-map + (lambda (group) + (and (member user (group-membership-additional-members group)) + (group-membership-name group))) + groups-memberships))) + users))) + (define (account-activation accounts+groups) "Return a gexp that activates ACCOUNTS+GROUPS, a list of and objects. Raise an error if a user account refers to a undefined group." + (define users-additional-groups + (group-memberships->users-groups (filter group-membership? accounts+groups))) + (define accounts - (delete-duplicates (filter user-account? accounts+groups) eq?)) + (map (lambda (user) + (let ((additional-groups (assoc-ref users-additional-groups + (user-account-name user)))) + (if additional-groups + (user-account + (inherit user) + (supplementary-groups + (delete-duplicates (append (user-account-supplementary-groups user) + additional-groups)))) + user))) + (delete-duplicates (filter user-account? accounts+groups) eq?))) (define user-specs (map user-account->gexp accounts)) -- 2.32.0 From debbugs-submit-bounces@debbugs.gnu.org Tue Aug 10 09:06:23 2021 Received: (at 49814) by debbugs.gnu.org; 10 Aug 2021 13:06:23 +0000 Received: from localhost ([127.0.0.1]:58705 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1mDRSZ-0005wZ-1t for submit@debbugs.gnu.org; Tue, 10 Aug 2021 09:06:23 -0400 Received: from eggs.gnu.org ([209.51.188.92]:54702) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1mDRSX-0005wL-Jl for 49814@debbugs.gnu.org; Tue, 10 Aug 2021 09:06:22 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:48322) by eggs.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1mDRSR-0001DW-II; Tue, 10 Aug 2021 09:06:15 -0400 Received: from [2001:660:6102:320:e120:2c8f:8909:cdfe] (port=45058 helo=ribbon) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1mDRSR-0006fh-9i; Tue, 10 Aug 2021 09:06:15 -0400 From: =?utf-8?Q?Ludovic_Court=C3=A8s?= To: Brice Waegeneire Subject: Re: bug#49814: [PATCH] accounts: Add . References: <20210801212413.8906-1-brice@waegenei.re> Date: Tue, 10 Aug 2021 15:06:13 +0200 In-Reply-To: <20210801212413.8906-1-brice@waegenei.re> (Brice Waegeneire's message of "Sun, 1 Aug 2021 23:24:13 +0200") Message-ID: <871r71sb3u.fsf@gnu.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.2 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Spam-Score: -2.3 (--) X-Debbugs-Envelope-To: 49814 Cc: 49814@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) Hello, Brice Waegeneire skribis: > As I was answerd on IRC, it's already possible to add groups to an already > defined 'operating-system' by modifying it's 'user' field. However this = isn't > that practical in my point of view. > > I would prefer to do such change from a service to be able to keep a pote= ntial > new group and its members in proximity in the code. For example when add= ing a > sgid dumpcap binary to be used by the wireshark group members, it makes s= ense > to keep the membership of that group close to the definition of the new g= roup > and its sgid binary: > > (simple-service 'wireshark-account account-service-type > (list (user-group (name "wireshark") (system? #t)) > (additional-group-members "wireshark" %sysadmins))) > (simple-service 'wireshark-dumpcap setuid-program-service-type > (list (setuid-program > (program (file-append wireshark "/bin/dumpcap")) > (setuid? #f) > (setgid? #t) > (group "wireshark")))) I understand the desire to keep these things close to one another, but I must say I=E2=80=99m not convinced by this style. I would do that along th= ese lines: (define (extend-account-membership group accounts) ;; Make ACCOUNTS members of GROUP. (map (lambda (account) (user-account (inherit account) (supplementary-groups (cons group (user-account-supplementary-groups account))))) accounts)) (operating-system ;; =E2=80=A6 (users (extend-account-membership "wireshark" (list =E2=80=A6)))) WDYT? > This patch add a new record to be used as as some of t= he > values for the 'account-service-type' which already support 3 other diffe= rent > types. Any service could modify any other account using this, right? There might be cases where it=E2=80=99s nice to have such a sledgehammer, but it = has the downside that it makes it harder to reason about who does what in the OS config=E2=80=94pretty much like NixOS modules can touch anything any= where in the config. Thanks, Ludo=E2=80=99.