From unknown Fri Jun 20 07:21:52 2025 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Mailer: MIME-tools 5.509 (Entity 5.509) Content-Type: text/plain; charset=utf-8 From: bug#68387 <68387@debbugs.gnu.org> To: bug#68387 <68387@debbugs.gnu.org> Subject: Status: guix shell --container --share=/etc overrides shadow files Reply-To: bug#68387 <68387@debbugs.gnu.org> Date: Fri, 20 Jun 2025 14:21:52 +0000 retitle 68387 guix shell --container --share=3D/etc overrides shadow files reassign 68387 guix submitter 68387 Christina O'Donnell severity 68387 normal thanks From debbugs-submit-bounces@debbugs.gnu.org Thu Jan 11 10:08:53 2024 Received: (at submit) by debbugs.gnu.org; 11 Jan 2024 15:08:54 +0000 Received: from localhost ([127.0.0.1]:33591 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1rNwfs-0001ya-P1 for submit@debbugs.gnu.org; Thu, 11 Jan 2024 10:08:53 -0500 Received: from lists.gnu.org ([2001:470:142::17]:38272) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1rNvlb-0005zx-OL for submit@debbugs.gnu.org; Thu, 11 Jan 2024 09:10:47 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1rNvlY-0007hB-81 for bug-guix@gnu.org; Thu, 11 Jan 2024 09:10:40 -0500 Received: from vmi993448.contaboserver.net ([194.163.141.236] helo=mutix.org) by eggs.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1rNvlW-00031s-2V for bug-guix@gnu.org; Thu, 11 Jan 2024 09:10:40 -0500 Received: from [192.168.1.81] (host86-132-246-87.range86-132.btcentralplus.com [86.132.246.87]) (Authenticated sender: cdo) by mutix.org (Postfix) with ESMTPSA id 30CB1A6320E for ; Thu, 11 Jan 2024 15:10:34 +0100 (CET) Message-ID: Date: Thu, 11 Jan 2024 14:10:33 +0000 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.15.0 From: Christina O'Donnell Subject: guix shell --container --share=/etc overrides shadow files To: bug-guix@gnu.org Content-Language: en-US Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Received-SPF: pass client-ip=194.163.141.236; envelope-from=cdo@mutix.org; helo=mutix.org X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-Spam-Score: 1.0 (+) X-Debbugs-Envelope-To: submit X-Mailman-Approved-At: Thu, 11 Jan 2024 10:08:51 -0500 X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -0.0 (/) Hi Guix, Running the below command as root overrides the running system's shadow files (/etc/shadow, /etc/passwd, and /etc/group). WARNING: Don't run the following outside of a VM!   guix shell --container --share=/etc This erases the current user from the passwd database, meaning `su` and `sudo` no longer work, and you can't log in. Discussion The context is that I was tracking down a libreoffice bug using guix time-machine and ran the very clever command trying to get the display working.   sudo guix time-machine ... -- environment -C --ad-hoc coreutils sway \     --preserve='DISPLAY' --preserve='XDG' --share=/etc -- sway Now of course if you write random commands with sudo, you should expect to brick your system from time to time. And setting `--share=/etc` wasn't particularly smart idea. However, it would have been nice to not have that wipe my shadow files. For example, being warned about sharing /etc with a container. To reproduce, run the Guix command in a basic VM image, connecting to Guix daemon on the host.[1] Please let me know if you have any questions! Kind regards,  - Christina O'Donnell https://mutix.org/ --- [1] See my blog for more details: https://mutix.org/pages/blog/20240109-how-to-run-guix-in-vm.html