Subject: bug#71352: closed (Re: bug#71352: branch master updated: services: nix: Mount Nix store read only.)

From: [email-masked] (GNU bug Tracking System)
Date: Mon, 24 Jun 2024 02:49:02 +0000

Your bug report

#71352: branch master updated: services: nix: Mount Nix store read only.

which was filed against the guix package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
71352: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=71352
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#71352: branch master updated: services: nix: Mount Nix store read only.
From: Maxim Cournoyer <[email-masked]>
To: Oleg Pykhalov <[email-masked]>
Cc: [email-masked]
Date: Sun, 23 Jun 2024 22:47:33 -0400
List-Id: <debbugs-submit.debbugs.gnu.org>

Hi Oleg,

Maxim Cournoyer <[email-masked]> writes:

> Hi Oleg,
>
> [...]
>
>>> Are these chown still useful in the activation snippet?
>>>
>>> (define (nix-activation _)
>>>   ;; Return the activation gexp.
>>>   #~(begin
>>>       (use-modules (guix build utils)
>>>                    (srfi srfi-26))
>>>       (for-each (cut mkdir-p <>) '("/nix/store" "/nix/var/log"
>>>                                    "/nix/var/nix/gcroots/per-user"
>>>                                    "/nix/var/nix/profiles/per-user"))
>>>       (chown "/nix/store"
>>>              (passwd:uid (getpw "root")) (group:gid (getpw "nixbld01")))
>>>       (chmod "/nix/store" #o775)
>>>       (for-each (cut chmod <> #o777) '("/nix/var/nix/profiles"
>>>                                        "/nix/var/nix/profiles/per-user"))))
>>>
>>> If they are useful only on the first time, perhaps we could catch the
>>> exceptions for when it runs on an already read-only mounted /nix/store?
>>
>> Indeed, it is a good idea.
>>
>> A hotfix for the issue was discussed and implemented. It has already
>> been pushed to the master branch. The fix involves a simple
>> 'file-exists?' check. You can find more details in the discussion at
>> https://debbugs.gnu.org/cgi/bugreport.cgi?bug=71320
>>
>> What do you think is preferable in this scenario – catching exceptions
>> or sticking with '(unless (file-exists? ...))'?  Your thoughts on the
>> best approach here?
>
> Exceptions are usually better than 'check then do' as they avoid the
> TOCTTOU (time-of-check to time-of-use) class of bugs/vulnerabilities.

I'm closing this for now; I'm satisfied that working order has been
restored :-).

-- 
Thanks,
Maxim

Subject: Re: branch master updated: services: nix: Mount Nix store read only.
From: Maxim Cournoyer <[email-masked]>
To: bug-guix <[email-masked]>
Cc: Oleg Pykhalov <[email-masked]>
Date: Mon, 03 Jun 2024 22:34:35 -0400
List-Id: <debbugs-submit.debbugs.gnu.org>

Hello,

[email-masked] writes:

>     services: nix: Mount Nix store read only.
>     
>     * gnu/services/nix.scm (nix-shepherd-service): Add requirements.
>     (%nix-store-directory): New variable.
>     (nix-service-type): Add file-system-service-type extension.
>     
>     Change-Id: I18a5d58c92c1f2b5b6dcecc3d5b439cc15bf4e49

This commit unfortunately appears to introduce a regression where
reconfiguring a system with the read-only /nix/store causes the
following error:

--8<---------------cut here---------------start------------->8---
guix system: error: chown: Système de fichiers accessible en lecture seulement
--8<---------------cut here---------------end--------------->8---

With the accompanying strace output:

--8<---------------cut here---------------start------------->8---
20261 close(17)                         = 0
20261 chown("/nix/store", 0, 981)       = -1 EROFS (Système de fichiers accessible en lecture seulement)
20261 close(13)                         = 0
20261 write(2, "guix system: \33[1;31merror: \33[0m\33[1mchown\33[0m: Syst\303\250me de fichiers accessible en lecture seulement\n", 99) = 99
--8<---------------cut here---------------end--------------->8---

Are these chown still useful in the activation snippet?

--8<---------------cut here---------------start------------->8---
(define (nix-activation _)
  ;; Return the activation gexp.
  #~(begin
      (use-modules (guix build utils)
                   (srfi srfi-26))
      (for-each (cut mkdir-p <>) '("/nix/store" "/nix/var/log"
                                   "/nix/var/nix/gcroots/per-user"
                                   "/nix/var/nix/profiles/per-user"))
      (chown "/nix/store"
             (passwd:uid (getpw "root")) (group:gid (getpw "nixbld01")))
      (chmod "/nix/store" #o775)
      (for-each (cut chmod <> #o777) '("/nix/var/nix/profiles"
                                       "/nix/var/nix/profiles/per-user"))))
--8<---------------cut here---------------end--------------->8---

If they are useful only on the first time, perhaps we could catch the
exceptions for when it runs on an already read-only mounted /nix/store?

-- 
Thanks,
Maxim