Subject: [bug#75810] [PATCH v4 06/14] daemon: Allow running as non-root with unprivileged user namespaces.

From: Maxim Cournoyer <[email-masked]>
Date: Tue, 04 Mar 2025 09:25:41 +0900

Hi Ludovic,

Ludovic Courtès <[email-masked]> writes:

[...]

>>> -        if (chown(chrootRootDir.c_str(), 0, buildUser.getGID()) == -1)
>>> +        if (buildUser.enabled() && chown(chrootRootDir.c_str(), 0, buildUser.getGID()) == -1)
>
>> I think adding the new check for buildUser.enabled() in the above ifs
>> should be split into a distinct commit since it's not relevant to this
>> specific new feature.
>
> It’s in fact related: previously you could not run guix-daemon with
> useChroot == true unless running as root, and buildUser.enabled() was
> implied in this case.
>
> With this change, you can end up in the “if (useChroot)” block without
> running as root, which is why this distinction needs to be made.

Oh, I see (and for the other instance as well).  Thanks for explaining!

Reviewed-by: Maxim Cournoyer <maxim.cournoyer@gmail>

-- 
Thanks,
Maxim