guix-install.sh does not add build users to kvm group

Done

Details

3 participants

Leo Famulari
Ludovic Courtès
Marius Bakke

Owner: unassigned

Submitted by: Marius Bakke

Severity: important

Marius Bakke wrote on 29 Jun 2020 22:01

Recipients:(address . bug-guix@gnu.org)

Message-ID:875zb91w0d.fsf@gnu.org

Hello,

guix-install.sh should add the build users to the 'kvm' group if present

so that commands that require use of KVM can succeed.

Ludovic Courtès wrote on 1 Apr 2021 15:21

control message for bug #42129

Recipients:(address . control@debbugs.gnu.org)

Message-ID:87eefu87jc.fsf@gnu.org

severity 42129 important

quit

Ludovic Courtès wrote on 2 Apr 2021 09:46

Recipients:(address . control@debbugs.gnu.org)

Message-ID:8735w93z94.fsf@gnu.org

tags 42129 + easy

quit

Ludovic Courtès wrote on 2 Apr 2021 09:46

control message for bug #47297

Recipients:(address . control@debbugs.gnu.org)

Message-ID:87zgyh2kny.fsf@gnu.org

block 47297 by 42129

quit

Leo Famulari wrote on 9 Apr 2021 00:38

Re: bug#42129: guix-install.sh does not add build users to kvm group

Recipients:(name . Marius Bakke)(address . marius@gnu.org)(address . 42129@debbugs.gnu.org)

Message-ID:YG+GA/0KSRuqnbM2@jasmine.lan

On Mon, Jun 29, 2020 at 10:01:54PM +0200, Marius Bakke wrote:

Toggle quote (3 lines)

> guix-install.sh should add the build users to the 'kvm' group if present

> so that commands that require use of KVM can succeed.

Here is a patch (untested) that makes sure a 'kvm' group exists and adds

it to the guixbuilders' groups.

From 929102f7b52d00f731a9f61fb2fe32bad441f1dd Mon Sep 17 00:00:00 2001
From: Leo Famulari <leo@famulari.name>
Date: Thu, 8 Apr 2021 18:34:43 -0400
Subject: [PATCH] guix-install.sh: Add the build users to the 'kvm' group.

* etc/guix-install.sh (sys_create_build_user): Ensure that a 'kvm' group exists,
and add it to the guixbuilders' lists of supplementary groups.
---
 etc/guix-install.sh | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

Toggle diff (31 lines)diff --git a/etc/guix-install.sh b/etc/guix-install.sh
index c84e7b7577..15fa44f1e2 100755
--- a/etc/guix-install.sh
+++ b/etc/guix-install.sh
@@ -330,15 +330,22 @@ sys_create_build_user()
         _msg "${PAS}group <guixbuild> created"
     fi
 
+    if [ $(getent group kvm) ]; then
+        _msg "${INF}group kvm exists"
+    else
+        groupadd --system kvm
+        _msg "${PAS}group <kvm> created"
+    fi
+
     for i in $(seq -w 1 10); do
         if id "guixbuilder${i}" &>/dev/null; then
             _msg "${INF}user is already in the system, reset"
-            usermod -g guixbuild -G guixbuild           \
+            usermod -g guixbuild -G guixbuild,kvm       \
                     -d /var/empty -s "$(which nologin)" \
                     -c "Guix build user $i"             \
                     "guixbuilder${i}";
         else
-            useradd -g guixbuild -G guixbuild           \
+            useradd -g guixbuild -G guixbuild,kvm       \
                     -d /var/empty -s "$(which nologin)" \
                     -c "Guix build user $i" --system    \
                     "guixbuilder${i}";
-- 
2.31.1

Leo Famulari wrote on 9 Apr 2021 01:03

Recipients:(name . Marius Bakke)(address . marius@gnu.org)(address . 42129@debbugs.gnu.org)

Message-ID:YG+LvpQrqF0icNPd@jasmine.lan

On Thu, Apr 08, 2021 at 06:38:59PM -0400, Leo Famulari wrote:

Toggle quote (7 lines)

> On Mon, Jun 29, 2020 at 10:01:54PM +0200, Marius Bakke wrote:

> > guix-install.sh should add the build users to the 'kvm' group if present

> > so that commands that require use of KVM can succeed.

> Here is a patch (untested) that makes sure a 'kvm' group exists and adds

> it to the guixbuilders' groups.

I realized that you specified that the build users should be added to

the kvm group 'if' it is present. So, here is a revised patch.

From 1a9fd7decd843f21c36d8ec4d1e218f478b983cf Mon Sep 17 00:00:00 2001
From: Leo Famulari <leo@famulari.name>
Date: Thu, 8 Apr 2021 18:34:43 -0400
Subject: [PATCH v2] guix-install.sh: Add the build users to the 'kvm' group.

* etc/guix-install.sh (sys_create_build_user): If a 'kvm' group exists,
add it to the guixbuilders' lists of supplementary groups.
---
 etc/guix-install.sh | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

Toggle diff (29 lines)diff --git a/etc/guix-install.sh b/etc/guix-install.sh
index c84e7b7577..f3fcbf5d05 100755
--- a/etc/guix-install.sh
+++ b/etc/guix-install.sh
@@ -330,15 +330,20 @@ sys_create_build_user()
         _msg "${PAS}group <guixbuild> created"
     fi
 
+    if [ $(getent group kvm) ]; then
+        _msg "${INF}group kvm exists and build users will be added to it"
+	local KVMGROUP=,kvm
+    fi
+
     for i in $(seq -w 1 10); do
         if id "guixbuilder${i}" &>/dev/null; then
             _msg "${INF}user is already in the system, reset"
-            usermod -g guixbuild -G guixbuild           \
+            usermod -g guixbuild -G guixbuild{$KVMGROUP}     \
                     -d /var/empty -s "$(which nologin)" \
                     -c "Guix build user $i"             \
                     "guixbuilder${i}";
         else
-            useradd -g guixbuild -G guixbuild           \
+            useradd -g guixbuild -G guixbuild{$KVMGROUP}     \
                     -d /var/empty -s "$(which nologin)" \
                     -c "Guix build user $i" --system    \
                     "guixbuilder${i}";
-- 
2.31.1

Leo Famulari wrote on 14 Apr 2021 21:33

Recipients:(name . Marius Bakke)(address . marius@gnu.org)(address . 42129-done@debbugs.gnu.org)

Message-ID:YHdDmkj2OHpBWNEP@jasmine.lan

On Thu, Apr 08, 2021 at 07:03:26PM -0400, Leo Famulari wrote:

Toggle quote (8 lines)

> From 1a9fd7decd843f21c36d8ec4d1e218f478b983cf Mon Sep 17 00:00:00 2001

> From: Leo Famulari <leo@famulari.name>

> Date: Thu, 8 Apr 2021 18:34:43 -0400

> Subject: [PATCH v2] guix-install.sh: Add the build users to the 'kvm' group.

> * etc/guix-install.sh (sys_create_build_user): If a 'kvm' group exists,

> add it to the guixbuilders' lists of supplementary groups.

I tested, fixed bugs, and pushed as 8e214c53a48a841887a59f24a20e7392b5e59b55

Closed

Your comment

This issue is archived.

To comment on this conversation send an email to 42129@debbugs.gnu.org

To respond to this issue using the mumi CLI, first switch to it

mumi current 42129

Then, you may apply the latest patchset in this issue (with sign off)

mumi am -- -s

Or, compose a reply to this issue

mumi compose

Or, send patches to this issue

mumi send-email *.patch

is:open	open issues
is:done	closed issues
submitter:<who>	search issue submitter
author:<who>	search by message author
date:yesterday..now	search by issue date
mdate:3m..2d	search by message date