[PATCH 0/4] Ensure correct ownership of directory trees in services.Hello Guix,

  • Open
  • quality assurance status badge
Details
2 participants
  • Brice Waegeneire
  • Ludovic Courtès
Owner
unassigned
Submitted by
Brice Waegeneire
Severity
normal
Merged with
B
B
Brice Waegeneire wrote on 12 Dec 2021 19:28
(address . guix-patches@gnu.org)
87h7bdad9o.fsf@waegenei.re
Hello Guix,

A number of times I got hit by newly configured service not starting because
of wrong ownership for files they ought to own. This appear when
reconfiguring a operating system with a service that was unsed in the past,
but not present in previous generation. For example, this time, cuirass and
postgresql service wouldn't start because that system had them running before,
but a few weeks ago I reconfigured the operating system without them and now
that I want to have these services running again they won't start because the
activation scripts were only changing the ownership of the runtime, data, log
and co. directories but not their content. Concretely
/var/lib/postgresql/data/PG_VERSION (and others) wasn't owned by
postgresql:postgresql but by an other pair of UID/GID, however
/var/lib/postgresql had the correct ownership

This patch fix such UID/GID mismatch for the cuirass and postgresql service by
recusrivly changing the owner and group of the whole tree these services
need. And not just the root directories of theses trees. It is related to the issue
https://issues.guix.gnu.org/45571 about stable UID/GID in Guix's containers.

Cheers,
- Brice

Brice Waegeneire (4):
syscalls: Add 'lchown'.
activation: Add 'lchown-recursive'.
services: postgresql: Ensure correct ownership of directory trees.
services: cuirass: Ensure correct ownership of directory trees.

gnu/build/activation.scm | 22 ++++++++++++++++++++--
gnu/services/cuirass.scm | 18 +++++++++++-------
gnu/services/databases.scm | 14 +++++++++-----
guix/build/syscalls.scm | 16 ++++++++++++++++
4 files changed, 56 insertions(+), 14 deletions(-)


base-commit: 604880ae22e1a7662acb1d3f282242470de0cd03
--
2.34.0
B
B
Brice Waegeneire wrote on 12 Dec 2021 19:36
[PATCH 1/4] syscalls: Add 'lchown'.
(address . 52454@debbugs.gnu.org)
20211212183614.19730-1-brice@waegenei.re
* guix/build/syscalls.scm (lchown): New procedure.
---
guix/build/syscalls.scm | 16 ++++++++++++++++
1 file changed, 16 insertions(+)

Toggle diff (43 lines)
diff --git a/guix/build/syscalls.scm b/guix/build/syscalls.scm
index 63bd017d1d..1c432507c3 100644
--- a/guix/build/syscalls.scm
+++ b/guix/build/syscalls.scm
@@ -8,6 +8,7 @@
;;; Copyright © 2020 Jan (janneke) Nieuwenhuizen <janneke@gnu.org>
;;; Copyright © 2021 Chris Marusich <cmmarusich@gmail.com>
;;; Copyright © 2021 Tobias Geerinckx-Rice <me@tobias.gr>
+;;; Copyright © 2021 Brice Waegeneire <brice@waegenei.re>
;;;
;;; This file is part of GNU Guix.
;;;
@@ -118,6 +119,7 @@ (define-module (guix build syscalls)
scandir*
getxattr
setxattr
+ lchown
fcntl-flock
lock-file
@@ -1275,6 +1277,20 @@ (define* (scandir* name #:optional
(lambda ()
(closedir* directory)))))
+(define lchown
+ (let ((proc (syscall->procedure int "lchown" (list '* int int))))
+ (lambda (file owner group)
+ "As 'chown', change the ownership and group of the file referred to by
+FILE to the integer values OWNER and GROUP but doesn't dereference symbolic
+links. Unlike 'chown' this doesn't support port or integer file descriptor
+via 'fchown'."
+ (let-values (((ret err)
+ (proc (string->pointer file) owner group)))
+ (unless (zero? ret)
+ (throw 'system-error "lchown" "~S: ~A"
+ (list file (strerror err))
+ (list err)))))))
+
;;;
;;; Advisory file locking.
--
2.34.0
B
B
Brice Waegeneire wrote on 12 Dec 2021 19:36
[PATCH 3/4] services: postgresql: Ensure correct ownership of directory trees.
(address . 52454@debbugs.gnu.org)
20211212183614.19730-3-brice@waegenei.re
* gnu/services/databases.scm (postgresql-activation): Replace 'chown'
calls by 'lchown-recursive'.
---
gnu/services/databases.scm | 14 +++++++++-----
1 file changed, 9 insertions(+), 5 deletions(-)

Toggle diff (59 lines)
diff --git a/gnu/services/databases.scm b/gnu/services/databases.scm
index 8e983ef0be..83f9fe5239 100644
--- a/gnu/services/databases.scm
+++ b/gnu/services/databases.scm
@@ -8,6 +8,7 @@
;;; Copyright © 2019 Robert Vollmert <rob@vllmrt.net>
;;; Copyright © 2020 Marius Bakke <marius@gnu.org>
;;; Copyright © 2021 David Larsson <david.larsson@selfhosted.xyz>
+;;; Copyright © 2021 Brice Waegeneire <brice@waegenei.re>
;;;
;;; This file is part of GNU Guix.
;;;
@@ -214,8 +215,11 @@ (define postgresql-activation
(($ <postgresql-configuration> postgresql port locale config-file
log-directory data-directory
extension-packages)
- #~(begin
+ (with-imported-modules (source-module-closure
+ '((gnu build activation)))
+ #~(begin
(use-modules (guix build utils)
+ (gnu build activation)
(ice-9 match))
(let ((user (getpwnam "postgres"))
@@ -230,19 +234,19 @@ (define postgresql-activation
'()))))
;; Create db state directory.
(mkdir-p #$data-directory)
- (chown #$data-directory (passwd:uid user) (passwd:gid user))
+ (lchown-recursive #$data-directory (passwd:uid user) (passwd:gid user))
;; Create the socket directory.
(let ((socket-directory
#$(postgresql-config-file-socket-directory config-file)))
(when (string? socket-directory)
(mkdir-p socket-directory)
- (chown socket-directory (passwd:uid user) (passwd:gid user))))
+ (lchown-recursive socket-directory (passwd:uid user) (passwd:gid user))))
;; Create the log directory.
(when (string? #$log-directory)
(mkdir-p #$log-directory)
- (chown #$log-directory (passwd:uid user) (passwd:gid user)))
+ (lchown-recursive #$log-directory (passwd:uid user) (passwd:gid user)))
;; Drop privileges and init state directory in a new
;; process. Wait for it to finish before proceeding.
@@ -262,7 +266,7 @@ (define postgresql-activation
initdb-args)))
(lambda ()
(primitive-exit 1))))
- (pid (waitpid pid))))))))
+ (pid (waitpid pid)))))))))
(define postgresql-shepherd-service
(match-lambda
--
2.34.0
B
B
Brice Waegeneire wrote on 12 Dec 2021 19:36
[PATCH 2/4] activation: Add 'lchown-recursive'.
(address . 52454@debbugs.gnu.org)
20211212183614.19730-2-brice@waegenei.re
* gnu/build/activation.scm (lchown-recursive): New procedure.
---
gnu/build/activation.scm | 22 ++++++++++++++++++++--
1 file changed, 20 insertions(+), 2 deletions(-)

Toggle diff (49 lines)
diff --git a/gnu/build/activation.scm b/gnu/build/activation.scm
index 9f6126023c..79c835a045 100644
--- a/gnu/build/activation.scm
+++ b/gnu/build/activation.scm
@@ -30,7 +30,7 @@ (define-module (gnu build activation)
#:use-module (gnu build accounts)
#:use-module (gnu build linux-boot)
#:use-module (guix build utils)
- #:use-module ((guix build syscalls) #:select (with-file-lock))
+ #:use-module ((guix build syscalls) #:select (with-file-lock lchown))
#:use-module (ice-9 ftw)
#:use-module (ice-9 match)
#:use-module (ice-9 vlist)
@@ -46,7 +46,8 @@ (define-module (gnu build activation)
activate-firmware
activate-ptrace-attach
activate-current-system
- mkdir-p/perms))
+ mkdir-p/perms
+ lchown-recursive))
;;; Commentary:
;;;
@@ -105,6 +106,23 @@ (define (mkdir-p/perms directory owner bits)
(chown directory (passwd:uid owner) (passwd:gid owner))
(chmod directory bits))
+(define (lchown-recursive file owner group)
+ "As 'lchown' but recursively, change ownership of FILE to the integer values
+OWNER and GROUP without dereferencing symbolic links it encounter."
+ (nftw file
+ (lambda (filename statinfo flag base level)
+ (catch 'system-error
+ (lambda ()
+ (when (member flag '(regular directory symlink))
+ (lchown filename owner group)))
+ (lambda args
+ (format (current-error-port)
+ "warning: failed to chown ~s: ~a~%"
+ filename
+ (strerror (system-error-errno args)))))
+ #t)
+ 'physical))
+
(define* (copy-account-skeletons home
#:key
(directory %skeleton-directory)
--
2.34.0
B
B
Brice Waegeneire wrote on 12 Dec 2021 19:36
[PATCH 4/4] services: cuirass: Ensure correct ownership of directory trees.
(address . 52454@debbugs.gnu.org)
20211212183614.19730-4-brice@waegenei.re
* gnu/services/cuirass.scm (cuirass-activation): Replace 'chown'
calls by 'lchown-recursive'.
---
gnu/services/cuirass.scm | 18 +++++++++++-------
1 file changed, 11 insertions(+), 7 deletions(-)

Toggle diff (55 lines)
diff --git a/gnu/services/cuirass.scm b/gnu/services/cuirass.scm
index a69c20adb8..116c12063e 100644
--- a/gnu/services/cuirass.scm
+++ b/gnu/services/cuirass.scm
@@ -5,6 +5,7 @@
;;; Copyright © 2017 Jan Nieuwenhuizen <janneke@gnu.org>
;;; Copyright © 2018, 2019 Ricardo Wurmus <rekado@elephly.net>
;;; Copyright © 2018 Clément Lassieur <clement@lassieur.org>
+;;; Copyright © 2021 Brice Waegeneire <brice@waegenei.re>
;;;
;;; This file is part of GNU Guix.
;;;
@@ -24,6 +25,7 @@
(define-module (gnu services cuirass)
#:use-module (guix channels)
#:use-module (guix gexp)
+ #:use-module (guix modules)
#:use-module (guix records)
#:use-module (guix store)
#:use-module (guix utils)
@@ -278,9 +280,11 @@ (define (cuirass-activation config)
(profile (string-append "/var/guix/profiles/per-user/" user))
(roots (string-append profile "/cuirass"))
(group (cuirass-configuration-group config)))
- (with-imported-modules '((guix build utils))
+ (with-imported-modules (source-module-closure
+ '((gnu build activation)))
#~(begin
- (use-modules (guix build utils))
+ (use-modules (guix build utils)
+ (gnu build activation))
(mkdir-p #$cache)
(mkdir-p #$log)
@@ -291,13 +295,13 @@ (define (cuirass-activation config)
(let ((uid (passwd:uid (getpw #$user)))
(gid (group:gid (getgr #$group))))
- (chown #$cache uid gid)
- (chown #$log uid gid)
- (chown #$roots uid gid)
- (chown #$profile uid gid)
+ (lchown-recursive #$cache uid gid)
+ (lchown-recursive #$log uid gid)
+ (lchown-recursive #$profile uid gid)
+ (lchown-recursive (passwd:dir (getpw #$user)) uid gid)
(when #$remote-cache
- (chown #$remote-cache uid gid)))))))
+ (lchown-recursive #$remote-cache uid gid)))))))
(define (cuirass-log-rotations config)
"Return the list of log rotations that corresponds to CONFIG."
--
2.34.0
L
L
Ludovic Courtès wrote on 18 Dec 2021 22:34
Re: bug#52454: [PATCH 0/4] Ensure correct ownership of directory trees in services.Hello Guix,
(name . Brice Waegeneire)(address . brice@waegenei.re)(address . 52454@debbugs.gnu.org)
87zgoxmway.fsf_-_@gnu.org
Hi!

Great patch series!

This has been discussed a few times: I wonder if we should simply chown
service home directories systematically?

Brice Waegeneire <brice@waegenei.re> skribis:

Toggle quote (2 lines)
> * guix/build/syscalls.scm (lchown): New procedure.

Would be nice to add even trivial tests to tests/syscalls.scm.

Unfortunately, this doesn’t work for service activation because when
booting, activation snippets are run from the initrd’s Guile, which is
statically linked and lacks dlopen.

This leads to failures like:

Toggle snippet (18 lines)
$ make check-system TESTS="postgresql" -j4

[...]

populating /etc from /gnu/store/bchxln4wkfmdbsxww9jaxafsyvlpdbmg-etc...
Please wait while gathering entropy to generate the key pair;
this may take time...
warning: failed to chown "/var/lib/postgresql/data": Function not implemented
warning: failed to chown "/var/run/postgresql": Function not implemented
warning: failed to chown "/var/log/postgresql": Function not implemented
The files belonging to this database system will be owned by user "postgres".
This user must also own the server process.

[...]

fixing permissions on existing directory /var/lib/postgresql/data ... initdb: could not change permissions of directory "/var/lib/postgresql/data": Operation not permitted

(The ENOSYS error above comes from the ‘lchown’ wrapper.)

For this strategy to work, you need to add ‘lchown’ in
‘guile-3.0-linux-syscalls.patch’ and to use ‘define-as-needed’ in (guix
build syscalls).

(I’m surprised we didn’t already have recursive chown.)

With this in place, we should be all set!

Thanks,
Ludo’.
B
B
Brice Waegeneire wrote on 21 Dec 2021 20:30
[PATCH v2 0/4] Ensure correct ownership of directory trees in services
(name . Ludovic Courtès)(address . ludo@gnu.org)(address . 52454@debbugs.gnu.org)
8735mleoxo.fsf_-_@waegenei.re
Hello Ludo’,

Here is a second version of the patch set.

Ludovic Courtès <ludo@gnu.org> writes:

Toggle quote (5 lines)
> [...]
>
> This has been discussed a few times: I wonder if we should simply chown
> service home directories systematically?

#45571¹ is one of such discussion. For services' home, I guess that's what we
should do, but it probably won't be sufficient as log or chache directories
usualy aren't in a home, but still need to chowned. The easiest and probably
least controversion would be to just replace current `chown` calls on
directories by `lchown-recursive`.

Seeing that we don't want static UID/GID mapping, like most other distros do, we
could try to implement something like systemd's dynamic users² approch.

Toggle quote (6 lines)
> Brice Waegeneire <brice@waegenei.re> skribis:
>
>> * guix/build/syscalls.scm (lchown): New procedure.
>
> Would be nice to add even trivial tests to tests/syscalls.scm.

I wrote 4 tests, however the last two, the ones actually testing 'lchown' fail
bescause "/tmp" has it's sticky bit set, which prevent changing ownership of
files there. I tried to workaround this but didn't managed to.

Toggle quote (10 lines)
> Unfortunately, this doesn’t work for service activation because when
> booting, activation snippets are run from the initrd’s Guile, which is
> statically linked and lacks dlopen.
>
> [...]
>
> For this strategy to work, you need to add ‘lchown’ in
> ‘guile-3.0-linux-syscalls.patch’ and to use ‘define-as-needed’ in (guix
> build syscalls).

Done and it fixes the check system for postgresql service.


Cheers,
- Brice

Brice Waegeneire (4):
syscalls: Add 'lchown'.
activation: Add 'lchown-recursive'.
services: postgresql: Ensure correct ownership of directory trees.
services: cuirass: Ensure correct ownership of directory trees.

gnu/build/activation.scm | 20 +++++-
.../patches/guile-3.0-linux-syscalls.patch | 33 ++++++++++
gnu/services/cuirass.scm | 18 +++---
gnu/services/databases.scm | 14 +++--
guix/build/syscalls.scm | 16 +++++
tests/syscalls.scm | 62 +++++++++++++++++++
6 files changed, 150 insertions(+), 13 deletions(-)


base-commit: 87e5502d406bfb44b61f7577b241602e02a3498e
--
2.34.0
B
B
Brice Waegeneire wrote on 21 Dec 2021 21:10
control message for bug #52715
(address . control@debbugs.gnu.org)
E1mzlTE-00081s-ML@debbugs.gnu.org
merge 52715 52454
quit
B
B
Brice Waegeneire wrote on 21 Dec 2021 21:10
control message for bug #52714
(address . control@debbugs.gnu.org)
E1mzlTO-00082G-Rt@debbugs.gnu.org
merge 52714 52454
quit
B
B
Brice Waegeneire wrote on 21 Dec 2021 21:10
control message for bug #52713
(address . control@debbugs.gnu.org)
E1mzlTW-00083L-0S@debbugs.gnu.org
merge 52713 52454
quit
B
B
Brice Waegeneire wrote on 21 Dec 2021 21:11
control message for bug #52712
(address . control@debbugs.gnu.org)
E1mzlTe-00083g-5l@debbugs.gnu.org
merge 52712 52454
quit
?
Your comment

Commenting via the web interface is currently disabled.

To comment on this conversation send an email to 52454@debbugs.gnu.org

To respond to this issue using the mumi CLI, first switch to it
mumi current 52454
Then, you may apply the latest patchset in this issue (with sign off)
mumi am -- -s
Or, compose a reply to this issue
mumi compose
Or, send patches to this issue
mumi send-email *.patch