enhancement: Link guix system and guix home

  • Open
  • quality assurance status badge
Details
3 participants
  • Andrew Tropin
  • Maxime Devos
  • Dale Mellor
Owner
unassigned
Submitted by
Dale Mellor
Severity
normal
D
D
Dale Mellor wrote on 20 Jul 2022 12:47
(address . bug-guix@gnu.org)
63960cf762aec1ed2c4182f49cac66bc37fce2aa.camel@rdmp.org
I would like to be able to create a rescue disk for my system in which
the admin user's home directory contains a copy of an encrypted key,
for manually unlocking encrypted disk drives.

Following a short discussion in IRC, it appears the best route to
achieve this would be to link *guix system* and *guix home* together,
so that the system configuration file can specify

(user-account
...
(configuration (local-file "my-home-config.scm")))

for example (it should be possible to use either (home-configuration)
or a file-like object here).

Hopefully this is an easy thing to accomplish, but I don't know...

Thanks,
Dale
A
A
Andrew Tropin wrote on 20 Jul 2022 19:57
(name . Tissevert)(address . tissevert+guix@marvid.fr)
87o7xjbrb1.fsf@trop.in
On 2022-07-20 11:47, Dale Mellor wrote:

Toggle quote (18 lines)
> I would like to be able to create a rescue disk for my system in which
> the admin user's home directory contains a copy of an encrypted key,
> for manually unlocking encrypted disk drives.
>
> Following a short discussion in IRC, it appears the best route to
> achieve this would be to link *guix system* and *guix home* together,
> so that the system configuration file can specify
>
> (user-account
> ...
> (configuration (local-file "my-home-config.scm")))
>
> for example (it should be possible to use either (home-configuration)
> or a file-like object here).
>
> Hopefully this is an easy thing to accomplish, but I don't know...
>

Hi Dale,

it's not easy, but doable.

This topic popups from time to time, but this feature is not implemented
yet.


I have spare time tomorrow and can try to implement it, however Idk how
much time will it take and if I don't finish tomorrow, there is no
guarantee that I'll finish it anytime soon.

--
Best regards,
Andrew Tropin
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEKEGaxlA4dEDH6S/6IgjSCVjB3rAFAmLYQgIACgkQIgjSCVjB
3rDGBA/+OMJehwrn8ZYF226p0QJN0xufYvKYyf/+E36fNhyS3DQikSiUStEoulLu
UDxRmuJz0Hop3Echh5mghodPVg0OYTCUtz7xKTpyqfG4HcyGFYPUg6BYxosGOd5j
LehbhCt6SH72IjIT/Tic79z4h1prAqaMYs+b7gvKSRBarRpy407aj7oeaGC85UYT
1fWdSXYhupKg5Sz0CRX6n/eong9oCWZCLNbfflQrykUYOchcZk1XQwDargdncgHM
8tRycck4+F3j5kPMZsVNArToP3GiQ7zB4aaGMnH5QW6QxT420VMTPdJDxRFvTqRd
HkQj+1cVkYDeirgka2MDy7ogccOMOfHtFf6RHiIcscA0A+7q6L2TvCEGvsCI7NFV
+UncYeS40yx+byPK00fR57UHLfvoyE82aG35hcP/lCSBrPSXR8WLgWgZlxakbhRb
xitg/mvhd3RsHkFN3kbUvwkCrSix/GyQscL0la5Pq0kfgaPZbyt1CGSqKx+ETTPd
cRb8rdPuvPvSyht99coExZy7ygCyANx6W3G5idsVnYUMuRbYTV2SA2QLxuyN7M20
Ouj5NFD8lrzQNQKvOzQTol5YOZ3UQYgVznRs8tuMuh5MDjUXyAH9Oc05XzwzRmKt
vh4NKcdk3tu+N7kLRrKS2Opn2NUdViZqBevRt+Wqub4Ti8tN+u0=
=qmvK
-----END PGP SIGNATURE-----

A
A
Andrew Tropin wrote on 21 Jul 2022 19:13
(name . Tissevert)(address . tissevert+guix@marvid.fr)
87k086crtr.fsf@trop.in
On 2022-07-20 20:57, Andrew Tropin wrote:

Toggle quote (33 lines)
> On 2022-07-20 11:47, Dale Mellor wrote:
>
>> I would like to be able to create a rescue disk for my system in which
>> the admin user's home directory contains a copy of an encrypted key,
>> for manually unlocking encrypted disk drives.
>>
>> Following a short discussion in IRC, it appears the best route to
>> achieve this would be to link *guix system* and *guix home* together,
>> so that the system configuration file can specify
>>
>> (user-account
>> ...
>> (configuration (local-file "my-home-config.scm")))
>>
>> for example (it should be possible to use either (home-configuration)
>> or a file-like object here).
>>
>> Hopefully this is an easy thing to accomplish, but I don't know...
>>
>
> Hi Dale,
>
> it's not easy, but doable.
>
> This topic popups from time to time, but this feature is not implemented
> yet.
>
> https://yhetil.org/guix-devel/20220706112011.77c71a94@marvid.fr/
>
> I have spare time tomorrow and can try to implement it, however Idk how
> much time will it take and if I don't finish tomorrow, there is no
> guarantee that I'll finish it anytime soon.

I built home environment baked in operating system and sucessfully
deployed it with guix deploy. I face some issues with the similiar
setup on livecd, but I think I will figure out it soon and will publish
results in a few days.

The source code is here:

It's drafty and will be rewritten, also there are a few local commits
that I haven't sent to guix yet, but it should work without them if
elogind is enabled.

The usage example:
Attachment: config.scm
--
Best regards,
Andrew Tropin
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEKEGaxlA4dEDH6S/6IgjSCVjB3rAFAmLZiSAACgkQIgjSCVjB
3rDUSw/+ISbTIlRF7QVM00QHQte8HxnopjN2oTJCsILGaUZ3+esw5lLugGuIwzZv
CUn6zsEDTQqsz+WlnlJTdyjqwD2M67MZDRsGYhEG768xz8uDEOR3F06tcrekoOe1
kl2ZvQ1UsEGA7tDvAgux1FLLRFdQjyM/Wsch5HlykHc41sKkREWZqgV2Q+yF4+Wq
aJkNDVlK3v1+lxtOb0sLUnSSolgLnjXne3+8wTr13ALysMDQTmVjkFsmIPK610K5
qJA8U7FCL+cNGMZTE4d0EZyQjrv86Wa8vSPz7vTGORYkSwBwP1qhMpM6hbCq35CS
3KXyxGW4IpQkxApcmxsXT9lwIjcGy1jpp0CkoTEOaDV5hooOLMQ4PTVOqpxT/uNk
XWIqHYmhqCcDQ5FWzU9S+3Ls+6CYx8/vg3sS/Sbr8ayLlJoCo7o10v3jHet2b0zT
BsWzgCsmpdKCJEaeuyjLN91GehAg1HorH/uVTnyrRfubu/LjjRIwhdW5vvPHXdp8
gu0jQlpNJFufuIGsgQT3rKGBzqCyDdq2u3Y4AmvesMUHrI093Yj6CXL4Y1Uu5+Sj
u1ZllZUhpe5VJS0IpnDLGY/ZM37nY5qRYbGwOG1g7UsmX+K/b+y16BXq2oNEMx3I
ilASUQ71SElMB2DtcL/epwNQyxZgMv+CiVX0yAZvut+dmxxamms=
=oh01
-----END PGP SIGNATURE-----

M
M
Maxime Devos wrote on 21 Jul 2022 19:25
(name . Tissevert)(address . tissevert+guix@marvid.fr)
e9772bd4-f913-a22b-edbd-459c098e82f9@telenet.be
On 21-07-2022 19:13, Andrew Tropin wrote:
Toggle quote (2 lines)
> The source code is here:
> https://git.sr.ht/~abcdw/rde/commit/c5b4097ab99309ace23e40d957e9fa1f938f97e9
What's the 'guix-home-gc-roots' for? I would expect the reference
#$(file-append he "/activate") to be sufficient to keep things from
being gc'ed.
Toggle quote (13 lines)
> +
> <https://git.sr.ht/~abcdw/rde/commit/c5b4097ab99309ace23e40d957e9fa1f938f97e9#gnu/services/home.scm-1-23>
> (start #~(make-forkexec-constructor +
> <https://git.sr.ht/~abcdw/rde/commit/c5b4097ab99309ace23e40d957e9fa1f938f97e9#gnu/services/home.scm-1-24>
> '(#$(file-append he "/activate")) +
> <https://git.sr.ht/~abcdw/rde/commit/c5b4097ab99309ace23e40d957e9fa1f938f97e9#gnu/services/home.scm-1-25>
> #:user #$user +
> <https://git.sr.ht/~abcdw/rde/commit/c5b4097ab99309ace23e40d957e9fa1f938f97e9#gnu/services/home.scm-1-26>
> #:environment-variables +
> <https://git.sr.ht/~abcdw/rde/commit/c5b4097ab99309ace23e40d957e9fa1f938f97e9#gnu/services/home.scm-1-27>
> (list (string-append "HOME=" (passwd:dir (getpw #$user)))) +
> <https://git.sr.ht/~abcdw/rde/commit/c5b4097ab99309ace23e40d957e9fa1f938f97e9#gnu/services/home.scm-1-28>
> #:group (group:name (getgrgid (passwd:gid (getpw #$user))))))
I'm wondering if GUIX_LOCPATH is needed as well. Anyway, if not done
already internally by /activate, you could consider doing it in a
container to reduce potential irreproducibility, or insecurity on
multi-user systems (I'd assume the #:user + #:group to be sufficient for
security, especially if it appears sufficient for other system services,
but I'm not some expert on what things need to be set).
Toggle quote (7 lines)
> +
> <https://git.sr.ht/~abcdw/rde/commit/c5b4097ab99309ace23e40d957e9fa1f938f97e9#gnu/services/home.scm-1-20>
> (provision (list (symbol-append 'guix-home- (string->symbol user)))) +
> <https://git.sr.ht/~abcdw/rde/commit/c5b4097ab99309ace23e40d957e9fa1f938f97e9#gnu/services/home.scm-1-21>
> (one-shot? #t) +
> <https://git.sr.ht/~abcdw/rde/commit/c5b4097ab99309ace23e40d957e9fa1f938f97e9#gnu/services/home.scm-1-22>
> (auto-start? #f)
Wouldn't it then be possible for the user to login via the login manager
before initialisation has completed, as gdm etc don't wait for
guix-home-... currently?
Greetings,
Maxime.
Attachment: file
Attachment: OpenPGP_signature
A
A
Andrew Tropin wrote on 26 Jul 2022 11:23
(name . Tissevert)(address . tissevert+guix@marvid.fr)
87sfmo8byh.fsf@trop.in
On 2022-07-21 19:25, Maxime Devos wrote:

Toggle quote (9 lines)
> On 21-07-2022 19:13, Andrew Tropin wrote:
>
>> The source code is here:
>> https://git.sr.ht/~abcdw/rde/commit/c5b4097ab99309ace23e40d957e9fa1f938f97e9
>
> What's the 'guix-home-gc-roots' for? I would expect the reference
> #$(file-append he "/activate") to be sufficient to keep things from
> being gc'ed.

It was needed while I was testing manual activation without shepherd
service, not needed anymore, already removed it locally.

Toggle quote (21 lines)
>
>> +
>> <https://git.sr.ht/~abcdw/rde/commit/c5b4097ab99309ace23e40d957e9fa1f938f97e9#gnu/services/home.scm-1-23>
>> (start #~(make-forkexec-constructor +
>> <https://git.sr.ht/~abcdw/rde/commit/c5b4097ab99309ace23e40d957e9fa1f938f97e9#gnu/services/home.scm-1-24>
>> '(#$(file-append he "/activate")) +
>> <https://git.sr.ht/~abcdw/rde/commit/c5b4097ab99309ace23e40d957e9fa1f938f97e9#gnu/services/home.scm-1-25>
>> #:user #$user +
>> <https://git.sr.ht/~abcdw/rde/commit/c5b4097ab99309ace23e40d957e9fa1f938f97e9#gnu/services/home.scm-1-26>
>> #:environment-variables +
>> <https://git.sr.ht/~abcdw/rde/commit/c5b4097ab99309ace23e40d957e9fa1f938f97e9#gnu/services/home.scm-1-27>
>> (list (string-append "HOME=" (passwd:dir (getpw #$user)))) +
>> <https://git.sr.ht/~abcdw/rde/commit/c5b4097ab99309ace23e40d957e9fa1f938f97e9#gnu/services/home.scm-1-28>
>> #:group (group:name (getgrgid (passwd:gid (getpw #$user))))))
> I'm wondering if GUIX_LOCPATH is needed as well. Anyway, if not done
> already internally by /activate, you could consider doing it in a
> container to reduce potential irreproducibility, or insecurity on
> multi-user systems (I'd assume the #:user + #:group to be sufficient for
> security, especially if it appears sufficient for other system services,
> but I'm not some expert on what things need to be set).
>
It's not set by /activate.

Toggle quote (11 lines)
>> +
>> <https://git.sr.ht/~abcdw/rde/commit/c5b4097ab99309ace23e40d957e9fa1f938f97e9#gnu/services/home.scm-1-20>
>> (provision (list (symbol-append 'guix-home- (string->symbol user)))) +
>> <https://git.sr.ht/~abcdw/rde/commit/c5b4097ab99309ace23e40d957e9fa1f938f97e9#gnu/services/home.scm-1-21>
>> (one-shot? #t) +
>> <https://git.sr.ht/~abcdw/rde/commit/c5b4097ab99309ace23e40d957e9fa1f938f97e9#gnu/services/home.scm-1-22>
>> (auto-start? #f)
> Wouldn't it then be possible for the user to login via the login manager
> before initialisation has completed, as gdm etc don't wait for
> guix-home-... currently?

You are right, the same as the first one, needed for more manual
approach, changed to #t, thank you.

Three patches for this service to work is on the way on guix-patches.
In the meantime, will try to build livecd with the home environment
inside.

P.S. Probably this system service is far from final version of this
feature, I still think about making home-environment a part of
user-account. Will evaluate pros and cons, after I get livecd built
successfully.

--
Best regards,
Andrew Tropin
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEKEGaxlA4dEDH6S/6IgjSCVjB3rAFAmLfsnYACgkQIgjSCVjB
3rDxIA//RzUUKtKs5Cvo89KM3aUIMNfRzIxV8mWt65okAMmQ8yspNTdCDAFFd511
hpX17dcpmLRhmo1Hbvylt6nEWPaVIfCrCcNyUbTpPWPxz6g2u/XEm/MQzuC+csov
xh8K2SwGsQ33fEBNEGH1NSnIj89y50lmB4C+JQZ3JmkOpMKvRNVqIMl0i2kTKhSP
nOUhiNwRtva2IZlCmJwh9ga6jqJYNpAqun+lGwEgSdKapk7PPsoZhfYZCZoIJdvi
SDthmIaGuqeizsHQA/qWHB/iwTtK5tHyjSMptciQYizvVdgqXUAdXUxEm0Ztc/G5
aX/Hkin62zvwJVywvKshlM0M37SregIh63yAzhNRKGvPNO8cEdmjO6pBS91TmmgW
3L+rP2tSvVrcsXsjScJgf3jPosN9RECaZTdHmgr4F2FTGYgzoQ3dLqzQYk7e+Y6b
isEKJxreblp2yqd+E1CIBetvpl+JYI65qMA9GSXHUvXFr0JyCWI4hirSy4Cfabry
fbDQaLD4sKU+UbNpmVfBQ6FzJBNb+0w1yKYtfg/aS1idMzho677tbnTdkxuvNDHe
Ua+YLEiS6U6sWvwOnPS7FRnBms2frlYtgNLeI6JnT2YTcw5ez+6nIaHB1z+SpmbK
uX1zFdcI4dZD2Vx2TWoWuKGSxMoTN4J3RPDIVg3tJ68ZsZvZAf0=
=tPuX
-----END PGP SIGNATURE-----

A
A
Andrew Tropin wrote on 8 Feb 2023 14:42
(name . Tissevert)(address . tissevert+guix@marvid.fr)
87h6vw1des.fsf@trop.in
On 2022-07-26 12:23, Andrew Tropin wrote:

Toggle quote (60 lines)
> On 2022-07-21 19:25, Maxime Devos wrote:
>
>> On 21-07-2022 19:13, Andrew Tropin wrote:
>>
>>> The source code is here:
>>> https://git.sr.ht/~abcdw/rde/commit/c5b4097ab99309ace23e40d957e9fa1f938f97e9
>>
>> What's the 'guix-home-gc-roots' for? I would expect the reference
>> #$(file-append he "/activate") to be sufficient to keep things from
>> being gc'ed.
>
> It was needed while I was testing manual activation without shepherd
> service, not needed anymore, already removed it locally.
>
>>
>>> +
>>> <https://git.sr.ht/~abcdw/rde/commit/c5b4097ab99309ace23e40d957e9fa1f938f97e9#gnu/services/home.scm-1-23>
>>> (start #~(make-forkexec-constructor +
>>> <https://git.sr.ht/~abcdw/rde/commit/c5b4097ab99309ace23e40d957e9fa1f938f97e9#gnu/services/home.scm-1-24>
>>> '(#$(file-append he "/activate")) +
>>> <https://git.sr.ht/~abcdw/rde/commit/c5b4097ab99309ace23e40d957e9fa1f938f97e9#gnu/services/home.scm-1-25>
>>> #:user #$user +
>>> <https://git.sr.ht/~abcdw/rde/commit/c5b4097ab99309ace23e40d957e9fa1f938f97e9#gnu/services/home.scm-1-26>
>>> #:environment-variables +
>>> <https://git.sr.ht/~abcdw/rde/commit/c5b4097ab99309ace23e40d957e9fa1f938f97e9#gnu/services/home.scm-1-27>
>>> (list (string-append "HOME=" (passwd:dir (getpw #$user)))) +
>>> <https://git.sr.ht/~abcdw/rde/commit/c5b4097ab99309ace23e40d957e9fa1f938f97e9#gnu/services/home.scm-1-28>
>>> #:group (group:name (getgrgid (passwd:gid (getpw #$user))))))
>> I'm wondering if GUIX_LOCPATH is needed as well. Anyway, if not done
>> already internally by /activate, you could consider doing it in a
>> container to reduce potential irreproducibility, or insecurity on
>> multi-user systems (I'd assume the #:user + #:group to be sufficient for
>> security, especially if it appears sufficient for other system services,
>> but I'm not some expert on what things need to be set).
>>
> It's not set by /activate.
>
>>> +
>>> <https://git.sr.ht/~abcdw/rde/commit/c5b4097ab99309ace23e40d957e9fa1f938f97e9#gnu/services/home.scm-1-20>
>>> (provision (list (symbol-append 'guix-home- (string->symbol user)))) +
>>> <https://git.sr.ht/~abcdw/rde/commit/c5b4097ab99309ace23e40d957e9fa1f938f97e9#gnu/services/home.scm-1-21>
>>> (one-shot? #t) +
>>> <https://git.sr.ht/~abcdw/rde/commit/c5b4097ab99309ace23e40d957e9fa1f938f97e9#gnu/services/home.scm-1-22>
>>> (auto-start? #f)
>> Wouldn't it then be possible for the user to login via the login manager
>> before initialisation has completed, as gdm etc don't wait for
>> guix-home-... currently?
>
> You are right, the same as the first one, needed for more manual
> approach, changed to #t, thank you.
>
> Three patches for this service to work is on the way on guix-patches.
> In the meantime, will try to build livecd with the home environment
> inside.
>
> P.S. Probably this system service is far from final version of this
> feature, I still think about making home-environment a part of
> user-account. Will evaluate pros and cons, after I get livecd built
> successfully.

Sorry for the long status update, some life moments are happened.

Polished all the things on Guix Home side and I can confirm that the
service works correctly and it's possible to make home-environments a
part of operating-system record.

Current very simple implementation works relatively good. It accepts a
list of ("user" . home-env) pairs and creates a shepherd services, which
activate respective home environments.

This is how sway graphical environment activation is implemented in rde-live image.

I still find it not completely satisfying because activation happens
when one-shot shepherd service get started and not during system
activation, which leads to the problem mentioned by Maxim: you can login
into user's shell before home-environment activated. I would like to
just extend system activation with calls to home activation scripts, but
it's not that straightforward because we depend on user-homes (which is
a shepherd service).

That said the guix-home system service works fine and you can already
use it, but before merging it to Guix I would like to move home
activations into system activation, which requires some work on
user-homes. It doesn't seem to be a big task, but still require some
dedication and IDK when I get spare time for it. Let me know if this
feature blocks you in some way, otherwise I'll keep working on it in my
own pace.

--
Best regards,
Andrew Tropin
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEKEGaxlA4dEDH6S/6IgjSCVjB3rAFAmPjptsACgkQIgjSCVjB
3rA8VA//epO1s/+BsUsWO0NjoiXQWYdBJBWpReNMhFWLrF1phKJ7WP+TZba6xfpP
TsylTyofV55cYKSLcT/sZy0OwsgDvYPG4JH2JYt8EwWsDh0HQMgLIarwjgb/ChC4
AzkXux7ieigIC1tS1p7b/ULDi9mt5Cmpv0zAD2+rX1C1yMU8NrV++r/NL729YJ3c
1wRL0A6NzTDsgJ6B/8N+beQK9FiOCUEDcn+qExavnSbpw1iPWnhWgjiXAFWwsyVB
//FyUbPvNBxi8Jt38/vdx9O22EwS3vmEbhhgYFI0IvpNKBwOZBIzHP9mkWuIMe/E
LkapvlZoHOIdC/7Q34Pz6MI8TvtqOXnqWv0h2emr4QPzZOTkUIACvd9ZFk/HVaIU
CfAgK+WHEdIOI+IIC6yRJH6ROYGv72skaJ0v63HhmdyC5m6vLJanPJEbBFtNa1sL
vRQnyx+fWWE0c2n0/R7opNbGCPQVvjtyjn/ysdL/KbmoCVmcMpf3aGlJsCpMqZjq
Nkyl4qZ/k9QRCsojNyslvs4an8cDZ4UPREN72l37jstxX+/S/q472MjRqvIz3jl/
KxBIKO3ttiOCObbPbb386kb1c1/ceF3gIFmjnLThfiuv9Y3yxgRI8q5bvzBgoGRw
b5Crt1gb9jLS2LvdU13iIkNQpzu3sK7VYLD7oBEBcZE/rryisMM=
=kfyn
-----END PGP SIGNATURE-----

?