(address . bug-guix@gnu.org)
Hi,
As per discussion here:
Above change reduced permissions of greeter user.
While it is ok for greeters that do not talk to seatd,
greeters talking to seatd lost access to seatd socket.
As result, greeter (e.g. gtkgreet) requiring communication
with seatd is failing to start, causing "black screen"
behavior on active terminal (switching to the other non seatd
related terminal is possible, for manual permissions
adjustment as workaround).
To address this issue, we need more flexible control over
seatd user/group, which creates seatd.sock, and greeter user
which connects to seatd.sock.
Other distros (Arch for instance) introduced "seat" group.
So user which wants to login on system controlled by seatd
should be member of that group.
However, not all greeters require that, so I decided to make
more flexible. Propsed solutions consists of:
* 56690 - gnu: seatd-service-type: Should use seat group.
With this change, if seatd-service-type is present in the
system configuration, "seat" group will be added, and seatd
will run as root/seat. Group is configurable, but default is
"seat".
* 56699 - gnu: greetd-service-type: Add greeter-extra-groups
config field.
With this change, if user wants to use seatd-service-type with
greeter requiring seatd.sock, he can add "seat" group to
greeter-extra-groups field.
Thanks in advance,
muradm
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEESPY5lma9A9l5HGLP6M7O0mLOBeIFAmLrmVQACgkQ6M7O0mLO
BeJFohAAr/iwhBTm8Ge6F/u/RRnlewbKP5VcZaU2sR1ck6NqQ27eFU1Zn+ZqUDA9
6tWjCMg/lfpxBt91+V9HOdOQY+3v0Yno6SqkMODYsQFLB8w1LvHAchpJaju43Z21
B84viXLYJHFXKBQvWi9nuH8mB5q7icZ8bmGGqP/SXh7Gf4v1jeKJEHFl4Gmn0SW2
AGu9+rjE9WUlqhEKiYgXvok90WCHu0syBzGD9bpOfOHMvgOFsYLBqP7BSSm84Kso
VpT7+6ZB5Xh9De0BCFr4CUInKrSwmNJQEs7ShkXGfPVJHa1AGDSXdTwEURJRHYXZ
8erF9etX4J5Mi0lgT/hST8PCV18E0//le0WXs5PiYYnKfCHp/SmFqEI1aDkiFlEE
rCvKLiVedglaaUSxjx6uSSgjk5A1/SAZCFEgrMWlJsduKuXzkUsSyN+Ai/iQGn7I
UEqWbApWRXdJrBbviAb5LtokVAelnT9KksXlxXiANLLXUN6xds1IuR/nBZekqi3K
YK/U4CSNhv+Bpdd5fgat58t2l9nY23ELAe4IORSPzpmNGEcMHUkadesuaSdaMgZs
f0YwGKFQ44KzHYazrcQKwl+RljGggL7MfsUOrK5J0AJscZGLSuDKGYAg9jIoIRtZ
s8KvNOcocG5o+/Li1utgPIIYwTROFc1rV7FMrwUIKuypCbTQak4=
=fLZ+
-----END PGP SIGNATURE-----