From patchwork Sun Aug 1 21:24:13 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Brice Waegeneire X-Patchwork-Id: 31703 Return-Path: X-Original-To: patchwork@mira.cbaines.net Delivered-To: patchwork@mira.cbaines.net Received: by mira.cbaines.net (Postfix, from userid 113) id 619BC27BC78; Sun, 1 Aug 2021 22:25:12 +0100 (BST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on mira.cbaines.net X-Spam-Level: X-Spam-Status: No, score=-2.9 required=5.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_MSPIKE_H4,RCVD_IN_MSPIKE_WL,SPF_HELO_PASS,URIBL_BLOCKED autolearn=unavailable autolearn_force=no version=3.4.2 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mira.cbaines.net (Postfix) with ESMTPS id B547427BC6B for ; Sun, 1 Aug 2021 22:25:11 +0100 (BST) Received: from localhost ([::1]:35916 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1mAIxK-0003TL-PQ for patchwork@mira.cbaines.net; Sun, 01 Aug 2021 17:25:10 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:46758) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1mAIxC-0003Qg-II for guix-patches@gnu.org; Sun, 01 Aug 2021 17:25:02 -0400 Received: from debbugs.gnu.org ([209.51.188.43]:53819) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1mAIxC-00023K-AG for guix-patches@gnu.org; Sun, 01 Aug 2021 17:25:02 -0400 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1mAIxB-0006MT-W4 for guix-patches@gnu.org; Sun, 01 Aug 2021 17:25:01 -0400 X-Loop: help-debbugs@gnu.org Subject: [bug#49814] [PATCH] accounts: Add . Resent-From: Brice Waegeneire Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Sun, 01 Aug 2021 21:25:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: report 49814 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 49814@debbugs.gnu.org X-Debbugs-Original-To: guix-patches@gnu.org Received: via spool by submit@debbugs.gnu.org id=B.162785306524404 (code B ref -1); Sun, 01 Aug 2021 21:25:01 +0000 Received: (at submit) by debbugs.gnu.org; 1 Aug 2021 21:24:25 +0000 Received: from localhost ([127.0.0.1]:37132 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1mAIwa-0006LY-Tq for submit@debbugs.gnu.org; Sun, 01 Aug 2021 17:24:25 -0400 Received: from lists.gnu.org ([209.51.188.17]:51164) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1mAIwY-0006LQ-T7 for submit@debbugs.gnu.org; Sun, 01 Aug 2021 17:24:23 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:46694) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1mAIwY-00037W-Me for guix-patches@gnu.org; Sun, 01 Aug 2021 17:24:22 -0400 Received: from relay10.mail.gandi.net ([217.70.178.230]:33033) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1mAIwW-0001bW-9G for guix-patches@gnu.org; Sun, 01 Aug 2021 17:24:22 -0400 Received: (Authenticated sender: brice@waegenei.re) by relay10.mail.gandi.net (Postfix) with ESMTPSA id 3F375240003 for ; Sun, 1 Aug 2021 21:24:15 +0000 (UTC) From: Brice Waegeneire Date: Sun, 1 Aug 2021 23:24:13 +0200 Message-Id: <20210801212413.8906-1-brice@waegenei.re> X-Mailer: git-send-email 2.32.0 MIME-Version: 1.0 Received-SPF: pass client-ip=217.70.178.230; envelope-from=brice@waegenei.re; helo=relay10.mail.gandi.net X-Spam_score_int: -25 X-Spam_score: -2.6 X-Spam_bar: -- X-Spam_report: (-2.6 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: guix-patches@gnu.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-patches-bounces+patchwork=mira.cbaines.net@gnu.org Sender: "Guix-patches" X-getmail-retrieved-from-mailbox: Patches Support adding supplementary groups to defined users by extending 'account-service-type'. * gnu/system/accounts.scm (group-membership): New record. (additional-group-members): New procedure. * gnu/system/shadow.scm (group-memberships->users-groups): New procedure. (account-activation accounts+groups): Add additional group memberships to the defined users. --- gnu/system/accounts.scm | 19 +++++++++++++++++++ gnu/system/shadow.scm | 30 +++++++++++++++++++++++++++++- 2 files changed, 48 insertions(+), 1 deletion(-) As I was answerd on IRC, it's already possible to add groups to an already defined 'operating-system' by modifying it's 'user' field. However this isn't that practical in my point of view. I would prefer to do such change from a service to be able to keep a potential new group and its members in proximity in the code. For example when adding a sgid dumpcap binary to be used by the wireshark group members, it makes sense to keep the membership of that group close to the definition of the new group and its sgid binary: --8<---------------cut here---------------start------------->8--- (simple-service 'wireshark-account account-service-type (list (user-group (name "wireshark") (system? #t)) (additional-group-members "wireshark" %sysadmins))) (simple-service 'wireshark-dumpcap setuid-program-service-type (list (setuid-program (program (file-append wireshark "/bin/dumpcap")) (setuid? #f) (setgid? #t) (group "wireshark")))) --8<---------------cut here---------------end--------------->8--- This patch add a new record to be used as as some of the values for the 'account-service-type' which already support 3 other different types. diff --git a/gnu/system/accounts.scm b/gnu/system/accounts.scm index 586cff1842..c12f5644d0 100644 --- a/gnu/system/accounts.scm +++ b/gnu/system/accounts.scm @@ -1,5 +1,6 @@ ;;; GNU Guix --- Functional package management for GNU ;;; Copyright © 2013, 2014, 2015, 2016, 2017, 2018, 2019 Ludovic Courtès +;;; Copyright © 2021 Brice Waegeneire ;;; ;;; This file is part of GNU Guix. ;;; @@ -39,6 +40,12 @@ user-group-id user-group-system? + group-membership + group-membership? + group-membership-name + group-membership-additional-members + additional-group-members + sexp->user-account sexp->user-group @@ -85,6 +92,12 @@ (system? user-group-system? ; Boolean (default #f))) +(define-record-type* + group-membership make-group-membership + group-membership? + (name group-membership-name) ; string + (additional-members group-membership-additional-members)) ; list of strings + (define (default-home-directory account) "Return the default home directory for ACCOUNT." (string-append "/home/" (user-account-name account))) @@ -112,3 +125,9 @@ user-account record." (create-home-directory? create-home-directory?) (shell shell) (password password) (system? system?))))) + +(define (additional-group-members group members) + "Return a object with name GROUPS and additional +MEMEBERS." + (group-membership (name group) + (additional-members members))) diff --git a/gnu/system/shadow.scm b/gnu/system/shadow.scm index 7c57222716..273c1f6d87 100644 --- a/gnu/system/shadow.scm +++ b/gnu/system/shadow.scm @@ -3,6 +3,7 @@ ;;; Copyright © 2016 Alex Griffin ;;; Copyright © 2020 Jan (janneke) Nieuwenhuizen ;;; Copyright © 2020 Efraim Flashner +;;; Copyright © 2021 Brice Waegeneire ;;; ;;; This file is part of GNU Guix. ;;; @@ -316,12 +317,39 @@ of user '~a' is undeclared") #$(user-account-password account) #$(user-account-system? account))) +(define (group-memberships->users-groups groups-memberships) + "Turn GROUP-MEMBERSHIPS, a list of object, into an alist +of users with additional group membership." + (let ((users (delete-duplicates (append-map group-membership-additional-members + groups-memberships)))) + (map (lambda (user) + (cons user + (filter-map + (lambda (group) + (and (member user (group-membership-additional-members group)) + (group-membership-name group))) + groups-memberships))) + users))) + (define (account-activation accounts+groups) "Return a gexp that activates ACCOUNTS+GROUPS, a list of and objects. Raise an error if a user account refers to a undefined group." + (define users-additional-groups + (group-memberships->users-groups (filter group-membership? accounts+groups))) + (define accounts - (delete-duplicates (filter user-account? accounts+groups) eq?)) + (map (lambda (user) + (let ((additional-groups (assoc-ref users-additional-groups + (user-account-name user)))) + (if additional-groups + (user-account + (inherit user) + (supplementary-groups + (delete-duplicates (append (user-account-supplementary-groups user) + additional-groups)))) + user))) + (delete-duplicates (filter user-account? accounts+groups) eq?))) (define user-specs (map user-account->gexp accounts))