[bug#77288,6/6] DRAFT news: Add entry about unprivileged guix-daemon on Guix System.

  DRAFT: Temporary commit.

* etc/news.scm: Add it.

Change-Id: I28eae7f7b4305225b13281b99458cbedda3c3b94
---
 etc/news.scm | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)
  

Rootless daemon is an important change, though I have not tested yet...

Ludovic Courtès <ludo@gnu.org> writes:
> +Eventually running @command{guix-daemon} without root privileges may become
> +the default.")))
> +

I dislike the word “may” in this last sentence.  How about “likely
will” or some such thing, even if we have not reviewed bugfreeness of
Linux here?

Can you tell foreign distro users about their rootless options in the
news, too?

Could you add this German translation?
(entry (commit "XXX")
        (title
         (en "Guix System can run @command{guix-daemon} without root
privileges")
         (de "Guix System kann @command{guix-daemon} ohne root-Berechtigungen
ausführen"))
        (body
         (en "On Guix System, @code{guix-service-type} can now be configured
to run the build daemon, @command{guix-daemon}, without root privileges.  In
that configuration, the daemon runs with the authority of the
@code{guix-daemon} user, which we think can reduce the impact of some classes
of vulnerabilities that could affect it.

For now, this is opt-in: you have to change @code{guix-configuration} to set
the @code{privileged?} field to @code{#f}.  When you do this, all the files in
@file{/gnu/store}, @file{/var/guix}, etc. will have their ownership changed to
the @code{guix-daemon} user (instead of @code{root}); this can take a while,
especially if the store is big.  To learn more about it, run:

@example
info guix --index-search=guix-service-type
@end example

Eventually running @command{guix-daemon} without root privileges may become
the default.")
         (de "Auf Guix System kann @code{guix-service-type} jetzt so
konfiguriert werden, dass der Erstellungs-Daemon @command{guix-daemon} ohne
root-Berechtigungen ausgeführt wird.  In dieser Konfiguration läuft der Daemon
mit den Berechtigungen des Benutzers @code{guix-daemon}, wovon wir glauben,
dass es die Auswirkungen mancher Schwachstellen-Kategorien verringert, die ihn
betreffen könnten.

Fürs Erste bleibt es Ihnen überlassen: Sie müssen @code{guix-configuration}
anpassen und dort das Feld @code{privileged?} auf @code{#f} setzen. Wenn Sie
das tun, wird der Besitzer aller Dateien in @file{/gnu/store},
@file{/var/guix}, usw.@: auf den Benutzer @code{guix-daemon} geändert (anstelle
von @code{root}); das kann eine Weile dauern, besonders wenn der Store groß
ist.  Um mehr zu erfahren, führen Sie aus:

@example
info guix --index-search=guix-service-type
@end example

Schließlich wird das Ausführen von @command{guix-daemon} ohne
root-Berechtigungen vielleicht die Vorgabe werden.")))
Regards,
Florian
  

Hi Florian,

"pelzflorian (Florian Pelz)" <pelzflorian@pelzflorian.de> skribis:

> Rootless daemon is an important change, though I have not tested yet...
>
> Ludovic Courtès <ludo@gnu.org> writes:
>> +Eventually running @command{guix-daemon} without root privileges may become
>> +the default.")))
>> +
>
> I dislike the word “may” in this last sentence.  How about “likely
> will” or some such thing, even if we have not reviewed bugfreeness of
> Linux here?

Sure; I view “may” and “likely will” as synonymous, but maybe there are
subtleties that escape me.

> Can you tell foreign distro users about their rootless options in the
> news, too?

This news item is specifically about Guix System (announced upfront),
but I guess we can add a sentence toward the end.  (Thing is, the
situation will be simpler on foreign distros: we won’t support switching
between privileged and unprivileged, so either you get one or the
other.)

Thanks for the comments and for the translation!

Ludo’.
  

Hi Ludo.

Ludovic Courtès <ludo@gnu.org> writes:
> "pelzflorian (Florian Pelz)" <pelzflorian@pelzflorian.de> skribis:
>> Ludovic Courtès <ludo@gnu.org> writes:
>>> +Eventually running @command{guix-daemon} without root privileges may become
>>> +the default.")))
>>> +
>>
>> I dislike the word “may” in this last sentence.  How about “likely
>> will” or some such thing, even if we have not reviewed bugfreeness of
>> Linux here?
>
> Sure; I view “may” and “likely will” as synonymous, but maybe there are
> subtleties that escape me.
>

I had understood “likely” to be “probably”.  With more thinking and
Wiktionary reading, “likely” can also mean “plausibly”, though not in
this context, I think.

The word “may” you had used means “possibly”, which sounds
indecisive/uncommitted and if even Guix does not know yet if rootless is
a good idea, how should a news-reading user know?  I thought you wrote
it for this purpose, because distros had been wary of USERNS some time
ago, or something.

This is why I translated to German as „vielleicht” (maybe).

Apparently some people want to banish the word “may” for its suppossed
ambiguity; it can mean “possibly” and “have permission to”, according to
Wiktionary.  This subtlety is news to me; I think context makes clear
what “may” means.

But perhaps it really is better to use unambiguous adverbs, adjectives
like “probably”.

In case you write this “probably” or “likely”, I would translate in
German as „wahrscheinlich” (probably).



>> Can you tell foreign distro users about their rootless options in the
>> news, too?
>
> This news item is specifically about Guix System (announced upfront),
> but I guess we can add a sentence toward the end.  (Thing is, the
> situation will be simpler on foreign distros: we won’t support switching
> between privileged and unprivileged, so either you get one or the
> other.)
>

Yes, please!  That sentence in parentheses explains the situation, but
needs rewording for etc/news.scm of course.


> Thanks for the comments and for the translation!
>
> Ludo’.

:)

I also now notice it is impossible to translate

info guix --index-search=guix-service-type

as

info guix.de --index-search=guix-service-type

although

info guix.fr --index-search=guix-service-type

works fine.  No idea why; both texi files look the same here.  But since
the rootless documentation is not translated yet anyway, please leave

info guix --index-search=guix-service-type

Regards,
Florian