From patchwork Tue Jul 18 14:06:16 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Brian Cully X-Patchwork-Id: 51792 Return-Path: X-Original-To: patchwork@mira.cbaines.net Delivered-To: patchwork@mira.cbaines.net Received: by mira.cbaines.net (Postfix, from userid 113) id BA2E827BBEA; Tue, 18 Jul 2023 15:07:25 +0100 (BST) X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on mira.cbaines.net X-Spam-Level: X-Spam-Status: No, score=-3.7 required=5.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,MAILING_LIST_MULTI,RCVD_IN_MSPIKE_H2,SPF_HELO_PASS, URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.6 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mira.cbaines.net (Postfix) with ESMTPS id 623AE27BBE2 for ; Tue, 18 Jul 2023 15:07:23 +0100 (BST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1qLlM7-0004Gh-RD; Tue, 18 Jul 2023 10:07:12 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1qLlM0-0004GM-JS for guix-patches@gnu.org; Tue, 18 Jul 2023 10:07:06 -0400 Received: from debbugs.gnu.org ([2001:470:142:5::43]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1qLlLz-0005wA-75 for guix-patches@gnu.org; Tue, 18 Jul 2023 10:07:04 -0400 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1qLlLy-0005es-DZ for guix-patches@gnu.org; Tue, 18 Jul 2023 10:07:02 -0400 X-Loop: help-debbugs@gnu.org Subject: [bug#62699] [PATCH v2] services: add pam-mount-volume-service-type Resent-From: Brian Cully Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Tue, 18 Jul 2023 14:07:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 62699 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: Ludovic =?utf-8?q?Court=C3=A8s?= Cc: glv@posteo.net, 62699@debbugs.gnu.org Received: via spool by 62699-submit@debbugs.gnu.org id=B62699.168968921321735 (code B ref 62699); Tue, 18 Jul 2023 14:07:02 +0000 Received: (at 62699) by debbugs.gnu.org; 18 Jul 2023 14:06:53 +0000 Received: from localhost ([127.0.0.1]:53660 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1qLlLo-0005eU-Jr for submit@debbugs.gnu.org; Tue, 18 Jul 2023 10:06:53 -0400 Received: from coleridge.kublai.com ([166.84.7.167]:62105 helo=mail.spork.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1qLlLj-0005eI-CS for 62699@debbugs.gnu.org; Tue, 18 Jul 2023 10:06:51 -0400 Received: from psyduck (ool-18b8e9e7.dyn.optonline.net [24.184.233.231]) by mail.spork.org (Postfix) with ESMTPSA id D6282367F; Tue, 18 Jul 2023 10:06:16 -0400 (EDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=spork.org; s=dkim; t=1689689176; bh=M02ChYF/Jn9ZhJ5p7yNqGj6pLctFeNbQ8ilJ7SSPxCI=; h=From:To:Cc:Subject:In-Reply-To:References:Date; b=tJxnc1e3/R6ADrDLK72KQYmn8QI72uk5t6YPsvYKGH92L7hRd8TWPofHt8g5Rn06a a3WiSAMZ92ci1HYJ6QKq4W2gPExzCEfa2U7VjF0OASfHI1UHK/ksI6SE6jBqZ94oet CTVM32/zafYZfcnB/SCL244KcbIOZHA61DDG/MBo= In-Reply-To: <875y6h1fqa.fsf_-_@psyduck.jhoto.kublai.com> (Brian Cully's message of "Tue, 18 Jul 2023 10:01:01 -0400") References: <87lej5x8ke.fsf@psyduck.jhoto.kublai.com> <87352opiw9.fsf_-_@gnu.org> <87v8ficj1y.fsf@psyduck.jhoto.kublai.com> <875y6h1fqa.fsf_-_@psyduck.jhoto.kublai.com> Date: Tue, 18 Jul 2023 10:06:16 -0400 Message-ID: <87351l1fhj.fsf_-_@psyduck.jhoto.kublai.com> User-Agent: Gnus/5.13 (Gnus v5.13) MIME-Version: 1.0 Content-Disposition: inline; filename=v2-0001-services-pam-mount-add-pam-mount-volume-service-t.patch X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: guix-patches@gnu.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-to: Brian Cully X-ACL-Warn: , Brian Cully via Guix-patches X-Patchwork-Original-From: Brian Cully via Guix-patches via From: Brian Cully Errors-To: guix-patches-bounces+patchwork=mira.cbaines.net@gnu.org Sender: guix-patches-bounces+patchwork=mira.cbaines.net@gnu.org X-getmail-retrieved-from-mailbox: Patches The `pam-mount-volumes-service-type' adds additional volumes to the pam-mount-service-type in addition to any that are already specified in `pam-mount-rules'. * doc/guix.texi (PAM Mount Volume Service): add documentation for `pam-mount-service-type'. * gnu/services/pam-mount.scm: new file. * Makefile.am: add pam-mount tests * tests/services/pam-mount.scm: new tests --- Makefile.am | 1 + doc/guix.texi | 99 +++++++++++++++++++++++++++++++ gnu/services/pam-mount.scm | 111 ++++++++++++++++++++++++++++++++++- tests/services/pam-mount.scm | 83 ++++++++++++++++++++++++++ 4 files changed, 293 insertions(+), 1 deletion(-) create mode 100644 tests/services/pam-mount.scm diff --git a/Makefile.am b/Makefile.am index d680c8c76c..de239d7fca 100644 --- a/Makefile.am +++ b/Makefile.am @@ -557,6 +557,7 @@ SCM_TESTS = \ tests/services/configuration.scm \ tests/services/lightdm.scm \ tests/services/linux.scm \ + tests/services/pam-mount.scm \ tests/services/telephony.scm \ tests/sets.scm \ tests/size.scm \ diff --git a/doc/guix.texi b/doc/guix.texi index ee03de04dc..2c1ac6d090 100644 --- a/doc/guix.texi +++ b/doc/guix.texi @@ -116,6 +116,7 @@ Copyright @copyright{} 2023 Karl Hallsby@* Copyright @copyright{} 2023 Nathaniel Nicandro@* Copyright @copyright{} 2023 Tanguy Le Carrour@* +Copyright @copyright{} 2023 Brian Cully@* Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.3 or @@ -37752,6 +37753,104 @@ PAM Mount Service @end table @end deftp +@subheading PAM Mount Volume Service +@cindex pam volume mounting + +PAM mount volumes are automatically mounted at login by the PAM login +service according to a set of per-volume rules. Because they are +mounted by PAM the password entered during login may be used directly to +mount authenticated volumes, such as @code{cifs}, using the same +credentials. + +These volumes will be added in addition to any volumes directly +specified in @code{pam-mount-rules}. + +Here is an example of a rule which will mount a remote CIFS share from +@file{//remote-server/share} into a sub-directory of @file{/shares} +named after the user logging in: + +@lisp +(simple-service 'pam-mount-remote-share pam-mount-volume-service-type + (list (pam-mount-volume + (secondary-group "users") + (file-system-type "cifs") + (server "remote-server") + (file-name "share") + (mount-point "/shares/%(USER)") + (options "nosuid,nodev,seal,cifsacl")))) +@end lisp + +@deftp {Data Type} pam-mount-volume-service-type +Configuration for a single volume to be mounted. Any fields not +specified will be omitted from the run-time PAM configuration. See +@uref{http://pam-mount.sourceforge.net/pam_mount.conf.5.html, +the man page} for the default values when unspecified. + +@table @asis +@item @code{user-name} (type: maybe-string) +Mount the volume for the given user. + +@item @code{user-id} (type: maybe-integer-or-range) +Mount the volume for the user with this ID. This field may also be +specified as a pair of @code{(start . end)} indicating a range of user +IDs for whom to mount the volume. + +@item @code{primary-group} (type: maybe-string) +Mount the volume for users with this primary group name. + +@item @code{group-id} (type: maybe-integer-or-range) +Mount the volume for the users with this primary group ID. This field +may also be specified as a cons cell of @code{(start . end)} indicating +a range of group ids for whom to mount the volume. + +@item @code{secondary-group} (type: maybe-string) +Mount the volume for users who are members of this group as either a +primary or secondary group. + +@item @code{file-system-type} (type: maybe-string) +The file system type for the volume being mounted (e.g., @code{cifs}) + +@item @code{no-mount-as-root?} (type: maybe-boolean) +Whether or not to mount the volume with root privileges. This is +normally disabled, but may be enabled for mounts of type @code{fuse}, or +other user-level mounts. + +@item @code{server} (type: maybe-string) +The name of the remote server to mount the volume from, when necessary. + +@item @code{file-name} (type: maybe-string) +The location of the volume, either local or remote, depending on the +@code{file-system-type}. + +@item @code{mount-point} (type: maybe-string) +Where to mount the volume in the local file-system. This may be set to +@file{~} to indicate the home directory of the user logging in. If this +field is omitted then @file{/etc/fstab} is consulted for the mount +destination. + +@item @code{options} (type: maybe-string) +The options to be passed as-is to the underlying mount program. + +@item @code{ssh?} (type: maybe-boolean) +Enable this option to pass the login password to SSH for use with mounts +involving SSH (e.g., @code{sshfs}). + +@item @code{cipher} (type: maybe-string) +Cryptsetup cipher name for the volume. To be used with the @code{crypt} +@code{file-system-type}. + +@item @code{file-system-key-cipher} (type: maybe-string) +Cipher name used by the target volume. + +@item @code{file-system-key-hash} (type: maybe-string) +SSL hash name used by the target volume. + +@item @code{file-system-key-file-name} (type: maybe-string) +File name of the file system key for the target volume. + +@end table +@end deftp + @node Guix Services @subsection Guix Services diff --git a/gnu/services/pam-mount.scm b/gnu/services/pam-mount.scm index 21c34ddd61..8a38d6b1cc 100644 --- a/gnu/services/pam-mount.scm +++ b/gnu/services/pam-mount.scm @@ -23,9 +23,15 @@ (define-module (gnu services pam-mount) #:use-module (gnu system pam) #:use-module (guix gexp) #:use-module (guix records) + #:use-module (ice-9 match) + #:use-module (srfi srfi-1) #:export (pam-mount-configuration pam-mount-configuration? - pam-mount-service-type)) + pam-mount-service-type + + pam-mount-volume + pam-mount-volume? + pam-mount-volume-service-type)) (define %pam-mount-default-configuration `((debug (@ (enable "0"))) @@ -102,6 +108,11 @@ (define (pam-mount-pam-service config) (list optional-pam-mount)))) pam)))))) +(define (extend-pam-mount-configuration initial extensions) + "Extends INITIAL with EXTENSIONS." + (pam-mount-configuration (rules (append (pam-mount-configuration-rules + initial) extensions)))) + (define pam-mount-service-type (service-type (name 'pam-mount) @@ -109,6 +120,104 @@ (define pam-mount-service-type pam-mount-etc-service) (service-extension pam-root-service-type pam-mount-pam-service))) + (compose concatenate) + (extend extend-pam-mount-configuration) (default-value (pam-mount-configuration)) (description "Activate PAM-Mount support. It allows mounting volumes for specific users when they log in."))) + +(define (field-name->tag field-name) + "Convert FIELD-NAME to its tag used by the configuration XML." + (match field-name + ('user-name 'user) + ('user-id 'uid) + ('primary-group 'pgrp) + ('group-id 'gid) + ('secondary-group 'sgrp) + ('file-system-type 'fstype) + ('no-mount-as-root? 'noroot) + ('file-name 'path) + ('mount-point 'mountpoint) + ('ssh? 'ssh) + ('file-system-key-cipher 'fskeycipher) + ('file-system-key-hash 'fskeyhash) + ('file-system-key-file-name 'fskeypath) + (_ field-name))) + +(define-maybe string) + +(define (serialize-string field-name value) + (list (field-name->tag field-name) value)) + +(define (integer-or-range? value) + (match value + ((start . end) (and (integer? start) + (integer? end))) + (_ (number? value)))) + +(define-maybe integer-or-range) + +(define (serialize-integer-or-range field-name value) + (let ((value-string (match value + ((start . end) (format #f "~a-~a" start end)) + (_ (number->string value))))) + (list (field-name->tag field-name) value-string))) + +(define-maybe boolean) + +(define (serialize-boolean field-name value) + (let ((value-string (if value "1" "0"))) + (list (field-name->tag field-name) value-string))) + +(define-configuration pam-mount-volume + (user-name maybe-string "User name to match.") + (user-id maybe-integer-or-range + "User ID, or range of user IDs, in the form of @code{(start . end)} to\nmatch.") + (primary-group maybe-string "Primary group name to match.") + (group-id maybe-integer-or-range + "Group ID, or range of group IDs, in the form of @code{(start . end)} to\nmatch.") + (secondary-group maybe-string + "Match users who belong to this group name as either a primary or secondary\ngroup.") + (file-system-type maybe-string "File system type of volume being mounted.") + (no-mount-as-root? maybe-boolean + "Do not use super user privileges to mount this volume.") + (server maybe-string "Remote server this volume resides on.") + (file-name maybe-string "Location of the volume to be mounted.") + (mount-point maybe-string + "Where to mount the volume in the local file system.") + (options maybe-string "Options to pass to the underlying mount program.") + (ssh? maybe-boolean "Whether to pass the login password to SSH.") + (cipher maybe-string "Cryptsetup cipher named used by volume.") + (file-system-key-cipher maybe-string + "Cipher name used by the target volume.") + (file-system-key-hash maybe-string + "SSL hash name used by the target volume.") + (file-system-key-file-name maybe-string + "File name for the file system key used by the target volume.")) + +(define (pam-mount-volume->sxml volume) + ;; Convert a list of configuration fields into an SXML-compatible attribute + ;; list. + (define xml-attrs + (filter-map (lambda (field) + (let* ((accessor (configuration-field-getter field)) + (value (accessor volume))) + (and (not (eq? value %unset-value)) + (list (field-name->tag (configuration-field-name + field)) value)))) + pam-mount-volume-fields)) + + `(volume (@ ,@xml-attrs))) + +(define (pam-mount-volume-rules volumes) + (map pam-mount-volume->sxml volumes)) + +(define pam-mount-volume-service-type + (service-type (name 'pam-mount-volume) + (extensions (list (service-extension pam-mount-service-type + pam-mount-volume-rules))) + (compose concatenate) + (extend append) + (default-value '()) + (description + "Volumes to be mounted during PAM-assisted login."))) diff --git a/tests/services/pam-mount.scm b/tests/services/pam-mount.scm new file mode 100644 index 0000000000..bfbd15967f --- /dev/null +++ b/tests/services/pam-mount.scm @@ -0,0 +1,83 @@ +;;; GNU Guix --- Functional package management for GNU +;;; Copyright © 2023 Brian Cully +;;; +;;; This file is part of GNU Guix. +;;; +;;; GNU Guix is free software; you can redistribute it and/or modify it +;;; under the terms of the GNU General Public License as published by +;;; the Free Software Foundation; either version 3 of the License, or (at +;;; your option) any later version. +;;; +;;; GNU Guix is distributed in the hope that it will be useful, but +;;; WITHOUT ANY WARRANTY; without even the implied warranty of +;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +;;; GNU General Public License for more details. +;;; +;;; You should have received a copy of the GNU General Public License +;;; along with GNU Guix. If not, see . + +(define-module (tests services pam-mount) + #:use-module (gnu services pam-mount) + #:use-module (gnu system pam) + #:use-module (gnu services) + #:use-module (gnu services configuration) + #:use-module (guix derivations) + #:use-module (guix gexp) + #:use-module (guix grafts) + #:use-module (guix store) + #:use-module (guix tests) + #:use-module (ice-9 match) + #:use-module (srfi srfi-1) + #:use-module (srfi srfi-64)) + +(define pam-mount-volume-fields (@@ (gnu services pam-mount) + pam-mount-volume-fields)) +(define field-name->tag (@@ (gnu services pam-mount) + field-name->tag)) + +(define pam-mount-volume->sxml (@@ (gnu services pam-mount) + pam-mount-volume->sxml)) + +(test-begin "services-pam-mount") + +(test-group "field-name->tag" + (let ((field-map '((user-name user) + (user-id uid) + (primary-group pgrp) + (group-id gid) + (secondary-group sgrp) + (file-system-type fstype) + (no-mount-as-root? noroot) + (server server) + (file-name path) + (mount-point mountpoint) + (options options) + (ssh? ssh) + (cipher cipher) + (file-system-key-cipher fskeycipher) + (file-system-key-hash fskeyhash) + (file-system-key-file-name fskeypath)))) + + (test-equal "all fields accounted for" + (map car field-map) + (map configuration-field-name pam-mount-volume-fields)) + + (for-each (match-lambda + ((field-name tag-name) + (test-eq (format #f "~a -> ~a" field-name tag-name) + (field-name->tag field-name) tag-name))) + field-map))) + +(let ((tmpfs-volume (pam-mount-volume + (secondary-group "users") + (file-system-type "tmpfs") + (mount-point "/run/user/%(USERUID)") + (options "someoptions")))) + (test-equal "tmpfs" + '(volume (@ (sgrp "users") + (fstype "tmpfs") + (mountpoint "/run/user/%(USERUID)") + (options "someoptions"))) + (pam-mount-volume->sxml tmpfs-volume))) + +(test-end "services-pam-mount") base-commit: a8c79839d57acf96df720630b8e6ddee8a8c2cf8 -- 2.41.0