From ad9323d5b3f774ee479cf16f41753dbbe2f90ff4 Mon Sep 17 00:00:00 2001
From: muradm <mail@muradm.net>
Date: Fri, 22 Jul 2022 07:09:54 +0300
Subject: [PATCH v4] gnu: seatd-service-type: Should use seat group.
To: 56690@debbugs.gnu.org
* gnu/services/desktop.scm (seatd-service-type): Uses "seat" group.
[extensions]: Added account-service-type with seatd-accounts.
(seatd-accounts): Conditionally produces list with "seat" group.
(<seatd-configuration>):
[user] Removed user field, since it is not going to be used.
[group] Change default value to "seat" user-group.
* doc/guix.texi: Mention that users may need to become members of
"seat" group and update default value for group field. Add
explanation on seatd.sock file. Remove dropped user field.
---
doc/guix.texi | 29 +++++++++++++++++++++++++----
gnu/services/desktop.scm | 25 +++++++++++++++++++------
gnu/tests/desktop.scm | 9 +++++++++
3 files changed, 53 insertions(+), 10 deletions(-)
@@ -23189,6 +23189,30 @@ input), without requiring the applications needing access to be root.
%base-services)
@end lisp
+
+@code{seatd} operates over a UNIX domain socket, with @code{libseat}
+providing the client-side of the protocol. Then applications dealing
+with seat management (e.g. @code{sway}) connects to @code{seatd} via
+mentioned socket.
+
+When seat management is provided by @code{seatd}, @code{libseat} users
+that acquire resources provided by @code{seatd} should have permissions
+to access its UNIX domain socket. By default, @code{seatd-service-type}
+provides ``seat'' group. And @code{libseat} user should become its
+member.
+
+@lisp
+(user-account
+ (name "alice")
+ (group "users")
+ (supplementary-groups '("wheel" ;allow use of sudo, etc.
+ "seat" ;interact with seatd
+ "audio" ;sound card
+ "video" ;video devices such as webcams
+ "cdrom")) ;the good ol' CD-ROM
+ (comment "Bob's sister"))
+@end lisp
+
@end defvr
@deftp {Data Type} seatd-configuration
@@ -23198,10 +23222,7 @@ Configuration record for the seatd daemon service.
@item @code{seatd} (default: @code{seatd})
The seatd package to use.
-@item @code{user} (default: @samp{"root"})
-User to own the seatd socket.
-
-@item @code{group} (default: @samp{"users"})
+@item @code{group} (default: @samp{"seat"})
Group to own the seatd socket.
@item @code{socket} (default: @samp{"/run/seatd.sock"})
@@ -13,7 +13,7 @@
;;; Copyright © 2020 Tobias Geerinckx-Rice <me@tobias.gr>
;;; Copyright © 2020 Reza Alizadeh Majd <r.majd@pantherx.org>
;;; Copyright © 2021 Brice Waegeneire <brice@waegenei.re>
-;;; Copyright © 2021 muradm <mail@muradm.net>
+;;; Copyright © 2021, 2022 muradm <mail@muradm.net>
;;;
;;; This file is part of GNU Guix.
;;;
@@ -69,6 +69,7 @@ (define-module (gnu services desktop)
#:use-module (guix records)
#:use-module (guix packages)
#:use-module (guix store)
+ #:use-module (guix ui)
#:use-module (guix utils)
#:use-module (guix gexp)
#:use-module (srfi srfi-1)
@@ -1643,12 +1644,21 @@ (define polkit-wheel-service
;;; seatd-service-type -- minimal seat management daemon
;;;
+(define (seatd-make-group g)
+ (user-group (name g) (system? #t)))
+
+(define (seatd-group-sanitizer g)
+ (cond ((user-group? g) g)
+ ((string? g) (seatd-make-group g))
+ (#t (leave (G_ "seatd: '~a' is not a valid group-%") (object->string g)))))
+
(define-record-type* <seatd-configuration> seatd-configuration
make-seatd-configuration
seatd-configuration?
(seatd seatd-package (default seatd))
- (user seatd-user (default "root"))
- (group seatd-group (default "users"))
+ (group seatd-group
+ (default (seatd-make-group "seat"))
+ (sanitize seatd-group-sanitizer))
(socket seatd-socket (default "/run/seatd.sock"))
(logfile seatd-logfile (default "/var/log/seatd.log"))
(loglevel seatd-loglevel (default "info")))
@@ -1662,8 +1672,7 @@ (define (seatd-shepherd-service config)
(provision '(seatd elogind))
(start #~(make-forkexec-constructor
(list #$(file-append (seatd-package config) "/bin/seatd")
- "-u" #$(seatd-user config)
- "-g" #$(seatd-group config))
+ "-g" #$(user-group-name (seatd-group config)))
#:environment-variables
(list (string-append "SEATD_LOGLEVEL="
#$(seatd-loglevel config))
@@ -1672,9 +1681,12 @@ (define (seatd-shepherd-service config)
#:log-file #$(seatd-logfile config)))
(stop #~(make-kill-destructor)))))
+(define seatd-accounts
+ (match-lambda (($ <seatd-configuration> _ group) (list group))))
+
(define seatd-environment
(match-lambda
- (($ <seatd-configuration> _ _ _ socket)
+ (($ <seatd-configuration> _ _ socket)
`(("SEATD_SOCK" . ,socket)))))
(define seatd-service-type
@@ -1685,6 +1697,7 @@ (define seatd-service-type
applications needing access to be root.")
(extensions
(list
+ (service-extension account-service-type seatd-accounts)
(service-extension session-environment-service-type seatd-environment)
;; TODO: once cgroups is separate dependency we should not mount it here
;; for now it is mounted here, because elogind mounts it
@@ -255,6 +255,15 @@ (define (sock-var-sock var)
(socks (map wait-for-unix-socket-m socks)))
(and (= 2 (length socks)) (every identity socks)))))
+ (test-equal "seatd.sock ownership"
+ '("root" "seat")
+ `(,(marionette-eval
+ '(passwd:name (getpwuid (stat:uid (stat "/run/seatd.sock"))))
+ marionette)
+ ,(marionette-eval
+ '(group:name (getgrgid (stat:gid (stat "/run/seatd.sock"))))
+ marionette)))
+
(test-assert "greetd is ready"
(begin
(marionette-type "ps -C greetd -o pid,args --no-headers > ps-greetd\n"
--
2.37.1