From patchwork Sun Sep 27 15:32:14 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: =?utf-8?q?Ludovic_Court=C3=A8s?= X-Patchwork-Id: 24346 Return-Path: X-Original-To: patchwork@mira.cbaines.net Delivered-To: patchwork@mira.cbaines.net Received: by mira.cbaines.net (Postfix, from userid 113) id D3F9127BBE9; Sun, 27 Sep 2020 16:33:09 +0100 (BST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on mira.cbaines.net X-Spam-Level: X-Spam-Status: No, score=-2.9 required=5.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_MSPIKE_H4,RCVD_IN_MSPIKE_WL autolearn=unavailable autolearn_force=no version=3.4.2 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mira.cbaines.net (Postfix) with ESMTPS id A362327BBE8 for ; Sun, 27 Sep 2020 16:33:09 +0100 (BST) Received: from localhost ([::1]:50006 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1kMYfk-00030a-Ri for patchwork@mira.cbaines.net; Sun, 27 Sep 2020 11:33:08 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:54500) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1kMYff-00030K-5x for guix-patches@gnu.org; Sun, 27 Sep 2020 11:33:03 -0400 Received: from debbugs.gnu.org ([209.51.188.43]:38663) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1kMYfe-0003uD-SN for guix-patches@gnu.org; Sun, 27 Sep 2020 11:33:02 -0400 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1kMYfe-0002l9-Pe for guix-patches@gnu.org; Sun, 27 Sep 2020 11:33:02 -0400 X-Loop: help-debbugs@gnu.org Subject: [bug#43650] [PATCH 1/8] services: hurd-vm: Run QEMU as an unprivileged user. References: <20200927152932.8924-1-ludo@gnu.org> In-Reply-To: <20200927152932.8924-1-ludo@gnu.org> Resent-From: Ludovic =?utf-8?q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Sun, 27 Sep 2020 15:33:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 43650 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 43650@debbugs.gnu.org Cc: Ludovic =?utf-8?q?Court=C3=A8s?= , janneke@gnu.org Received: via spool by 43650-submit@debbugs.gnu.org id=B43650.160122076010516 (code B ref 43650); Sun, 27 Sep 2020 15:33:02 +0000 Received: (at 43650) by debbugs.gnu.org; 27 Sep 2020 15:32:40 +0000 Received: from localhost ([127.0.0.1]:50196 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1kMYfH-0002jY-Rw for submit@debbugs.gnu.org; Sun, 27 Sep 2020 11:32:40 -0400 Received: from eggs.gnu.org ([209.51.188.92]:47576) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1kMYfG-0002jI-AL for 43650@debbugs.gnu.org; Sun, 27 Sep 2020 11:32:38 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:52524) by eggs.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1kMYfB-0003sF-1W; Sun, 27 Sep 2020 11:32:33 -0400 Received: from [2a01:e0a:1d:7270:af76:b9b:ca24:c465] (port=38894 helo=gnu.org) by fencepost.gnu.org with esmtpsa (TLS1.2:DHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.82) (envelope-from ) id 1kMYf7-00016f-Rm; Sun, 27 Sep 2020 11:32:30 -0400 From: Ludovic =?utf-8?q?Court=C3=A8s?= Date: Sun, 27 Sep 2020 17:32:14 +0200 Message-Id: <20200927153221.9154-1-ludo@gnu.org> X-Mailer: git-send-email 2.28.0 MIME-Version: 1.0 X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: guix-patches@gnu.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-patches-bounces+patchwork=mira.cbaines.net@gnu.org Sender: "Guix-patches" X-getmail-retrieved-from-mailbox: Patches Until qemu was running as "root", which is unnecessary. * gnu/services/virtualization.scm (%hurd-vm-accounts): New variable. (hurd-vm-service-type)[extensions]: Add ACCOUNT-SERVICE-TYPE extension. --- gnu/services/virtualization.scm | 43 +++++++++++++++++++++++---------- 1 file changed, 30 insertions(+), 13 deletions(-) diff --git a/gnu/services/virtualization.scm b/gnu/services/virtualization.scm index 20e104f48c..55a19d7af9 100644 --- a/gnu/services/virtualization.scm +++ b/gnu/services/virtualization.scm @@ -959,28 +959,45 @@ is added to the OS specified in CONFIG." (with-imported-modules (source-module-closure '((gnu build secret-service) (guix build utils))) - #~(let ((spawn (make-forkexec-constructor #$vm-command))) - (lambda _ - (let ((pid (spawn)) - (port #$(hurd-vm-port config %hurd-vm-secrets-port)) - (root #$(hurd-vm-configuration-secret-root config))) - (catch #t - (lambda _ - (secret-service-send-secrets port root)) - (lambda (key . args) - (kill (- pid) SIGTERM) - (apply throw key args))) - pid))))) + #~(lambda () + (let ((pid (fork+exec-command #$vm-command + #:user "childhurd" + #:group "childhurd" + #:environment-variables + ;; QEMU tries to write to /var/tmp + ;; by default. + '("TMPDIR=/tmp"))) + (port #$(hurd-vm-port config %hurd-vm-secrets-port)) + (root #$(hurd-vm-configuration-secret-root config))) + (catch #t + (lambda _ + (secret-service-send-secrets port root) + pid) + (lambda (key . args) + (kill (- pid) SIGTERM) + (apply throw key args))))))) (modules `((gnu build secret-service) (guix build utils) ,@%default-modules)) (stop #~(make-kill-destructor)))))) +(define %hurd-vm-accounts + (list (user-group (name "childhurd") (system? #t)) + (user-account + (name "childhurd") + (group "childhurd") + (comment "Privilege separation user for the childhurd") + (home-directory "/var/empty") + (shell (file-append shadow "/sbin/nologin")) + (system? #t)))) + (define hurd-vm-service-type (service-type (name 'hurd-vm) (extensions (list (service-extension shepherd-root-service-type - hurd-vm-shepherd-service))) + hurd-vm-shepherd-service) + (service-extension account-service-type + (const %hurd-vm-accounts)))) (default-value (hurd-vm-configuration)) (description "Provide a Virtual Machine running the GNU/Hurd."))) From patchwork Sun Sep 27 15:32:15 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: =?utf-8?q?Ludovic_Court=C3=A8s?= X-Patchwork-Id: 24348 Return-Path: X-Original-To: patchwork@mira.cbaines.net Delivered-To: patchwork@mira.cbaines.net Received: by mira.cbaines.net (Postfix, from userid 113) id BFC4427BBE9; Sun, 27 Sep 2020 16:33:15 +0100 (BST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on mira.cbaines.net X-Spam-Level: X-Spam-Status: No, score=-2.9 required=5.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_MSPIKE_H4,RCVD_IN_MSPIKE_WL autolearn=unavailable autolearn_force=no version=3.4.2 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mira.cbaines.net (Postfix) with ESMTPS id 99B3927BBE8 for ; Sun, 27 Sep 2020 16:33:15 +0100 (BST) Received: from localhost ([::1]:50334 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1kMYfq-0003BZ-QH for patchwork@mira.cbaines.net; Sun, 27 Sep 2020 11:33:14 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:54502) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1kMYff-00030R-J9 for guix-patches@gnu.org; Sun, 27 Sep 2020 11:33:03 -0400 Received: from debbugs.gnu.org ([209.51.188.43]:38665) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1kMYff-0003uH-9g for guix-patches@gnu.org; Sun, 27 Sep 2020 11:33:03 -0400 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1kMYff-0002lG-6o for guix-patches@gnu.org; Sun, 27 Sep 2020 11:33:03 -0400 X-Loop: help-debbugs@gnu.org Subject: [bug#43650] [PATCH 2/8] services: childhurd: Tweak description. Resent-From: Ludovic =?utf-8?q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Sun, 27 Sep 2020 15:33:03 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 43650 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 43650@debbugs.gnu.org Cc: Ludovic =?utf-8?q?Court=C3=A8s?= , janneke@gnu.org Received: via spool by 43650-submit@debbugs.gnu.org id=B43650.160122076310531 (code B ref 43650); Sun, 27 Sep 2020 15:33:03 +0000 Received: (at 43650) by debbugs.gnu.org; 27 Sep 2020 15:32:43 +0000 Received: from localhost ([127.0.0.1]:50199 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1kMYfL-0002jn-3j for submit@debbugs.gnu.org; Sun, 27 Sep 2020 11:32:43 -0400 Received: from eggs.gnu.org ([209.51.188.92]:47584) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1kMYfI-0002jM-5r for 43650@debbugs.gnu.org; Sun, 27 Sep 2020 11:32:40 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:52525) by eggs.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1kMYfC-0003sX-Tc; Sun, 27 Sep 2020 11:32:34 -0400 Received: from [2a01:e0a:1d:7270:af76:b9b:ca24:c465] (port=38894 helo=gnu.org) by fencepost.gnu.org with esmtpsa (TLS1.2:DHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.82) (envelope-from ) id 1kMYfB-00016f-AV; Sun, 27 Sep 2020 11:32:34 -0400 From: Ludovic =?utf-8?q?Court=C3=A8s?= Date: Sun, 27 Sep 2020 17:32:15 +0200 Message-Id: <20200927153221.9154-2-ludo@gnu.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200927153221.9154-1-ludo@gnu.org> References: <20200927153221.9154-1-ludo@gnu.org> MIME-Version: 1.0 X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: guix-patches@gnu.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-patches-bounces+patchwork=mira.cbaines.net@gnu.org Sender: "Guix-patches" X-getmail-retrieved-from-mailbox: Patches * gnu/services/virtualization.scm (hurd-vm-service-type)[description]: Mention "childhurd". --- gnu/services/virtualization.scm | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/gnu/services/virtualization.scm b/gnu/services/virtualization.scm index 55a19d7af9..d184eea746 100644 --- a/gnu/services/virtualization.scm +++ b/gnu/services/virtualization.scm @@ -1000,4 +1000,5 @@ is added to the OS specified in CONFIG." (const %hurd-vm-accounts)))) (default-value (hurd-vm-configuration)) (description - "Provide a Virtual Machine running the GNU/Hurd."))) + "Provide a virtual machine (VM) running GNU/Hurd, also known as a +@dfn{childhurd}."))) From patchwork Sun Sep 27 15:32:16 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: =?utf-8?q?Ludovic_Court=C3=A8s?= X-Patchwork-Id: 24349 Return-Path: X-Original-To: patchwork@mira.cbaines.net Delivered-To: patchwork@mira.cbaines.net Received: by mira.cbaines.net (Postfix, from userid 113) id D098327BBE9; Sun, 27 Sep 2020 16:33:20 +0100 (BST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on mira.cbaines.net X-Spam-Level: X-Spam-Status: No, score=-2.9 required=5.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_MSPIKE_H4,RCVD_IN_MSPIKE_WL autolearn=unavailable autolearn_force=no version=3.4.2 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mira.cbaines.net (Postfix) with ESMTPS id 9D23727BBE8 for ; Sun, 27 Sep 2020 16:33:20 +0100 (BST) Received: from localhost ([::1]:50626 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1kMYfv-0003Ip-Rj for patchwork@mira.cbaines.net; Sun, 27 Sep 2020 11:33:19 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:54504) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1kMYfg-00030Y-2r for guix-patches@gnu.org; Sun, 27 Sep 2020 11:33:04 -0400 Received: from debbugs.gnu.org ([209.51.188.43]:38666) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1kMYff-0003uL-Pl for guix-patches@gnu.org; Sun, 27 Sep 2020 11:33:03 -0400 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1kMYff-0002lT-MN for guix-patches@gnu.org; Sun, 27 Sep 2020 11:33:03 -0400 X-Loop: help-debbugs@gnu.org Subject: [bug#43650] [PATCH 3/8] secret-service: Clarify the origin of messages. Resent-From: Ludovic =?utf-8?q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Sun, 27 Sep 2020 15:33:03 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 43650 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 43650@debbugs.gnu.org Cc: Ludovic =?utf-8?q?Court=C3=A8s?= , janneke@gnu.org Received: via spool by 43650-submit@debbugs.gnu.org id=B43650.160122076810550 (code B ref 43650); Sun, 27 Sep 2020 15:33:03 +0000 Received: (at 43650) by debbugs.gnu.org; 27 Sep 2020 15:32:48 +0000 Received: from localhost ([127.0.0.1]:50202 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1kMYfQ-0002k6-C8 for submit@debbugs.gnu.org; Sun, 27 Sep 2020 11:32:48 -0400 Received: from eggs.gnu.org ([209.51.188.92]:47590) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1kMYfL-0002jR-EG for 43650@debbugs.gnu.org; Sun, 27 Sep 2020 11:32:43 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:52529) by eggs.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1kMYfG-0003sg-5i; Sun, 27 Sep 2020 11:32:38 -0400 Received: from [2a01:e0a:1d:7270:af76:b9b:ca24:c465] (port=38894 helo=gnu.org) by fencepost.gnu.org with esmtpsa (TLS1.2:DHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.82) (envelope-from ) id 1kMYfD-00016f-7r; Sun, 27 Sep 2020 11:32:35 -0400 From: Ludovic =?utf-8?q?Court=C3=A8s?= Date: Sun, 27 Sep 2020 17:32:16 +0200 Message-Id: <20200927153221.9154-3-ludo@gnu.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200927153221.9154-1-ludo@gnu.org> References: <20200927153221.9154-1-ludo@gnu.org> MIME-Version: 1.0 X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: guix-patches@gnu.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-patches-bounces+patchwork=mira.cbaines.net@gnu.org Sender: "Guix-patches" X-getmail-retrieved-from-mailbox: Patches * gnu/build/secret-service.scm (secret-service-send-secrets) (secret-service-receive-secrets): Prefix messages by "secret service". --- gnu/build/secret-service.scm | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/gnu/build/secret-service.scm b/gnu/build/secret-service.scm index 781651e90d..aafb1684b5 100644 --- a/gnu/build/secret-service.scm +++ b/gnu/build/secret-service.scm @@ -54,11 +54,14 @@ local PORT. If connect fails, sleep 1s and retry RETRY times." (lambda (key . args) (when (zero? retry) (apply throw key args)) - (format (current-error-port) "retrying connection~%") + (format (current-error-port) + "secret service: retrying connection [~a attempts left]~%" + (- retry 1)) (sleep 1) (loop (1- retry))))) - (format (current-error-port) "connected! sending files in ~s %~" + (format (current-error-port) + "secret service: connected; sending files in ~s~%" secret-root) (let* ((files (if secret-root (find-files secret-root) '())) (files-sizes-modes (map file->file+size+mode files)) @@ -82,11 +85,12 @@ Write them to the file system." (bind sock AF_INET INADDR_ANY port) (listen sock 1) (format (current-error-port) - "waiting for secrets on port ~a...~%" + "secret service: waiting for secrets on port ~a...~%" port) (match (accept sock) ((client . address) - (format (current-error-port) "client connection from ~a~%" + (format (current-error-port) + "secret service: client connection from ~a~%" (inet-ntop (sockaddr:fam address) (sockaddr:addr address))) (close-port sock) @@ -116,7 +120,8 @@ Write them to the file system." ('files ((files sizes modes) ...))) (for-each (lambda (file size mode) (format (current-error-port) - "installing file '~a' (~a bytes)...~%" + "secret service: \ +installing file '~a' (~a bytes)...~%" file size) (mkdir-p (dirname file)) (call-with-output-file file @@ -126,7 +131,7 @@ Write them to the file system." files sizes modes)) (_ (format (current-error-port) - "invalid secrets received~%") + "secret service: invalid secrets received~%") #f))) (let* ((port (wait-for-client port)) From patchwork Sun Sep 27 15:32:17 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: =?utf-8?q?Ludovic_Court=C3=A8s?= X-Patchwork-Id: 24347 Return-Path: X-Original-To: patchwork@mira.cbaines.net Delivered-To: patchwork@mira.cbaines.net Received: by mira.cbaines.net (Postfix, from userid 113) id 4689327BBE9; Sun, 27 Sep 2020 16:33:12 +0100 (BST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on mira.cbaines.net X-Spam-Level: X-Spam-Status: No, score=-2.9 required=5.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_MSPIKE_H4,RCVD_IN_MSPIKE_WL autolearn=unavailable autolearn_force=no version=3.4.2 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mira.cbaines.net (Postfix) with ESMTPS id 2040327BBE8 for ; Sun, 27 Sep 2020 16:33:12 +0100 (BST) Received: from localhost ([::1]:50080 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1kMYfn-00033S-70 for patchwork@mira.cbaines.net; Sun, 27 Sep 2020 11:33:11 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:54506) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1kMYfg-00030t-EQ for guix-patches@gnu.org; Sun, 27 Sep 2020 11:33:04 -0400 Received: from debbugs.gnu.org ([209.51.188.43]:38667) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1kMYfg-0003uQ-53 for guix-patches@gnu.org; Sun, 27 Sep 2020 11:33:04 -0400 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1kMYfg-0002la-2b for guix-patches@gnu.org; Sun, 27 Sep 2020 11:33:04 -0400 X-Loop: help-debbugs@gnu.org Subject: [bug#43650] [PATCH 4/8] services: hurd-vm: Check whether /dev/kvm exists at run time. Resent-From: Ludovic =?utf-8?q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Sun, 27 Sep 2020 15:33:04 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 43650 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 43650@debbugs.gnu.org Cc: Ludovic =?utf-8?q?Court=C3=A8s?= , janneke@gnu.org Received: via spool by 43650-submit@debbugs.gnu.org id=B43650.160122077810577 (code B ref 43650); Sun, 27 Sep 2020 15:33:04 +0000 Received: (at 43650) by debbugs.gnu.org; 27 Sep 2020 15:32:58 +0000 Received: from localhost ([127.0.0.1]:50205 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1kMYfZ-0002kW-MG for submit@debbugs.gnu.org; Sun, 27 Sep 2020 11:32:57 -0400 Received: from eggs.gnu.org ([209.51.188.92]:47620) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1kMYfT-0002k3-Cc for 43650@debbugs.gnu.org; Sun, 27 Sep 2020 11:32:56 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:52533) by eggs.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1kMYfO-0003t8-4N; Sun, 27 Sep 2020 11:32:46 -0400 Received: from [2a01:e0a:1d:7270:af76:b9b:ca24:c465] (port=38894 helo=gnu.org) by fencepost.gnu.org with esmtpsa (TLS1.2:DHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.82) (envelope-from ) id 1kMYfG-00016f-Ia; Sun, 27 Sep 2020 11:32:40 -0400 From: Ludovic =?utf-8?q?Court=C3=A8s?= Date: Sun, 27 Sep 2020 17:32:17 +0200 Message-Id: <20200927153221.9154-4-ludo@gnu.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200927153221.9154-1-ludo@gnu.org> References: <20200927153221.9154-1-ludo@gnu.org> MIME-Version: 1.0 X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: guix-patches@gnu.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-patches-bounces+patchwork=mira.cbaines.net@gnu.org Sender: "Guix-patches" X-getmail-retrieved-from-mailbox: Patches This change allows a childhurd to run within Guix System in a VM. * gnu/services/virtualization.scm (hurd-vm-shepherd-service)[vm-command]: Stage the 'file-exists?' call. --- gnu/services/virtualization.scm | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/gnu/services/virtualization.scm b/gnu/services/virtualization.scm index d184eea746..b84203ad18 100644 --- a/gnu/services/virtualization.scm +++ b/gnu/services/virtualization.scm @@ -937,13 +937,14 @@ is added to the OS specified in CONFIG." (provisions '(hurd-vm childhurd))) (define vm-command - #~(list - (string-append #$qemu "/bin/qemu-system-i386") - #$@(if (file-exists? "/dev/kvm") '("--enable-kvm") '()) - "-m" (number->string #$memory-size) - #$@net-options - #$@options - "--hda" #+image)) + #~(append (list #$(file-append qemu "/bin/qemu-system-i386") + "-m" (number->string #$memory-size) + #$@net-options + #$@options + "--hda" #+image) + (if (file-exists? "/dev/kvm") + '("--enable-kvm") + '()))) (list (shepherd-service From patchwork Sun Sep 27 15:32:18 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: =?utf-8?q?Ludovic_Court=C3=A8s?= X-Patchwork-Id: 24350 Return-Path: X-Original-To: patchwork@mira.cbaines.net Delivered-To: patchwork@mira.cbaines.net Received: by mira.cbaines.net (Postfix, from userid 113) id 1160A27BBEA; Sun, 27 Sep 2020 16:33:29 +0100 (BST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on mira.cbaines.net X-Spam-Level: X-Spam-Status: No, score=-2.9 required=5.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_MSPIKE_H4,RCVD_IN_MSPIKE_WL,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.2 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mira.cbaines.net (Postfix) with ESMTPS id 73D8E27BBE8 for ; Sun, 27 Sep 2020 16:33:28 +0100 (BST) Received: from localhost ([::1]:50852 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1kMYg3-0003P0-JQ for patchwork@mira.cbaines.net; Sun, 27 Sep 2020 11:33:27 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:54508) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1kMYfg-00031f-Sr for guix-patches@gnu.org; Sun, 27 Sep 2020 11:33:04 -0400 Received: from debbugs.gnu.org ([209.51.188.43]:38669) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1kMYfg-0003uY-Jh for guix-patches@gnu.org; Sun, 27 Sep 2020 11:33:04 -0400 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1kMYfg-0002lh-GH for guix-patches@gnu.org; Sun, 27 Sep 2020 11:33:04 -0400 X-Loop: help-debbugs@gnu.org Subject: [bug#43650] [PATCH 5/8] services: guix: Generate key pair if needed during activation. Resent-From: Ludovic =?utf-8?q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Sun, 27 Sep 2020 15:33:04 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 43650 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 43650@debbugs.gnu.org Cc: Ludovic =?utf-8?q?Court=C3=A8s?= , janneke@gnu.org Received: via spool by 43650-submit@debbugs.gnu.org id=B43650.160122078110594 (code B ref 43650); Sun, 27 Sep 2020 15:33:04 +0000 Received: (at 43650) by debbugs.gnu.org; 27 Sep 2020 15:33:01 +0000 Received: from localhost ([127.0.0.1]:50208 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1kMYfc-0002ko-Vb for submit@debbugs.gnu.org; Sun, 27 Sep 2020 11:33:01 -0400 Received: from eggs.gnu.org ([209.51.188.92]:47660) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1kMYfc-0002kN-6T for 43650@debbugs.gnu.org; Sun, 27 Sep 2020 11:33:00 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:52536) by eggs.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1kMYfW-0003td-U3; Sun, 27 Sep 2020 11:32:54 -0400 Received: from [2a01:e0a:1d:7270:af76:b9b:ca24:c465] (port=38894 helo=gnu.org) by fencepost.gnu.org with esmtpsa (TLS1.2:DHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.82) (envelope-from ) id 1kMYfO-00016f-Dr; Sun, 27 Sep 2020 11:32:53 -0400 From: Ludovic =?utf-8?q?Court=C3=A8s?= Date: Sun, 27 Sep 2020 17:32:18 +0200 Message-Id: <20200927153221.9154-5-ludo@gnu.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200927153221.9154-1-ludo@gnu.org> References: <20200927153221.9154-1-ludo@gnu.org> MIME-Version: 1.0 X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: guix-patches@gnu.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-patches-bounces+patchwork=mira.cbaines.net@gnu.org Sender: "Guix-patches" X-getmail-retrieved-from-mailbox: Patches * gnu/services/base.scm (guix-activation): Invoke "guix archive --generate-key". * doc/guix.texi (Invoking guix archive) (Invoking guix deploy): Mention that 'guix-service-type' takes care of generating the key pair. --- doc/guix.texi | 11 +++++++---- gnu/services/base.scm | 13 +++++++++---- 2 files changed, 16 insertions(+), 8 deletions(-) diff --git a/doc/guix.texi b/doc/guix.texi index 82241b010a..885f7fcf97 100644 --- a/doc/guix.texi +++ b/doc/guix.texi @@ -5048,9 +5048,11 @@ the store. @item --generate-key[=@var{parameters}] @cindex signing, archives Generate a new key pair for the daemon. This is a prerequisite before -archives can be exported with @option{--export}. Note that this -operation usually takes time, because it needs to gather enough entropy -to generate the key pair. +archives can be exported with @option{--export}. This +operation is usually instantaneous but it can take time if the system's +entropy pool needs to be refilled. On Guix System, +@code{guix-service-type} takes care of generating this key pair the +first boot. The generated key pair is typically stored under @file{/etc/guix}, in @file{signing-key.pub} (public key) and @file{signing-key.sec} (private @@ -29531,7 +29533,8 @@ a Virtual Private Server (VPS) provider. In such a case, a different Do note that you first need to generate a key pair on the coordinator machine to allow the daemon to export signed archives of files from the store -(@pxref{Invoking guix archive}). +(@pxref{Invoking guix archive}), though this step is automatic on Guix +System: @example # guix archive --generate-key diff --git a/gnu/services/base.scm b/gnu/services/base.scm index bef4eef241..04bc991356 100644 --- a/gnu/services/base.scm +++ b/gnu/services/base.scm @@ -1653,10 +1653,15 @@ proxy of 'guix-daemon'...~%") ;; otherwise call 'chown' here, but the problem is that on a COW overlayfs, ;; chown leads to an entire copy of the tree, which is a bad idea. - ;; Optionally authorize substitute server keys. - (if authorize-key? - (substitute-key-authorization keys guix) - #~#f)))) + ;; Generate a key pair and optionally authorize substitute server keys. + #~(begin + (unless (file-exists? "/etc/guix/signing-key.pub") + (system* #$(file-append guix "/bin/guix") "archive" + "--generate-key")) + + #$(if authorize-key? + (substitute-key-authorization keys guix) + #~#f))))) (define* (references-file item #:optional (name "references")) "Return a file that contains the list of references of ITEM." From patchwork Sun Sep 27 15:32:19 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: =?utf-8?q?Ludovic_Court=C3=A8s?= X-Patchwork-Id: 24351 Return-Path: X-Original-To: patchwork@mira.cbaines.net Delivered-To: patchwork@mira.cbaines.net Received: by mira.cbaines.net (Postfix, from userid 113) id 1CE1427BBE9; Sun, 27 Sep 2020 16:34:09 +0100 (BST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on mira.cbaines.net X-Spam-Level: X-Spam-Status: No, score=-2.9 required=5.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_MSPIKE_H4,RCVD_IN_MSPIKE_WL,URIBL_BLOCKED autolearn=unavailable autolearn_force=no version=3.4.2 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mira.cbaines.net (Postfix) with ESMTPS id A7F5827BBE8 for ; Sun, 27 Sep 2020 16:34:08 +0100 (BST) Received: from localhost ([::1]:51358 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1kMYgh-0003fP-Rx for patchwork@mira.cbaines.net; Sun, 27 Sep 2020 11:34:07 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:54800) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1kMYgc-0003es-Dh for guix-patches@gnu.org; Sun, 27 Sep 2020 11:34:02 -0400 Received: from debbugs.gnu.org ([209.51.188.43]:38676) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1kMYgc-00043a-4R for guix-patches@gnu.org; Sun, 27 Sep 2020 11:34:02 -0400 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1kMYgc-0002nQ-2J for guix-patches@gnu.org; Sun, 27 Sep 2020 11:34:02 -0400 X-Loop: help-debbugs@gnu.org Subject: [bug#43650] [PATCH 6/8] services: hurd-vm: Initialize the guest's SSH/Guix keys at activation time. Resent-From: Ludovic =?utf-8?q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Sun, 27 Sep 2020 15:34:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 43650 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 43650@debbugs.gnu.org Cc: Ludovic =?utf-8?q?Court=C3=A8s?= , janneke@gnu.org Received: via spool by 43650-submit@debbugs.gnu.org id=B43650.160122078610674 (code B ref 43650); Sun, 27 Sep 2020 15:34:01 +0000 Received: (at 43650) by debbugs.gnu.org; 27 Sep 2020 15:33:06 +0000 Received: from localhost ([127.0.0.1]:50218 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1kMYfi-0002m5-9X for submit@debbugs.gnu.org; Sun, 27 Sep 2020 11:33:06 -0400 Received: from eggs.gnu.org ([209.51.188.92]:47670) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1kMYfe-0002kV-3P for 43650@debbugs.gnu.org; Sun, 27 Sep 2020 11:33:02 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:52538) by eggs.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1kMYfY-0003tu-RN; Sun, 27 Sep 2020 11:32:56 -0400 Received: from [2a01:e0a:1d:7270:af76:b9b:ca24:c465] (port=38894 helo=gnu.org) by fencepost.gnu.org with esmtpsa (TLS1.2:DHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.82) (envelope-from ) id 1kMYfX-00016f-7r; Sun, 27 Sep 2020 11:32:56 -0400 From: Ludovic =?utf-8?q?Court=C3=A8s?= Date: Sun, 27 Sep 2020 17:32:19 +0200 Message-Id: <20200927153221.9154-6-ludo@gnu.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200927153221.9154-1-ludo@gnu.org> References: <20200927153221.9154-1-ludo@gnu.org> MIME-Version: 1.0 X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: guix-patches@gnu.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-patches-bounces+patchwork=mira.cbaines.net@gnu.org Sender: "Guix-patches" X-getmail-retrieved-from-mailbox: Patches * gnu/services/virtualization.scm (initialize-hurd-vm-substitutes) (hurd-vm-activation): New procedures. (hurd-vm-service-type)[extensions]: Add ACTIVATION-SERVICE-TYPE extension. * doc/guix.texi (Transparent Emulation with QEMU): Mention GNU/Hurd. (The Hurd in a Virtual Machine): Explain which files are automatically installed and mention offloading. --- doc/guix.texi | 33 ++++++++++++++-- gnu/services/virtualization.scm | 67 ++++++++++++++++++++++++++++++++- 2 files changed, 96 insertions(+), 4 deletions(-) diff --git a/doc/guix.texi b/doc/guix.texi index 885f7fcf97..851afe843d 100644 --- a/doc/guix.texi +++ b/doc/guix.texi @@ -25342,6 +25342,8 @@ emulation of program binaries built for different architectures---e.g., it allows you to transparently execute an ARMv7 program on an x86_64 machine. It achieves this by combining the @uref{https://www.qemu.org, QEMU} emulator and the @code{binfmt_misc} feature of the kernel Linux. +This feature only allows you to emulate GNU/Linux on a different +architecture, but see below for GNU/Hurd support. @defvr {Scheme Variable} qemu-binfmt-service-type This is the type of the QEMU/binfmt service for transparent emulation. @@ -25544,10 +25546,11 @@ If the @file{/etc/childhurd} directory does not exist, the @code{secret-service} running in the Childhurd will be sent an empty list of secrets. -Typical use to populate @file{"/etc/childhurd"} with a tree of -non-volatile secrets, like so +By default, the service automatically populates @file{/etc/childhurd} +with the following non-volatile secrets, unless they already exist: @example +/etc/childhurd/etc/guix/acl /etc/childhurd/etc/guix/signing-key.pub /etc/childhurd/etc/guix/signing-key.sec /etc/childhurd/etc/ssh/ssh_host_ed25519_key @@ -25556,8 +25559,32 @@ non-volatile secrets, like so /etc/childhurd/etc/ssh/ssh_host_ecdsa_key.pub @end example -to be sent to the Childhurd, including permissions. +These files are automatically sent to the guest Hurd VM when it boots, +including permissions. +@cindex childhurd, offloading +@cindex Hurd, offloading +Having these files in place means that only a couple of things are +missing to allow the host to offload @code{i586-gnu} builds to the +childhurd: + +@enumerate +@item +Authorizing the childhurd's key on the host so that the host accepts +build results coming from the childhurd, which can be done like so: + +@example +guix archive --authorize < \ + /etc/childhurd/etc/guix/signing-key.pub +@end example + +@item +Adding the childhurd to @file{/etc/guix/machines.scm} (@pxref{Daemon +Offload Setup}). +@end enumerate + +We're working towards making that happen automatically---get in touch +with us at @email{guix-devel@@gnu.org} to discuss it! @end table @end deftp diff --git a/gnu/services/virtualization.scm b/gnu/services/virtualization.scm index b84203ad18..c639fa3741 100644 --- a/gnu/services/virtualization.scm +++ b/gnu/services/virtualization.scm @@ -23,6 +23,7 @@ #:use-module (gnu bootloader grub) #:use-module (gnu image) #:use-module (gnu packages admin) + #:use-module (gnu packages package-management) #:use-module (gnu packages ssh) #:use-module (gnu packages virtualization) #:use-module (gnu services base) @@ -992,13 +993,77 @@ is added to the OS specified in CONFIG." (shell (file-append shadow "/sbin/nologin")) (system? #t)))) +(define (initialize-hurd-vm-substitutes) + "Initialize the Hurd VM's key pair and ACL and store it on the host." + (define run + (with-imported-modules '((guix build utils)) + #~(begin + (use-modules (guix build utils) + (ice-9 match)) + + (define host-key + "/etc/guix/signing-key.pub") + + (define host-acl + "/etc/guix/acl") + + (match (command-line) + ((_ guest-config-directory) + (setenv "GUIX_CONFIGURATION_DIRECTORY" + guest-config-directory) + (invoke #+(file-append guix "/bin/guix") "archive" + "--generate-key") + + (when (file-exists? host-acl) + ;; Copy the host ACL. + (copy-file host-acl + (string-append guest-config-directory + "/acl"))) + + (when (file-exists? host-key) + ;; Add the host key to the childhurd's ACL. + (let ((key (open-fdes host-key O_RDONLY))) + (close-fdes 0) + (dup2 key 0) + (execl #+(file-append guix "/bin/guix") + "guix" "archive" "--authorize")))))))) + + (program-file "initialize-hurd-vm-substitutes" run)) + +(define (hurd-vm-activation config) + "Return a gexp to activate the Hurd VM according to CONFIG." + (with-imported-modules '((guix build utils)) + #~(begin + (use-modules (guix build utils)) + + (define secret-directory + #$(hurd-vm-configuration-secret-root config)) + + (define ssh-directory + (string-append secret-directory "/etc/ssh")) + + (define guix-directory + (string-append secret-directory "/etc/guix")) + + (unless (file-exists? ssh-directory) + ;; Generate SSH host keys under SSH-DIRECTORY. + (mkdir-p ssh-directory) + (invoke #$(file-append openssh "/bin/ssh-keygen") + "-A" "-f" secret-directory)) + + (unless (file-exists? guix-directory) + (invoke #$(initialize-hurd-vm-substitutes) + guix-directory))))) + (define hurd-vm-service-type (service-type (name 'hurd-vm) (extensions (list (service-extension shepherd-root-service-type hurd-vm-shepherd-service) (service-extension account-service-type - (const %hurd-vm-accounts)))) + (const %hurd-vm-accounts)) + (service-extension activation-service-type + hurd-vm-activation))) (default-value (hurd-vm-configuration)) (description "Provide a virtual machine (VM) running GNU/Hurd, also known as a From patchwork Sun Sep 27 15:32:20 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: =?utf-8?q?Ludovic_Court=C3=A8s?= X-Patchwork-Id: 24352 Return-Path: X-Original-To: patchwork@mira.cbaines.net Delivered-To: patchwork@mira.cbaines.net Received: by mira.cbaines.net (Postfix, from userid 113) id 77F4A27BBEA; Sun, 27 Sep 2020 16:34:18 +0100 (BST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on mira.cbaines.net X-Spam-Level: X-Spam-Status: No, score=-2.9 required=5.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_MSPIKE_H4,RCVD_IN_MSPIKE_WL autolearn=unavailable autolearn_force=no version=3.4.2 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mira.cbaines.net (Postfix) with ESMTPS id 750AA27BBE8 for ; Sun, 27 Sep 2020 16:34:17 +0100 (BST) Received: from localhost ([::1]:51394 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1kMYgo-0003gi-RD for patchwork@mira.cbaines.net; Sun, 27 Sep 2020 11:34:16 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:54802) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1kMYgc-0003f0-QJ for guix-patches@gnu.org; Sun, 27 Sep 2020 11:34:02 -0400 Received: from debbugs.gnu.org ([209.51.188.43]:38677) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1kMYgc-00043e-HE for guix-patches@gnu.org; Sun, 27 Sep 2020 11:34:02 -0400 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1kMYgc-0002nY-FK for guix-patches@gnu.org; Sun, 27 Sep 2020 11:34:02 -0400 X-Loop: help-debbugs@gnu.org Subject: [bug#43650] [PATCH 7/8] services: hurd-vm: Pass "-no-reboot" when spawning the Hurd VM. Resent-From: Ludovic =?utf-8?q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Sun, 27 Sep 2020 15:34:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 43650 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 43650@debbugs.gnu.org Cc: Ludovic =?utf-8?q?Court=C3=A8s?= , janneke@gnu.org Received: via spool by 43650-submit@debbugs.gnu.org id=B43650.160122078710682 (code B ref 43650); Sun, 27 Sep 2020 15:34:02 +0000 Received: (at 43650) by debbugs.gnu.org; 27 Sep 2020 15:33:07 +0000 Received: from localhost ([127.0.0.1]:50220 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1kMYfi-0002m7-M9 for submit@debbugs.gnu.org; Sun, 27 Sep 2020 11:33:06 -0400 Received: from eggs.gnu.org ([209.51.188.92]:47676) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1kMYff-0002kf-7Y for 43650@debbugs.gnu.org; Sun, 27 Sep 2020 11:33:03 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:52547) by eggs.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1kMYfZ-0003u0-VY; Sun, 27 Sep 2020 11:32:57 -0400 Received: from [2a01:e0a:1d:7270:af76:b9b:ca24:c465] (port=38894 helo=gnu.org) by fencepost.gnu.org with esmtpsa (TLS1.2:DHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.82) (envelope-from ) id 1kMYfZ-00016f-8H; Sun, 27 Sep 2020 11:32:57 -0400 From: Ludovic =?utf-8?q?Court=C3=A8s?= Date: Sun, 27 Sep 2020 17:32:20 +0200 Message-Id: <20200927153221.9154-7-ludo@gnu.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200927153221.9154-1-ludo@gnu.org> References: <20200927153221.9154-1-ludo@gnu.org> MIME-Version: 1.0 X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: guix-patches@gnu.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-patches-bounces+patchwork=mira.cbaines.net@gnu.org Sender: "Guix-patches" X-getmail-retrieved-from-mailbox: Patches * gnu/services/virtualization.scm (hurd-vm-shepherd-service)[vm-command]: Add "--no-reboot". --- gnu/services/virtualization.scm | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/gnu/services/virtualization.scm b/gnu/services/virtualization.scm index c639fa3741..a50cf8b733 100644 --- a/gnu/services/virtualization.scm +++ b/gnu/services/virtualization.scm @@ -942,7 +942,12 @@ is added to the OS specified in CONFIG." "-m" (number->string #$memory-size) #$@net-options #$@options - "--hda" #+image) + "--hda" #+image + + ;; Cause the service to be respawned if the guest + ;; reboots (it can reboot for instance if it did not + ;; receive valid secrets, or if it crashed.) + "--no-reboot") (if (file-exists? "/dev/kvm") '("--enable-kvm") '()))) From patchwork Sun Sep 27 15:32:21 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: =?utf-8?q?Ludovic_Court=C3=A8s?= X-Patchwork-Id: 24353 Return-Path: X-Original-To: patchwork@mira.cbaines.net Delivered-To: patchwork@mira.cbaines.net Received: by mira.cbaines.net (Postfix, from userid 113) id 6535927BBE9; Sun, 27 Sep 2020 16:35:00 +0100 (BST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on mira.cbaines.net X-Spam-Level: X-Spam-Status: No, score=-2.9 required=5.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_MSPIKE_H4,RCVD_IN_MSPIKE_WL autolearn=unavailable autolearn_force=no version=3.4.2 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mira.cbaines.net (Postfix) with ESMTPS id 0BE7427BBE8 for ; Sun, 27 Sep 2020 16:35:00 +0100 (BST) Received: from localhost ([::1]:51794 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1kMYhX-0003t0-8j for patchwork@mira.cbaines.net; Sun, 27 Sep 2020 11:34:59 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:54804) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1kMYgd-0003fI-71 for guix-patches@gnu.org; Sun, 27 Sep 2020 11:34:03 -0400 Received: from debbugs.gnu.org ([209.51.188.43]:38678) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1kMYgc-00043i-UG for guix-patches@gnu.org; Sun, 27 Sep 2020 11:34:02 -0400 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1kMYgc-0002ng-S9 for guix-patches@gnu.org; Sun, 27 Sep 2020 11:34:02 -0400 X-Loop: help-debbugs@gnu.org Subject: [bug#43650] [PATCH 8/8] secret-service: Add a timeout when waiting for a client. Resent-From: Ludovic =?utf-8?q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Sun, 27 Sep 2020 15:34:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 43650 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 43650@debbugs.gnu.org Cc: Ludovic =?utf-8?q?Court=C3=A8s?= , janneke@gnu.org Received: via spool by 43650-submit@debbugs.gnu.org id=B43650.160122078710688 (code B ref 43650); Sun, 27 Sep 2020 15:34:02 +0000 Received: (at 43650) by debbugs.gnu.org; 27 Sep 2020 15:33:07 +0000 Received: from localhost ([127.0.0.1]:50222 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1kMYfj-0002mF-1E for submit@debbugs.gnu.org; Sun, 27 Sep 2020 11:33:07 -0400 Received: from eggs.gnu.org ([209.51.188.92]:47680) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1kMYfg-0002kh-An for 43650@debbugs.gnu.org; Sun, 27 Sep 2020 11:33:04 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:52548) by eggs.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1kMYfb-0003u6-2n; Sun, 27 Sep 2020 11:32:59 -0400 Received: from [2a01:e0a:1d:7270:af76:b9b:ca24:c465] (port=38894 helo=gnu.org) by fencepost.gnu.org with esmtpsa (TLS1.2:DHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.82) (envelope-from ) id 1kMYfa-00016f-C5; Sun, 27 Sep 2020 11:32:58 -0400 From: Ludovic =?utf-8?q?Court=C3=A8s?= Date: Sun, 27 Sep 2020 17:32:21 +0200 Message-Id: <20200927153221.9154-8-ludo@gnu.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200927153221.9154-1-ludo@gnu.org> References: <20200927153221.9154-1-ludo@gnu.org> MIME-Version: 1.0 X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: guix-patches@gnu.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-patches-bounces+patchwork=mira.cbaines.net@gnu.org Sender: "Guix-patches" X-getmail-retrieved-from-mailbox: Patches * gnu/build/secret-service.scm (secret-service-receive-secrets) [wait-for-client]: Call 'select' with a 60s timeout before 'accept'. Return #f upon timeout. [read-secrets]: Return FILES on success. Adjust caller of 'wait-for-client' to handle #f. --- gnu/build/secret-service.scm | 33 +++++++++++++++++++++------------ 1 file changed, 21 insertions(+), 12 deletions(-) diff --git a/gnu/build/secret-service.scm b/gnu/build/secret-service.scm index aafb1684b5..40c24abf09 100644 --- a/gnu/build/secret-service.scm +++ b/gnu/build/secret-service.scm @@ -75,7 +75,8 @@ local PORT. If connect fails, sleep 1s and retry RETRY times." (define (secret-service-receive-secrets port) "Listen to local PORT and wait for a secret service client to send secrets. -Write them to the file system." +Write them to the file system. Return the list of files installed on success, +and #f otherwise." (define (wait-for-client port) ;; Wait for a TCP connection on PORT. Note: We cannot use the @@ -87,14 +88,20 @@ Write them to the file system." (format (current-error-port) "secret service: waiting for secrets on port ~a...~%" port) - (match (accept sock) - ((client . address) + (match (select (list sock) '() '() 60) + (((_) () ()) + (match (accept sock) + ((client . address) + (format (current-error-port) + "secret service: client connection from ~a~%" + (inet-ntop (sockaddr:fam address) + (sockaddr:addr address))) + (close-port sock) + client))) + ((() () ()) (format (current-error-port) - "secret service: client connection from ~a~%" - (inet-ntop (sockaddr:fam address) - (sockaddr:addr address))) - (close-port sock) - client)))) + "secret service: did not receive any secrets; time out~%") + #f)))) ;; TODO: Remove when (@ (guix build utils) dump-port) has a 'size' ;; parameter. @@ -128,15 +135,17 @@ installing file '~a' (~a bytes)...~%" (lambda (output) (dump port output size) (chmod file mode)))) - files sizes modes)) + files sizes modes) + files) (_ (format (current-error-port) "secret service: invalid secrets received~%") #f))) - (let* ((port (wait-for-client port)) - (result (read-secrets port))) - (close-port port) + (let* ((port (wait-for-client port)) + (result (and=> port read-secrets))) + (when port + (close-port port)) result)) ;;; secret-service.scm ends here