Add GNOME3 ISO, Don't run graphical installer ISOs as root #66313

worldofpeace · 2019-08-08T04:25:03Z

Motivation for this change

I think it's a great idea to provide another graphical iso.
I've seen people turn away from nixos because they somehow thought the only DE
choice was plasma5.

This also renames the regular iso_graphical image to iso_graphical_plasma5.
We already definitely have to organize updating

https://nixos.org/nixos/download.html

to accommodate this.

Some of you may be interested in the ISO size and it's

1.5 GB

Probably most important commit here is d3c9489.

The graphical installer will no longer use root, but a less privileged live user.
I'm going to quote the commit message here

There's many reason why it is and is going to
continue to be difficult to do this:

1. All display-managers (excluding slim) default PAM rules
   disallow root auto login.

2. We can't use wayland

3. We have to use system-wide pulseaudio

4. It could break applications in the session.
   This happened to dolphin in plasma5
   in the past.

Because of 1 and 2 it completely prevented me from doing this.
This change was already seen in #42610 and my opinion was received as reactive.
I hope this better supports my claim, this is going to be more work for us in the long run to maintain.

Now you could say the ISO should just use slim, but this project is abandoned and we really shouldn't be using it. Not to mention it wouldn't integrate at all with gnome.

Things done

I've ran the gnome and plasma5 iso's in qemu and they seemed to work fine.

There's many reason why it is and is going to continue to be difficult to do this: 1. All display-managers (excluding slim) default PAM rules disallow root auto login. 2. We can't use wayland 3. We have to use system-wide pulseaudio 4. It could break applications in the session. This happened to dolphin in plasma5 in the past. This is a growing technical debt, let's just use passwordless sudo.

Note we're not using wayland default in the graphical media because it could cause headaches for Nvidia users. But the session is still available.

And all the other things and paths to match it

lheckemann

Overall I like it!

One concern I have is that this would add another big file to the release, and @edolstra may not like that.

nixos/doc/manual/installation/installing.xml

nixos/modules/installer/cd-dvd/installation-cd-graphical-plasma5.nix

lheckemann · 2019-08-08T07:53:28Z

nixos/modules/installer/cd-dvd/installation-cd-graphical-plasma5.nix

@@ -30,15 +30,27 @@ with lib;
      Version=1.0
      Type=Application
      Name=NixOS Manual
-      Exec=firefox ${config.system.build.manual.manualHTMLIndex}
+      Exec=firefox ${config.system.build.manual.manual}/share/doc/nixos/index.html


Did the manualHTMLIndex variant not work?

Thought on the side: maybe this should be extracted into the nixos manual module…

edolstra · 2019-08-08T10:24:31Z

nixos/release.nix

-  iso_graphical = forMatchingSystems [ "x86_64-linux" ] (system: makeIso {
-    module = ./modules/installer/cd-dvd/installation-cd-graphical-kde.nix;
-    type = "graphical";
+  iso_graphical_plasma5 = forMatchingSystems [ "x86_64-linux" ] (system: makeIso {


Note that renaming iso_graphical will break the NixOS channel generation script.

edolstra · 2019-08-08T10:27:56Z

I'm not too keen on providing multiple graphical ISOs. Apart from the overhead this adds to the release process (in terms of storage costs and upload time), I'd rather have one well-tested ISO than multiple poorly tested ones. It also adds friction for new users since they have to decide which ISO to download, and it's not obvious which one is better.

edolstra · 2019-08-08T10:35:07Z

nixos/modules/installer/cd-dvd/installation-cd-graphical-base.nix

@@ -8,6 +8,30 @@ with lib;
 {
  imports = [ ./installation-cd-base.nix ];

+  users.extraUsers.live = {
+    isNormalUser = true;
+    uid = 1000;


We probably shouldn't use UIDs in the >1000 range since that's reserved for users. Maybe just leave out the UID?

edolstra · 2019-08-08T10:36:49Z

nixos/modules/installer/cd-dvd/installation-cd-graphical-base.nix

+  users.extraUsers.live = {
+    isNormalUser = true;
+    uid = 1000;
+    extraGroups = [ "wheel" "networkmanager" "video" ];


Are networkmanager and video needed? NetworkManager should work for locally logged-in users without it, and likewise logged-in users get access for /dev/video* via an ACL.

I'm not sure. I think I'd have an issue on my own installation if I didn't use this. I've received guidance that this should be done, but I've yet to verify this.

I will find out 👍

I tried this in a vm and it caused it to require authentication to initiate a connection with networkmanager. Not sure about video though but perhaps it's fine to leave it.

edolstra · 2019-08-08T10:39:36Z

We could merge this without the changes to nixos/release.nix for now.

worldofpeace · 2019-08-08T11:53:59Z

@edolstra
I'm not too keen on providing multiple graphical ISOs. Apart from the overhead this adds to the release process (in terms of storage costs and upload time), I'd rather have one well-tested ISO than multiple poorly tested ones. It also adds friction for new users since they have to decide which ISO to download, and it's not obvious which one is better.

Are we saying that manually testing these is the way to go?
Because if we had good automated tested for these it shouldn't be a problem how many ISO's we distribute, aside from the technical overhead. Additionally, I've put a lot of work into GNOME3 in NixOS, I'd like my work to be visible to users trying it. It's a good way to attract desktop users in general.

Additionally, any graphical ISO would be better for new users. And I'm not sure we'd be able to deduce one as being "better" plainly but better for a particular person's preference. I'd say it's simply another option of graphical ISO so I don't think it would cause to much trouble in the decision process.

@lheckemann
One concern I have is that this would add another big file to the release

Indeed it is a big file, but it's still smaller than other GNOME3 based iso's in the wild.

Examples

Ubuntu 19.04 (2.1 GB)
Fedora Workstation 30 (1.9)
Manjaro (2.0 GB)
Pop!_OS (2.1 GB)

Though Opensuse Leap has somehow got it to 921 MB.

So I'd say, comparatively, it's in line with being one of the smaller ones.

@edolstra
We could merge this without the changes to nixos/release.nix for now.

I can see how we wouldn't want to block this on that, I respect your guidance if you think the technical overhead should cause us to consider carefully adding this to the release.

samueldr

We need all installer images to run under the same user. The minimal one included.

Otherwise, this may cause issues in writing documentation, and supporting users. Assumptions will be made "they are running ____" but instead they are running ____, thus the assumption doesn't hold and they need to either run through sudo or not.

Though, I'm not saying that graphical images must be run as root, only that all installers should use the same user, and relevant installation notes fixed, if needs be.

worldofpeace · 2019-08-08T15:09:53Z

@samueldr Ah I overlooked that, I will move that to installation-device.nix etc.

Note I think the ova image uses a demo user already, but that was inconsistent before this.

* Move the config to installation-device.nix * correct mingetty helpline polkit config is still in graphical-base because that is where polkit is useful.

* Don't use old users.extraUsers option. * Don't set uid.

… root Fixup the release note.

…ISOs as root

worldofpeace · 2019-08-08T18:04:57Z

So I've decided with some guidance from @grahamc that it would help me to split this into smaller PR's.

First one will be Don't run installer as root.
The other stuff will come after since this needs that change first.

worldofpeace added 3 commits August 8, 2019 00:10

nixos/release: add GNOME3 ISO

6c5dd0b

Note we're not using wayland default in the graphical media because it could cause headaches for Nvidia users. But the session is still available.

nixos/release: rename iso_graphical to iso_graphical_plasma5

3ea0206

And all the other things and paths to match it

worldofpeace requested review from grahamc, samueldr, lheckemann, etu, disassembler, jtojnar and edolstra August 8, 2019 04:25

worldofpeace force-pushed the gnome3-iso branch from fded89f to 3ea0206 Compare August 8, 2019 04:26

ofborg bot added 6.topic: nixos 8.has: changelog 8.has: documentation 8.has: module (update) 10.rebuild-darwin: 0 10.rebuild-linux: 0 labels Aug 8, 2019

lheckemann approved these changes Aug 8, 2019

View reviewed changes

edolstra reviewed Aug 8, 2019

View reviewed changes

samueldr requested changes Aug 8, 2019

View reviewed changes

worldofpeace added 4 commits August 8, 2019 11:33

fixup! installer: Don't run graphical installer ISOs as root

d181cc6

* Move the config to installation-device.nix * correct mingetty helpline polkit config is still in graphical-base because that is where polkit is useful.

fixup! fixup! installer: Don't run graphical installer ISOs as root

70e6869

* Don't use old users.extraUsers option. * Don't set uid.

fixup! fixup! fixup! installer: Don't run graphical installer ISOs as…

64b666a

… root Fixup the release note.

fixup! fixup! fixup! fixup! installer: Don't run graphical installer …

da25ab2

…ISOs as root

worldofpeace added the 6.topic: GNOME GNOME desktop environment and its underlying platform label Aug 8, 2019

ofborg bot removed the 6.topic: GNOME GNOME desktop environment and its underlying platform label Aug 8, 2019

worldofpeace closed this Aug 8, 2019

worldofpeace mentioned this pull request Aug 8, 2019

installer: Don't run as root #66338

Merged

10 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add GNOME3 ISO, Don't run graphical installer ISOs as root #66313

Add GNOME3 ISO, Don't run graphical installer ISOs as root #66313

worldofpeace commented Aug 8, 2019 •

edited

lheckemann left a comment

lheckemann Aug 8, 2019

edolstra Aug 8, 2019

edolstra commented Aug 8, 2019

edolstra Aug 8, 2019

edolstra Aug 8, 2019

worldofpeace Aug 8, 2019

worldofpeace Aug 8, 2019

edolstra commented Aug 8, 2019

worldofpeace commented Aug 8, 2019 •

edited

samueldr left a comment •

edited

worldofpeace commented Aug 8, 2019 •

edited

worldofpeace commented Aug 8, 2019

Add GNOME3 ISO, Don't run graphical installer ISOs as root #66313

Add GNOME3 ISO, Don't run graphical installer ISOs as root #66313

Conversation

worldofpeace commented Aug 8, 2019 • edited

Motivation for this change

Things done

lheckemann left a comment

Choose a reason for hiding this comment

lheckemann Aug 8, 2019

Choose a reason for hiding this comment

edolstra Aug 8, 2019

Choose a reason for hiding this comment

edolstra commented Aug 8, 2019

edolstra Aug 8, 2019

Choose a reason for hiding this comment

edolstra Aug 8, 2019

Choose a reason for hiding this comment

worldofpeace Aug 8, 2019

Choose a reason for hiding this comment

worldofpeace Aug 8, 2019

Choose a reason for hiding this comment

edolstra commented Aug 8, 2019

worldofpeace commented Aug 8, 2019 • edited

samueldr left a comment • edited

Choose a reason for hiding this comment

worldofpeace commented Aug 8, 2019 • edited

worldofpeace commented Aug 8, 2019

worldofpeace commented Aug 8, 2019 •

edited

worldofpeace commented Aug 8, 2019 •

edited

samueldr left a comment •

edited

worldofpeace commented Aug 8, 2019 •

edited