Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[RFC 0052] Away from static IDs #52

Merged
merged 13 commits into from Oct 21, 2019
Merged

[RFC 0052] Away from static IDs #52

merged 13 commits into from Oct 21, 2019

Conversation

infinisil
Copy link
Member

Summary

A lot of NixOS modules are assigning static uids/gids to their users. This has resulted in less than 90 static ids left in the reserved range from 0 to 400.

This RFC deprecates the practice of doing that and instead suggests to

  • If applicable use systemd's DynamicUser
  • Otherwise let NixOS assign dynamic persistent ids, which happens automatically when users.users.<name?>.uid/users.groups.<name?>.gid is not set. For users, users.users.<name?>.isSystemUser should be set so that only uids under 1000 are used by NixOS services.

Only in special circumstances are static ids allowed anymore.

Rendered

Partial implementation PR: NixOS/nixpkgs#65698

cc @edolstra @aanderse @ryantm @arianvp @globin @volth @arcnmx

@infinisil infinisil mentioned this pull request Sep 5, 2019
Merged
@Profpatsch
Copy link
Member

Does DynamicUser magically work when migrating between machines (as compared to the mapping file)?

@infinisil
Copy link
Member Author

@Profpatsch If you need a stateful directory with DynamicUser, you need to use StateDirectory for it, which ensures correct permissions, so yeah this should just work.

@Mic92 Mic92 mentioned this pull request Sep 5, 2019
Closed
@edolstra edolstra changed the title [RFC 0052] Away from static ids [RFC 0052] Away from static IDs Sep 5, 2019
@nixos-discourse
Copy link

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/new-rfc-52-away-from-static-ids/3931/1

@edolstra edolstra added status: open for nominations Open for shepherding team nominations and removed status: new labels Sep 5, 2019
@edolstra
Copy link
Member

edolstra commented Sep 5, 2019

This PR is now open for shepherd nominations. Any volunteers?

@ryantm
Copy link
Member

ryantm commented Sep 5, 2019

I volunteer to be a shepherd.

1 similar comment
@Mic92
Copy link
Member

Mic92 commented Sep 5, 2019

I volunteer to be a shepherd.

@arianvp
Copy link
Member

arianvp commented Sep 5, 2019

I volunteer too!

@asymmetric
Copy link
Contributor

I too volunteer to be a shepherd 🐑.

7c6f434c
7c6f434c reviewed Sep 6, 2019
View reviewed changes
rfcs/0052-dynamic-ids.md Outdated Show resolved Hide resolved
Mic92
Mic92 reviewed Sep 6, 2019
View reviewed changes
rfcs/0052-dynamic-ids.md Outdated Show resolved Hide resolved
Mic92
Mic92 reviewed Sep 6, 2019
View reviewed changes
rfcs/0052-dynamic-ids.md Outdated Show resolved Hide resolved
@edolstra edolstra mentioned this pull request Sep 12, 2019
Closed
@edolstra
Copy link
Member

Also nominating myself.

So we have the following shepherd team: @ryantm, @arianvp, @asymmetric and @edolstra. Thanks! @ryantm do you have to lead this team?

@arianvp
Copy link
Member

arianvp commented Sep 12, 2019 •
edited

A link from the systemd folks on how they envision groups, users, uids and guids on a "systemd system" https://systemd.io/UIDS-GIDS.html . It's a good read and will make our lives if we adapt our RFC to be sort of in line with what they are suggesting when possible. I'm reading it as we speak and will leave some feedback from the things I learnt from it.

@edolstra edolstra added status: in discussion and removed status: open for nominations Open for shepherding team nominations labels Sep 12, 2019
@ryantm
Copy link
Member

ryantm commented Sep 12, 2019

Sure, I will lead the shepherd team.

ryantm
ryantm suggested changes Sep 12, 2019
View reviewed changes
rfcs/0052-dynamic-ids.md Outdated Show resolved Hide resolved
rfcs/0052-dynamic-ids.md Outdated Show resolved Hide resolved
rfcs/0052-dynamic-ids.md Outdated Show resolved Hide resolved
rfcs/0052-dynamic-ids.md Outdated Show resolved Hide resolved
arianvp
arianvp reviewed Sep 16, 2019
View reviewed changes
rfcs/0052-dynamic-ids.md
Services should make permissions of their directories are usable by them.
- The easiest way to achieve this is to use `systemd.services.<name?>.serviceConfig.StateDirectory = "myservice"`, which ensures that `/var/lib/myservice` belongs to the services user.
- `systemd.tmpfiles.rules = [ "Z '/var/lib/myservice' - myuser mygroup - -" ]` can also be used, with the disadvantage that it will only run at system activation and not when the service starts. It also recursively fixes the permissions every time, meaning it can lead to considerable slowdown with many files.
- An alternative is to assign `serviceConfig.ExecStartPre = "+${pkgs.writeScript "myservice-prestart" "..."}"` with a script to fix the permissions, where the `+` makes the script run with full root permissions as documented in `man systemd.service`.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would be nice if we could have this syntax work in the preStart and postStart shorthands that we currently have in the systemd module

@Mic92 Mic92 mentioned this pull request Sep 17, 2019
Closed
asymmetric
asymmetric reviewed Sep 18, 2019
View reviewed changes
rfcs/0052-dynamic-ids.md Outdated Show resolved Hide resolved
rfcs/0052-dynamic-ids.md Outdated Show resolved Hide resolved
rfcs/0052-dynamic-ids.md Outdated Show resolved Hide resolved
rfcs/0052-dynamic-ids.md Outdated Show resolved Hide resolved
rfcs/0052-dynamic-ids.md Outdated Show resolved Hide resolved
rfcs/0052-dynamic-ids.md Outdated Show resolved Hide resolved
rfcs/0052-dynamic-ids.md Outdated Show resolved Hide resolved
rfcs/0052-dynamic-ids.md Outdated Show resolved Hide resolved
asymmetric
asymmetric approved these changes Oct 9, 2019
View reviewed changes
Copy link
Contributor

@asymmetric asymmetric left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A couple of nits, but otherwise 👍

rfcs/0052-dynamic-ids.md Outdated Show resolved Hide resolved
rfcs/0052-dynamic-ids.md Show resolved Hide resolved
@infinisil
Copy link
Member Author

Ah yes, forgot to push the changes for those

@globin globin mentioned this pull request Oct 10, 2019
Closed
@nixos-discourse
Copy link

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/nixos-weekly-13-nixos-19-09-release-cache-nixos-org-improvements-github-actions-for-nix-a-number-of-talks/4322/1

@infinisil infinisil mentioned this pull request Oct 12, 2019
Merged
10 tasks
@infinisil
Copy link
Member Author

Lucky coincidence: @dasJ just opened NixOS/nixpkgs#71055 for making all NixOS module users use isSystemUser = true which I planned to do after this RFC. With NixOS/nixpkgs#65698 the system user limit of 100 ids will be increased to non-problematic levels.

@edolstra edolstra mentioned this pull request Oct 17, 2019
Closed
@ryantm
Copy link
Member

ryantm commented Oct 19, 2019

The FCP has ended without any objections. @NixOS/rfc-steering-committee please merge.

@globin globin merged commit 698b1ca into NixOS:master Oct 21, 2019
@globin globin added status: accepted and removed status: FCP in Final Comment Period labels Oct 21, 2019
@infinisil infinisil deleted the dynamic-ids branch October 21, 2019 08:46
@infinisil infinisil restored the dynamic-ids branch October 27, 2019 09:41
@shlevy shlevy mentioned this pull request Nov 1, 2019
Closed
@infinisil
Copy link
Member Author

Note to myself: This still needs the updates to the manual

@7c6f434c 7c6f434c mentioned this pull request Dec 25, 2019
Closed
@asymmetric asymmetric mentioned this pull request Jan 10, 2020
Closed
@misuzu misuzu mentioned this pull request Apr 13, 2020
Merged
10 tasks
@infinisil infinisil mentioned this pull request Jun 2, 2020
Closed
2 tasks
@kwohlfahrt kwohlfahrt mentioned this pull request Aug 3, 2020
Merged
10 tasks
@infinisil infinisil mentioned this pull request Sep 3, 2021
Merged
11 tasks
@pennae pennae mentioned this pull request Nov 4, 2021
Merged
12 tasks
@infinisil infinisil mentioned this pull request Feb 14, 2022
Closed
12 tasks
@infinisil infinisil mentioned this pull request Mar 1, 2022
Draft
9 tasks
KAction pushed a commit to KAction/rfcs that referenced this pull request Apr 13, 2024
@infinisil
[RFC 0052] Away from static IDs (NixOS#52)
819155a
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@manveru manveru manveru left review comments

@Mic92 Mic92 Mic92 left review comments

@arianvp arianvp arianvp left review comments

@edolstra edolstra edolstra left review comments

@7c6f434c 7c6f434c 7c6f434c left review comments

@aanderse aanderse aanderse left review comments

@ryantm ryantm ryantm requested changes

@asymmetric asymmetric asymmetric approved these changes

@globin globin globin approved these changes

Assignees
No one assigned
Labels
status: accepted
Projects
None yet
Milestone
No milestone