nixos/gnome-keyring: add option to enable the daemon as systemd service #36296

Ma27 · 2018-03-04T14:27:39Z

Motivation for this change

On my minimalistic i3 setup without any DE I don't have this daemon
running, so it's impossible for other services to talk to it even when
enabling this module.

I added an option which allows to start a user service running the
keyring daemon in the foreground to capture its output properly.

Things done

Tested using sandboxing (nix.useSandbox on NixOS, or option build-use-sandbox in nix.conf on non-NixOS)
Built on platform(s)
- NixOS
- macOS
- other Linux distributions
Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
Tested execution of all binary files (usually in ./result/bin/)
Fits CONTRIBUTING.md.

Mic92 · 2018-03-04T14:30:22Z

nixos/modules/services/desktops/gnome3/gnome-keyring.nix

-          Whether to enable GNOME Keyring daemon, a service designed to
-          take care of the user's security credentials,
-          such as user names and passwords.
+          Whether to run a systemd service which runs the keyring daemon.


How does gnome handle this usually? dbus activation?

DBus activation is limited according to https://wiki.gnome.org/Projects/GnomeKeyring/RunningDaemon. PAM module is the preferred method. Maybe check #30686

Arch wiki is also useful https://wiki.archlinux.org/index.php/GNOME/Keyring#Using_the_keyring_outside_GNOME

Mic92 · 2018-03-04T14:33:17Z

nixos/tests/gnome-keyring.nix

+    services.xserver.displayManager.auto.user = "bob";
+
+    services.gnome3.gnome-keyring.enable = true;
+    services.gnome3.gnome-keyring.enableService = true;


It looks a bit weird that a user has to enable both. Maybe gnome should explicitly disable the service, so the user do not has to care about it.

Ma27 · 2018-03-04T16:15:40Z

agreed, however I’m not sure if we really want to change the config for gnome users (and possibly introduce regressions or compatibility breaks). How about setting ‘enableService’ with mkDefault to true unless the gnome DE is enabled?

…

On 4. Mar 2018, at 3:33 PM, Jörg Thalheim ***@***.***> wrote: @Mic92 commented on this pull request. In nixos/tests/gnome-keyring.nix: > @@ -0,0 +1,22 @@ +import ./make-test.nix ({ pkgs, lib, ... }: + +with lib; + +{ + name = "gnome-keyring"; + meta.maintainers = with pkgs.stdenv.lib.maintainers; [ ma27 ]; + + nodes.machine = { + imports = [ ./common/x11.nix ./common/user-account.nix ]; + services.xserver.displayManager.auto.user = "bob"; + + services.gnome3.gnome-keyring.enable = true; + services.gnome3.gnome-keyring.enableService = true; It looks a bit weird that a user has to enable both. Maybe gnome should explicitly disable the service, so the user do not has to care about it. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub, or mute the thread.

Ma27 · 2018-03-04T18:29:44Z

... and we shouldn’t forget to actually register the test :-)

On my minimalistic i3 setup without any DE I don't have this daemon running, so it's impossible for other services to talk to it even when enabling this module. I added an option which allows to start a user service running the keyring daemon in the foreground to capture its output properly.

Ma27 · 2018-03-04T19:23:10Z

@Mic92 now enableService doesn't need to be used (see its description), it will be enabled with mkDefault if gnome-keyring is enabled, but gnome3 is not enabled.
Furthermore I added the test to release.nix to actually evaluate it :)

Mic92 · 2018-03-04T19:49:21Z

@GrahamcOfBorg test gnome-keyring

GrahamcOfBorg · 2018-03-04T19:49:34Z

Failure on x86_64-linux (full log)

Partial log (click to expand)

while evaluating the attribute ‘drvPath’ at /var/lib/gc-of-borg/.nix-test-rs/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/ogden/lib/customisation.nix:179:13:
while evaluating the attribute ‘drvPath’ at /var/lib/gc-of-borg/.nix-test-rs/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/ogden/lib/customisation.nix:146:13:
while evaluating the attribute ‘buildCommand’ of the derivation ‘vm-test-run-gnome-keyring’ at /var/lib/gc-of-borg/.nix-test-rs/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/ogden/pkgs/stdenv/generic/make-derivation.nix:148:11:
while evaluating the attribute ‘buildCommand’ of the derivation ‘nixos-test-driver-gnome-keyring’ at /var/lib/gc-of-borg/.nix-test-rs/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/ogden/pkgs/stdenv/generic/make-derivation.nix:148:11:
while evaluating the attribute ‘buildCommand’ of the derivation ‘nixos-vm’ at /var/lib/gc-of-borg/.nix-test-rs/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/ogden/pkgs/stdenv/generic/make-derivation.nix:148:11:
while evaluating the attribute ‘buildCommand’ of the derivation ‘nixos-system-machine-18.03.git.6feb25d’ at /var/lib/gc-of-borg/.nix-test-rs/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/ogden/pkgs/stdenv/generic/make-derivation.nix:148:11:
while evaluating ‘optionalString’ at /var/lib/gc-of-borg/.nix-test-rs/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/ogden/lib/strings.nix:138:26, called from /var/lib/gc-of-borg/.nix-test-rs/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/ogden/nixos/modules/system/activation/top-level.nix:40:9:
while evaluating the attribute ‘closure’ of the derivation ‘initrd’ at /var/lib/gc-of-borg/.nix-test-rs/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/ogden/pkgs/stdenv/generic/make-derivation.nix:148:11:
while evaluating anonymous function at /var/lib/gc-of-borg/.nix-test-rs/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/ogden/pkgs/build-support/closure-info.nix:9:1, called from /var/lib/gc-of-borg/.nix-test-rs/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/ogden/pkgs/build-support/kernel/make-initrd.nix:33:13:
assertion failed at /var/lib/gc-of-borg/.nix-test-rs/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/ogden/pkgs/build-support/closure-info.nix:11:1

GrahamcOfBorg · 2018-03-04T19:52:19Z

Failure on aarch64-linux (full log)

Partial log (click to expand)

checking for references to /build in /nix/store/z2cvwbl3q42lvdc90d3x7mzphn6hw9b4-perl-List-Compare-0.53-devdoc...
building '/nix/store/1yrhpl6yfrx2lpddxhyq43cb2vsanqhp-install-grub.sh.drv'...
37922 blocks
cannot build derivation '/nix/store/86f4157zb94lwx5j2sjw7dnjrfn7awd0-nixos-system-machine-18.03.git.c940c85.drv': 1 dependencies couldn't be built
cannot build derivation '/nix/store/bp8m1dwrxa9l1zwm2i5dk4j0hn4qn4m2-closure-info.drv': 1 dependencies couldn't be built
cannot build derivation '/nix/store/r1r6krq54qrk4ivvjld2qm7rwmr2kz01-run-nixos-vm.drv': 2 dependencies couldn't be built
cannot build derivation '/nix/store/0pvlys5yc3ck5ll3a0lmd876fcbj21g8-nixos-vm.drv': 2 dependencies couldn't be built
cannot build derivation '/nix/store/jyrg2v8jya1g4xan9fga5bpam1kd8i6h-nixos-test-driver-gnome-keyring.drv': 1 dependencies couldn't be built
cannot build derivation '/nix/store/qsn8vpd3b04g8gziqyrvcfk51895dsf2-vm-test-run-gnome-keyring.drv': 1 dependencies couldn't be built
�[31;1merror:�[0m build of '/nix/store/qsn8vpd3b04g8gziqyrvcfk51895dsf2-vm-test-run-gnome-keyring.drv' failed

Mic92 · 2018-03-04T19:58:10Z

@GrahamcOfBorg eval

Ma27 · 2018-03-04T20:01:08Z

@Mic92 could you please have a look at the IRC? I discussed with @jtojnar shortly about it, I'll check if PAM modules are sufficient and then we could actually close this PR :)

Mic92 · 2018-03-04T20:03:21Z

The test could stay though.

Ma27 · 2018-03-07T10:57:11Z

closing as invalid. Thanks a lot to @jtojnar for your hint with the options to configure PAM accordingly, this makes it unnecessary to introduce another service as discussed in the IRC.

@Mic92 the test was intended to confirm the behavior of the new service I originally wanted to introduce. I'm unfortunately not sure how to check the integrity with gnome (I guess this requires a gnome-based test setup), so I'll close this for now and add a test in case I have sufficient time to.

Mic92 reviewed Mar 4, 2018

View reviewed changes

GrahamcOfBorg added 6.topic: nixos 8.has: module (update) 10.rebuild-darwin: 0 10.rebuild-linux: 0 labels Mar 4, 2018

Ma27 force-pushed the run-gnome-keyring-independently branch from 877d0ec to 21048e5 Compare March 4, 2018 19:17

Ma27 force-pushed the run-gnome-keyring-independently branch from 21048e5 to 9994c09 Compare March 4, 2018 19:21

Ma27 closed this Mar 7, 2018

Ma27 deleted the run-gnome-keyring-independently branch March 7, 2018 10:57

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

nixos/gnome-keyring: add option to enable the daemon as systemd service #36296

nixos/gnome-keyring: add option to enable the daemon as systemd service #36296

Ma27 commented Mar 4, 2018 •

edited

Mic92 Mar 4, 2018

jtojnar Mar 4, 2018

jtojnar Mar 4, 2018

Mic92 Mar 4, 2018

Ma27 commented Mar 4, 2018 via email

Ma27 commented Mar 4, 2018

Ma27 commented Mar 4, 2018

Mic92 commented Mar 4, 2018

GrahamcOfBorg commented Mar 4, 2018

GrahamcOfBorg commented Mar 4, 2018

Mic92 commented Mar 4, 2018

Ma27 commented Mar 4, 2018

Mic92 commented Mar 4, 2018

Ma27 commented Mar 7, 2018

nixos/gnome-keyring: add option to enable the daemon as systemd service #36296

nixos/gnome-keyring: add option to enable the daemon as systemd service #36296

Conversation

Ma27 commented Mar 4, 2018 • edited

Motivation for this change

Things done

Mic92 Mar 4, 2018

Choose a reason for hiding this comment

jtojnar Mar 4, 2018

Choose a reason for hiding this comment

jtojnar Mar 4, 2018

Choose a reason for hiding this comment

Mic92 Mar 4, 2018

Choose a reason for hiding this comment

Ma27 commented Mar 4, 2018 via email

Ma27 commented Mar 4, 2018

Ma27 commented Mar 4, 2018

Mic92 commented Mar 4, 2018

GrahamcOfBorg commented Mar 4, 2018

GrahamcOfBorg commented Mar 4, 2018

Mic92 commented Mar 4, 2018

Ma27 commented Mar 4, 2018

Mic92 commented Mar 4, 2018

Ma27 commented Mar 7, 2018

Ma27 commented Mar 4, 2018 •

edited