Increase max group name length to 32 characters #38548

aszlig · 2018-04-07T13:36:08Z

With #36556, a check was introduced to make sure the user and group names do not exceed their respective maximum length. This is in part because systemd also enforces that length, but only at runtime.

So in general it's a good idea to catch as much as we can during evaluation time, however the maximum length of the group name was set to 16 characters according groupadd(8).

The maximum length of the group names however is a compile-time option and even systemd allows more than 16 characters. In the mentioned pull request (#36556) there was already a report that this has broken
evaluation for people out there.

I have also checked what other distributions are doing and they set the length to either 31 characters or 32 characters, the latter being more common.

Unfortunately there is a difference between the maximum length enforced by the shadow package and systemd, both for user name lengths and group name lengths. However, systemd enforces both length to have a maximum of 31 characters and I'm not sure if this is intended or just a off-by-one error in systemd.

Nevertheless, I choose 32 characters simply to bring it in par with the maximum user name length.

For the NixOS assertion however, I use a maximum length of 31 to make sure that nobody accidentally creates services that contain group names that systemd considers invalid because of a length of 32 characters.

Note: I'm basing this on master instead of staging, because while it affects a lot of packages (not stdenv however), the change is rather trivial and needs to land in 18.03 ASAP as the change from #36556 breaks evaluation of systems out there which use group names with a length from 17 to 31 characters.

Cc: @vcunat, @fpletz, @qknight

@vcunat

With NixOS#36556, a check was introduced to make sure the user and group names do not exceed their respective maximum length. This is in part because systemd also enforces that length, but only at runtime. So in general it's a good idea to catch as much as we can during evaluation time, however the maximum length of the group name was set to 16 characters according groupadd(8). The maximum length of the group names however is a compile-time option and even systemd allows more than 16 characters. In the mentioned pull request (NixOS#36556) there was already a report that this has broken evaluation for people out there. I have also checked what other distributions are doing and they set the length to either 31 characters or 32 characters, the latter being more common. Unfortunately there is a difference between the maximum length enforced by the shadow package and systemd, both for user name lengths and group name lengths. However, systemd enforces both length to have a maximum of 31 characters and I'm not sure if this is intended or just a off-by-one error in systemd. Nevertheless, I choose 32 characters simply to bring it in par with the maximum user name length. For the NixOS assertion however, I use a maximum length of 31 to make sure that nobody accidentally creates services that contain group names that systemd considers invalid because of a length of 32 characters. Signed-off-by: aszlig <aszlig@nix.build> Cc: @vcunat, @fpletz, @qknight

aszlig · 2018-04-07T18:57:50Z

@fpletz, @vcunat: 23293 changed packages, so I'll push that to staging and staging-18.03 once you don't have any objections.

vcunat · 2018-04-08T09:29:29Z

nixos/modules/config/users-groups.nix

@@ -92,7 +92,7 @@ let

      group = mkOption {
        type = types.str;
-        apply = x: assert (builtins.stringLength x < 17 || abort "Group name '${x}' is longer than 16 characters which is not allowed!"); x;
+        apply = x: assert (builtins.stringLength x < 32 || abort "Group name '${x}' is longer than 31 characters which is not allowed!"); x;


Nitpick: are you sure +-1 is correct here? --with-group-name-max-length=32 would feel like 32 characters is still OK, but I didn't verify that at all.

Ah, now I read your description in full so I see it's unclear :-)

vcunat

👍 great to make this consistent within nixpkgs and with other common distributions. The man page that triggered this restriction reflects the configure-time choice.

@vcunat

With #36556, a check was introduced to make sure the user and group names do not exceed their respective maximum length. This is in part because systemd also enforces that length, but only at runtime. So in general it's a good idea to catch as much as we can during evaluation time, however the maximum length of the group name was set to 16 characters according groupadd(8). The maximum length of the group names however is a compile-time option and even systemd allows more than 16 characters. In the mentioned pull request (#36556) there was already a report that this has broken evaluation for people out there. I have also checked what other distributions are doing and they set the length to either 31 characters or 32 characters, the latter being more common. Unfortunately there is a difference between the maximum length enforced by the shadow package and systemd, both for user name lengths and group name lengths. However, systemd enforces both length to have a maximum of 31 characters and I'm not sure if this is intended or just a off-by-one error in systemd. Nevertheless, I choose 32 characters simply to bring it in par with the maximum user name length. For the NixOS assertion however, I use a maximum length of 31 to make sure that nobody accidentally creates services that contain group names that systemd considers invalid because of a length of 32 characters. Signed-off-by: aszlig <aszlig@nix.build> Closes: #38548 Cc: @vcunat, @fpletz, @qknight

@vcunat

With #36556, a check was introduced to make sure the user and group names do not exceed their respective maximum length. This is in part because systemd also enforces that length, but only at runtime. So in general it's a good idea to catch as much as we can during evaluation time, however the maximum length of the group name was set to 16 characters according groupadd(8). The maximum length of the group names however is a compile-time option and even systemd allows more than 16 characters. In the mentioned pull request (#36556) there was already a report that this has broken evaluation for people out there. I have also checked what other distributions are doing and they set the length to either 31 characters or 32 characters, the latter being more common. Unfortunately there is a difference between the maximum length enforced by the shadow package and systemd, both for user name lengths and group name lengths. However, systemd enforces both length to have a maximum of 31 characters and I'm not sure if this is intended or just a off-by-one error in systemd. Nevertheless, I choose 32 characters simply to bring it in par with the maximum user name length. For the NixOS assertion however, I use a maximum length of 31 to make sure that nobody accidentally creates services that contain group names that systemd considers invalid because of a length of 32 characters. Signed-off-by: aszlig <aszlig@nix.build> Closes: #38548 Cc: @vcunat, @fpletz, @qknight (cherry picked from commit 99ba1cb)

qknight · 2018-04-08T11:29:09Z

@aszlig can you also backport this to 18.03?

vcunat · 2018-04-08T11:32:14Z

He had pushed it to staging-18.03 immediately.

@vcunat

With NixOS#36556, a check was introduced to make sure the user and group names do not exceed their respective maximum length. This is in part because systemd also enforces that length, but only at runtime. So in general it's a good idea to catch as much as we can during evaluation time, however the maximum length of the group name was set to 16 characters according groupadd(8). The maximum length of the group names however is a compile-time option and even systemd allows more than 16 characters. In the mentioned pull request (NixOS#36556) there was already a report that this has broken evaluation for people out there. I have also checked what other distributions are doing and they set the length to either 31 characters or 32 characters, the latter being more common. Unfortunately there is a difference between the maximum length enforced by the shadow package and systemd, both for user name lengths and group name lengths. However, systemd enforces both length to have a maximum of 31 characters and I'm not sure if this is intended or just a off-by-one error in systemd. Nevertheless, I choose 32 characters simply to bring it in par with the maximum user name length. For the NixOS assertion however, I use a maximum length of 31 to make sure that nobody accidentally creates services that contain group names that systemd considers invalid because of a length of 32 characters. Signed-off-by: aszlig <aszlig@nix.build> Closes: NixOS#38548 Cc: @vcunat, @fpletz, @qknight (cherry picked from commit 99ba1cb)

GrahamcOfBorg added 6.topic: nixos 8.has: module (update) 10.rebuild-darwin: 11-100 10.rebuild-linux: 501+ labels Apr 7, 2018

aszlig requested review from fpletz and vcunat April 7, 2018 18:53

vcunat reviewed Apr 8, 2018

View reviewed changes

vcunat approved these changes Apr 8, 2018

View reviewed changes

aszlig closed this Apr 8, 2018

aszlig mentioned this pull request Apr 10, 2018

Too long group names nixcloud/nixcloud-webservices#20

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Increase max group name length to 32 characters #38548

Increase max group name length to 32 characters #38548

aszlig commented Apr 7, 2018 •

edited

aszlig commented Apr 7, 2018

vcunat Apr 8, 2018

vcunat Apr 8, 2018 •

edited

vcunat left a comment

qknight commented Apr 8, 2018

vcunat commented Apr 8, 2018 •

edited

Increase max group name length to 32 characters #38548

Increase max group name length to 32 characters #38548

Conversation

aszlig commented Apr 7, 2018 • edited

aszlig commented Apr 7, 2018

vcunat Apr 8, 2018

Choose a reason for hiding this comment

vcunat Apr 8, 2018 • edited

Choose a reason for hiding this comment

vcunat left a comment

Choose a reason for hiding this comment

qknight commented Apr 8, 2018

vcunat commented Apr 8, 2018 • edited

aszlig commented Apr 7, 2018 •

edited

vcunat Apr 8, 2018 •

edited

vcunat commented Apr 8, 2018 •

edited