[bug#41259] [PATCH] etc: Add a systemd unit to bind-mount @storedir@ read-only.

[Julien Lepiller]

Le 14 mai 2020 10:01:51 GMT-04:00, Julien Lepiller <address@hidden> a écrit :
>Le 14 mai 2020 09:48:46 GMT-04:00, Tobias Geerinckx-Rice via
>Guix-patches via <address@hidden> a écrit :
>>* etc/gnu-store.mount.in: New file.
>>* nix/local.mk (nodist_systemdservice_DATA): Add it.
>>(etc/%.mount): New rule.
>>* etc/guix-install.sh (sys_enable_guix_daemon): Install it.
>>* doc/guix.texi (Binary Installation): Document it.
>>---
>>
>>For
>><https://lists.gnu.org/archive/html/help-guix/2020-05/msg00097.html>.
>>
>> doc/guix.texi          |  5 +++--
>> etc/gnu-store.mount.in | 14 ++++++++++++++
>> etc/guix-install.sh    | 12 +++++++++---
>> nix/local.mk           | 12 +++++++++++-
>> 4 files changed, 37 insertions(+), 6 deletions(-)
>> create mode 100644 etc/gnu-store.mount.in
>>
>>diff --git a/doc/guix.texi b/doc/guix.texi
>>index d6fbd85fde..5d80a7e405 100644
>>--- a/doc/guix.texi
>>+++ b/doc/guix.texi
>>@@ -659,9 +659,10 @@ with these commands:
>> @c
>https://lists.gnu.org/archive/html/guix-devel/2017-01/msg01199.html
>> 
>> @example
>>-# cp
>~root/.config/guix/current/lib/systemd/system/guix-daemon.service
>>\
>>+# cp ~root/.config/guix/current/lib/systemd/system/gnu-store.mount \
>>+    
>~root/.config/guix/current/lib/systemd/system/guix-daemon.service
>>\
>>      /etc/systemd/system/
>>-# systemctl enable --now guix-daemon
>>+# systemctl enable --now gnu-store.mount guix-daemon
>> @end example
>> 
>> If your host distro uses the Upstart init system:
>>diff --git a/etc/gnu-store.mount.in b/etc/gnu-store.mount.in
>>new file mode 100644
>>index 0000000000..c94f2db72b
>>--- /dev/null
>>+++ b/etc/gnu-store.mount.in
>>@@ -0,0 +1,14 @@
>>+[Unit]
>>+Description=Read-only @storedir@ for GNU Guix
>>+DefaultDependencies=no
>>+ConditionPathExists=@storedir@
>>+Before=guix-daemon.service
>>+
>>+[Install]
>>+WantedBy=guix-daemon.service
>>+
>>+[Mount]
>>+What=@storedir@
>>+Where=@storedir@
>>+Type=none
>>+Options=bind,ro
>>diff --git a/etc/guix-install.sh b/etc/guix-install.sh
>>index 4909d3f162..d252c132fb 100755
>>--- a/etc/guix-install.sh
>>+++ b/etc/guix-install.sh
>>@@ -342,7 +342,13 @@ sys_enable_guix_daemon()
>>                 _msg "${PAS}enabled Guix daemon via upstart"
>>             ;;
>>         systemd)
>>-            { cp
>>"${ROOT_HOME}/.config/guix/current/lib/systemd/system/guix-daemon.service"
>>\
>>+            { # systemd .mount units must be named after the target
>>directory.
>>+              # Here we assume a hard-coded name of /gnu/store.
>>+              cp
>>"${ROOT_HOME}/.config/guix/current/lib/systemd/system/gnu-store.mount"
>>\
>>+                 /etc/systemd/system/;
>>+              chmod 664 /etc/systemd/system/gnu-store.mount;
>>+
>>+              cp
>>"${ROOT_HOME}/.config/guix/current/lib/systemd/system/guix-daemon.service"
>>\
>>                  /etc/systemd/system/;
>>               chmod 664 /etc/systemd/system/guix-daemon.service;
>> 
>>@@ -357,8 +363,8 @@ sys_enable_guix_daemon()
>>            fi;
>> 
>>               systemctl daemon-reload &&
>>-                  systemctl start guix-daemon &&
>>-                  systemctl enable guix-daemon; } &&
>>+                  systemctl start  gnu-store.mount guix-daemon &&
>>+                  systemctl enable gnu-store.mount guix-daemon; } &&
>>                 _msg "${PAS}enabled Guix daemon via systemd"
>>             ;;
>>         sysv-init)
>>diff --git a/nix/local.mk b/nix/local.mk
>>index a64bdd2137..435fdd389a 100644
>>--- a/nix/local.mk
>>+++ b/nix/local.mk
>>@@ -155,7 +155,17 @@ noinst_HEADERS =                                         
>>\
>> 
>> # The '.service' files for systemd.
>> systemdservicedir = $(libdir)/systemd/system
>>-nodist_systemdservice_DATA = etc/guix-daemon.service
>>etc/guix-publish.service
>>+nodist_systemdservice_DATA =                 \
>>+  etc/gnu-store.mount                                \
>>+  etc/guix-daemon.service                    \
>>+  etc/guix-publish.service
>>+
>>+etc/%.mount: etc/%.mount.in  \
>>+                      $(top_builddir)/config.status
>>+     $(AM_V_GEN)$(MKDIR_P) "`dirname $@`";   \
>>+     $(SED) -e 's|@''storedir''@|$(storedir)|' <     \
>>+            "$<" > "$@.tmp";         \
>>+     mv "$@.tmp" "$@"
>> 
>> etc/guix-%.service: etc/guix-%.service.in    \
>>                       $(top_builddir)/config.status
>
>I see that's how it's done with the existing service, but why sed the
>.in file when we could let configure.ac take care of it?
>
>I'll try that on a VM of a foreign distro soonish and report. Thanks!

I tested it on a debian VM and it worked well. I tested the installer script 
and it fails at installing the .mount unit, because it does not exist in the 
tarball.

After installing the unit manually, I could start the .mount service and found 
that I was not able to remove store store items with rm. I checked that Guix is 
able to install new store items.