Closed TheRealGramdalf closed 1 month ago
Can see the same problem. Here's a reproducing VM config:
{ pkgs, config, ... }:
{
users.mutableUsers = false;
users.users.root.hashedPassword = "";
services.getty.autologinUser = "root";
systemd.sysusers.enable = true;
users.users."main" = {
isNormalUser = true;
group = "main";
# Start vm once, create this file, uncomment, re-build & restart vm
# hashedPasswordFile = "/var/lib/secrets/mainpw";
};
users.groups."main" = {};
system.stateVersion = config.system.nixos.release;
virtualisation.vmVariant = {
virtualisation = {
mountHostNixStore = true;
writableStoreUseTmpfs = false;
};
};
}
# Build with:
# NIXOS_CONFIG="$PWD/configuration.nix" nixos-rebuild build-vm --max-jobs auto --builders ''
# # ...you might need `nix-shell -p nixos-rebuild` as it's only installed on NixOS
# Run with:
# ./result/bin/run-*-vm &
This only happens when mutableUsers = false
because we currently statically (i.e. at build time) generate /etc/passwd and friends. It cannot read a hashedPasswordFile from outside the Nix store in this scenario.
I'd say that's a pretty big deal, because it's security relevant - people might unexpectedly end up with an insecure password or lock themselves out of a system - and because of the docs currently imply it works with immutable users:
The full path to a file that contains the hash of the user’s password. The password file is read on each system activation. [...] If the option
users.mutableUsers
istrue
, the password defined in one of the three options will only be set when the user is created for the first time. After that, you are free to change the password with the ordinary user management commands. Ifusers.mutableUsers
isfalse
, you cannot change user passwords, they will always be set according to the password options.
~It used to work~, it's dangerous, so it should be ~reverted or~ fixed or at the very least very clearly documented and warned about.
Edit: Sorry, forget that this was aboutsysusers
.
It used to work, it's dangerous, so it should be reverted
It cannot have ever worked with systemd-sysusers. There is nothing to revert. If you want the old behaviour you simply do not enable sysusers.
My comment also simply explained why what happens happens. I never said that it shouldn't be fixed.
Additionally, systemd-sysusers does not attempt to entirely emulate what the users-groups.pl script does. It most likely will never be able to.
systemd-sysusers is experimental right now, which is clearly indicated in the option description.
Describe the bug
After enabling
systemd.sysusers.enable
(ref) while enablinghashedPasswordFile
, attempting tonixos-rebuild boot --flake .#
fails withcat: /persist/secrets/passwdfile.gramdalf: No such file or directory
Steps To Reproduce
Steps to reproduce the behavior:
systemd.sysusers.enable
normalUser
with ahashedPasswordFile
(ref)nixos-rebuild boot --flake .#
Expected behavior
The
hashedPasswordFile
is used, but not added to/nix/store
Screenshots
If applicable, add screenshots to help explain your problem.
Additional context
The suggested
nix log
only gives a single error line, complaining that the file doesn't exist. Copy/pasting thecat
command works, I assume this to be due to the nix build environment being sanitized, with limited access to the filesystem as a whole. The source comes from this part of the file, which attempts to read thehashedPasswordFile
at build time rather than activation (which was the previous behavior) Semi related to https://github.com/NixOS/nixpkgs/issues/307159Notify maintainers
@nikstur @NickCao
Metadata
Please run
nix-shell -p nix-info --run "nix-info -m"
and paste the result.Add a :+1: reaction to issues you find important.