Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use DynamicUser instead of a static kolibri user #2

Draft
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

dylanmccall
Copy link
Contributor

@dylanmccall dylanmccall commented Jan 22, 2021

As discussed in pull request #1, this removes the static kolibri system user, and instead uses systemd's DynamicUser= option. That allows us to greatly simplify how this component is implemented.

Unfortunately, dbus policy files don't work with dynamic users (systemd/systemd#9503), so the following policy breaks:

  <policy user="kolibri">
    <allow own="org.learningequality.Kolibri.Daemon" />
  </policy>

At the moment, I am changing the policy to allow any user to own the Kolibri daemon's name on the system bus, but that is not ideal. I think we would need a better solution to that problem before merging this.

@dbnicholson
Copy link
Member

Note that you almost definitely need to keep the predefined system kolibri user even if you do this because DynamicUser doesn't deal with our persistent user scheme correctly across ostree upgrades IIRC. I can dig up the details later, but I know we went through this exercise before.

@dylanmccall dylanmccall force-pushed the dynamic-user branch 2 times, most recently from 6117115 to d9243ed Compare February 12, 2021 00:59
To allow this, we need a more lenient policy for owning the service's
name on the system bus.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants