nixos/systemd: Enable debug-shell.service.

[ElvishJerricco]

Description of changes

The debug shell is an upstream systemd unit that spawns a bare shell on tty 9. It is enabled by a systemd generator with the systemd.debug_shell cmdline parameter, or the rd.systemd.debug_shell parameter for stage 1.

At first I had some security concern about this, because it's an unauthenticated shell. But you have to be able to edit the cmdline to enable it, and in that case you would be able to use init=/bin/sh anyway. So I think this is no worse than that.

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 24.05 Release Notes (or backporting 23.05 and 23.11 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[msanft]

Regarding your security concerns: This should be perfectly fine for the exact reason you've mentioned.

[ElvishJerricco]

It should be noted that the switch to bashInteractive is a very pleasant switch, but it costs 350K in initrd size. We've been slowly inflating the initrd size for systemd stage 1, and it's up to 17M now, so this isn't exactly welcome. But I personally think it's worth it, and we're still competitive with other distros' initrd sizes. e.g. The one in the fedora 38 vagrant image is 29M.

[philiptaron]

Yeah, I saw the fancier (and weightier) package being added. I think it's worth it by default.