Skip to content

installer: Don't run graphical installer ISOs as root #42610

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
adisbladis wants to merge 1 commit into from
Closed

installer: Don't run graphical installer ISOs as root #42610

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions nixos/doc/manual/release-notes/rl-1809.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,6 +76,12 @@ $ nix-instantiate -E '(import <nixpkgsunstable> {}).gitFull'
</para>

<itemizedlist>
<listitem>
<para>
The installer is no longer running the graphical session as root.
To gain root privileges in the graphical session use <literal>sudo</literal> without a password.

@edolstra edolstra Jul 13, 2018

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should probably be mentioned in the installation section of the manual as well.

Also, it probably should be sudo -i.

</para>
</listitem>
<listitem>
<para>
<literal>lib.strict</literal> is removed. Use
Expand Down
73 changes: 73 additions & 0 deletions nixos/modules/installer/cd-dvd/installation-cd-graphical-base.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,73 @@
# This module contains the basic configuration for building a graphical NixOS
# installation CD.

{ config, lib, pkgs, ... }:

with lib;

{
imports = [ ./installation-cd-base.nix ];

users.extraUsers.live = {
isNormalUser = true;
uid = 1000;
extraGroups = [ "wheel" "networkmanager" "video" ];
# Allow the graphical user to login without password
initialHashedPassword = "";
};

# Allow passwordless sudo from live user
security.sudo = {
enable = lib.mkForce true;
wheelNeedsPassword = lib.mkForce false;
};

# Whitelist wheel users to do anything
# This is useful for things like pkexec
security.polkit.extraConfig = ''
polkit.addRule(function(action, subject) {
if (subject.isInGroup("wheel")) {
return polkit.Result.YES;
}
});
'';

services.xserver = {
enable = true;

# Don't start the X server by default.
autorun = mkForce false;

@worldofpeace worldofpeace Jun 27, 2018

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Drop this I think. This is a graphical media, I would expect it to just start.

@adisbladis adisbladis Jun 27, 2018

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this belongs in another PR.

I think we should add another boot entry so you can still choose not to start the graphical environment, at the same time we make the one that autostarts the graphical environment the default.

@worldofpeace worldofpeace Jun 27, 2018 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we should add another boot entry so you can still choose not to start the graphical environment, at the same time we make the one that autostarts the graphical environment the default.

Why would that be needed? I don't see the graphical env ever being not functional, and you can always just start it and switch to a tty if needed. If someone wanted to not have a graphical env they would use the other iso...

Yeah a discussion for another PR. 👍


# Automatically login as live user.
displayManager.slim = {
enable = true;
defaultUser = "live";
autoLogin = true;
};

};

# Provide networkmanager for easy wireless configuration.
networking.networkmanager.enable = true;
networking.wireless.enable = mkForce false;

# KDE complains if power management is disabled (to be precise, if
# there is no power management backend such as upower).
powerManagement.enable = true;

environment.systemPackages = [
# Include gparted for partitioning disks.
pkgs.gparted

# Include some editors.
pkgs.vim
pkgs.bvi # binary editor
pkgs.joe

# Firefox for reading the manual.
pkgs.firefox

pkgs.glxinfo
];

}
49 changes: 3 additions & 46 deletions nixos/modules/installer/cd-dvd/installation-cd-graphical-gnome.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,16 +6,9 @@
with lib;

{
imports = [ ./installation-cd-base.nix ];
imports = [ ./installation-cd-graphical-base.nix ];

services.xserver = {
enable = true;
# GDM doesn't start in virtual machines with ISO
displayManager.slim = {
enable = true;
defaultUser = "root";
autoLogin = true;
};
desktopManager.gnome3 = {
enable = true;
extraGSettingsOverrides = ''
Expand All @@ -33,46 +26,10 @@ with lib;
};
};

environment.systemPackages =
[ # Include gparted for partitioning disks.
pkgs.gparted

# Include some editors.
pkgs.vim
pkgs.bvi # binary editor
pkgs.joe

pkgs.glxinfo
];

# Don't start the X server by default.
services.xserver.autorun = mkForce false;

# Auto-login as root.
# Auto-login as live.
services.xserver.displayManager.gdm.autoLogin = {
enable = true;
user = "root";
user = "live";
};

system.activationScripts.installerDesktop = let
# Must be executable
desktopFile = pkgs.writeScript "nixos-manual.desktop" ''
[Desktop Entry]
Version=1.0
Type=Link
Name=NixOS Manual
URL=${config.system.build.manual.manual}/share/doc/nixos/index.html
Icon=system-help
'';

# use cp and chmod +x, we must be sure the apps are in the nix store though
in ''
mkdir -p /root/Desktop
ln -sfT ${desktopFile} /root/Desktop/nixos-manual.desktop
cp ${pkgs.gnome3.gnome-terminal}/share/applications/gnome-terminal.desktop /root/Desktop/gnome-terminal.desktop
chmod a+rx /root/Desktop/gnome-terminal.desktop
cp ${pkgs.gparted}/share/applications/gparted.desktop /root/Desktop/gparted.desktop
chmod a+rx /root/Desktop/gparted.desktop
'';

}
63 changes: 23 additions & 40 deletions nixos/modules/installer/cd-dvd/installation-cd-graphical-kde.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,18 +6,9 @@
with lib;

{
imports = [ ./installation-cd-base.nix ];
imports = [ ./installation-cd-graphical-base.nix ];

services.xserver = {
enable = true;

# Automatically login as root.
displayManager.slim = {
enable = true;
defaultUser = "root";
autoLogin = true;
};

desktopManager.plasma5 = {
enable = true;
enableQt4Support = false;
Expand All @@ -27,34 +18,14 @@ with lib;
synaptics.enable = true;

@worldofpeace worldofpeace Jun 26, 2018

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shouldn't this be libinput? I don't think it's a default for plasma5.

@adisbladis adisbladis Jun 27, 2018

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree. I didn't want to make any major functionality changes right now.
Running as non-root is major enough for a single PR and warrants consideration purely on it's own rights.

};

environment.systemPackages =
[ pkgs.glxinfo

# Include gparted for partitioning disks.
pkgs.gparted

# Firefox for reading the manual.
pkgs.firefox

# Include some editors.
pkgs.vim
pkgs.bvi # binary editor
pkgs.joe
];

# Provide networkmanager for easy wireless configuration.
networking.networkmanager.enable = true;
networking.wireless.enable = mkForce false;

# KDE complains if power management is disabled (to be precise, if
# there is no power management backend such as upower).
powerManagement.enable = true;

# Don't start the X server by default.
services.xserver.autorun = mkForce false;
environment.systemPackages = with pkgs; [
# Graphical text editor
kate
];

system.activationScripts.installerDesktop = let
desktopFile = pkgs.writeText "nixos-manual.desktop" ''

manualDesktopFile = pkgs.writeScript "nixos-manual.desktop" ''
[Desktop Entry]
Version=1.0
Type=Application
Expand All @@ -63,11 +34,23 @@ with lib;
Icon=text-html
'';

# Replace default gparted desktop file with one that does "sudo gparted"

@etu etu Jul 13, 2018

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wouldn't this block be useful for both Gnome and KDE images?

@worldofpeace worldofpeace Jul 13, 2018

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Gnome doesn't have files on the desktop anymore.

@etu etu Jul 13, 2018 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A desktop file is not a file on the desktop, a desktop file is still used to launch applications from launchers etc.

And from my point of view it would possibly be useful if a user could click "gparted" in the launcher and that it's executed with sudo. But I'm not sure if there's any magic involved.

@adisbladis adisbladis Jul 13, 2018

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

But these entries would not be visible any more since gnome doesn't read ~/Desktop.

@worldofpeace worldofpeace Jul 13, 2018

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You suggest this would be useful if it used a patched version of gparted that uses sudo?
Currently here it only copies this file to the desktop.

@etu etu Jul 13, 2018

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@worldofpeace Yeah, sure. That would be more useful. Especially on an installation media.

Not sure if that's in scope of this PR. But maybe it should be since the behaviour is changed from "I can click that button" to "Clicking that button tells me that it requires root to run".

gpartedDesktopFile = pkgs.runCommand "gparted.desktop" {} ''
mkdir -p $out
cp ${pkgs.gparted}/share/applications/gparted.desktop $out/gparted.desktop
substituteInPlace $out/gparted.desktop --replace "Exec=" "Exec=sudo "
'';

desktopDir = "/home/live/Desktop/";

in ''
mkdir -p /root/Desktop
ln -sfT ${desktopFile} /root/Desktop/nixos-manual.desktop
ln -sfT ${pkgs.konsole}/share/applications/org.kde.konsole.desktop /root/Desktop/org.kde.konsole.desktop
ln -sfT ${pkgs.gparted}/share/applications/gparted.desktop /root/Desktop/gparted.desktop
mkdir -p ${desktopDir}
chown live /home/live ${desktopDir}

ln -sfT ${manualDesktopFile} ${desktopDir + "nixos-manual.desktop"}
ln -sfT ${gpartedDesktopFile}/gparted.desktop ${desktopDir + "gparted.desktop"}

ln -sfT ${pkgs.konsole}/share/applications/org.kde.konsole.desktop ${desktopDir + "org.kde.konsole.desktop"}
'';

}