Add GNOME3 ISO, Don't run graphical installer ISOs as root

nixos/doc/manual/installation/installing.xml

@@ -29,13 +29,14 @@
   </para>
 
   <para>
-   You are logged-in automatically as <literal>root</literal>. (The
-   <literal>root</literal> user account has an empty password.)
+   You are logged-in automatically as <literal>live</literal>.
+   The <literal>live</literal> user account has an empty password so you
+   can use <command>sudo</command> without a password.
   </para>
 
   <para>
    If you downloaded the graphical ISO image, you can run <command>systemctl
-   start display-manager</command> to start KDE. If you want to continue on the
+   start display-manager</command> to start the desktop environment. If you want to continue on the
    terminal, you can use <command>loadkeys</command> to switch to your
    preferred keyboard layout. (We even provide neo2 via <command>loadkeys de
    neo</command>!)

nixos/doc/manual/release-notes/rl-1909.xml

@@ -33,6 +33,17 @@
      PHP 7.1 is no longer supported due to upstream not supporting this version for the entire lifecycle of the 19.09 release.
     </para>
    </listitem>
+   <listitem>
+    <para>
+     The installer now uses a less privileged <literal>live</literal> user whereas before we logged in as root.
+     To gain root privileges use <literal>sudo</literal> without a password.
+    </para>
+  </listitem>
+  <listitem>
+    <para>
+      We now distribute a GNOME3 graphical ISO.
+    </para>
+  </listitem>
   </itemizedlist>
  </section>
 

nixos/modules/installer/cd-dvd/installation-cd-graphical-base.nix

@@ -8,6 +8,16 @@ with lib;
 {
   imports = [ ./installation-cd-base.nix ];
 
+  # Whitelist wheel users to do anything
+  # This is useful for things like pkexec
+  security.polkit.extraConfig = ''
+    polkit.addRule(function(action, subject) {
+      if (subject.isInGroup("wheel")) {
+        return polkit.Result.YES;
+      }
+    });
+  '';
+
   services.xserver = {
     enable = true;
 
@@ -17,7 +27,7 @@ with lib;
     # Automatically login as root.
     displayManager.slim = {
       enable = true;
-      defaultUser = "root";
+      defaultUser = "live";
       autoLogin = true;
     };
 
@@ -33,7 +43,6 @@ with lib;
 
   # Enable sound in graphical iso's.
   hardware.pulseaudio.enable = true;
-  hardware.pulseaudio.systemWide = true; # Needed since we run plasma as root.
 
   environment.systemPackages = [
     # Include gparted for partitioning disks.

nixos/modules/installer/cd-dvd/installation-cd-graphical-gnome.nix

@@ -10,12 +10,19 @@ with lib;
 
   services.xserver.desktopManager.gnome3.enable = true;
 
-  services.xserver.displayManager.slim.enable = mkForce false;
+  services.xserver.displayManager.slim.enable = lib.mkForce false;
 
-  # Auto-login as root.
-  services.xserver.displayManager.gdm.autoLogin = {
+  # wayland can be problematic for some hardware
+  services.xserver.desktopManager.default = "gnome-xorg";
+
+  services.xserver.displayManager.gdm = {
     enable = true;
-    user = "root";
+    # This might be problematic on a live system
+    autoSuspend = false;
+    autoLogin = {
+      enable = true;
+      user = "live";
+    };
   };
 
 }

nixos/modules/installer/cd-dvd/installation-cd-graphical-kde-new-kernel.nix → nixos/modules/installer/cd-dvd/installation-cd-graphical-plasma5-new-kernel.nix

@@ -1,7 +1,7 @@
 { pkgs, ... }:
 
 {
-  imports = [ ./installation-cd-graphical-kde.nix ];
+  imports = [ ./installation-cd-graphical-plasma5.nix ];
 
   boot.kernelPackages = pkgs.linuxPackages_latest;
 }

nixos/modules/installer/cd-dvd/installation-cd-graphical-kde.nix → nixos/modules/installer/cd-dvd/installation-cd-graphical-plasma5.nix

@@ -1,5 +1,5 @@
 # This module defines a NixOS installation CD that contains X11 and
-# Plasma5.
+# Plasma 5.
 
 { config, lib, pkgs, ... }:
 
@@ -30,15 +30,27 @@ with lib;
       Version=1.0
       Type=Application
       Name=NixOS Manual
-      Exec=firefox ${config.system.build.manual.manualHTMLIndex}
+      Exec=firefox ${config.system.build.manual.manual}/share/doc/nixos/index.html
       Icon=text-html
     '';
 
+    # Replace default gparted desktop file with one that does "sudo gparted"
+    gpartedDesktopFile = pkgs.runCommand "gparted.desktop" {} ''
+      mkdir -p $out
+      cp ${pkgs.gparted}/share/applications/gparted.desktop $out/gparted.desktop
+      substituteInPlace $out/gparted.desktop --replace "Exec=" "Exec=sudo "
+    '';
+
+    desktopDir = "/home/live/Desktop/";
+
   in ''
-    mkdir -p /root/Desktop
-    ln -sfT ${manualDesktopFile} /root/Desktop/nixos-manual.desktop
-    ln -sfT ${pkgs.konsole}/share/applications/org.kde.konsole.desktop /root/Desktop/org.kde.konsole.desktop
-    ln -sfT ${pkgs.gparted}/share/applications/gparted.desktop /root/Desktop/gparted.desktop
+    mkdir -p ${desktopDir}
+    chown live /home/live ${desktopDir}
+
+    ln -sfT ${manualDesktopFile} ${desktopDir + "nixos-manual.desktop"}
+    ln -sfT ${gpartedDesktopFile}/gparted.desktop ${desktopDir + "gparted.desktop"}
+
+    ln -sfT ${pkgs.konsole}/share/applications/org.kde.konsole.desktop ${desktopDir + "org.kde.konsole.desktop"}
   '';
 
 }

nixos/modules/profiles/installation-device.nix

@@ -32,17 +32,33 @@ with lib;
     #services.rogue.enable = true;
 
     # Disable some other stuff we don't need.
-    security.sudo.enable = mkDefault false;
     services.udisks2.enable = mkDefault false;
 
+    # Use less privileged live user
+    users.users.live = {
+      isNormalUser = true;
+      extraGroups = [ "wheel" "networkmanager" "video" ];
+      # Allow the graphical user to login without password
+      initialHashedPassword = "";
+    };
+
+    # Allow the user to log in as root without a password.
+    users.users.root.initialHashedPassword = "";
+
+    # Allow passwordless sudo from live user
+    security.sudo = {
+      enable = mkDefault true;
+      wheelNeedsPassword = mkForce false;
+    };
+
     # Automatically log in at the virtual consoles.
-    services.mingetty.autologinUser = "root";
+    services.mingetty.autologinUser = "live";
 
     # Some more help text.
     services.mingetty.helpLine =
       ''
 
-        The "root" account has an empty password.  ${
+        The "live" and "root" account have empty passwords.  ${
           optionalString config.services.xserver.enable
             "Type `systemctl start display-manager' to\nstart the graphical user interface."}
       '';
@@ -86,8 +102,5 @@ with lib;
     # because we have the firewall enabled. This makes installs from the
     # console less cumbersome if the machine has a public IP.
     networking.firewall.logRefusedConnections = mkDefault false;
-
-    # Allow the user to log in as root without a password.
-    users.users.root.initialHashedPassword = "";
   };
 }

nixos/release-combined.nix

@@ -54,7 +54,8 @@ in rec {
         (all nixos.dummy)
         (all nixos.manual)
 
-        nixos.iso_graphical.x86_64-linux or []
+        nixos.iso_graphical_plasma5.x86_64-linux or []
+        nixos.iso_graphical_gnome3.x86_64-linux or []
         nixos.iso_minimal.aarch64-linux or []
         nixos.iso_minimal.i686-linux or []
         nixos.iso_minimal.x86_64-linux or []

nixos/release.nix

@@ -149,9 +149,15 @@ in rec {
     inherit system;
   });
 
-  iso_graphical = forMatchingSystems [ "x86_64-linux" ] (system: makeIso {
-    module = ./modules/installer/cd-dvd/installation-cd-graphical-kde.nix;
-    type = "graphical";
+  iso_graphical_plasma5 = forMatchingSystems [ "x86_64-linux" ] (system: makeIso {
+    module = ./modules/installer/cd-dvd/installation-cd-graphical-plasma5.nix;
+    type = "graphical-plasma5";
+    inherit system;
+  });
+
+  iso_graphical_gnome3 = forMatchingSystems [ "x86_64-linux" ] (system: makeIso {
+    module = ./modules/installer/cd-dvd/installation-cd-graphical-gnome.nix;
+    type = "graphical-gnome3";
     inherit system;
   });