Skip to content

Add GNOME3 ISO, Don't run graphical installer ISOs as root #66313

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
worldofpeace wants to merge 7 commits into from
Closed

Add GNOME3 ISO, Don't run graphical installer ISOs as root #66313

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
4f82426
installer: Don't run graphical installer ISOs as root
worldofpeace Aug 8, 2019
6c5dd0b
nixos/release: add GNOME3 ISO
worldofpeace Aug 7, 2019
3ea0206
nixos/release: rename iso_graphical to iso_graphical_plasma5
worldofpeace Aug 7, 2019
d181cc6
fixup! installer: Don't run graphical installer ISOs as root
worldofpeace Aug 8, 2019
70e6869
fixup! fixup! installer: Don't run graphical installer ISOs as root
worldofpeace Aug 8, 2019
64b666a
fixup! fixup! fixup! installer: Don't run graphical installer ISOs as…
worldofpeace Aug 8, 2019
da25ab2
fixup! fixup! fixup! fixup! installer: Don't run graphical installer …
worldofpeace Aug 8, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions nixos/doc/manual/installation/installing.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,13 +29,14 @@
</para>

<para>
You are logged-in automatically as <literal>root</literal>. (The
<literal>root</literal> user account has an empty password.)
You are logged-in automatically as <literal>live</literal>.
The <literal>live</literal> user account has an empty password so you
can use <command>sudo</command> without a password.
</para>

<para>
If you downloaded the graphical ISO image, you can run <command>systemctl
start display-manager</command> to start KDE. If you want to continue on the
start display-manager</command> to start the DE. If you want to continue on the
Comment thread
worldofpeace marked this conversation as resolved.
Outdated
terminal, you can use <command>loadkeys</command> to switch to your
preferred keyboard layout. (We even provide neo2 via <command>loadkeys de
neo</command>!)
Expand Down
11 changes: 11 additions & 0 deletions nixos/doc/manual/release-notes/rl-1909.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,17 @@
PHP 7.1 is no longer supported due to upstream not supporting this version for the entire lifecycle of the 19.09 release.
</para>
</listitem>
<listitem>
<para>
The installer is no longer running the graphical session as root.
To gain root privileges in the graphical session use <literal>sudo</literal> without a password.
</para>
</listitem>
<listitem>
<para>
We now distribute a GNOME3 graphical ISO.
</para>
</listitem>
</itemizedlist>
</section>

Expand Down
27 changes: 25 additions & 2 deletions nixos/modules/installer/cd-dvd/installation-cd-graphical-base.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,30 @@ with lib;
{
imports = [ ./installation-cd-base.nix ];

users.extraUsers.live = {
isNormalUser = true;
uid = 1000;

@edolstra edolstra Aug 8, 2019

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We probably shouldn't use UIDs in the >1000 range since that's reserved for users. Maybe just leave out the UID?

extraGroups = [ "wheel" "networkmanager" "video" ];

@edolstra edolstra Aug 8, 2019

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are networkmanager and video needed? NetworkManager should work for locally logged-in users without it, and likewise logged-in users get access for /dev/video* via an ACL.

@worldofpeace worldofpeace Aug 8, 2019

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure. I think I'd have an issue on my own installation if I didn't use this. I've received guidance that this should be done, but I've yet to verify this.

I will find out 👍

@worldofpeace worldofpeace Aug 8, 2019

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I tried this in a vm and it caused it to require authentication to initiate a connection with networkmanager. Not sure about video though but perhaps it's fine to leave it.

# Allow the graphical user to login without password
initialHashedPassword = "";
};

# Allow passwordless sudo from live user
security.sudo = {
enable = lib.mkForce true;
wheelNeedsPassword = lib.mkForce false;
};

# Whitelist wheel users to do anything
# This is useful for things like pkexec
security.polkit.extraConfig = ''
polkit.addRule(function(action, subject) {
if (subject.isInGroup("wheel")) {
return polkit.Result.YES;
}
});
'';

services.xserver = {
enable = true;

Expand All @@ -17,7 +41,7 @@ with lib;
# Automatically login as root.
displayManager.slim = {
enable = true;
defaultUser = "root";
defaultUser = "live";
autoLogin = true;
};

Expand All @@ -33,7 +57,6 @@ with lib;

# Enable sound in graphical iso's.
hardware.pulseaudio.enable = true;
hardware.pulseaudio.systemWide = true; # Needed since we run plasma as root.

environment.systemPackages = [
# Include gparted for partitioning disks.
Expand Down
15 changes: 11 additions & 4 deletions nixos/modules/installer/cd-dvd/installation-cd-graphical-gnome.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,12 +10,19 @@ with lib;

services.xserver.desktopManager.gnome3.enable = true;

services.xserver.displayManager.slim.enable = mkForce false;
services.xserver.displayManager.slim.enable = lib.mkForce false;

# Auto-login as root.
services.xserver.displayManager.gdm.autoLogin = {
# wayland can be problematic for some hardware
services.xserver.desktopManager.default = "gnome-xorg";

services.xserver.displayManager.gdm = {
enable = true;
user = "root";
# This might be problematic on a live system
autoSuspend = false;
autoLogin = {
enable = true;
user = "live";
};
};

}
2 changes: 1 addition & 1 deletion ...tallation-cd-graphical-kde-new-kernel.nix → ...ation-cd-graphical-plasma5-new-kernel.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{ pkgs, ... }:

{
imports = [ ./installation-cd-graphical-kde.nix ];
imports = [ ./installation-cd-graphical-plasma5.nix ];

boot.kernelPackages = pkgs.linuxPackages_latest;
}
24 changes: 18 additions & 6 deletions .../cd-dvd/installation-cd-graphical-kde.nix → ...dvd/installation-cd-graphical-plasma5.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# This module defines a NixOS installation CD that contains X11 and
# Plasma5.
# KDE 5.
Comment thread
worldofpeace marked this conversation as resolved.
Outdated

{ config, lib, pkgs, ... }:

Expand Down Expand Up @@ -30,15 +30,27 @@ with lib;
Version=1.0
Type=Application
Name=NixOS Manual
Exec=firefox ${config.system.build.manual.manualHTMLIndex}
Exec=firefox ${config.system.build.manual.manual}/share/doc/nixos/index.html

@lheckemann lheckemann Aug 8, 2019

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Did the manualHTMLIndex variant not work?

Thought on the side: maybe this should be extracted into the nixos manual module…

Icon=text-html
'';

# Replace default gparted desktop file with one that does "sudo gparted"
gpartedDesktopFile = pkgs.runCommand "gparted.desktop" {} ''
mkdir -p $out
cp ${pkgs.gparted}/share/applications/gparted.desktop $out/gparted.desktop
substituteInPlace $out/gparted.desktop --replace "Exec=" "Exec=sudo "
'';

desktopDir = "/home/live/Desktop/";

in ''
mkdir -p /root/Desktop
ln -sfT ${manualDesktopFile} /root/Desktop/nixos-manual.desktop
ln -sfT ${pkgs.konsole}/share/applications/org.kde.konsole.desktop /root/Desktop/org.kde.konsole.desktop
ln -sfT ${pkgs.gparted}/share/applications/gparted.desktop /root/Desktop/gparted.desktop
mkdir -p ${desktopDir}
chown live /home/live ${desktopDir}

ln -sfT ${manualDesktopFile} ${desktopDir + "nixos-manual.desktop"}
ln -sfT ${gpartedDesktopFile}/gparted.desktop ${desktopDir + "gparted.desktop"}

ln -sfT ${pkgs.konsole}/share/applications/org.kde.konsole.desktop ${desktopDir + "org.kde.konsole.desktop"}
'';

}
3 changes: 2 additions & 1 deletion nixos/release-combined.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,8 @@ in rec {
(all nixos.dummy)
(all nixos.manual)

nixos.iso_graphical.x86_64-linux or []
nixos.iso_graphical_plasma5.x86_64-linux or []
nixos.iso_graphical_gnome3.x86_64-linux or []
nixos.iso_minimal.aarch64-linux or []
nixos.iso_minimal.i686-linux or []
nixos.iso_minimal.x86_64-linux or []
Expand Down
12 changes: 9 additions & 3 deletions nixos/release.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -149,9 +149,15 @@ in rec {
inherit system;
});

iso_graphical = forMatchingSystems [ "x86_64-linux" ] (system: makeIso {
module = ./modules/installer/cd-dvd/installation-cd-graphical-kde.nix;
type = "graphical";
iso_graphical_plasma5 = forMatchingSystems [ "x86_64-linux" ] (system: makeIso {

@edolstra edolstra Aug 8, 2019

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note that renaming iso_graphical will break the NixOS channel generation script.

module = ./modules/installer/cd-dvd/installation-cd-graphical-plasma5.nix;
type = "graphical-plasma5";
inherit system;
});

iso_graphical_gnome3 = forMatchingSystems [ "x86_64-linux" ] (system: makeIso {
module = ./modules/installer/cd-dvd/installation-cd-graphical-gnome.nix;
type = "graphical-gnome3";
inherit system;
});

Expand Down