update-users-groups.pl: use atomic write_file

[Enteee]

Motivation for this change

This should prevent critical files from being overwritten by update-users-groups.pl in case something goes wrong when writing. Also in that script there are a lot of: FIXME: acquire lock. - comments which won't be solved by this, but at least mitigated to a point that parallel writes from an other source will not corrupt the file.

From the doc:

• atomic

The atomic option is a boolean option, defaulted to false (0). Setting this option to true (1) will cause the file to be be written to in an atomic fashion. A temporary file name is created using "tempfile" in File::Temp. After the file is closed it is renamed to the original file name (and rename is an atomic operation on most OSes). If the program using this were to crash in the middle of this, then the temporary file could be left behind.

With this pull request I am patching something that stumbled upon today. I am not familiar with this part of nixos. I believe this change makes sense, but at the same time I have my concerns. By opening this PR i would like to open the discussion around several open points I am not fully able to answer myself:

• Does this improve the current situation?
• Where do temporary files get written and is it safe to do so in this script?
• ...

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • login.nix
  • mutable-users.nix
• Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.

[danbst]

is it possible to control location where $tmp file is created for atomic write_file? I think this is fine as long as we have both $path and $tmp on same filesystem.

If not, then better to introduce some random cruft into $path.tmp name, like, $path.$random.tmp and not use atomic (because we do atomic rename anyway as a final step).

I also wonder how to reproduce the race condition. Should I run concurrent nixos-rebuild test with two different user configurations?

[Enteee]

is it possible to control location where $tmp file is created for atomic write_file? I think this is fine as long as we have both $path and $tmp on same filesystem.

yes I do think this is possible: https://metacpan.org/pod/File::Temp#tempfile

If not, then better to introduce some random cruft into $path.tmp name, like, $path.$random.tmp and not use atomic (because we do atomic rename anyway as a final step).

I also wonder how to reproduce the race condition. Should I run concurrent nixos-rebuild test with two different user configurations?

Honestly, neither do I. I don't know Perl much, therefore maybe I am misjudging the situation. But looking at the script it seems to be in a very bad shape overall. Tons of FIXME's and an empty salt for generated password hashes and quite a few spooky bugs which lead to corrupted systems:

• update-users-groups.pl fails if /var/lib/nixos/*-map malformed #26788
• Corruption of files used during init(rd) prevents boot #61755
• update-users-groups.pl is broken when running NixOS tests interactively #69365
• uid-map gets corrupted by Unicode usernames #80426

.. Maybe #48378 wasn't such a bad idea after all.

[stale]

Hello, I'm a bot and I thank you in the name of the community for your contributions.

Nixpkgs is a busy repository, and unfortunately sometimes PRs get left behind for too long. Nevertheless, we'd like to help committers reach the PRs that are still important. This PR has had no activity for 180 days, and so I marked it as stale, but you can rest assured it will never be closed by a non-human.

If this is still important to you and you'd like to remove the stale label, we ask that you leave a comment. Your comment can be as simple as "still important to me". But there's a bit more you can do:

If you received an approval by an unprivileged maintainer and you are just waiting for a merge, you can @ mention someone with merge permissions and ask them to help. You might be able to find someone relevant by using Git blame on the relevant files, or via GitHub's web interface. You can see if someone's a member of the nixpkgs-committers team, by hovering with the mouse over their username on the web interface, or by searching them directly on the list.

If your PR wasn't reviewed at all, it might help to find someone who's perhaps a user of the package or module you are changing, or alternatively, ask once more for a review by the maintainer of the package/module this is about. If you don't know any, you can use Git blame on the relevant files, or GitHub's web interface to find someone who touched the relevant files in the past.

If your PR has had reviews and nevertheless got stale, make sure you've responded to all of the reviewer's requests / questions. Usually when PR authors show responsibility and dedication, reviewers (privileged or not) show dedication as well. If you've pushed a change, it's possible the reviewer wasn't notified about your push via email, so you can always officially request them for a review, or just @ mention them and say you've addressed their comments.

Lastly, you can always ask for help at our Discourse Forum, or more specifically, at this thread or at #nixos' IRC channel.

[Mic92]

If we use this flag I don't see a point of having an additional rename step, which was also meant to make the write atomic-ish (no really so when we have multiple writers).

Suggested change

	write_file("$path.tmp", { binmode => ':utf8', perms => $perms // 0644, atomic => 1 }, $contents);
	rename("$path.tmp", $path) or die;
	write_file("$path", { binmode => ':utf8', perms => $perms // 0644, atomic => 1 }, $contents) or die;

Please also check if write_file or die is correct here. I assume so but than we have perl which is full of ways to shoot yourself in the foot.

[Mic92]

The or die is correct in the error case it returns undef: https://github.com/perhunter/slurp/blob/d909fac92e6eb0592362c8337c7abc7f4693ac94/lib/File/Slurp.pm#L602

[Mic92]

is it possible to control location where $tmp file is created for atomic write_file? I think this is fine as long as we have both $path and $tmp on same filesystem.

If not, then better to introduce some random cruft into $path.tmp name, like, $path.$random.tmp and not use atomic (because we do atomic rename anyway as a final step).

I also wonder how to reproduce the race condition. Should I run concurrent nixos-rebuild test with two different user configurations?

A sane implementation of the atomic flag should do the same thing you described (create a temporary file in the same directory with a random suffix and rename it), but please check so.

[Mic92]

I checked using the atomic flag on its own is sufficient: https://github.com/perhunter/slurp/blob/d909fac92e6eb0592362c8337c7abc7f4693ac94/lib/File/Slurp.pm#L284

[Mic92]

Part of #98544