futurile/guix-play
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

services: Add pam-mount-volume-service-type.

Browse Source 
The `pam-mount-volumes-service-type' adds additional volumes to the
pam-mount-service-type in addition to any that are already specified in
`pam-mount-rules'.

* doc/guix.texi (PAM Mount Volume Service): add documentation for
`pam-mount-service-type'.
* gnu/services/pam-mount.scm: new file.
* Makefile.am: add pam-mount tests
* tests/services/pam-mount.scm: new tests

Signed-off-by: Ludovic Courtès <ludo@gnu.org>
This commit is contained in:
Brian Cully 2023-07-18 10:06:16 -04:00 committed by Ludovic Courtès
parent 90e34d25d5
commit 8a88b8b0b5
No known key found for this signature in database
GPG Key ID: 090B11993D9AEBB5
4 changed files with 296 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
Makefile.am
View File

@ -559,6 +559,7 @@ SCM_TESTS = \
tests/services/configuration.scm \
tests/services/lightdm.scm \
tests/services/linux.scm \
tests/services/pam-mount.scm \
tests/services/telephony.scm \
tests/services/vpn.scm \
tests/sets.scm \

99
doc/guix.texi
View File

@ -116,6 +116,7 @@ Copyright @copyright{} 2022 Antero Mejr@*
Copyright @copyright{} 2023 Karl Hallsby@*
Copyright @copyright{} 2023 Nathaniel Nicandro@*
Copyright @copyright{} 2023 Tanguy Le Carrour@*
Copyright @copyright{} 2023 Brian Cully@*
Permission is granted to copy, distribute and/or modify this document
under the terms of the GNU Free Documentation License, Version 1.3 or
@ -37927,6 +37928,104 @@ The complete list of possible options can be found in the man page for
@end table
@end deftp
@subheading PAM Mount Volume Service
@cindex pam volume mounting
PAM mount volumes are automatically mounted at login by the PAM login
service according to a set of per-volume rules. Because they are
mounted by PAM the password entered during login may be used directly to
mount authenticated volumes, such as @code{cifs}, using the same
credentials.
These volumes will be added in addition to any volumes directly
specified in @code{pam-mount-rules}.
Here is an example of a rule which will mount a remote CIFS share from
@file{//remote-server/share} into a sub-directory of @file{/shares}
named after the user logging in:
@lisp
(simple-service 'pam-mount-remote-share pam-mount-volume-service-type
(list (pam-mount-volume
(secondary-group "users")
(file-system-type "cifs")
(server "remote-server")
(file-name "share")
(mount-point "/shares/%(USER)")
(options "nosuid,nodev,seal,cifsacl"))))
@end lisp
@deftp {Data Type} pam-mount-volume-service-type
Configuration for a single volume to be mounted. Any fields not
specified will be omitted from the run-time PAM configuration. See
@uref{http://pam-mount.sourceforge.net/pam_mount.conf.5.html,
the man page} for the default values when unspecified.
@table @asis
@item @code{user-name} (type: maybe-string)
Mount the volume for the given user.
@item @code{user-id} (type: maybe-integer-or-range)
Mount the volume for the user with this ID. This field may also be
specified as a pair of @code{(start . end)} indicating a range of user
IDs for whom to mount the volume.
@item @code{primary-group} (type: maybe-string)
Mount the volume for users with this primary group name.
@item @code{group-id} (type: maybe-integer-or-range)
Mount the volume for the users with this primary group ID. This field
may also be specified as a cons cell of @code{(start . end)} indicating
a range of group ids for whom to mount the volume.
@item @code{secondary-group} (type: maybe-string)
Mount the volume for users who are members of this group as either a
primary or secondary group.
@item @code{file-system-type} (type: maybe-string)
The file system type for the volume being mounted (e.g., @code{cifs})
@item @code{no-mount-as-root?} (type: maybe-boolean)
Whether or not to mount the volume with root privileges. This is
normally disabled, but may be enabled for mounts of type @code{fuse}, or
other user-level mounts.
@item @code{server} (type: maybe-string)
The name of the remote server to mount the volume from, when necessary.
@item @code{file-name} (type: maybe-string)
The location of the volume, either local or remote, depending on the
@code{file-system-type}.
@item @code{mount-point} (type: maybe-string)
Where to mount the volume in the local file-system. This may be set to
@file{~} to indicate the home directory of the user logging in. If this
field is omitted then @file{/etc/fstab} is consulted for the mount
destination.
@item @code{options} (type: maybe-string)
The options to be passed as-is to the underlying mount program.
@item @code{ssh?} (type: maybe-boolean)
Enable this option to pass the login password to SSH for use with mounts
involving SSH (e.g., @code{sshfs}).
@item @code{cipher} (type: maybe-string)
Cryptsetup cipher name for the volume. To be used with the @code{crypt}
@code{file-system-type}.
@item @code{file-system-key-cipher} (type: maybe-string)
Cipher name used by the target volume.
@item @code{file-system-key-hash} (type: maybe-string)
SSL hash name used by the target volume.
@item @code{file-system-key-file-name} (type: maybe-string)
File name of the file system key for the target volume.
@end table
@end deftp
@node Guix Services
@subsection Guix Services

114
gnu/services/pam-mount.scm
View File

@ -1,5 +1,6 @@
;;; GNU Guix --- Functional package management for GNU
;;; Copyright © 2019 Guillaume Le Vaillant <glv@posteo.net>
;;; Copyright © 2023 Brian Cully <bjc@spork.org>
;;;
;;; This file is part of GNU Guix.
;;;
@ -23,9 +24,15 @@
#:use-module (gnu system pam)
#:use-module (guix gexp)
#:use-module (guix records)
#:use-module (ice-9 match)
#:use-module (srfi srfi-1)
#:export (pam-mount-configuration
pam-mount-configuration?
pam-mount-service-type))
pam-mount-service-type
pam-mount-volume
pam-mount-volume?
pam-mount-volume-service-type))
(define %pam-mount-default-configuration
`((debug (@ (enable "0")))
@ -102,6 +109,11 @@
(list optional-pam-mount))))
pam))))))
(define (extend-pam-mount-configuration initial extensions)
"Extends INITIAL with EXTENSIONS."
(pam-mount-configuration (rules (append (pam-mount-configuration-rules
initial) extensions))))
(define pam-mount-service-type
(service-type
(name 'pam-mount)
@ -109,6 +121,106 @@
pam-mount-etc-service)
(service-extension pam-root-service-type
pam-mount-pam-service)))
(compose concatenate)
(extend extend-pam-mount-configuration)
(default-value (pam-mount-configuration))
(description "Activate PAM-Mount support. It allows mounting volumes for
specific users when they log in.")))
(define (field-name->tag field-name)
"Convert FIELD-NAME to its tag used by the configuration XML."
(match field-name
('user-name 'user)
('user-id 'uid)
('primary-group 'pgrp)
('group-id 'gid)
('secondary-group 'sgrp)
('file-system-type 'fstype)
('no-mount-as-root? 'noroot)
('file-name 'path)
('mount-point 'mountpoint)
('ssh? 'ssh)
('file-system-key-cipher 'fskeycipher)
('file-system-key-hash 'fskeyhash)
('file-system-key-file-name 'fskeypath)
(_ field-name)))
(define-maybe string)
(define (serialize-string field-name value)
(list (field-name->tag field-name) value))
(define (integer-or-range? value)
(match value
((start . end) (and (integer? start)
(integer? end)))
(_ (number? value))))
(define-maybe integer-or-range)
(define (serialize-integer-or-range field-name value)
(let ((value-string (match value
((start . end) (format #f "~a-~a" start end))
(_ (number->string value)))))
(list (field-name->tag field-name) value-string)))
(define-maybe boolean)
(define (serialize-boolean field-name value)
(let ((value-string (if value "1" "0")))
(list (field-name->tag field-name) value-string)))
(define-configuration pam-mount-volume
(user-name maybe-string "User name to match.")
(user-id maybe-integer-or-range
"User ID, or range of user IDs, in the form of @code{(start . end)} to\nmatch.")
(primary-group maybe-string "Primary group name to match.")
(group-id maybe-integer-or-range
"Group ID, or range of group IDs, in the form of @code{(start . end)} to\nmatch.")
(secondary-group maybe-string
"Match users who belong to this group name as either a primary or secondary\ngroup.")
(file-system-type maybe-string "File system type of volume being mounted.")
(no-mount-as-root? maybe-boolean
"Do not use super user privileges to mount this volume.")
(server maybe-string "Remote server this volume resides on.")
(file-name maybe-string "Location of the volume to be mounted.")
(mount-point maybe-string
"Where to mount the volume in the local file system.")
(options maybe-string "Options to pass to the underlying mount program.")
(ssh? maybe-boolean "Whether to pass the login password to SSH.")
(cipher maybe-string "Cryptsetup cipher named used by volume.")
(file-system-key-cipher maybe-string
"Cipher name used by the target volume.")
(file-system-key-hash maybe-string
"SSL hash name used by the target volume.")
(file-system-key-file-name maybe-string
"File name for the file system key used by the target volume."))
(define (pam-mount-volume->sxml volume)
;; Convert a list of configuration fields into an SXML-compatible attribute
;; list.
(define xml-attrs
(filter-map (lambda (field)
(let* ((accessor (configuration-field-getter field))
(value (accessor volume)))
(and (not (eq? value %unset-value))
(list (field-name->tag (configuration-field-name
field)) value))))
pam-mount-volume-fields))
`(volume (@ ,@xml-attrs)))
(define (pam-mount-volume-rules volumes)
(map pam-mount-volume->sxml volumes))
(define pam-mount-volume-service-type
(service-type (name 'pam-mount-volume)
(extensions (list (service-extension pam-mount-service-type
pam-mount-volume-rules)))
(compose concatenate)
(extend append)
(default-value '())
(description
"Mount remote volumes such as CIFS shares @i{via}
@acronym{PAM, Pluggable Authentication Modules} when logging in, using login
credentials.")))

83
tests/services/pam-mount.scm Normal file
View File

@ -0,0 +1,83 @@
;;; GNU Guix --- Functional package management for GNU
;;; Copyright © 2023 Brian Cully <bjc@spork.org>
;;;
;;; This file is part of GNU Guix.
;;;
;;; GNU Guix is free software; you can redistribute it and/or modify it
;;; under the terms of the GNU General Public License as published by
;;; the Free Software Foundation; either version 3 of the License, or (at
;;; your option) any later version.
;;;
;;; GNU Guix is distributed in the hope that it will be useful, but
;;; WITHOUT ANY WARRANTY; without even the implied warranty of
;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
;;; GNU General Public License for more details.
;;;
;;; You should have received a copy of the GNU General Public License
;;; along with GNU Guix. If not, see <http://www.gnu.org/licenses/>.
(define-module (tests services pam-mount)
#:use-module (gnu services pam-mount)
#:use-module (gnu system pam)
#:use-module (gnu services)
#:use-module (gnu services configuration)
#:use-module (guix derivations)
#:use-module (guix gexp)
#:use-module (guix grafts)
#:use-module (guix store)
#:use-module (guix tests)
#:use-module (ice-9 match)
#:use-module (srfi srfi-1)
#:use-module (srfi srfi-64))
(define pam-mount-volume-fields (@@ (gnu services pam-mount)
pam-mount-volume-fields))
(define field-name->tag (@@ (gnu services pam-mount)
field-name->tag))
(define pam-mount-volume->sxml (@@ (gnu services pam-mount)
pam-mount-volume->sxml))
(test-begin "services-pam-mount")
(test-group "field-name->tag"
(let ((field-map '((user-name user)
(user-id uid)
(primary-group pgrp)
(group-id gid)
(secondary-group sgrp)
(file-system-type fstype)
(no-mount-as-root? noroot)
(server server)
(file-name path)
(mount-point mountpoint)
(options options)
(ssh? ssh)
(cipher cipher)
(file-system-key-cipher fskeycipher)
(file-system-key-hash fskeyhash)
(file-system-key-file-name fskeypath))))
(test-equal "all fields accounted for"
(map car field-map)
(map configuration-field-name pam-mount-volume-fields))
(for-each (match-lambda
((field-name tag-name)
(test-eq (format #f "~a -> ~a" field-name tag-name)
(field-name->tag field-name) tag-name)))
field-map)))
(let ((tmpfs-volume (pam-mount-volume
(secondary-group "users")
(file-system-type "tmpfs")
(mount-point "/run/user/%(USERUID)")
(options "someoptions"))))
(test-equal "tmpfs"
'(volume (@ (sgrp "users")
(fstype "tmpfs")
(mountpoint "/run/user/%(USERUID)")
(options "someoptions")))
(pam-mount-volume->sxml tmpfs-volume)))
(test-end "services-pam-mount")