Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Please don't use sudo -E #11

Open
SeerLite opened this issue Nov 29, 2021 · 6 comments · May be fixed by #14
Open

Please don't use sudo -E #11

SeerLite opened this issue Nov 29, 2021 · 6 comments · May be fixed by #14

Comments

@SeerLite
Copy link

SeerLite commented Nov 29, 2021 •
edited
Loading

Hi! Thank you very much for this great Guix resource, it's been very useful to get everything set up.

I suggest you stop using sudo -E in your config and examples. It will make the Guile auto-compiler use the user's home directory to write caches for the system.scm (~/.cache). This means these files will be created with the root user.

The bad part is, if ~/.cache/guix or even just ~/.cache don't already exist, these directories will also be created with the root user and be owned and only writeable by them. As you can imagine, this becomes a problem.

EDIT: Try find ~ -user root to list all root-owned files to see what I mean :P

It took me quite a while to understand why guile would complain all the time when trying to run Scheme scripts, and I just realized it's because it was unable to write the compiled code to the cache. Luckily I haven't had problems with other programs, but I think that's because the ~/.cache directory is created by default (or I've just been really lucky).

So, I suggest you stop using it in examples and in your own code too. This is not the first time sudo -E has caused me problems, so I really discourage it. (sudo -E $EDITOR is also a common use, and it's just as harmful! If your editor downloads any plugins or creates any folders inside $HOME, they will have the exact same problem as the Guile compiler above).

Again, thank you for this resource. The use of org-mode (or whatever other emacs magic is involved :s) to make the self-describing files in a nice format is amazing and very easy to follow.
@daviwil
Copy link
Owner

daviwil commented Nov 29, 2021

Thanks! That does sound like it could become a problem but strangely I've never had an issue with it (yet).

What do you use instead of sudo -E for the specific case of guix system reconfigure? I believe the reason I started using it was because Guix wasn't finding something it needed until I dropped my user environment in with -E.

@SeerLite
Copy link
Author

sudo guix system reconfigure ~/.config/guix/system.scm without the -E works just fine for me and I've been using it for some time now.

Was it maybe a sudo guix pull? Where you wanted your user's ~/.config/guix/channels.scm but got root's instead? That's the only command I can think of that would use $HOME directly. (And yikes this one seems to also fill ~/.cache and even ~/.config with root owned files).

AFAIK guix pull shouldn't really ever be needed to run as root. Just guix pull with the regular user and then sudo guix system reconfigure.

@daviwil
Copy link
Owner

daviwil commented Nov 29, 2021

Yeah, I never use guix pull with sudo. I think the reason I was using sudo -E was to make sure that my own channel file was being used for reconfiguring the system instead of the root user's channel file. At the time I started using sudo -E, guix time-machine didn't exist, so I should probably use time-machine to consume my own channel file at this point.

@SeerLite SeerLite linked a pull request Mar 19, 2022 that will close this issue
Open
@emixa-d
Copy link

emixa-d commented May 13, 2022

IIRC from past discussions, the exact behaviour of sudo depends on the distribution you are using and for some the -E is the default or such.

@emixa-d
Copy link

emixa-d commented May 13, 2022

Relevant comment from guix/scripts/pull.scm:

;; XXX: Ubuntu's 'sudo' preserves $HOME by default, and thus the second
;; condition below is always false when one runs "sudo guix pull". As a
;; workaround, skip this code when $SUDO_USER is set. See
;; https://bugs.gnu.org/36785.

@SeerLite
Copy link
Author

SeerLite commented Feb 9, 2023

@emixa-d I gotta agree with Ludovic Courtès there regarding it being a bug-like behavior from part of Ubuntu. IMO this patch/PR still applies, especially since the configuration in this repo is aimed at Guix System which uses unpatched sudo (unlike Ubuntu, which seems to be the only distro messing with sudo).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

systems: Remove -E from sudo call SeerLite/daviwil-dotfiles
3 participants
@daviwil @SeerLite @emixa-d