Vula #240

yakampe · 2024-05-23T12:48:07Z

Closes #96

yakampe · 2024-06-03T13:09:01Z

Update:

As far as we can tell, this seems ready and useful and possibly reliable. We are marking as ready for review; but the only review we would want, at this point, is from the Vula authors.

cc @ioerror @leif

yakampe · 2024-06-03T13:11:56Z

And to be clear we would like the authors review before merging.

ioerror · 2024-06-03T13:25:37Z

If you request me as a reviewer, I will make time this week to review it.

ioerror

I would be happy to further discuss this review and other aspects on Wednesday. Thank you for packaging this software and while there are additional changes to be made, the most important is using the vula altfiles fork as it does what is required and nothing more. The second most important is using the highctidh remote on codeberg. The rest of my comments are minor or otherwise cosmetic issues.

pkgs/by-name/highctidh/package.nix

projects/Vula/test.nix

lorenzleutgeb · 2024-06-04T11:26:55Z

What's the justification for adding so many users to the system (looks like one user per service)? Why not use one user for all of them, like before?

lorenzleutgeb · 2024-06-04T11:29:58Z

projects/Vula/test.nix

    };
+  in {
+    a = recursiveUpdate common {
+      services.vula.userPrefix = "fula";


I suggest something that is more obviously a test value, since "fula" is confusing, as evidenced by discussions in this very PR.

Suggested change

services.vula.userPrefix = "fula";

services.vula.userPrefix = "vula-testuserprefix";

I agree. I was confused and others may also be confused. For example a name that is self-documenting might be a good choice.

@lorenzleutgeb I don't like resolving others' concerns.

lorenzleutgeb · 2024-06-04T11:30:28Z

projects/Vula/test.nix

+  in {
+    a = recursiveUpdate common {
+      services.vula.userPrefix = "fula";
+      services.vula.systemGroup = "zula";


Suggested change

services.vula.systemGroup = "zula";

services.vula.systemGroup = "vula-testgroup";

lorenzleutgeb · 2024-06-04T11:33:24Z

projects/Vula/service.nix

+  commonServiceAttrs = {
+    serviceConfig.DevicePolicy = "closed";
+    serviceConfig.Group = cfg.systemGroup;
+    serviceConfig.LockPersonality = "yes";
+    serviceConfig.MemoryDenyWriteExecute = "yes";
+    serviceConfig.NoNewPrivileges = "yes";
+    serviceConfig.PrivateDevices = "yes";
+    serviceConfig.PrivateTmp = "yes";
+    serviceConfig.ProtectControlGroups = "yes";
+    serviceConfig.ProtectHome = "read-only";
+    serviceConfig.ProtectKernelLogs = "yes";
+    serviceConfig.ProtectKernelModules = "yes";
+    serviceConfig.ProtectKernelTunables = "yes";
+    serviceConfig.Restart = "always";
+    serviceConfig.RestartSec = "5s";
+    serviceConfig.RestrictNamespaces = "yes";
+    serviceConfig.RestrictRealtime = "yes";
+    serviceConfig.RestrictSUIDSGID = "yes";
+    serviceConfig.Slice = "vula.slice";
+    serviceConfig.StandardError = "journal";
+    serviceConfig.StandardOutput = "journal";
+    serviceConfig.Type = "dbus";
+    wantedBy = ["multi-user.target"];
+  };


Suggested change

commonServiceAttrs = {

serviceConfig.DevicePolicy = "closed";

serviceConfig.Group = cfg.systemGroup;

serviceConfig.LockPersonality = "yes";

serviceConfig.MemoryDenyWriteExecute = "yes";

serviceConfig.NoNewPrivileges = "yes";

serviceConfig.PrivateDevices = "yes";

serviceConfig.PrivateTmp = "yes";

serviceConfig.ProtectControlGroups = "yes";

serviceConfig.ProtectHome = "read-only";

serviceConfig.ProtectKernelLogs = "yes";

serviceConfig.ProtectKernelModules = "yes";

serviceConfig.ProtectKernelTunables = "yes";

serviceConfig.Restart = "always";

serviceConfig.RestartSec = "5s";

serviceConfig.RestrictNamespaces = "yes";

serviceConfig.RestrictRealtime = "yes";

serviceConfig.RestrictSUIDSGID = "yes";

serviceConfig.Slice = "vula.slice";

serviceConfig.StandardError = "journal";

serviceConfig.StandardOutput = "journal";

serviceConfig.Type = "dbus";

wantedBy = ["multi-user.target"];

};

commonServiceAttrs = {

serviceConfig = {

DevicePolicy = "closed";

Group = cfg.systemGroup;

LockPersonality = "yes";

MemoryDenyWriteExecute = "yes";

NoNewPrivileges = "yes";

PrivateDevices = "yes";

PrivateTmp = "yes";

ProtectControlGroups = "yes";

ProtectHome = "read-only";

ProtectKernelLogs = "yes";

ProtectKernelModules = "yes";

ProtectKernelTunables = "yes";

Restart = "always";

RestartSec = "5s";

RestrictNamespaces = "yes";

RestrictRealtime = "yes";

RestrictSUIDSGID = "yes";

Slice = "vula.slice";

StandardError = "journal";

StandardOutput = "journal";

Type = "dbus";

};

wantedBy = ["multi-user.target"];

};

It's a feature!

ioerror · 2024-06-04T12:02:46Z

What's the justification for adding so many users to the system (looks like one user per service)? Why not use one user for all of them, like before?

https://github.com/ngi-nix/ngipkgs/pull/240/files#diff-4cca03cc74f9020e75e823657c35110b6fbf820f27b87a5976a59e6439e3fd56R166

https://github.com/ngi-nix/ngipkgs/pull/240/files#diff-4cca03cc74f9020e75e823657c35110b6fbf820f27b87a5976a59e6439e3fd56R178

https://github.com/ngi-nix/ngipkgs/pull/240/files#diff-4cca03cc74f9020e75e823657c35110b6fbf820f27b87a5976a59e6439e3fd56R190

The design of vula depends on a separation of concerns. For example: vula-discover should only be able to do exactly what is required to do discovery and to communicate descriptors to vula-organize over dbus.

ioerror · 2024-06-04T12:07:02Z

We would like to add documentation to vula's README to show users how to use and install this nix ngipkgs pkg. We would also be happy to do that with highctidh. Could someone provide us with specific instructions? We can then tag new versions that include that documentation and then the final packages can be based on that tag.

ioerror · 2024-06-04T12:10:30Z

We would also be willing to add a CI test to test building a nix package against git tip for every commit, is there a template or a specific way that is supported for this kind of CI-centric testing?

pkgs/by-name/vula/package.nix

lorenzleutgeb · 2024-06-04T15:46:20Z

The design of vula depends on a separation of concerns. For example: vula-discover should only be able to do exactly what is required to do discovery and to communicate descriptors to vula-organize over dbus.

Could the same be achieved with dynamic users? Can a subset of these users be dynamic?

ioerror · 2024-06-04T17:01:43Z

The design of vula depends on a separation of concerns. For example: vula-discover should only be able to do exactly what is required to do discovery and to communicate descriptors to vula-organize over dbus.

Could the same be achieved with dynamic users? Can a subset of these users be dynamic?

It could be but we would prefer not to use that systemd feature without testing and consideration. Using fixed users and groups has already been analyzed.

Co-authored-by: Adrien Faure <adrien.faure@protonmail.com> Co-authored-by: Ali Jamadi <jamadi1377@gmail.com> Co-authored-by: GetPsyched <priyanshu@getpsyched.dev> Co-authored-by: Robert James Hernandez <rob@sarcasticadmin.com> Co-authored-by: Shahar "Dawn" Or <mightyiampresence@gmail.com> Co-authored-by: Yifei Sun <ysun@hey.com> Co-authored-by: yakampe <yanis.kampe.cv@gmail.com>

fricklerhandwerk · 2024-06-10T09:01:35Z

@ngi-nix/cake @ngi-nix/magic great job everyone!

@ioerror given the heavy lifting is done, upstreaming only needs a bit of scaffolding on your end. There's a tutorial series for all the moving parts on https://nix.dev if you want to try alone, but we can also make a pull request, such that all you'd have to do in CI is get Nix into the execution environment and run nix-build, or a combination of guidance and writing code - what would you prefer?

ioerror · 2024-06-11T10:49:31Z

@ngi-nix/cake @ngi-nix/magic great job everyone!

@ioerror given the heavy lifting is done, upstreaming only needs a bit of scaffolding on your end. There's a tutorial series for all the moving parts on https://nix.dev if you want to try alone, but we can also make a pull request, such that all you'd have to do in CI is get Nix into the execution environment and run nix-build, or a combination of guidance and writing code - what would you prefer?

We would prefer a pull request - ideally one for highctidh and one for vula, and then we will run those tests for all work performed in either repo in the future.

Also, thank you - this is a lot of work. Ideally the pull request should add a small section about Nix (how to use the packages, and some credit to those who did this work). We'd be happy to have text in our main README.md files for example in a Nix specific section, and in the Acknowledgements section.

A-jay98 force-pushed the mob/vula-test branch from 18599a0 to 4e6c178 Compare June 3, 2024 09:32

adfaure force-pushed the mob/vula-test branch from 4e6c178 to c6cf884 Compare June 3, 2024 09:42

GetPsyched force-pushed the mob/vula-test branch from c6cf884 to 6d9673a Compare June 3, 2024 12:38

sarcasticadmin force-pushed the mob/vula-test branch from 6d9673a to 351ec25 Compare June 3, 2024 12:48

yakampe marked this pull request as ready for review June 3, 2024 13:09

ioerror suggested changes Jun 3, 2024

View reviewed changes

lorenzleutgeb self-requested a review June 3, 2024 19:51

stepbrobd force-pushed the mob/vula-test branch from 351ec25 to e70fb95 Compare June 4, 2024 09:02

ioerror reviewed Jun 4, 2024

View reviewed changes

projects/Vula/test.nix Outdated Show resolved Hide resolved

lorenzleutgeb reviewed Jun 4, 2024

View reviewed changes

mightyiam force-pushed the mob/vula-test branch from e70fb95 to abae026 Compare June 4, 2024 13:52

yakampe commented Jun 4, 2024

View reviewed changes

pkgs/by-name/vula/package.nix Show resolved Hide resolved

mightyiam force-pushed the mob/vula-test branch from abae026 to 677c86e Compare June 5, 2024 07:53

sarcasticadmin force-pushed the mob/vula-test branch from 677c86e to 07fa826 Compare June 6, 2024 15:04

mightyiam force-pushed the mob/vula-test branch 3 times, most recently from 8eb683a to 691f29d Compare June 10, 2024 07:23

adfaure force-pushed the mob/vula-test branch from 691f29d to 935b95d Compare June 10, 2024 07:41

mightyiam force-pushed the mob/vula-test branch from 935b95d to 691f29d Compare June 10, 2024 07:45

mightyiam force-pushed the mob/vula-test branch from 691f29d to f3fd754 Compare June 10, 2024 07:47

mightyiam force-pushed the mob/vula-test branch from f3fd754 to 2ccea1b Compare June 10, 2024 07:47

A-jay98 merged commit d53e3a1 into main Jun 10, 2024
72 checks passed

A-jay98 deleted the mob/vula-test branch June 10, 2024 07:56

lorenzleutgeb mentioned this pull request Jun 10, 2024

Overview is not part of checks #279

Closed

mightyiam mentioned this pull request Jun 10, 2024

Vula GUI fails to start #277

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Vula #240

Vula #240

yakampe commented May 23, 2024 •

edited

Loading

yakampe commented Jun 3, 2024

yakampe commented Jun 3, 2024

ioerror commented Jun 3, 2024

ioerror left a comment

lorenzleutgeb commented Jun 4, 2024 •

edited

Loading

lorenzleutgeb Jun 4, 2024 •

edited

Loading

ioerror Jun 4, 2024

mightyiam Jun 4, 2024

mightyiam Jun 6, 2024

lorenzleutgeb Jun 4, 2024

mightyiam Jun 4, 2024

lorenzleutgeb Jun 4, 2024

mightyiam Jun 4, 2024

mightyiam Jun 10, 2024

ioerror commented Jun 4, 2024

ioerror commented Jun 4, 2024 •

edited

Loading

ioerror commented Jun 4, 2024

lorenzleutgeb commented Jun 4, 2024 •

edited

Loading

ioerror commented Jun 4, 2024

fricklerhandwerk commented Jun 10, 2024

ioerror commented Jun 11, 2024

	services.vula.userPrefix = "fula";
	services.vula.userPrefix = "vula-testuserprefix";

	services.vula.systemGroup = "zula";
	services.vula.systemGroup = "vula-testgroup";

Vula #240

Vula #240

Conversation

yakampe commented May 23, 2024 • edited Loading

yakampe commented Jun 3, 2024

yakampe commented Jun 3, 2024

ioerror commented Jun 3, 2024

ioerror left a comment

Choose a reason for hiding this comment

lorenzleutgeb commented Jun 4, 2024 • edited Loading

lorenzleutgeb Jun 4, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ioerror commented Jun 4, 2024

ioerror commented Jun 4, 2024 • edited Loading

ioerror commented Jun 4, 2024

lorenzleutgeb commented Jun 4, 2024 • edited Loading

ioerror commented Jun 4, 2024

fricklerhandwerk commented Jun 10, 2024

ioerror commented Jun 11, 2024

yakampe commented May 23, 2024 •

edited

Loading

lorenzleutgeb commented Jun 4, 2024 •

edited

Loading

lorenzleutgeb Jun 4, 2024 •

edited

Loading

ioerror commented Jun 4, 2024 •

edited

Loading

lorenzleutgeb commented Jun 4, 2024 •

edited

Loading