Sysusers only for sysusers

[nikstur]

d43e323 fixes #325052
2710a49 fixes #318365
2ca0453 fixes #307159

The most important change is that sysusers now will only create system users. You cannot use this when you have normal users! I plan to add a perlless mode to add normal users via systemd-homed in the future.

Also, sysusers is now always executed at runtime even when /etc is immutable and when mutableUsers = false.

closes #328727

Description of changes

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 24.11 Release Notes (or backporting 23.11 and 24.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[arianvp]

How will the root user be handled in the homed case?

[nikstur]

How will the root user be handled in the homed case?

The root user will always be handled by sysusers

[nikstur]

@ofborg test systemd-sysusers-immutable systemd-sysusers-mutable activation-etc-overlay-immutable activation-etc-overlay-mutable

[evrim]

Hi there,

I am afraid this patch has some problems within.

       assertion = !opts.isNormalUser;
        message = "systemd-sysusers doesn't create normal users. You can currently only use it to create system users.";

First of all, the above assertion is pretty cruel to devs, I had no idea which user is blocking my build so adding "${_username}" as a prefix mite be kind to all of us.

Another problem is I build a kexec image with nixos-images by the modules noninteractive and kexec-installer. The former uses perlless and the latter insert users.user.nixos. I do not know any means to remove the nixos user from the installer hence the following uglyness.

 users.users.nixos = {                                                                                                                                                                                                                      
    isSystemUser = true;                                                                                                                                                                                                                     
    isNormalUser = lib.mkForce false;                                                                                                                                                                                                        
  };                                                                                                                                                                                                                                         
  users.users.nixos.group = "nixos";                                                                                                                                                                                                         
  users.groups.nixos = {};                                                                                                                                                                                                                                                  

I think there must be an agreement btw the installer in nixos and the perlless otherwise the above error message mite bite us on the long run.

best,
evrim.

[Mic92]

       assertion = !opts.isNormalUser;
        message = "systemd-sysusers doesn't create normal users. You can currently only use it to create system users.";

First of all, the above assertion is pretty cruel to devs, I had no idea which user is blocking my build so adding "${_username}" as a prefix mite be kind to all of us.

Makes sense. Could you make a pull request?

[Mic92]

I also added your patch to nixos-images: nix-community/nixos-images#261