aboutsummaryrefslogtreecommitdiff
;;; GNU Guix --- Functional package management for GNU
;;; Copyright © 2017 Sou Bunnbu <iyzsong@member.fsf.org>
;;;
;;; This file is part of GNU Guix.
;;;
;;; GNU Guix is free software; you can redistribute it and/or modify it
;;; under the terms of the GNU General Public License as published by
;;; the Free Software Foundation; either version 3 of the License, or (at
;;; your option) any later version.
;;;
;;; GNU Guix is distributed in the hope that it will be useful, but
;;; WITHOUT ANY WARRANTY; without even the implied warranty of
;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
;;; GNU General Public License for more details.
;;;
;;; You should have received a copy of the GNU General Public License
;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.

(define-module (gnu services sysctl)
  #:use-module (gnu services)
  #:use-module (gnu services shepherd)
  #:use-module (gnu packages linux)
  #:use-module (guix gexp)
  #:use-module (guix records)
  #:use-module (srfi srfi-1)
  #:use-module (ice-9 match)
  #:export (sysctl-configuration
            sysctl-configuration-sysctl
            sysctl-configuration-settings
            sysctl-service-type
            %default-sysctl-settings))


;;;
;;; System Control Service.
;;;

(define %default-sysctl-settings
  ;; Default kernel parameters enabled with sysctl.
  '(("fs.protected_hardlinks" . "1")
    ("fs.protected_symlinks" . "1")))

(define-record-type* <sysctl-configuration>
  sysctl-configuration make-sysctl-configuration
  sysctl-configuration?
  (sysctl   sysctl-configuration-sysctl    ; path of the 'sysctl' command
            (default (file-append procps "/sbin/sysctl")))
  (settings sysctl-configuration-settings  ; alist of string pairs
            (default %default-sysctl-settings)))

(define (sysctl-configuration-settings->sysctl.conf settings)
  "Return a file for @command{sysctl} to set kernel parameters as specified by
@var{settings}."
  (apply mixed-text-file "sysctl.conf"
         (append-map (match-lambda
                       ((key . value)
                        (list key "=" value "\n")))
                     settings)))

(define sysctl-shepherd-service
  (match-lambda
    (($ <sysctl-configuration> sysctl settings)
     (let ((sysctl.conf
            (sysctl-configuration-settings->sysctl.conf settings)))
       (shepherd-service
        (documentation "Configure kernel parameters at boot.")
        (provision '(sysctl))
        (start #~(lambda _
                   (zero? (system* #$sysctl "--load" #$sysctl.conf))))
        (one-shot? #t))))))

(define sysctl-service-type
  (service-type
   (name 'sysctl)
   (extensions
    (list (service-extension shepherd-root-service-type
                             (compose list sysctl-shepherd-service))))
   (compose concatenate)
   (extend (lambda (config settings)
             (sysctl-configuration
              (inherit config)
              (settings (append (sysctl-configuration-settings config)
                                settings)))))
   (default-value (sysctl-configuration))
   (description "Set Linux kernel parameters under @file{/proc/sys} at system
startup time.")))
u-store.mount.in' to the distribution....Reported by Vagrant Cascadian. * nix/local.mk (EXTRA_DIST): Add 'etc/gnu-store.mount.in'. Ludovic Courtès 2020-09-17guix-install.sh: Support OpenRC....* etc/guix-install.sh (chk_init_sys): Detect OpenRC. (sys_enable_guix_daemon): Install & enable the Guix daemon on such systems. * etc/openrc/guix-daemon.in: New file. * nix/local.mk: Add a rule for it. (openrcservicedir, nodist_openrcservice_DATA): New variables. (CLEANFILES, EXTRA_DIST): Add them. * .gitignore: Ignore etc/openrc/guix-daemon. Signed-off-by: Tobias Geerinckx-Rice <me@tobias.gr> Morgan Smith 2020-06-27daemon: Remove OpenSSL hash compatibility wrappers....* nix/libutil/hash.cc (struct Ctx): Copy from gcrypt-hash.hh. (start, update, finish): Use gcrypt functions directly instead of OpenSSL-like wrappers. * nix/libutil/gcrypt-hash.cc, nix/libutil/gcrypt-hash.hh, nix/libutil/md5.h, nix/libutil/sha1.h, nix/libutil/sha256.h, nix/libutil/sha512.h: Remove. * nix/local.mk (libutil_a_SOURCES, libutil_headers): Adjust accordingly. Ludovic Courtès 2020-05-23build: Add a comment above the sysvinit section....* nix/local.mk (sysvinitservicedir): Add a comment. Signed-off-by: Tobias Geerinckx-Rice <me@tobias.gr> Vincent Legoll 2020-05-17etc: Install mount unit only if it exists....This follows up on 1a1faa78b0498fbb71f1533beb4b65817c1d3f2a, and avoids the (non-fatal) error seen in <https://issues.guix.gnu.org/41356>. /gnu/store will remain writable on new foreign distribution installations until the next release. * etc/guix-install.sh (sys_enable_guix_daemon): Check for ‘gnu-store.mount’ presence before trying to cp it. Update forgotten copyright header. Tobias Geerinckx-Rice 2020-05-16etc: Add a systemd unit to bind-mount @storedir@ read-only....* etc/gnu-store.mount.in: New file. * nix/local.mk (nodist_systemdservice_DATA): Add it. (etc/%.mount): New rule for it. * etc/guix-install.sh (sys_enable_guix_daemon): Install it. * doc/guix.texi (Binary Installation): Document it. * .gitignore: Ignore changes to it. Tobias Geerinckx-Rice 2020-03-11Add system start-up files for guix-daemon....* etc/init.d/guix-daemon.in: New file. * nix/local.mk (etc/init.d/guix-daemon): New rule. (nodist_sysvinitservice_DATA): Add etc/init.d/guix-daemon.in . (CLEANFILES): Add etc/init.d/guix-daemon . * .gitignore: Add etc/init.d/guix-daemon . Danny Milosavljevic 2019-09-08daemon: Remove 'NIX_LIBEXEC_DIR'....* nix/libstore/globals.hh (Settings)[nixLibexecDir]: Remove. * nix/libstore/globals.cc (Settings::processEnvironment): Remove reference to 'nixLibexecDir'. * nix/local.mk (libstore_a_CPPFLAGS): Remove -DNIX_LIBEXEC_DIR flag. * build-aux/pre-inst-env.in: Remove references to 'NIX_LIBEXEC_DIR'. Ludovic Courtès 2019-09-08daemon: Run 'guix substitute' directly and assume a single substituter....The daemon had a mechanism that allows it to handle a list of substituters and try them sequentially; this removes it. * nix/scripts/substitute.in: Remove. * nix/local.mk (nodist_pkglibexec_SCRIPTS): Remove. * config-daemon.ac: Don't output 'nix/scripts/substitute'. * nix/libstore/build.cc (SubstitutionGoal)[subs, sub, hasSubstitute]: Remove. [tryNext]: Make private. (SubstitutionGoal::SubstitutionGoal, SubstitutionGoal::init): Remove now unneeded initializers. (SubstitutionGoal::tryNext): Adjust to assume a single substituter: call 'amDone' upfront when we couldn't find substitutes. (SubstitutionGoal::tryToRun): Adjust to run 'guix substitute' via 'settings.guixProgram'. (SubstitutionGoal::finished): Call 'amDone(ecFailed)' upon failure instead of setting 'state' to 'tryNext'. * nix/libstore/globals.hh (Settings)[substituters]: Remove. * nix/libstore/local-store.cc (LocalStore::~LocalStore): Adjust to handle a single substituter. (LocalStore::startSubstituter): Remove 'path' parameter. Adjust to invoke 'settings.guixProgram'. Don't refer to 'run.program', which no longer exists. (LocalStore::querySubstitutablePaths): Adjust for 'runningSubstituters' being a singleton instead of a list. (LocalStore::querySubstitutablePathInfos): Likewise, and remove 'substituter' parameter. * nix/libstore/local-store.hh (RunningSubstituter)[program]: Remove. (LocalStore)[runningSubstituters]: Remove. [runningSubstituter]: New field. [querySubstitutablePathInfos]: Remove 'substituter' parameter. [startSubstituter]: Remove 'substituter' parameter. * nix/nix-daemon/guix-daemon.cc (main): Remove references to 'settings.substituters'. * nix/nix-daemon/nix-daemon.cc (performOp): Ignore the user's "build-use-substitutes" value when 'settings.useSubstitutes' is false. Ludovic Courtès 2019-09-08daemon: Run 'guix offload' directly....* nix/scripts/offload.in: Remove. * nix/local.mk (nodist_pkglibexec_SCRIPTS) [BUILD_DAEMON_OFFLOAD]: Remove 'scripts/offload'. * config-daemon.ac: Don't output 'nix/scripts/offload'. * build-aux/pre-inst-env.in: Don't set 'NIX_BUILD_HOOK'. * nix/libstore/build.cc (HookInstance::HookInstance): Run 'guix offload'. (DerivationGoal::tryBuildHook): Remove reference to 'NIX_BUILD_HOOK'. * nix/nix-daemon/guix-daemon.cc (main) [HAVE_DAEMON_OFFLOAD_HOOK]: Don't set 'NIX_BUILD_HOOK'. * nix/nix-daemon/nix-daemon.cc (performOp) [!HAVE_DAEMON_OFFLOAD_HOOK]: Leave 'settings.useBuildHook' unchanged. Ludovic Courtès 2019-09-08daemon: Run 'guix perform-download' directly....* nix/scripts/download.in: Remove. * nix/local.mk (nodist_pkglibexec_SCRIPTS): Remove 'scripts/download'. * config-daemon.ac: Don't output 'nix/scripts/download'. * nix/libstore/builtins.cc (builtinDownload): Invoke 'guix perform-download' directly. Ludovic Courtès 2019-09-08daemon: Run 'guix authenticate' directly....* nix/scripts/authenticate.in: Remove. * nix/local.mk (nodist_pkglibexec_SCRIPTS): Remove scripts/authenticate. * config-daemon.ac: Don't output 'nix/scripts/authenticate'. * nix/libstore/local-store.cc (runAuthenticationProgram): Run 'guix authenticate'. Ludovic Courtès 2019-09-08daemon: Invoke 'guix gc --list-busy' instead of 'list-runtime-roots'....* nix/scripts/list-runtime-roots.in: Remove. * guix/store/roots.scm (%proc-directory): New variable. (proc-file-roots, proc-exe-roots, proc-cwd-roots) (proc-fd-roots, proc-maps-roots, proc-environ-roots) (referenced-files, canonicalize-store-item, busy-store-items): New procedures, taken from 'list-runtime-roots.in'. * nix/libstore/globals.hh (Settings)[guixProgram]: New field. * nix/libstore/globals.cc (Settings::processEnvironment): Initialize 'guixProgram'. * nix/libstore/gc.cc (addAdditionalRoots): Drop code related to 'NIX_ROOT_FINDER'. Run "guix gc --list-busy". * nix/local.mk (nodist_pkglibexec_SCRIPTS): Remove 'scripts/list-runtime-roots'. * config-daemon.ac: Don't output nix/scripts/list-runtime-roots. * build-aux/pre-inst-env.in: Don't set 'NIX_ROOT_FINDER'. Set 'GUIX'. * doc/guix.texi (Invoking guix gc): Document '--list-busy'. * guix/scripts/gc.scm (show-help, %options): Add "--list-busy". (guix-gc)[list-busy]: New procedure. Handle the 'list-busy' action. Ludovic Courtès