Skip to content

Directory permissions for ${stateDir} are set wrongly on the initial creation of it #424

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Directory permissions for ${stateDir} are set wrongly on the initial creation of it #424

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
73d4f61
fix: directory permission bug on creating stateDir the first time
0xCCF4 Oct 29, 2025
525caed
Change state dir permission on activation to at least 7xx which is re…
0xCCF4 Oct 30, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion nixos-modules/host/default.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ in
system.activationScripts.microvm-host = ''
mkdir -p ${stateDir}
chown ${user}:${group} ${stateDir}
chmod g+w ${stateDir}
chmod 775 ${stateDir}
Copy link
Member

@SuperSandro2000 SuperSandro2000 Oct 29, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure if we would want 770 here 🤔

Copy link
Author

@0xCCF4 0xCCF4 Oct 29, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As far as I understand, 7xx is required to run the systemd services, which run under the user owning the folder.

Since I am not familiar with the project's source. I assumed that x7x is the desired configuration for the ${stateDir} - inferred from the chmod g+w.

Setting xx0 would be properly ok, otherwise, do you think that chmod u+rwx,g+w would do the trick? Letting the end-user decide on the others' permission?

Copy link
Member

@astro astro Oct 29, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If that's arbitrary, how about making it configurable with a NixOS option along with a sensible default?

Copy link
Member

@SuperSandro2000 SuperSandro2000 Oct 29, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Setting xx0 would be properly ok, otherwise, do you think that chmod u+rwx,g+w would do the trick? Letting the end-user decide on the others' permission?

Sounds good to me and making it configurable may also be a good idea but could also be to detailed.

Copy link
Author

@0xCCF4 0xCCF4 Oct 30, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If that's arbitrary, how about making it configurable with a NixOS option along with a sensible default?

The others' permission is arbitrary, yes. Creating a new option for that could be an idea, but I believe that no new option would be required to control that if we went with chmod u+rwx,g+w, since setting the permission that way would only enforce that the microvm services are working. A user who wants to control the other permissions on the file can simply imperatively change it or write their own script that modifies the file permissions.

'';

environment.systemPackages = [
Expand Down