GNU bug report logs - #77001
[PATCH 0/8] Improve Kerberos support

Please note: This is a static page, with minimal formatting, updated once a day.
Click here to see this page with the latest information and nicer formatting.

Package: guix-patches; Reported by: Tomas Volf <~@wolfsden.cz>; Keywords: patch; dated Thu, 13 Mar 2025 22:19:02 UTC; Maintainer for guix-patches is guix-patches@HIDDEN.

Message received at 77001 <at> debbugs.gnu.org:

Received: (at 77001) by debbugs.gnu.org; 13 Mar 2025 22:20:23 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Thu Mar 13 18:20:23 2025
Received: from localhost ([127.0.0.1]:58710 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1tsqud-0004Jd-1A
	for submit <at> debbugs.gnu.org; Thu, 13 Mar 2025 18:20:23 -0400
Received: from wolfsden.cz ([37.205.8.62]:39368)
 by debbugs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)
 (Exim 4.84_2) (envelope-from <~@wolfsden.cz>) id 1tsquM-0004Cr-As
 for 77001 <at> debbugs.gnu.org; Thu, 13 Mar 2025 18:20:08 -0400
Received: by wolfsden.cz (Postfix, from userid 104)
 id 4147629C9AA; Thu, 13 Mar 2025 22:20:05 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=wolfsden.cz; s=mail;
 t=1741904405; bh=WmtN665r4J5+lJ7TZXqEPoUma1BpLX0nWzOE5ShZzo8=;
 h=From:To:Cc:Subject:Date:In-Reply-To:References;
 b=bZ8lqjyqc3JXNM8sTRx5ETC+YsIv8vzod4Cx5b777r4LTUVm47XwWg8VjZtKBlMgr
 8ejtN+G5D7fltWvNxTPGewj0sUnstbUxE8C08Y5Y0OSz67rDv8xJirYl4k/ERQF4tk
 zJ0Gx7C2ZMHV2TuJ3AaCwxuqUhvPJrwATLE8mWQTiMkvz3W5boVYQsY0E4WRvwo50+
 D4v0SXfcHX9TOACaS6JKJuGfGCzbh1tRh4sMTz7RBSjORPJLXqUcEVY9MdkTxPEV1R
 cIorbkS2ZaZzmhDVmrsbl7/c4sIAUdYrtncLfY2GAMFt89vkL/CicguVLmX5gFWth6
 5Y8kSD64jSWq3larMhBOK+93FvXtMyUuLOzQVfQ03eIKLQGH3dSEyf2ppgz+s2rweS
 Carzd/nrzR7wlQgussKUdz+SIB9HcicCjWaGF/fiuGwTftW58royAHZhM9G7rwPXRp
 AucmCpXMH+NWqV7I6zpfIpTm93efGg5i1bDZYDt31PYssOXppyl0rK+GTDDXeuogxz
 yzJOniV0G9961vAL9EnjXr0lsWYylrTYHSpYuHVjySKHuhxUihG9TqKj0VXbqsL03p
 VAYcIchIuPpKvE3Tr4hWgFK0CYoSO6LgV0gaYzI9qU8Mf85wSkYBR4goTGZCcs50na
 a2NUhpGBXwvEuWCbRP0H6GT8=
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on wolfsden
X-Spam-Level: 
X-Spam-Status: No, score=-3.1 required=5.0 tests=ALL_TRUSTED,BAYES_00,
 DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,URIBL_BLOCKED
 autolearn=ham autolearn_force=no version=3.4.6
Received: from localhost (unknown [128.0.188.242])
 by wolfsden.cz (Postfix) with ESMTPSA id AA5F929C88F;
 Thu, 13 Mar 2025 22:20:04 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=wolfsden.cz; s=mail;
 t=1741904404; bh=WmtN665r4J5+lJ7TZXqEPoUma1BpLX0nWzOE5ShZzo8=;
 h=From:To:Cc:Subject:Date:In-Reply-To:References;
 b=YaI+xEHMYFGH5EGglTJaaNC/gL9j/XHG7Rqp3AXgmt4/7BSjUO7DoigsJPZ8oJUEe
 cE1zQnChrEMa2v13i5/65vVUvovoW9oKDV4n8487v5TiPUpFwTC1sDh8Ez5F07bKsS
 vEINYDF2VWxOuv8JAYhUSx3gEtS/8R0E68uZ2e4JJueXwfWjItId/AEHzCkBuF/7S8
 A1t+N6li1Re2ahZm+XcqY5iXcQh4fCQx4nASNGPdwOO2oJStYP6SHdHGp5sTIquipu
 xf75nsDVA0fVH+sLiOFX3WROd3C9U/jGt0Xwl7He1DaR+UY/6Cn3XRQqCgBEFnGkJ4
 gr1Jir7Zl9DGBLOnqcbM2e11EPfrOvmjAjPigD+sq20mdS8kDpUeFB1VKjwM7psuCT
 VBwbQk+vZChScUdEteOX3nQgEt290vutnyoN2hdS6L3PZXIEF6cLU8wzq+lIinC/JN
 D7QeP3dG2EdLhK+MdRRfOUUwBYAf6mGbCpoXQ+CJDN9f403htNk8lApZDA5eEXuw7I
 a1+SmVSd5v510rRrHkB70eH7DsIE/9XOTzu1Ow+eVbTC/PYf3fYJUOD8bsMZSmT9jW
 6LqAdyhEVNhmamdl+x0k/UH0p1K0LFhOFGtrWLPdzAnKDO/1eTKnJ48a2714vKeSQ8
 mphkJEilNyf8UJu/IxeoYkVE=
From: Tomas Volf <~@wolfsden.cz>
To: 77001 <at> debbugs.gnu.org
Subject: [PATCH 8/8] services: krb5-service-type: Support launching KDC daemon.
Date: Thu, 13 Mar 2025 23:19:51 +0100
Message-ID: <152c7158621d0b623dfa36365a80370f69b2e06a.1741904210.git.~@wolfsden.cz>
X-Mailer: git-send-email 2.48.1
In-Reply-To: <cover.1741904210.git.~@wolfsden.cz>
References: <cover.1741904210.git.~@wolfsden.cz>
MIME-Version: 1.0
X-Debbugs-Cc: Ludovic Courtès <ludo@HIDDEN>, Maxim Cournoyer <maxim.cournoyer@HIDDEN>
Content-Transfer-Encoding: 8bit
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 77001
Cc: Tomas Volf <~@wolfsden.cz>
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -1.0 (-)

* gnu/services/kerberos.scm (krb5-configuration): Add krb5,
kdc-shepherd-service? fields.
(krb5-activation, krb5-shepherd-services): New procedures.
(krb5-service-type): Use them.

Change-Id: I091ae2a6ef25f5ce95123c29588749483954c2ac
---
 doc/guix.texi             | 12 ++++++-----
 gnu/services/kerberos.scm | 43 ++++++++++++++++++++++++++++++++++++---
 2 files changed, 47 insertions(+), 8 deletions(-)

diff --git a/doc/guix.texi b/doc/guix.texi
index 05c855c5ea..a58cf40b63 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -32125,11 +32125,13 @@ Kerberos Services
 
 @subsubheading Krb5 Service
 
-Programs using a Kerberos client library normally
-expect a configuration file in @file{/etc/krb5.conf}.
-This service generates such a file from a definition provided in the
-operating system declaration.
-It does not cause any daemon to be started.
+Programs using a Kerberos client library normally expect a configuration
+file in @file{/etc/krb5.conf}.  This service generates such a file from
+a definition provided in the operating system declaration.
+
+When @code{kdc-shepherd-service?} is set to @code{#t}, a shepherd
+service for @acronym{KDC, Key Distribution Center} is created.
+Otherwise no daemons are started.
 
 No ``keytab'' files are provided by this service---you must explicitly create them.
 This service is known to work with the MIT client library, @code{mit-krb5}.
diff --git a/gnu/services/kerberos.scm b/gnu/services/kerberos.scm
index 1e826a1455..3d1ab01cb8 100644
--- a/gnu/services/kerberos.scm
+++ b/gnu/services/kerberos.scm
@@ -17,10 +17,13 @@
 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
 
 (define-module (gnu services kerberos)
+  #:use-module (gnu packages kerberos)
   #:use-module (gnu services)
   #:use-module (gnu services configuration)
+  #:use-module (gnu services shepherd)
   #:use-module (gnu system pam)
   #:use-module (guix gexp)
+  #:use-module (guix packages)
   #:use-module (guix records)
   #:use-module (srfi srfi-1)
   #:use-module (srfi srfi-34)
@@ -416,7 +419,16 @@ (define-configuration krb5-configuration
 
   (realms
    (realm-list '())
-   "The list of realms which clients may access."))
+   "The list of realms which clients may access.")
+
+  (krb5
+   (package mit-krb5)
+   "The package to use for @command{krb5kdc}.")
+
+  (kdc-shepherd-service?
+   (boolean #f)
+   "Whether to generate a shepherd service for the @acronym{KDC, Key
+Distribution Center} daemon."  empty-serializer))
 
 
 (define (krb5-configuration-file config)
@@ -431,15 +443,40 @@ (define (krb5-configuration-file config)
 (define (krb5-etc-service config)
   (list `("krb5.conf" ,(krb5-configuration-file config))))
 
+(define (krb5-activation config)
+  (if (krb5-configuration-kdc-shepherd-service? config)
+      #~(begin
+          (use-modules (guix build utils))
+          (mkdir-p "/var/krb5kdc"))
+      #~#t))
+
+(define (krb5-shepherd-services config)
+  (match-record config <krb5-configuration>
+                (krb5 kdc-shepherd-service?)
+    (if kdc-shepherd-service?
+        (list
+         (shepherd-service
+          (documentation "Run a krb5kdc daemon.")
+          (provision '(krb5kdc))
+          (requirement '(user-processes))
+          (start #~(make-forkexec-constructor
+                    '(#$(file-append krb5 "/sbin/krb5kdc") "-n")))
+          (stop #~(make-kill-destructor))))
+        '())))
+
 
 (define krb5-service-type
   (service-type (name 'krb5)
                 (extensions
                  (list (service-extension etc-service-type
-                                          krb5-etc-service)))
+                                          krb5-etc-service)
+                       (service-extension activation-service-type
+                                          krb5-activation)
+                       (service-extension shepherd-root-service-type
+                                          krb5-shepherd-services)))
                 (description "Programs using a Kerberos client library
 normally expect a configuration file in @file{/etc/krb5.conf}.  This service
-generates such a file.  It does not cause any daemon to be started.")))
+generates such a file and (optionally) a shepherd service to run a daemon.")))
 
 
 
-- 
2.48.1

Information forwarded to ludo@HIDDEN, maxim.cournoyer@HIDDEN, guix-patches@HIDDEN:
bug#77001; Package guix-patches. Full text available.