How to add the Kanata service, which runs as a systemd dynamic user, to a group?

Help
1

source code in nixpkgs

How do I add this user to a specific group in my configuration?

2 
systemd.services."kanata-${name}".serviceConfig.SupplementaryGroups = [ "somegroup" ];

That said, why?

2 Likes
3

There is a bug/feature in Systemd which renders SupplementaryGroups not working with dynamic users :frowning:

4

The bug report is from 2018 and looks unconfirmed. I am using SupplementaryGroups a lot, e.g. with the acme group, and I think we would be on top of the systemd people if that didn’t work.

5

I hope 5 months isn’t necroing the thread yet… In my usecase (different service, not kanata), the service needs to write to a non-/var folder (specifically, a cifs-mounted NAS), for which it needs the proper group/permissions.

That being said, this sadly does not seem to work. Not sure why though.

6
on "necroing"

Well, IMO necroing threads is fine, and there isn’t much of a statement against it around here. If anything getting more edge cases covered in one thread is nice because now finding it gives you way more useful information (within reason). Discourse doesn’t struggle with the necro-related issues other forums have anywhere near as much.

Usually the real issue is asking about a completely different scenario which then derails the thread, making it less useful for someone in the future, especially if you don’t give enough information so I need to ask you three times to figure out what your issue is - this is sadly pretty common, largely people don’t know if their problem is related if they’re asking questions about it, and are generally awful at knowing what is actually relevant to the question.

I see this a lot on nvidia-related posts, because well, nvidia drivers and their many, many failure states, insane configuration, horrible kernel integration, inexplicable errors, many versions, hardware dependency, and the, err… relative inexperience of the people running into problems…

You’re luckily only on the verge of exactly this. But now I’m derailing the thread to give my 2c about necroing, so that’s not useful either :slight_smile:

Chances are your service is “hardened”. Many NixOS services don’t allow access to filepaths outside of exactly one directory in general, even if they’re given proper group permissions. This is done through the use of systemd’s cgroup features (i.e., containers/sandboxes). It limits the impact of a potential privilege escalation bug somewhere; after all, a lot of services don’t really do anything with the filesystem besides storing a little bit of state, so exposing access to it at all is kind of a needless risk.

This is useful to know for anyone who might want to do this, so good that you asked.

That said, I’d suggest creating a new thread in which you mention the specific service you’re trying to use (so far the above is just conjecture), and perhaps explain your use case in a lil’ more detail to see if someone can spot a better way to achieve what you want without removing the hardening. It could be the module author was a bit overzealous, but it’s also quite possible your use case is deliberately not permitted because there are better alternatives.

If you then just mention the permalink to this comment in that post, discourse will add a handy lil’ link here so people can track if they realize they have a similar issue in the future, without interrupting the flow of conversation too much.

1 Like