Hard User Separation with NixOS
tweag.io
Hard User Separation with NixOS
1–10 of 27 posts
Re: Hard User Separation with NixOS
#2TIL specialisations: https://nixos.wiki/wiki/Specialisation
I plan to use this for testing changes to my boot units.
In theory, plain old generations allow you to safely test changes to boot units, by allowing you to jump to the previous generation. In practice, this involves remembering which generations have known-good boots.
Specialisations will allow me to run a stable and candy track, on per generation.
What other usecases do specialisations improve?
Re: Hard User Separation with NixOS
#3This seems really dangerous. Wouldn't running garbage collection on the nix store while in the work partition clean out nix paths required by the home partition's install, and vice versa?
Re: Hard User Separation with NixOS
#4TIL specialisations: https://nixos.wiki/wiki/Specialisation I plan to use this for testing changes to my boot units. In theory, plain old generations allow you to safely test changes to boot units, by allowing you to jump to the previous generation. In practice, this involves remembering which generations have known-good boots. Specialisations will allow me to run a stable and candy track, on per generation. What oth…
This makes testing changes easier in other ways too: when I make experimental changes, I'm reluctant to commit them until I know they're working, since I like being able to checkout an old commit and know it boots. In practice this means I end up with a dirty checkout, and uncertainty on which changes have been tested.
In theory I could manage this with git rebasing and/or tagging, but in practice I lose confidence in whether I've accurately tracked.
With specialisations, I'd comfortably commit an experimental change to my canary track, even though it might break, safe in the knowledge that the stable track continues to boot.
Re: Hard User Separation with NixOS
#5This seems really dangerous. Wouldn't running garbage collection on the nix store while in the work partition clean out nix paths required by the home partition's install, and vice versa?
I think both specializations are in the same profile, which is a GC root.
Re: Hard User Separation with NixOS
#6You could also use systemd-homed with dm-crypt or cryptfs to have two users with two different encrypted home partitions.
Re: Hard User Separation with NixOS
#7TIL specialisations: https://nixos.wiki/wiki/Specialisation I plan to use this for testing changes to my boot units. In theory, plain old generations allow you to safely test changes to boot units, by allowing you to jump to the previous generation. In practice, this involves remembering which generations have known-good boots. Specialisations will allow me to run a stable and candy track, on per generation. What oth…
> Specialisations will allow me to run a stable and candy track, on per generation.
Typos:
Specialisations will allow me to run a stable and canary track, one per generation.
Re: Hard User Separation with NixOS
#8You could also use systemd-homed with dm-crypt or cryptfs to have two users with two different encrypted home partitions.
Alas, nixos does not support homed:
Re: Hard User Separation with NixOS
#9This makes me nostalgic for Trusted Solaris. Nearly identical motivations, but also allowed for runtime context switching (even within running X11 sessions) without a reboot.
It combined Zones, ZFS filesystems, Crossbow network virtualization, a modified X11 server, and an auth framework to glue it all together.
I don't know how widely Trusted Solaris was ever adopted, but I know that I haven't seen it in use in many years. Maybe this particular NixOS strategy will gain more traction.
Re: Hard User Separation with NixOS
#10TIL specialisations: https://nixos.wiki/wiki/Specialisation I plan to use this for testing changes to my boot units. In theory, plain old generations allow you to safely test changes to boot units, by allowing you to jump to the previous generation. In practice, this involves remembering which generations have known-good boots. Specialisations will allow me to run a stable and candy track, on per generation. What oth…
> Specialisations will allow me to run a stable and candy track, on per generation. Typos: Specialisations will allow me to run a stable and canary track, one per generation.
Candy track sounds better.
It's candy for tinkerers.