19 ms·

Systemd-homed merged as a fundamental change to Linux home directories

61 points by mbreese 7y ago

kick 7y ago
I think this is going in the opposite direction of where I'd like to see Linux and UNIX home directories going, but it's still an interesting change. Has anyone played with it any? I know it just got merged, but I figure one of you may have tried it prior to that, so I might as well ask.
- JohnFen 7y ago
  I agree that this is not the direction that I want Linux to go. I object to systemd all by itself for the same reason, and it's why I'm moving from Linux to BSD. I haven't played with this, though. I don't have a use case for it.
- em-bee 7y ago
  where do you like to see home directories going insead?
mekster 7y ago
21k lines of new code added in systemd to maintain home directories? What would happen if the daemon goes down or has security hole? Are users screwed?
- lmilcin 7y ago
  Do not fret. Systemd crew does not make any mistakes.
  - hazeii 7y ago
    Because we have control over our own computers, right?
    - lmilcin 7y ago
      Do I really need to mark an obvious sarcasm so that everybody can enjoy it?
      - anonsivalley652 7y ago
        (Sigh.) Humor's equivalent of training wheels. I think Poe's law became more prevalent because more people lost their sense of humor because they're working more for less, are atomized from others and don't have a productive outlet for their frustrations and social media rewards pseudo-outrage/drama. Sometimes I throw in a "Poe's law disclaimer: ;)" to highlight the obvious redundancy of what seems obvious to me, whereas many are so quick to knee-jerk without nuance, ambiguity or extend an author an iota of grace that taking everything literally maybe such a cool way to go through the world that everyone should do it, all the time.
      - deleted 7y ago
        [deleted]
      - ColanR 7y ago
        Probably. I vouched for the comment.
- shrubble 7y ago
  Yes. I have already set up a VM for a friend where the root user could login but regular users could not. Took some research and at least an hour of my time... something was not set up in the user slice configuration for systemd's liking.
  - deleted 7y ago
    [deleted]
erik_seaberg 7y ago
I seem to recall this is incompatible with cronjobs, which puts it pretty far to the the game console end of the tool spectrum.
- tyingq 7y ago
  Pretty sure it also breaks ssh logins. This needs more discussion before blessing it. Systemd has bled far, far, beyond an init replacement.
  - throw0101a 7y ago
    > Systemd has bled far, far, beyond an init replacement. This has been my main objection to it: feature creep (with tight coupling between 'components').
  - PlutoIsAPlanet 7y ago
    You can store SSH keys in the user records. systemd was never just an init replacement, it's a project that includes an init replacement.
  - pnako 7y ago
    Don't worry about SSH, just wait for the systemd replacement for SSH.
- gerdesj 7y ago
  Please elaborate because that sounds odd to me. How on earth can a home directory manager mess with another daemon? I use winbind's associated PAM NSS module to run up a home dir as needed for my AD joined Linux machines. cron still works. I don't do games consoles, only business systems.
  - mondoshawan 7y ago
    Easy: crontabs are in /var/spool/cron/..., not /home, and user editable. If the user's homedir isn't mounted because they logged off and cleared their security tokens, any crontab they write that uses their homedir will break.
wnoise 7y ago
Without the amount of changes systemd makes to the operation of a system, at this point it should be thought of as a new operating system that shares a kernel with Linux.
- pmlnr 7y ago
  This is exactly what systemd sceptics have been shouting for years.
- throw0101a 7y ago
  We're not there yet: Every program attempts to expand until it can read mail. — Zawinski's Law
  - inetknght 7y ago
    All that's missing is a gvfs module to mount your IMAP directories...
    - grawprog 7y ago
      At this point you'd think systemd was trying to catch up with Emacs as the most 'everything but the kitchen sink' of all the software
    - rbanffy 7y ago
      From a UI perspective, this is brilliant. Windows had it with a shell extension that essentially turned Windows Explorer (not IE) into what would later be Outlook Express. It's awful that they opted out of making the desktop Explorer smarter and went the stand-alone application route.
  - salawat 7y ago
    Emacs went further. It absorbed systemd. See systemE.
    - Koshkin 7y ago
      Sure, the .emacs script could be just as good an init as any.
trulyrandom 7y ago
I really hope this gets nicely abstracted away into a NixOS module soon. I've been looking for a solution to securely suspend to RAM by clearing the LUKS keys and reopening the LUKS volume when resuming. It looks like systemd-homed will be the first viable option to accomplish that.
pmlnr 7y ago
I recently migrated to FreeNAS/FreeBSD. It's joyfully oldschool sysadmining, and for hobbyists/home server owners, it's so much nicer. For business vs systemd... you gotta keep your crew busy with change, right?
- geofft 7y ago
  For business we want something that works. At my last three jobs in a row I've had problems that systemd has been solving in an elegant, robust way. (Eight years ago it was startup ordering bugs with Upstart in an appliance; four years ago it was cleaning up a pile of cronjobs and handling the ordering relationships between them; today it's cleaning up a single cronjob that starts a big supervisord.) For home use, sure, there's a joy to making things work. Same as some people enjoy building a computer from parts - but you'll never see a business telling their employees to go to PCPartPicker and put something together.
  - pmlnr 7y ago
    > Upstart in an appliance > single cronjob that starts a big supervisord /me screams Seriously, why? All of those you're listing are monsters, and they should never have existed in the first place.
    - geofft 7y ago
      Because real-world systems aren't as pretty as hobby systems.
- deleted 7y ago
  [deleted]
0xFFFE 7y ago
Can systemd dynamically load new kernels at this point?
- newnewpdro 7y ago
  kexec has existed for ages...
- DoofusOfDeath 7y ago
  Systemd can launch an Emacs session, so...
Randor 7y ago
Interesting, I don't really understand why distribution maintainers are allowing this one project to have so much control over the operating system.
- geofft 7y ago
  There's a couple of possible reasons from the structure of your question: 1. The project really doesn't have that much control. Like packaging any other software, it adds a feature you can choose to install, but it does not affect the distro if you don't enable it. 2. The project generally comes up with good ideas, or at least better ideas than the shared consensus of historical UNIX practice, such that incorporating the product's changes is a sound technical decision. In this case I suspect it's 1 - the article points out that it's optional.
  - ColanR 7y ago
    > Like packaging any other software, it adds a feature you can choose to install, but it does not affect the distro if you don't enable it. I didn't want systemd, and there wasn't really an option for me to 'disable' it. I switched distros, because that was vastly easier. > The project generally comes up with good ideas, or at least better ideas than the shared consensus of historical UNIX practice [citation needed]
    - geofft 7y ago
      > I didn't want systemd I'm talking about this feature that is the subject of the article, not systemd in general. > [citation needed] I'm discussing possible reasons why a distro might choose to trust systemd. Perhaps I should have said, "The distro believes that...." Whether systemd does or does not do this is debatable, but it certainly seems possible, which is the entirety of my claim. (Also, I'm tentatively concluding that this is not the reason why distros are okay with this particular change.)
      - ColanR 7y ago
        > Perhaps I should have said, "The distro believes that...." I think so. As it stands, you are flat out stating that systemd produces better system design than UNIX - which is not only questionable of itself, but in blatant disregard of those who disagree with the systemd design philosophy.
knorker 7y ago
I read the design document for this. What's the point? This is not the 1990s. Who exactly is this for? Who actually has multi-user systems. Really has them. Clients are either all single-user laptops (at home and at work), or single-user workstations. Very rarely they're multi user workstations, but then they use something non-local for their home directories anyway, so again who is this for? This isn't the 1990s with 100 users on your computer club Linux server. Everyone just gets their own VM, now. Honestly, who still runs a 1990s style shared shell server? And per-user /home encryption on a shared system just sounds like a threat model contradiction. If you want to protect the users from each other then turning a blind eye to the regular local root exploits sounds odd at best. On servers for cifs /home if my home directory is secret, why would I expose it to every server I log in to? And if not for human user accounts, how will this help anyone run their docker containers or any other type of service? Am I just out of touch? Does this actually have users? Does it actually solve a problem? It breaks many use cases, that's very obvious.
- deleted 7y ago
  [deleted]
- deleted 7y ago
  [deleted]
- Iolaum 7y ago
  Anecdotally, my laptop is being used by two users. It irks very much that neither Ubuntu nor Fedora can easily support a common directory for data to be shared between users. I ve created custom bash commands to fix group file ownership and similar issues arising from sharing a directory between two home users.
  - grosswait 7y ago
    Have you looked into ACLs and/or setgid with a shared group? Used to do this at work all the time for numerous groups of users. This is definitely possible. You may need to pay attention to your umask.
    - 7y ago
lousken 7y ago
I'd much rather see easily portable desktop environments configs e.g. in KDE and xfce
- mfcl 7y ago
  How would that work?
  - lousken 7y ago
    I was thinking of a tool that would list GUI and integrated apps (maybe with a bunch of advanced options), you'd select which of those you'd like to backup and would give you an option to save a file which you'd then be able to import on another machine. It'd only dump non machine specific settings into the file. But in order to do this there should be some kind of a standard so that pretty much any app could integrate into such tool if it listed allowed settings and its locations.

61 points by mbreese 7y ago

kick 7y ago

I think this is going in the opposite direction of where I'd like to see Linux and UNIX home directories going, but it's still an interesting change. Has anyone played with it any? I know it just got merged, but I figure one of you may have tried it prior to that, so I might as well ask.

JohnFen 7y ago
I agree that this is not the direction that I want Linux to go. I object to systemd all by itself for the same reason, and it's why I'm moving from Linux to BSD. I haven't played with this, though. I don't have a use case for it.
em-bee 7y ago
where do you like to see home directories going insead?

mekster 7y ago

21k lines of new code added in systemd to maintain home directories? What would happen if the daemon goes down or has security hole? Are users screwed?

lmilcin 7y ago
Do not fret. Systemd crew does not make any mistakes.
- hazeii 7y ago
  Because we have control over our own computers, right?
  - lmilcin 7y ago
    Do I really need to mark an obvious sarcasm so that everybody can enjoy it?
    - anonsivalley652 7y ago
      (Sigh.) Humor's equivalent of training wheels. I think Poe's law became more prevalent because more people lost their sense of humor because they're working more for less, are atomized from others and don't have a productive outlet for their frustrations and social media rewards pseudo-outrage/drama. Sometimes I throw in a "Poe's law disclaimer: ;)" to highlight the obvious redundancy of what seems obvious to me, whereas many are so quick to knee-jerk without nuance, ambiguity or extend an author an iota of grace that taking everything literally maybe such a cool way to go through the world that everyone should do it, all the time.
    - deleted 7y ago
      [deleted]
    - ColanR 7y ago
      Probably. I vouched for the comment.
shrubble 7y ago
Yes. I have already set up a VM for a friend where the root user could login but regular users could not. Took some research and at least an hour of my time... something was not set up in the user slice configuration for systemd's liking.
- deleted 7y ago
  [deleted]

erik_seaberg 7y ago

I seem to recall this is incompatible with cronjobs, which puts it pretty far to the the game console end of the tool spectrum.

tyingq 7y ago
Pretty sure it also breaks ssh logins. This needs more discussion before blessing it. Systemd has bled far, far, beyond an init replacement.
- throw0101a 7y ago
  > Systemd has bled far, far, beyond an init replacement. This has been my main objection to it: feature creep (with tight coupling between 'components').
- PlutoIsAPlanet 7y ago
  You can store SSH keys in the user records. systemd was never just an init replacement, it's a project that includes an init replacement.
- pnako 7y ago
  Don't worry about SSH, just wait for the systemd replacement for SSH.
gerdesj 7y ago
Please elaborate because that sounds odd to me. How on earth can a home directory manager mess with another daemon? I use winbind's associated PAM NSS module to run up a home dir as needed for my AD joined Linux machines. cron still works. I don't do games consoles, only business systems.
- mondoshawan 7y ago
  Easy: crontabs are in /var/spool/cron/..., not /home, and user editable. If the user's homedir isn't mounted because they logged off and cleared their security tokens, any crontab they write that uses their homedir will break.

wnoise 7y ago

Without the amount of changes systemd makes to the operation of a system, at this point it should be thought of as a new operating system that shares a kernel with Linux.

pmlnr 7y ago
This is exactly what systemd sceptics have been shouting for years.
throw0101a 7y ago
We're not there yet: Every program attempts to expand until it can read mail. — Zawinski's Law
- inetknght 7y ago
  All that's missing is a gvfs module to mount your IMAP directories...
  - grawprog 7y ago
    At this point you'd think systemd was trying to catch up with Emacs as the most 'everything but the kitchen sink' of all the software
  - rbanffy 7y ago
    From a UI perspective, this is brilliant. Windows had it with a shell extension that essentially turned Windows Explorer (not IE) into what would later be Outlook Express. It's awful that they opted out of making the desktop Explorer smarter and went the stand-alone application route.
- salawat 7y ago
  Emacs went further. It absorbed systemd. See systemE.
  - Koshkin 7y ago
    Sure, the .emacs script could be just as good an init as any.

trulyrandom 7y ago

I really hope this gets nicely abstracted away into a NixOS module soon. I've been looking for a solution to securely suspend to RAM by clearing the LUKS keys and reopening the LUKS volume when resuming. It looks like systemd-homed will be the first viable option to accomplish that.

pmlnr 7y ago

I recently migrated to FreeNAS/FreeBSD. It's joyfully oldschool sysadmining, and for hobbyists/home server owners, it's so much nicer. For business vs systemd... you gotta keep your crew busy with change, right?

geofft 7y ago
For business we want something that works. At my last three jobs in a row I've had problems that systemd has been solving in an elegant, robust way. (Eight years ago it was startup ordering bugs with Upstart in an appliance; four years ago it was cleaning up a pile of cronjobs and handling the ordering relationships between them; today it's cleaning up a single cronjob that starts a big supervisord.) For home use, sure, there's a joy to making things work. Same as some people enjoy building a computer from parts - but you'll never see a business telling their employees to go to PCPartPicker and put something together.
- pmlnr 7y ago
  > Upstart in an appliance > single cronjob that starts a big supervisord /me screams Seriously, why? All of those you're listing are monsters, and they should never have existed in the first place.
  - geofft 7y ago
    Because real-world systems aren't as pretty as hobby systems.
deleted 7y ago
[deleted]

0xFFFE 7y ago

Can systemd dynamically load new kernels at this point?

newnewpdro 7y ago
kexec has existed for ages...
DoofusOfDeath 7y ago
Systemd can launch an Emacs session, so...

Randor 7y ago

Interesting, I don't really understand why distribution maintainers are allowing this one project to have so much control over the operating system.

geofft 7y ago
There's a couple of possible reasons from the structure of your question: 1. The project really doesn't have that much control. Like packaging any other software, it adds a feature you can choose to install, but it does not affect the distro if you don't enable it. 2. The project generally comes up with good ideas, or at least better ideas than the shared consensus of historical UNIX practice, such that incorporating the product's changes is a sound technical decision. In this case I suspect it's 1 - the article points out that it's optional.
- ColanR 7y ago
  > Like packaging any other software, it adds a feature you can choose to install, but it does not affect the distro if you don't enable it. I didn't want systemd, and there wasn't really an option for me to 'disable' it. I switched distros, because that was vastly easier. > The project generally comes up with good ideas, or at least better ideas than the shared consensus of historical UNIX practice [citation needed]
  - geofft 7y ago
    > I didn't want systemd I'm talking about this feature that is the subject of the article, not systemd in general. > [citation needed] I'm discussing possible reasons why a distro might choose to trust systemd. Perhaps I should have said, "The distro believes that...." Whether systemd does or does not do this is debatable, but it certainly seems possible, which is the entirety of my claim. (Also, I'm tentatively concluding that this is not the reason why distros are okay with this particular change.)
    - ColanR 7y ago
      > Perhaps I should have said, "The distro believes that...." I think so. As it stands, you are flat out stating that systemd produces better system design than UNIX - which is not only questionable of itself, but in blatant disregard of those who disagree with the systemd design philosophy.

knorker 7y ago

I read the design document for this. What's the point? This is not the 1990s. Who exactly is this for? Who actually has multi-user systems. Really has them. Clients are either all single-user laptops (at home and at work), or single-user workstations. Very rarely they're multi user workstations, but then they use something non-local for their home directories anyway, so again who is this for? This isn't the 1990s with 100 users on your computer club Linux server. Everyone just gets their own VM, now. Honestly, who still runs a 1990s style shared shell server? And per-user /home encryption on a shared system just sounds like a threat model contradiction. If you want to protect the users from each other then turning a blind eye to the regular local root exploits sounds odd at best. On servers for cifs /home if my home directory is secret, why would I expose it to every server I log in to? And if not for human user accounts, how will this help anyone run their docker containers or any other type of service? Am I just out of touch? Does this actually have users? Does it actually solve a problem? It breaks many use cases, that's very obvious.

deleted 7y ago
[deleted]
deleted 7y ago
[deleted]
Iolaum 7y ago
Anecdotally, my laptop is being used by two users. It irks very much that neither Ubuntu nor Fedora can easily support a common directory for data to be shared between users. I ve created custom bash commands to fix group file ownership and similar issues arising from sharing a directory between two home users.
- grosswait 7y ago
  Have you looked into ACLs and/or setgid with a shared group? Used to do this at work all the time for numerous groups of users. This is definitely possible. You may need to pay attention to your umask.
  - 7y ago

lousken 7y ago

I'd much rather see easily portable desktop environments configs e.g. in KDE and xfce

mfcl 7y ago
How would that work?
- lousken 7y ago
  I was thinking of a tool that would list GUI and integrated apps (maybe with a bunch of advanced options), you'd select which of those you'd like to backup and would give you an option to save a file which you'd then be able to import on another machine. It'd only dump non machine specific settings into the file. But in order to do this there should be some kind of a standard so that pretty much any app could integrate into such tool if it listed allowed settings and its locations.