On 2023-08-15 19:16:11 -0500, heat from fire via wrote:
> Hi all,
>
> First time posting on this forum.
>
> I am trying to set up a service that runs "sudo mullvad-daemon" upon user
> login. The mullvad package is installed through Nix on a user profile.
>
> I've tried creating a user service using Shepherd in a config file at
> "~/.config/shepherd/init.scm", but it doesn't seem possible to run the
> command as root.
> Here's a snippet from the file:
>
> (define mullvad
> (service '(mullvad)
> #:respawn? #t
> #:start (make-forkexec-constructor '("mullvad-daemon" "-v"))
> #:stop (make-kill-destructor)))
>
> I read through here in hopes to find a solution, but to no avail:
> https://www.gnu.org/software/shepherd/manual/shepherd.html#Services
> Perhaps there is a service constructor with an option to run the command as
> root?
I also do not see such option, and since the user shepherd runs under the user,
I do not think it is possible without modifications to the sudoers file.
>
> I know that I can define a Shepherd service in my system config file, which
> runs the command in it as root, but given that it depends on a user-installed
> Nix package, I'm not sure how I'll have to accommodate for that. The command
> is located at /home/user/.nix-profile/bin/mullvad-daemon.
> I also tried creating a regular system service using service-type, but
> couldn't get it to work.
>
> My only other alternative is to run sudo mullvad-daemon in ~/.profile and
> make an exception in the sudoers file to not require a password. This
> solution is messy so I wanna try to avoid it. I could also put the command in
> the Guix equivalent of "/etc/rc.local", but I don't think there is one in
> Guix.
>
> Any ideas on how I can create a service that runs a command installed in a
> user profile as root? Or alternatively, a better way to run a command as root
> without password on user login, after sourcing ~/.profile?
I do not have much experience with shepherd (yet!), but cannot you just use
'("sudo" "mullvad-daemon" "-v")? While still requiring an entry in sudoers
file, I would say it is cleaner than sudo ... in the ~/.profile, and it you
could still start/stop it via the herd command.
>
> Thanks!
--
There are only two hard things in Computer Science:
cache invalidation, naming things and off-by-one errors.
signature.asc
Description: PGP signature
