From 9a5920da2bc00b1a69e5242c1828e7a37efce4bb Mon Sep 17 00:00:00 2001 From: "K. Isom" Date: Fri, 25 Sep 2026 03:03:40 -0700 Subject: [PATCH] =?UTF-8?q?dixie:=20drop=20uid/gid=20from=20rsyncd=20modul?= =?UTF-8?q?es=20=E2=80=94=20daemon=20runs=20as=20dropsonde=20via=20SSH,=20?= =?UTF-8?q?setgroups()=20fails=20otherwise?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- hw/dixie/analysis.nix | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/hw/dixie/analysis.nix b/hw/dixie/analysis.nix index 5b3bede..0547abf 100644 --- a/hw/dixie/analysis.nix +++ b/hw/dixie/analysis.nix @@ -57,9 +57,10 @@ in # --- rsync daemon-over-ssh for the sync key -------------------------------- # The dropsonde sync key's forced command runs `rsync --server --daemon` # against this config: two write-only modules rooted at the dropsonde2 - # subdirs. use chroot = false so /srv paths resolve directly; uid/gid - # force the transfer to run as dropsonde. lock file is a global rsyncd - # parameter, so it sits at file scope (not per-module). + # subdirs. use chroot = false so /srv paths resolve directly; the daemon + # runs as dropsonde (the SSH user), so no uid/gid — setting them would + # make the non-root daemon fail at setgroups(). lock file is a global + # rsyncd parameter, so it sits at file scope (not per-module). environment.etc."rsyncd-dropsonde.conf".text = '' lock file = /home/dropsonde/rsyncd.lock @@ -67,16 +68,12 @@ in path = /srv/cold/dropsonde2 read only = false use chroot = false - uid = dropsonde - gid = dropsonde max connections = 2 [analysis] path = /srv/analysis/dropsonde2 read only = false use chroot = false - uid = dropsonde - gid = dropsonde max connections = 2 '';