From 9bea87a542d52bcaedfb4febb01bbe94b69934cf Mon Sep 17 00:00:00 2001 From: Ludovic Courtès Date: Wed, 8 Apr 2015 21:23:45 +0200 Subject: activation: Remove undeclared user accounts and groups. Fixes . Reported by David Thompson . * gnu/build/activation.scm (enumerate, current-users, current-groups, delete-user, delete-group): New procedures. (activate-users+groups): Add calls to 'delete-user' and 'delete-group'. * doc/guix.texi (User Accounts): Add a paragraph about statelessness. Explain that passwords are preserved. --- doc/guix.texi | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) (limited to 'doc/guix.texi') diff --git a/doc/guix.texi b/doc/guix.texi index 70604b7603..c0af4cb722 100644 --- a/doc/guix.texi +++ b/doc/guix.texi @@ -4238,7 +4238,9 @@ command, from the same-named package. This relies on the @node User Accounts @subsection User Accounts -User accounts are specified with the @code{user-account} form: +User accounts and groups are entirely managed through the +@code{operating-system} declaration. They are specified with the +@code{user-account} and @code{user-group} forms: @example (user-account @@ -4252,6 +4254,14 @@ User accounts are specified with the @code{user-account} form: (home-directory "/home/alice")) @end example +When booting or upon completion of @command{guix system reconfigure}, +the system ensures that only the user accounts and groups specified in +the @code{operating-system} declaration exist, and with the specified +properties. Thus, account or group creations or modifications made by +directly invoking commands such as @command{useradd} are lost upon +reconfiguration or reboot. This ensures that the system remains exactly +as declared. + @deftp {Data Type} user-account Objects of this type represent user accounts. The following members may be specified: @@ -4291,7 +4301,9 @@ graphical login managers do not list them. @item @code{password} (default: @code{#f}) You would normally leave this field to @code{#f}, initialize user passwords as @code{root} with the @command{passwd} command, and then let -users change it with @command{passwd}. +users change it with @command{passwd}. Passwords set with +@command{passwd} are of course preserved across reboot and +reconfiguration. If you @emph{do} want to have a preset password for an account, then this field must contain the encrypted password, as a string. -- cgit v1.2.3