nixos.photoprism: Rotating images fails.

[kevincox]

Describe the bug

When attempting to rotate an image in PhotoPrism the update fails.

Steps To Reproduce

Steps to reproduce the behavior:

1. Edit a Photo
2. Go to the "Files" tab.
3. Update the orientation.

Expected behavior

It succeeds.

Additional context

The root cause is that PhotoPrism calls exiftool which is written in Perl. Seeming as part of Perl startup it calls chown and that call fails because of the SystemCallFilter applied to the unit.

           PID: 1554712 (exiftool)
           UID: 983 (photoprism)
           GID: 985 (photoprism)
        Signal: 31 (SYS)
     Timestamp: Mon 2023-08-14 13:06:18 UTC (9min ago)
  Command Line: /nix/store/49g0ah60ppjrdgy70yagddvd9a4p8b1j-perl-5.38.0/bin/perl $'-w -I/nix/store/49g0ah60ppjrdgy70yagddvd9a4p8b1j-perl-5.38.0/lib/perl5/site_perl -I/nix/store/gj0dzrxhljzxhjlnr411a5pmn2zmpk63-perl5.38.0-Image-ExifTool-12.62/lib/perl5/site_perl' /nix/store/gj0dzrxhljzxhjlnr411a5pmn2zmpk63-perl5.38.0-Image-ExifTool-12.62/bin/exiftool -overwrite_original -n -Orientation=6 /REDACTED.jpg
    Executable: /nix/store/49g0ah60ppjrdgy70yagddvd9a4p8b1j-perl-5.38.0/bin/perl
 Control Group: /system.slice/photoprism.service
          Unit: photoprism.service
         Slice: system.slice
       Boot ID: 248b416753a7444db2c4efba7afcf163
    Machine ID: REDACTED
      Hostname: REDACTED
       Storage: /var/lib/systemd/coredump/core.exiftool.983.248b416753a7444db2c4efba7afcf163.1554712.1692018378000000.zst (present)
  Size on Disk: 5.0M
       Message: Process 1554712 (exiftool) of user 983 dumped core.
                
                Module Storable.so without build-id.
                Module Fcntl.so without build-id.
                Module Encode.so without build-id.
                Module Glob.so without build-id.
                Module libcrypt.so.2 without build-id.
                Module libperl.so without build-id.
                Module perl without build-id.
                Stack trace of thread 1554712:
                #0  0x00007fd2560319ab chown (libc.so.6 + 0xf79ab)
                #1  0x00007fd2563b58d9 Perl_apply (libperl.so + 0x1b58d9)
                #2  0x00007fd2563a2993 Perl_pp_chown (libperl.so + 0x1a2993)
                #3  0x00007fd25633f576 Perl_runops_standard (libperl.so + 0x13f576)
                #4  0x00007fd256277236 perl_run (libperl.so + 0x77236)
                #5  0x0000000000401252 main (perl + 0x1252)
                #6  0x00007fd255f5dace __libc_start_call_main (libc.so.6 + 0x23ace)
                #7  0x00007fd255f5db89 __libc_start_main@@GLIBC_2.34 (libc.so.6 + 0x23b89)
                #8  0x0000000000401295 _start (perl + 0x1295)
                ELF object binary architecture: AMD x86-64

It appears that the chown system call is explicitly blacklisted by the ~@privileged rule. Removing this rule allows the re-orientation to succeed. Just removing that blacklist is seemingly sufficient to resolve this issue.

Notify maintainers

@Stunkymonkey

Metadata

• system: "x86_64-linux"
• host os: Linux 6.1.44, NixOS, 23.11 (Tapir), 23.11pre512984.ce5e4a6ef2e5
• multi-user?: yes
• sandbox: yes
• version: nix-env (Nix) 2.15.1
• channels(root): "nixos"
• nixpkgs: /nix/var/nix/profiles/per-user/root/channels/nixos

[Stunkymonkey]

The NixOS-module was developed with read-only (which is my use-case).

Could you also check if uploading a picture is fixed as well? the re is another issue with this #218061

[kevincox]

I have never had issues uploading pictures.

[kevincox]

Ah, reading that thread the reason is probably because I have disabled the DynamicUser feature so that I could give it access to my photos directory. (I am using POSIX ACLs to manage access to that).

[Stunkymonkey]

I think having a normal user is a better way to fix this for all permission problems.
I should define an id for the user as well in https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/misc/ids.nix, and so on. Any PR fixing this is more then welcome.

[kevincox]

I don't think this issue is related to users at all. It is just the sandbox capability is too tight. I can send a PR.