Systemd Spawner DynamicUser= feature change directory?

whositwhatnow · September 1, 2021, 2:38pm

Is it possible to change the directory that this option uses by default from /var/lib/username to something else?
We have an NFS share setup for home directories and we want to use that location. We are using the LTI authenticator hence the reason for wanting to use the Dynamic user option.

manics · September 1, 2021, 5:37pm

These are the relevant sections of code:

github.com

jupyterhub/systemdspawner/blob/e75caddd7f310c591f642cdd559107c171a1e657/systemdspawner/systemdspawner.py#L123-L138

    
      
          dynamic_users = Bool(
              False,
              help="""
              Allocate system users dynamically for each user.
          
          
    Uses the DynamicUser= feature of Systemd to make a new system user
              for each hub user dynamically. Their home directories are set up
              under /var/lib/{USERNAME}, and persist over time. The system user
              is deallocated whenever the user's server is not running.
          
          
    See http://0pointer.net/blog/dynamic-users-with-systemd.html for more
              information.
          
          
    Requires systemd 235.
              """
          ).tag(config=True)

github.com

jupyterhub/systemdspawner/blob/e75caddd7f310c591f642cdd559107c171a1e657/systemdspawner/systemdspawner.py#L224-L233

    
      
          if self.dynamic_users:
              properties['DynamicUser'] = 'yes'
              properties['StateDirectory'] = self._expand_user_vars('{USERNAME}')
          
          
    # HOME is not set by default otherwise
              env['HOME'] = self._expand_user_vars('/var/lib/{USERNAME}')
              # Set working directory to $HOME too
              working_dir = env['HOME']
              # Set uid, gid = None so we don't set them
              uid = gid = None

There’s a link to Dynamic Users with systemd which includes:

How is that applied to dynamic user services? Let’s say StateDirectory=foobar is set for a service that has DynamicUser= turned off. The instant the service is started, /var/lib/foobar is created as state directory, owned by the service’s user and remains in existence when the service is stopped. If the same service now is run with DynamicUser= turned on, the implementation is slightly altered. Instead of a directory /var/lib/foobar a symbolic link by the same path is created (owned by root), pointing to /var/lib/private/foobar (the latter being owned by the service’s dynamic user). The /var/lib/private directory is created as boundary directory: it’s owned by root:root , and has a restrictive access mode of 0700. Both the symlink and the service’s state directory will survive the service’s life-cycle, but the state directory will remain, and continues to be owned by the now disposed dynamic UID — however it is protected from other host users (and other services which might get the same dynamic UID assigned due to UID recycling) by the boundary directory.