Add system configuration for the Kolibri dbus daemon

[dylanmccall]

This depends on changes to Kolibri pending review in flathub/org.learningequality.Kolibri#17, but I believe it is safe to merge at any time.

https://phabricator.endlessm.com/T31182

[dylanmccall]

Things to test here:

• A "kolibri" system user is created. This is both for upgrading Endless OS, and for new installs. (That isn't really changed in this branch, but we never actually had this stuff in a release so it's worth making sure).
• The newest (unreleased) version of the Kolibri flatpak app works, with the desktop application talking to a Kolibri instance whose home directory is located at /var/lib/kolibri/data.
• Using the old (released) version of the Kolibri flatpak will cause the provided dbus service to be non-functional, but will otherwise not break anything.

[dylanmccall]

To test this, we need an early version of the Kolibri flatpak from flathub/org.learningequality.Kolibri#17. You can install it from the Flathub testing repository:

flatpak install --system https://dl.flathub.org/build-repo/35974/org.learningequality.Kolibri.flatpakref

[jprvita]

The whole D-Bus + systemd approach looks correct and sensible to me. The only question I had is about the KOLIBRI_USER management, but it looks like we already have a user named kolibri in the system, so we are good there. Otherwise I would suggest for us to use systemd's DynamicUser= setting instead.

I don't know Kolibri too deeply, so take my CR+ with a grain of salt.

[manuq]

Looks good to me as well!

[dylanmccall]

Hm, now you mention it, I do wonder why we aren't using DynamicUser. I vaguely recall discussing that when we did eos-kolibri originally, but can't find an email about it so I might be imagining. I'll try that and see what happens, but perhaps in a separate branch :)

[jprvita]

Hm, now you mention it, I do wonder why we aren't using DynamicUser. I vaguely recall discussing that when we did eos-kolibri originally, but can't find an email about it so I might be imagining. I'll try that and see what happens, but perhaps in a separate branch :)

If we were to switch it now, we'd have to drop the created kolibri user by reverting endlessm/base-passwd@c12a433. The only problem I can think from the top of my head is that if there are any files owned by that user, they would need to be dealt with (since they would have the old uid/gid). I don't know from the top of my head how DynamicUser deals with file ownership.

[dylanmccall]

Ah, happily DynamicUser has migrations like that in mind and will behave as usual if there's an existing kolibri user. Alas, there is one other (rather serious) issue, but I made a draft pull request to explore the idea: #2.