pyrox.dev
1{ config, lib, pkgs, ... }:
2
3with lib;
4
5let
6
7 cfg = config.security.polkit;
8
9in
10
11{
12
13 options = {
14
15 security.polkit.enable = mkOption {
16 type = types.bool;
17 default = true;
18 description = "Whether to enable PolKit.";
19 };
20
21 security.polkit.extraConfig = mkOption {
22 type = types.lines;
23 default = "";
24 example =
25 ''
26 /* Log authorization checks. */
27 polkit.addRule(function(action, subject) {
28 polkit.log("user " + subject.user + " is attempting action " + action.id + " from PID " + subject.pid);
29 });
30
31 /* Allow any local user to do anything (dangerous!). */
32 polkit.addRule(function(action, subject) {
33 if (subject.local) return "yes";
34 });
35 '';
36 description =
37 ''
38 Any polkit rules to be added to config (in JavaScript ;-). See:
39 http://www.freedesktop.org/software/polkit/docs/latest/polkit.8.html#polkit-rules
40 '';
41 };
42
43 security.polkit.adminIdentities = mkOption {
44 type = types.listOf types.str;
45 default = [ "unix-user:0" "unix-group:wheel" ];
46 example = [ "unix-user:alice" "unix-group:admin" ];
47 description =
48 ''
49 Specifies which users are considered “administrators”, for those
50 actions that require the user to authenticate as an
51 administrator (i.e. have an <literal>auth_admin</literal>
52 value). By default, this is the <literal>root</literal>
53 user and all users in the <literal>wheel</literal> group.
54 '';
55 };
56
57 };
58
59
60 config = mkIf cfg.enable {
61
62 environment.systemPackages = [ pkgs.polkit.bin pkgs.polkit.out ];
63
64 systemd.packages = [ pkgs.polkit.out ];
65
66 systemd.services.polkit.restartTriggers = [ config.system.path ];
67 systemd.services.polkit.unitConfig.X-StopIfChanged = false;
68
69 # The polkit daemon reads action/rule files
70 environment.pathsToLink = [ "/share/polkit-1" ];
71
72 # PolKit rules for NixOS.
73 environment.etc."polkit-1/rules.d/10-nixos.rules".text =
74 ''
75 polkit.addAdminRule(function(action, subject) {
76 return [${concatStringsSep ", " (map (i: "\"${i}\"") cfg.adminIdentities)}];
77 });
78
79 ${cfg.extraConfig}
80 ''; #TODO: validation on compilation (at least against typos)
81
82 services.dbus.packages = [ pkgs.polkit.out ];
83
84 security.pam.services.polkit-1 = {};
85
86 security.setuidPrograms = [ "pkexec" ];
87
88 security.setuidOwners = [
89 { program = "polkit-agent-helper-1";
90 owner = "root";
91 group = "root";
92 setuid = true;
93 source = "${pkgs.polkit.out}/lib/polkit-1/polkit-agent-helper-1";
94 }
95 ];
96
97 system.activationScripts.polkit =
98 ''
99 # Probably no more needed, clean up
100 rm -rf /var/lib/{polkit-1,PolicyKit}
101 '';
102
103 users.extraUsers.polkituser = {
104 description = "PolKit daemon";
105 uid = config.ids.uids.polkituser;
106 };
107
108 };
109
110}
111