pyrox.dev
1# Configuration for the pwdutils suite of tools: passwd, useradd, etc.
2
3{ config, lib, utils, pkgs, ... }:
4
5with lib;
6
7let
8
9 /*
10 There are three different sources for user/group id ranges, each of which gets
11 used by different programs:
12 - The login.defs file, used by the useradd, groupadd and newusers commands
13 - The update-users-groups.pl file, used by NixOS in the activation phase to
14 decide on which ids to use for declaratively defined users without a static
15 id
16 - Systemd compile time options -Dsystem-uid-max= and -Dsystem-gid-max=, used
17 by systemd for features like ConditionUser=@system and systemd-sysusers
18 */
19 loginDefs =
20 ''
21 DEFAULT_HOME yes
22
23 SYS_UID_MIN 400
24 SYS_UID_MAX 999
25 UID_MIN 1000
26 UID_MAX 29999
27
28 SYS_GID_MIN 400
29 SYS_GID_MAX 999
30 GID_MIN 1000
31 GID_MAX 29999
32
33 TTYGROUP tty
34 TTYPERM 0620
35
36 # Ensure privacy for newly created home directories.
37 UMASK 077
38
39 # Uncomment this and install chfn SUID to allow non-root
40 # users to change their account GECOS information.
41 # This should be made configurable.
42 #CHFN_RESTRICT frwh
43
44 '';
45
46 mkSetuidRoot = source:
47 { setuid = true;
48 owner = "root";
49 group = "root";
50 inherit source;
51 };
52
53in
54
55{
56
57 ###### interface
58
59 options = {
60
61 users.defaultUserShell = lib.mkOption {
62 description = ''
63 This option defines the default shell assigned to user
64 accounts. This can be either a full system path or a shell package.
65
66 This must not be a store path, since the path is
67 used outside the store (in particular in /etc/passwd).
68 '';
69 example = literalExpression "pkgs.zsh";
70 type = types.either types.path types.shellPackage;
71 };
72
73 };
74
75
76 ###### implementation
77
78 config = {
79
80 environment.systemPackages =
81 lib.optional config.users.mutableUsers pkgs.shadow ++
82 lib.optional (types.shellPackage.check config.users.defaultUserShell)
83 config.users.defaultUserShell;
84
85 environment.etc =
86 { # /etc/login.defs: global configuration for pwdutils. You
87 # cannot login without it!
88 "login.defs".source = pkgs.writeText "login.defs" loginDefs;
89
90 # /etc/default/useradd: configuration for useradd.
91 "default/useradd".source = pkgs.writeText "useradd"
92 ''
93 GROUP=100
94 HOME=/home
95 SHELL=${utils.toShellPath config.users.defaultUserShell}
96 '';
97 };
98
99 security.pam.services =
100 { chsh = { rootOK = true; };
101 chfn = { rootOK = true; };
102 su = { rootOK = true; forwardXAuth = true; logFailures = true; };
103 passwd = {};
104 # Note: useradd, groupadd etc. aren't setuid root, so it
105 # doesn't really matter what the PAM config says as long as it
106 # lets root in.
107 useradd = { rootOK = true; };
108 usermod = { rootOK = true; };
109 userdel = { rootOK = true; };
110 groupadd = { rootOK = true; };
111 groupmod = { rootOK = true; };
112 groupmems = { rootOK = true; };
113 groupdel = { rootOK = true; };
114 login = { startSession = true; allowNullPassword = true; showMotd = true; updateWtmp = true; };
115 chpasswd = { rootOK = true; };
116 };
117
118 security.wrappers = {
119 su = mkSetuidRoot "${pkgs.shadow.su}/bin/su";
120 sg = mkSetuidRoot "${pkgs.shadow.out}/bin/sg";
121 newgrp = mkSetuidRoot "${pkgs.shadow.out}/bin/newgrp";
122 newuidmap = mkSetuidRoot "${pkgs.shadow.out}/bin/newuidmap";
123 newgidmap = mkSetuidRoot "${pkgs.shadow.out}/bin/newgidmap";
124 } // lib.optionalAttrs config.users.mutableUsers {
125 chsh = mkSetuidRoot "${pkgs.shadow.out}/bin/chsh";
126 passwd = mkSetuidRoot "${pkgs.shadow.out}/bin/passwd";
127 };
128 };
129}