pyrox.dev
1{
2 config,
3 lib,
4 pkgs,
5 ...
6}:
7
8let
9 cfg = config.programs.wireshark;
10 wireshark = cfg.package;
11in
12{
13 options = {
14 programs.wireshark = {
15 enable = lib.mkOption {
16 type = lib.types.bool;
17 default = false;
18 description = ''
19 Whether to add Wireshark to the global environment and create a 'wireshark'
20 group. To configure what users can capture, set the `dumpcap.enable` and
21 `usbmon.enable` options. By default, users in the 'wireshark' group are
22 allowed to capture network traffic but not USB traffic.
23 '';
24 };
25 package = lib.mkPackageOption pkgs "wireshark-cli" {
26 example = "wireshark";
27 };
28 dumpcap.enable = lib.mkOption {
29 type = lib.types.bool;
30 default = true;
31 description = ''
32 Whether to allow users in the 'wireshark' group to capture network traffic. This
33 configures a setcap wrapper for 'dumpcap' for users in the 'wireshark' group.
34 '';
35 };
36 usbmon.enable = lib.mkOption {
37 type = lib.types.bool;
38 default = false;
39 description = ''
40 Whether to allow users in the 'wireshark' group to capture USB traffic. This adds
41 udev rules to give users in the 'wireshark' group read permissions to all devices
42 in the usbmon subsystem.
43 '';
44 };
45 };
46 };
47
48 config = lib.mkIf cfg.enable {
49 environment.systemPackages = [ wireshark ];
50 users.groups.wireshark = { };
51
52 security.wrappers.dumpcap = lib.mkIf cfg.dumpcap.enable {
53 source = "${wireshark}/bin/dumpcap";
54 capabilities = "cap_net_raw,cap_net_admin+eip";
55 owner = "root";
56 group = "wireshark";
57 permissions = "u+rx,g+x";
58 };
59
60 services.udev.packages = lib.mkIf cfg.usbmon.enable [
61 (pkgs.writeTextDir "etc/udev/rules.d/85-wireshark-usbmon.rules" ''
62 SUBSYSTEM=="usbmon", MODE="0640", GROUP="wireshark"
63 '')
64 ];
65 };
66}