commit 077cdcc7e9a9ed406860e97ce3590fba15aed18b · pyrox.dev/nixpkgs

+43 -7
nixos/modules/security/pam.nix
···

       11
       11
        
           # These options are experimental and subject to breaking changes without notice.

     

       12
       12
        
           description = lib.mdDoc ''

     

       13
       13
        
             PAM `${type}` rules for this service.

     

       14
       14
       +
       

     

       15
       15
       +
             Attribute keys are the name of each rule.

     

       14
       16
        
           '';

     

       15
       15
       -
           type = types.listOf (types.submodule ({ config, ... }: {

     

       17
       17
       +
           type = types.attrsOf (types.submodule ({ name, config, ... }: {

     

       16
       18
        
             options = {

     

       17
       19
        
               name = mkOption {

     

       18
       20
        
                 type = types.str;

     

       19
       21
        
                 description = lib.mdDoc ''

     

       20
       22
        
                   Name of this rule.

     

       21
       23
        
                 '';

     

       24
       24
       +
                 internal = true;

     

       25
       25
       +
                 readOnly = true;

     

       22
       26
        
               };

     

       23
       27
        
               enable = mkOption {

     

       24
       28
        
                 type = types.bool;

     
···

       27
       31
        
                   Whether this rule is added to the PAM service config file.

     

       28
       32
        
                 '';

     

       29
       33
        
               };

     

       34
       34
       +
               order = mkOption {

     

       35
       35
       +
                 type = types.int;

     

       36
       36
       +
                 description = lib.mdDoc ''

     

       37
       37
       +
                   Order of this rule in the service file. Rules are arranged in ascending order of this value.

     

       38
       38
       +
       

     

       39
       39
       +
                   ::: {.warning}

     

       40
       40
       +
                   The `order` values for the built-in rules are subject to change. If you assign a constant value to this option, a system update could silently reorder your rule. You could be locked out of your system, or your system could be left wide open. When using this option, set it to a relative offset from another rule's `order` value:

     

       41
       41
       +
       

     

       42
       42
       +
                   ```nix

     

       43
       43
       +
                   {

     

       44
       44
       +
                     security.pam.services.login.rules.auth.foo.order =

     

       45
       45
       +
                       config.security.pam.services.login.rules.auth.unix.order + 10;

     

       46
       46
       +
                   }

     

       47
       47
       +
                   ```

     

       48
       48
       +
                   :::

     

       49
       49
       +
                 '';

     

       50
       50
       +
               };

     

       30
       51
        
               control = mkOption {

     

       31
       52
        
                 type = types.str;

     

       32
       53
        
                 description = lib.mdDoc ''

     
···

       60
       81
        
               };

     

       61
       82
        
             };

     

       62
       83
        
             config = {

     

       84
       84
       +
               inherit name;

     

       63
       85
        
               # Formats an attrset of settings as args for use as `module-arguments`.

     

       64
       86
        
               args = concatLists (flip mapAttrsToList config.settings (name: value:

     

       65
       87
        
                 if isBool value

     
···

       557
       579
        
             limits = mkDefault config.security.pam.loginLimits;

     

       558
       580
        
       

     

       559
       581
        
             text = let

     

       582
       582
       +
               ensureUniqueOrder = type: rules:

     

       583
       583
       +
                 let

     

       584
       584
       +
                   checkPair = a: b: assert assertMsg (a.order != b.order) "security.pam.services.${name}.rules.${type}: rules '${a.name}' and '${b.name}' cannot have the same order value (${toString a.order})"; b;

     

       585
       585
       +
                   checked = zipListsWith checkPair rules (drop 1 rules);

     

       586
       586
       +
                 in take 1 rules ++ checked;

     

       560
       587
        
               # Formats a string for use in `module-arguments`. See `man pam.conf`.

     

       561
       588
        
               formatModuleArgument = token:

     

       562
       589
        
                 if hasInfix " " token

     

       563
       590
        
                 then "[${replaceStrings ["]"] ["\\]"] token}]"

     

       564
       591
        
                 else token;

     

       565
       592
        
               formatRules = type: pipe cfg.rules.${type} [

     

       593
       593
       +
                 attrValues

     

       566
       594
        
                 (filter (rule: rule.enable))

     

       595
       595
       +
                 (sort (a: b: a.order < b.order))

     

       596
       596
       +
                 (ensureUniqueOrder type)

     

       567
       597
        
                 (map (rule: concatStringsSep " " (

     

       568
       598
        
                   [ type rule.control rule.modulePath ]

     

       569
       599
        
                   ++ map formatModuleArgument rule.args

     
···

       587
       617
        
             # !!! TODO: move the LDAP stuff to the LDAP module, and the

     

       588
       618
        
             # Samba stuff to the Samba module.  This requires that the PAM

     

       589
       619
        
             # module provides the right hooks.

     

       590
       590
       -
             rules = {

     

       591
       591
       -
               account = [

     

       620
       620
       +
             rules = let

     

       621
       621
       +
               autoOrderRules = flip pipe [

     

       622
       622
       +
                 (imap1 (index: rule: rule // { order = mkDefault (10000 + index * 100); } ))

     

       623
       623
       +
                 (map (rule: nameValuePair rule.name (removeAttrs rule [ "name" ])))

     

       624
       624
       +
                 listToAttrs

     

       625
       625
       +
               ];

     

       626
       626
       +
             in {

     

       627
       627
       +
               account = autoOrderRules [

     

       592
       628
        
                 { name = "ldap"; enable = use_ldap; control = "sufficient"; modulePath = "${pam_ldap}/lib/security/pam_ldap.so"; }

     

       593
       629
        
                 { name = "mysql"; enable = cfg.mysqlAuth; control = "sufficient"; modulePath = "${pkgs.pam_mysql}/lib/security/pam_mysql.so"; settings = {

     

       594
       630
        
                   config_file = "/etc/security/pam_mysql.conf";

     
···

       607
       643
        
                 { name = "unix"; control = "required"; modulePath = "pam_unix.so"; }

     

       608
       644
        
               ];

     

       609
       645
        
       

     

       610
       610
       -
               auth = [

     

       646
       646
       +
               auth = autoOrderRules ([

     

       611
       647
        
                 { name = "oslogin_login"; enable = cfg.googleOsLoginAuthentication; control = "[success=done perm_denied=die default=ignore]"; modulePath = "${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_login.so"; }

     

       612
       648
        
                 { name = "rootok"; enable = cfg.rootOK; control = "sufficient"; modulePath = "pam_rootok.so"; }

     

       613
       649
        
                 { name = "wheel"; enable = cfg.requireWheel; control = "required"; modulePath = "pam_wheel.so"; settings = {

     
···

       730
       766
        
                   use_first_pass = true;

     

       731
       767
        
                 }; }

     

       732
       768
        
                 { name = "deny"; control = "required"; modulePath = "pam_deny.so"; }

     

       733
       733
       -
               ];

     

       769
       769
       +
               ]);

     

       734
       770
        
       

     

       735
       735
       -
               password = [

     

       771
       771
       +
               password = autoOrderRules [

     

       736
       772
        
                 { name = "systemd_home"; enable = config.services.homed.enable; control = "sufficient"; modulePath = "${config.systemd.package}/lib/security/pam_systemd_home.so"; }

     

       737
       773
        
                 { name = "unix"; control = "sufficient"; modulePath = "pam_unix.so"; settings = {

     

       738
       774
        
                   nullok = true;

     
···

       758
       794
        
                 }; }

     

       759
       795
        
               ];

     

       760
       796
        
       

     

       761
       761
       -
               session = [

     

       797
       797
       +
               session = autoOrderRules [

     

       762
       798
        
                 { name = "env"; enable = cfg.setEnvironment; control = "required"; modulePath = "pam_env.so"; settings = {

     

       763
       799
        
                   conffile = "/etc/pam/environment";

     

       764
       800
        
                   readenv = 0;