nixos/fuse: add enable option

Fuse is stil enabled by default so the default behaviour of NixOS
doesn't change. However, now it's possible to actively exclude fuse when
you don't need it.

nikstur 0d9a5c20 9e0ac0c7

Changed files
+32 -11
nixos
modules
programs
security
wrappers
tasks
+31 -2
nixos/modules/programs/fuse.nix
···
-
{ config, lib, ... }:
+
{
+
config,
+
lib,
+
pkgs,
+
...
+
}:
let
cfg = config.programs.fuse;
···
meta.maintainers = with lib.maintainers; [ ];
options.programs.fuse = {
+
enable = lib.mkEnableOption "fuse" // {
+
default = true;
+
};
+
mountMax = lib.mkOption {
# In the C code it's an "int" (i.e. signed and at least 16 bit), but
# negative numbers obviously make no sense:
···
};
};
-
config = {
+
config = lib.mkIf cfg.enable {
+
environment.systemPackages = [
+
pkgs.fuse
+
pkgs.fuse3
+
];
+
+
security.wrappers =
+
let
+
mkSetuidRoot = source: {
+
setuid = true;
+
owner = "root";
+
group = "root";
+
inherit source;
+
};
+
in
+
{
+
fusermount = mkSetuidRoot "${lib.getBin pkgs.fuse}/bin/fusermount";
+
fusermount3 = mkSetuidRoot "${lib.getBin pkgs.fuse3}/bin/fusermount3";
+
};
+
environment.etc."fuse.conf".text = ''
${lib.optionalString (!cfg.userAllowOther) "#"}user_allow_other
mount_max = ${builtins.toString cfg.mountMax}
'';
+
};
}
-2
nixos/modules/security/wrappers/default.nix
···
in
{
# These are mount related wrappers that require the +s permission.
-
fusermount = mkSetuidRoot "${lib.getBin pkgs.fuse}/bin/fusermount";
-
fusermount3 = mkSetuidRoot "${lib.getBin pkgs.fuse3}/bin/fusermount3";
mount = mkSetuidRoot "${lib.getBin pkgs.util-linux}/bin/mount";
umount = mkSetuidRoot "${lib.getBin pkgs.util-linux}/bin/umount";
};
+1 -7
nixos/modules/tasks/filesystems.nix
···
# Add the mount helpers to the system path so that `mount' can find them.
system.fsPackages = [ pkgs.dosfstools ];
-
environment.systemPackages =
-
with pkgs;
-
[
-
fuse3
-
fuse
-
]
-
++ config.system.fsPackages;
+
environment.systemPackages = config.system.fsPackages;
environment.etc.fstab.text =
let