···

       
65
       
65
       
 
       
invoked by using the `nextcloud-occ` wrapper that's globally available on a system with Nextcloud enabled.

     

       
66
       
66
       
 
       


     

       
67
       
67
       
 
       
It requires elevated permissions to become the `nextcloud` user. Given the way the privilege

     

       
68
       
68
       
-
       
escalation is implemented, parameters passed via the environment to Nextcloud (e.g. `OC_PASS`) are

     

       
69
       
69
       
-
       
currently ignored.

     

       
68
       
68
       
+
       
escalation is implemented, parameters passed via the environment to Nextcloud are

     

       
69
       
69
       
+
       
currently ignored, except for `OC_PASS` and `NC_PASS`.

     

       
70
       
70
       
 
       


     

       
71
       
71
       
 
       
Custom service units that need to run `nextcloud-occ` either need elevated privileges

     

       
72
       
72
       
 
       
or the systemd configuration from `nextcloud-setup.service` (recommended):

     

···

       
163
       
163
       
 
       
            --wait \

     

       
164
       
164
       
 
       
            --collect \

     

       
165
       
165
       
 
       
            --service-type=exec \

     

       
166
       
166
       
+
       
            --setenv OC_PASS \

     

       
167
       
167
       
+
       
            --setenv NC_PASS \

     

       
166
       
168
       
 
       
            --quiet \

     

       
167
       
169
       
 
       
            ${command}

     

       
168
       
170
       
 
       
        elif [[ "$USER" != nextcloud ]]; then

     

       
169
       
171
       
 
       
          if [[ -x /run/wrappers/bin/sudo ]]; then

     

       
170
       
172
       
 
       
            exec /run/wrappers/bin/sudo \

     

       
171
       
173
       
 
       
              --preserve-env=CREDENTIALS_DIRECTORY \

     

       
174
       
174
       
+
       
              --preserve-env=OC_PASS \

     

       
175
       
175
       
+
       
              --preserve-env=NC_PASS \

     

       
172
       
176
       
 
       
              --user=nextcloud \

     

       
173
       
177
       
 
       
              ${command}

     

       
174
       
178
       
 
       
          else

     

       
175
       
179
       
 
       
            exec ${lib.getExe' pkgs.util-linux "runuser"} \

     

       
176
       
180
       
 
       
              --whitelist-environment=CREDENTIALS_DIRECTORY \

     

       
181
       
181
       
+
       
              --whitelist-environment=OC_PASS \

     

       
182
       
182
       
+
       
              --whitelist-environment=NC_PASS \

     

       
177
       
183
       
 
       
              --user=nextcloud \

     

       
178
       
184
       
 
       
              ${command}

     

       
179
       
185
       
 
       
          fi