···

       
42
       
42
       
 
       


     

       
43
       
43
       
 
       
  config = mkIf cfg.enable {

     

       
44
       
44
       
 
       


     

       
45
       
45
       
+
       
    # Not wrapping "batch" because it's a shell script (kernel drops perms

     

       
46
       
46
       
+
       
    # anyway) and it's patched to invoke the "at" setuid wrapper.

     

       
45
       
47
       
 
       
    security.wrappers = builtins.listToAttrs (

     

       
46
       
48
       
 
       
      map (program: { name = "${program}"; value = {

     

       
47
       
49
       
 
       
      source = "${at}/bin/${program}";

     
···

       
49
       
51
       
 
       
      group = "atd";

     

       
50
       
52
       
 
       
      setuid = true;

     

       
51
       
53
       
 
       
      setgid = true;

     

       
52
       
52
       
-
       
    };}) [ "at" "atq" "atrm" "batch" ]);

     

       
54
       
54
       
+
       
    };}) [ "at" "atq" "atrm" ]);

     

       
53
       
55
       
 
       


     

       
54
       
56
       
 
       
    environment.systemPackages = [ at ];

     

       
55
       
57