commit 4bcc603cd873e55088afec33ddf9be1beeac1c86 · pyrox.dev/nixpkgs

+32 -34

nixos/modules/services/security/usbguard.nix

···

       4
        
         pkgs,

     

       5
        
         ...

     

       6
        
       }:

     

       7
       -
       

     

       8
       -
       with lib;

     

       9
        
       let

     

       10
        
         cfg = config.services.usbguard;

     

       11
        
       

     

       12
        
         # valid policy options

     

       13
        
         policy = (

     

       14
       -
           types.enum [

     

       15
        
             "allow"

     

       16
        
             "block"

     

       17
        
             "reject"

     
···

       30
        
           PresentDevicePolicy=${cfg.presentDevicePolicy}

     

       31
        
           PresentControllerPolicy=${cfg.presentControllerPolicy}

     

       32
        
           InsertedDevicePolicy=${cfg.insertedDevicePolicy}

     

       33
       -
           RestoreControllerDeviceState=${boolToString cfg.restoreControllerDeviceState}

     

       34
        
           # this does not seem useful for endusers to change

     

       35
        
           DeviceManagerBackend=uevent

     

       36
       -
           IPCAllowedUsers=${concatStringsSep " " cfg.IPCAllowedUsers}

     

       37
       -
           IPCAllowedGroups=${concatStringsSep " " cfg.IPCAllowedGroups}

     

       38
        
           IPCAccessControlFiles=/var/lib/usbguard/IPCAccessControl.d/

     

       39
       -
           DeviceRulesWithPort=${boolToString cfg.deviceRulesWithPort}

     

       40
        
           # HACK: that way audit logs still land in the journal

     

       41
        
           AuditFilePath=/dev/null

     

       42
        
         '';

     
···

       50
        
       

     

       51
        
         options = {

     

       52
        
           services.usbguard = {

     

       53
       -
             enable = mkEnableOption "USBGuard daemon";

     

       54
        
       

     

       55
       -
             package = mkPackageOption pkgs "usbguard" {

     

       56
        
               extraDescription = ''

     

       57
        
                 If you do not need the Qt GUI, use `pkgs.usbguard-nox` to save disk space.

     

       58
        
               '';

     

       59
        
             };

     

       60
        
       

     

       61
       -
             ruleFile = mkOption {

     

       62
       -
               type = types.nullOr types.path;

     

       63
        
               default = "/var/lib/usbguard/rules.conf";

     

       64
        
               example = "/run/secrets/usbguard-rules";

     

       65
        
               description = ''

     
···

       71
        
               '';

     

       72
        
       

     

       73
        
             };

     

       74
       -
             rules = mkOption {

     

       75
       -
               type = types.nullOr types.lines;

     

       76
        
               default = null;

     

       77
        
               example = ''

     

       78
        
                 allow with-interface equals { 08:*:* }

     
···

       92
        
               '';

     

       93
        
             };

     

       94
        
       

     

       95
       -
             implicitPolicyTarget = mkOption {

     

       96
       -
               type = types.enum [

     

       97
        
                 "allow"

     

       98
        
                 "block"

     

       99
        
                 "reject"

     
···

       106
        
               '';

     

       107
        
             };

     

       108
        
       

     

       109
       -
             presentDevicePolicy = mkOption {

     

       110
        
               type = policy;

     

       111
        
               default = "apply-policy";

     

       112
        
               description = ''

     
···

       117
        
               '';

     

       118
        
             };

     

       119
        
       

     

       120
       -
             presentControllerPolicy = mkOption {

     

       121
        
               type = policy;

     

       122
        
               default = "keep";

     

       123
        
               description = ''

     
···

       126
        
               '';

     

       127
        
             };

     

       128
        
       

     

       129
       -
             insertedDevicePolicy = mkOption {

     

       130
       -
               type = types.enum [

     

       131
        
                 "block"

     

       132
        
                 "reject"

     

       133
        
                 "apply-policy"

     
···

       139
        
               '';

     

       140
        
             };

     

       141
        
       

     

       142
       -
             restoreControllerDeviceState = mkOption {

     

       143
       -
               type = types.bool;

     

       144
        
               default = false;

     

       145
        
               description = ''

     

       146
        
                 The  USBGuard  daemon  modifies  some attributes of controller

     
···

       151
        
               '';

     

       152
        
             };

     

       153
        
       

     

       154
       -
             IPCAllowedUsers = mkOption {

     

       155
       -
               type = types.listOf types.str;

     

       156
        
               default = [ "root" ];

     

       157
        
               example = [

     

       158
        
                 "root"

     
···

       163
        
               '';

     

       164
        
             };

     

       165
        
       

     

       166
       -
             IPCAllowedGroups = mkOption {

     

       167
       -
               type = types.listOf types.str;

     

       168
        
               default = [ ];

     

       169
        
               example = [ "wheel" ];

     

       170
        
               description = ''

     
···

       173
        
               '';

     

       174
        
             };

     

       175
        
       

     

       176
       -
             deviceRulesWithPort = mkOption {

     

       177
       -
               type = types.bool;

     

       178
        
               default = false;

     

       179
        
               description = ''

     

       180
        
                 Generate device specific rules including the "via-port" attribute.

     

       181
        
               '';

     

       182
        
             };

     

       183
        
       

     

       184
       -
             dbus.enable = mkEnableOption "USBGuard dbus daemon";

     

       185
        
           };

     

       186
        
         };

     

       187
        
       

     

       188
        
         ###### implementation

     

       189
        
       

     

       190
       -
         config = mkIf cfg.enable {

     

       191
        
       

     

       192
        
           environment.systemPackages = [ cfg.package ];

     

       193
        
       

     
···

       239
        
               };

     

       240
        
             };

     

       241
        
       

     

       242
       -
             usbguard-dbus = mkIf cfg.dbus.enable {

     

       243
        
               description = "USBGuard D-Bus Service";

     

       244
        
       

     

       245
        
               wantedBy = [ "multi-user.target" ];

     
···

       261
        
               groupCheck =

     

       262
        
                 (lib.concatStrings (map (g: "subject.isInGroup(\"${g}\") || ") cfg.IPCAllowedGroups)) + "false";

     

       263
        
             in

     

       264
       -
             optionalString cfg.dbus.enable ''

     

       265
        
               polkit.addRule(function(action, subject) {

     

       266
        
                   if ((action.id == "org.usbguard.Policy1.listRules" ||

     

       267
        
                        action.id == "org.usbguard.Policy1.appendRule" ||

     
···

       278
        
             '';

     

       279
        
         };

     

       280
        
         imports = [

     

       281
       -
           (mkRemovedOptionModule [ "services" "usbguard" "IPCAccessControlFiles" ]

     

       282
        
             "The usbguard module now hardcodes IPCAccessControlFiles to /var/lib/usbguard/IPCAccessControl.d."

     

       283
        
           )

     

       284
       -
           (mkRemovedOptionModule [

     

       285
        
             "services"

     

       286
        
             "usbguard"

     

       287
        
             "auditFilePath"

     

       288
        
           ] "Removed usbguard module audit log files. Audit logs can be found in the systemd journal.")

     

       289
       -
           (mkRenamedOptionModule

     

       290
        
             [ "services" "usbguard" "implictPolicyTarget" ]

     

       291
        
             [ "services" "usbguard" "implicitPolicyTarget" ]

     

       292
        
           )

···

       4
        
         pkgs,

     

       5
        
         ...

     

       6
        
       }:

     

       0
        
       
     

       0
        
       
     

       7
        
       let

     

       8
        
         cfg = config.services.usbguard;

     

       9
        
       

     

       10
        
         # valid policy options

     

       11
        
         policy = (

     

       12
       +
           lib.types.enum [

     

       13
        
             "allow"

     

       14
        
             "block"

     

       15
        
             "reject"

     
···

       28
        
           PresentDevicePolicy=${cfg.presentDevicePolicy}

     

       29
        
           PresentControllerPolicy=${cfg.presentControllerPolicy}

     

       30
        
           InsertedDevicePolicy=${cfg.insertedDevicePolicy}

     

       31
       +
           RestoreControllerDeviceState=${lib.boolToString cfg.restoreControllerDeviceState}

     

       32
        
           # this does not seem useful for endusers to change

     

       33
        
           DeviceManagerBackend=uevent

     

       34
       +
           IPCAllowedUsers=${lib.concatStringsSep " " cfg.IPCAllowedUsers}

     

       35
       +
           IPCAllowedGroups=${lib.concatStringsSep " " cfg.IPCAllowedGroups}

     

       36
        
           IPCAccessControlFiles=/var/lib/usbguard/IPCAccessControl.d/

     

       37
       +
           DeviceRulesWithPort=${lib.boolToString cfg.deviceRulesWithPort}

     

       38
        
           # HACK: that way audit logs still land in the journal

     

       39
        
           AuditFilePath=/dev/null

     

       40
        
         '';

     
···

       48
        
       

     

       49
        
         options = {

     

       50
        
           services.usbguard = {

     

       51
       +
             enable = lib.mkEnableOption "USBGuard daemon";

     

       52
        
       

     

       53
       +
             package = lib.mkPackageOption pkgs "usbguard" {

     

       54
        
               extraDescription = ''

     

       55
        
                 If you do not need the Qt GUI, use `pkgs.usbguard-nox` to save disk space.

     

       56
        
               '';

     

       57
        
             };

     

       58
        
       

     

       59
       +
             ruleFile = lib.mkOption {

     

       60
       +
               type = lib.types.nullOr lib.types.path;

     

       61
        
               default = "/var/lib/usbguard/rules.conf";

     

       62
        
               example = "/run/secrets/usbguard-rules";

     

       63
        
               description = ''

     
···

       69
        
               '';

     

       70
        
       

     

       71
        
             };

     

       72
       +
             rules = lib.mkOption {

     

       73
       +
               type = lib.types.nullOr lib.types.lines;

     

       74
        
               default = null;

     

       75
        
               example = ''

     

       76
        
                 allow with-interface equals { 08:*:* }

     
···

       90
        
               '';

     

       91
        
             };

     

       92
        
       

     

       93
       +
             implicitPolicyTarget = lib.mkOption {

     

       94
       +
               type = lib.types.enum [

     

       95
        
                 "allow"

     

       96
        
                 "block"

     

       97
        
                 "reject"

     
···

       104
        
               '';

     

       105
        
             };

     

       106
        
       

     

       107
       +
             presentDevicePolicy = lib.mkOption {

     

       108
        
               type = policy;

     

       109
        
               default = "apply-policy";

     

       110
        
               description = ''

     
···

       115
        
               '';

     

       116
        
             };

     

       117
        
       

     

       118
       +
             presentControllerPolicy = lib.mkOption {

     

       119
        
               type = policy;

     

       120
        
               default = "keep";

     

       121
        
               description = ''

     
···

       124
        
               '';

     

       125
        
             };

     

       126
        
       

     

       127
       +
             insertedDevicePolicy = lib.mkOption {

     

       128
       +
               type = lib.types.enum [

     

       129
        
                 "block"

     

       130
        
                 "reject"

     

       131
        
                 "apply-policy"

     
···

       137
        
               '';

     

       138
        
             };

     

       139
        
       

     

       140
       +
             restoreControllerDeviceState = lib.mkOption {

     

       141
       +
               type = lib.types.bool;

     

       142
        
               default = false;

     

       143
        
               description = ''

     

       144
        
                 The  USBGuard  daemon  modifies  some attributes of controller

     
···

       149
        
               '';

     

       150
        
             };

     

       151
        
       

     

       152
       +
             IPCAllowedUsers = lib.mkOption {

     

       153
       +
               type = lib.types.listOf lib.types.str;

     

       154
        
               default = [ "root" ];

     

       155
        
               example = [

     

       156
        
                 "root"

     
···

       161
        
               '';

     

       162
        
             };

     

       163
        
       

     

       164
       +
             IPCAllowedGroups = lib.mkOption {

     

       165
       +
               type = lib.types.listOf lib.types.str;

     

       166
        
               default = [ ];

     

       167
        
               example = [ "wheel" ];

     

       168
        
               description = ''

     
···

       171
        
               '';

     

       172
        
             };

     

       173
        
       

     

       174
       +
             deviceRulesWithPort = lib.mkOption {

     

       175
       +
               type = lib.types.bool;

     

       176
        
               default = false;

     

       177
        
               description = ''

     

       178
        
                 Generate device specific rules including the "via-port" attribute.

     

       179
        
               '';

     

       180
        
             };

     

       181
        
       

     

       182
       +
             dbus.enable = lib.mkEnableOption "USBGuard dbus daemon";

     

       183
        
           };

     

       184
        
         };

     

       185
        
       

     

       186
        
         ###### implementation

     

       187
        
       

     

       188
       +
         config = lib.mkIf cfg.enable {

     

       189
        
       

     

       190
        
           environment.systemPackages = [ cfg.package ];

     

       191
        
       

     
···

       237
        
               };

     

       238
        
             };

     

       239
        
       

     

       240
       +
             usbguard-dbus = lib.mkIf cfg.dbus.enable {

     

       241
        
               description = "USBGuard D-Bus Service";

     

       242
        
       

     

       243
        
               wantedBy = [ "multi-user.target" ];

     
···

       259
        
               groupCheck =

     

       260
        
                 (lib.concatStrings (map (g: "subject.isInGroup(\"${g}\") || ") cfg.IPCAllowedGroups)) + "false";

     

       261
        
             in

     

       262
       +
             lib.optionalString cfg.dbus.enable ''

     

       263
        
               polkit.addRule(function(action, subject) {

     

       264
        
                   if ((action.id == "org.usbguard.Policy1.listRules" ||

     

       265
        
                        action.id == "org.usbguard.Policy1.appendRule" ||

     
···

       276
        
             '';

     

       277
        
         };

     

       278
        
         imports = [

     

       279
       +
           (lib.mkRemovedOptionModule [ "services" "usbguard" "IPCAccessControlFiles" ]

     

       280
        
             "The usbguard module now hardcodes IPCAccessControlFiles to /var/lib/usbguard/IPCAccessControl.d."

     

       281
        
           )

     

       282
       +
           (lib.mkRemovedOptionModule [

     

       283
        
             "services"

     

       284
        
             "usbguard"

     

       285
        
             "auditFilePath"

     

       286
        
           ] "Removed usbguard module audit log files. Audit logs can be found in the systemd journal.")

     

       287
       +
           (lib.mkRenamedOptionModule

     

       288
        
             [ "services" "usbguard" "implictPolicyTarget" ]

     

       289
        
             [ "services" "usbguard" "implicitPolicyTarget" ]

     

       290
        
           )