commit 4ea0805f4ea40ac7f1f60b4ae17e8f28d6436e88 · pyrox.dev/nixpkgs

nixos/doc/manual/release-notes/rl-2505.section.md

···

       168
        
         to review the new defaults and description of

     

       169
        
         [](#opt-services.nextcloud.poolSettings).

     

       170
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       171
        
       - `kmonad` is now hardened by default using common `systemd` settings.

     

       172
        
         If KMonad is used to execute shell commands, hardening may make some of them fail.  In that case, you can disable hardening using {option}`services.kmonad.keyboards.<name>.enableHardening` option.

     

       173

···

       168
        
         to review the new defaults and description of

     

       169
        
         [](#opt-services.nextcloud.poolSettings).

     

       170
        
       

     

       171
       +
       - The `services.locate` module does no longer support findutil's `locate` due to its inferior performance compared to `mlocate` and `plocate`. The new default is `plocate`.

     

       172
       +
         As the `service.locate.localuser` option only applied when using findutil's `locate`, it has also been removed.

     

       173
       +
       

     

       174
        
       - `kmonad` is now hardened by default using common `systemd` settings.

     

       175
        
         If KMonad is used to execute shell commands, hardening may make some of them fail.  In that case, you can disable hardening using {option}`services.kmonad.keyboards.<name>.enableHardening` option.

     

       176

+23 -59

nixos/modules/misc/locate.nix

···

       9
        
         cfg = config.services.locate;

     

       10
        
         isMLocate = lib.hasPrefix "mlocate" cfg.package.name;

     

       11
        
         isPLocate = lib.hasPrefix "plocate" cfg.package.name;

     

       12
       -
         isMorPLocate = isMLocate || isPLocate;

     

       13
       -
         isFindutils = lib.hasPrefix "findutils" cfg.package.name;

     

       14
        
       in

     

       15
        
       {

     

       16
        
         imports = [

     

       17
        
           (lib.mkRenamedOptionModule [ "services" "locate" "period" ] [ "services" "locate" "interval" ])

     

       18
        
           (lib.mkRenamedOptionModule [ "services" "locate" "locate" ] [ "services" "locate" "package" ])

     

       19
        
           (lib.mkRemovedOptionModule [ "services" "locate" "includeStore" ] "Use services.locate.prunePaths")

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       20
        
         ];

     

       21
        
       

     

       22
        
         options.services.locate = {

     
···

       29
        
             '';

     

       30
        
           };

     

       31
        
       

     

       32
       -
           package = lib.mkPackageOption pkgs [ "findutils" "locate" ] {

     

       33
        
             example = "mlocate";

     

       34
        
           };

     

       35
        
       

     
···

       65
        
             '';

     

       66
        
           };

     

       67
        
       

     

       68
       -
           localuser = lib.mkOption {

     

       69
       -
             type = lib.types.nullOr lib.types.str;

     

       70
       -
             default = "nobody";

     

       71
       -
             description = ''

     

       72
       -
               The user to search non-network directories as, using

     

       73
       -
               {command}`su`.

     

       74
       -
             '';

     

       75
       -
           };

     

       76
       -
       

     

       77
        
           pruneFS = lib.mkOption {

     

       78
        
             type = lib.types.listOf lib.types.str;

     

       79
        
             default = [

     
···

       180
        
       

     

       181
        
           pruneNames = lib.mkOption {

     

       182
        
             type = lib.types.listOf lib.types.str;

     

       183
       -
             default = lib.optionals (!isFindutils) [

     

       184
        
               ".bzr"

     

       185
        
               ".cache"

     

       186
        
               ".git"

     
···

       229
        
                 source = "${cfg.package}/bin/plocate";

     

       230
        
               };

     

       231
        
             in

     

       232
       -
             lib.mkIf isMorPLocate {

     

       233
        
               locate = lib.mkMerge [

     

       234
        
                 common

     

       235
        
                 mlocate

     
···

       253
        
             '';

     

       254
        
       

     

       255
        
             systemPackages = [ cfg.package ];

     

       256
       -
       

     

       257
       -
             variables = lib.mkIf isFindutils {

     

       258
       -
               LOCATE_PATH = cfg.output;

     

       259
       -
             };

     

       260
        
           };

     

       261
        
       

     

       262
       -
           warnings =

     

       263
       -
             lib.optional (isMorPLocate && cfg.localuser != null)

     

       264
       -
               "mlocate and plocate do not support the services.locate.localuser option. updatedb will run as root. Silence this warning by setting services.locate.localuser = null."

     

       265
       -
             ++ lib.optional (

     

       266
       -
               isFindutils && cfg.pruneNames != [ ]

     

       267
       -
             ) "findutils locate does not support pruning by directory component"

     

       268
       -
             ++ lib.optional (

     

       269
       -
               isFindutils && cfg.pruneBindMounts

     

       270
       -
             ) "findutils locate does not support skipping bind mounts";

     

       271
       -
       

     

       272
        
           systemd.services.update-locatedb = {

     

       273
        
             description = "Update Locate Database";

     

       274
       -
             path = lib.mkIf (!isMorPLocate) [ pkgs.su ];

     

       275
        
       

     

       276
        
             # mlocate's updatedb takes flags via a configuration file or

     

       277
        
             # on the command line, but not by environment variable.

     

       278
        
             script =

     

       279
       -
               if isMorPLocate then

     

       280
       -
                 let

     

       281
       -
                   toFlags =

     

       282
       -
                     x: lib.optional (cfg.${x} != [ ]) "--${lib.toLower x} '${lib.concatStringsSep " " cfg.${x}}'";

     

       283
       -
                   args = lib.concatLists (

     

       284
       -
                     map toFlags [

     

       285
       -
                       "pruneFS"

     

       286
       -
                       "pruneNames"

     

       287
       -
                       "prunePaths"

     

       288
       -
                     ]

     

       289
       -
                   );

     

       290
       -
                 in

     

       291
       -
                 ''

     

       292
       -
                   exec ${cfg.package}/bin/updatedb \

     

       293
       -
                     --output ${toString cfg.output} ${lib.concatStringsSep " " args} \

     

       294
       -
                     --prune-bind-mounts ${if cfg.pruneBindMounts then "yes" else "no"} \

     

       295
       -
                     ${lib.concatStringsSep " " cfg.extraFlags}

     

       296
       -
                 ''

     

       297
       -
               else

     

       298
       -
                 ''

     

       299
       -
                   exec ${cfg.package}/bin/updatedb \

     

       300
       -
                     ${lib.optionalString (cfg.localuser != null && !isMorPLocate) "--localuser=${cfg.localuser}"} \

     

       301
       -
                     --output=${toString cfg.output} ${lib.concatStringsSep " " cfg.extraFlags}

     

       302
       -
                 '';

     

       303
       -
             environment = lib.optionalAttrs (!isMorPLocate) {

     

       304
       -
               PRUNEFS = lib.concatStringsSep " " cfg.pruneFS;

     

       305
       -
               PRUNEPATHS = lib.concatStringsSep " " cfg.prunePaths;

     

       306
       -
               PRUNENAMES = lib.concatStringsSep " " cfg.pruneNames;

     

       307
       -
               PRUNE_BIND_MOUNTS = if cfg.pruneBindMounts then "yes" else "no";

     

       308
       -
             };

     

       309
        
             serviceConfig = {

     

       310
        
               CapabilityBoundingSet = "CAP_DAC_READ_SEARCH CAP_CHOWN";

     

       311
        
               Nice = 19;

···

       9
        
         cfg = config.services.locate;

     

       10
        
         isMLocate = lib.hasPrefix "mlocate" cfg.package.name;

     

       11
        
         isPLocate = lib.hasPrefix "plocate" cfg.package.name;

     

       0
        
       
     

       0
        
       
     

       12
        
       in

     

       13
        
       {

     

       14
        
         imports = [

     

       15
        
           (lib.mkRenamedOptionModule [ "services" "locate" "period" ] [ "services" "locate" "interval" ])

     

       16
        
           (lib.mkRenamedOptionModule [ "services" "locate" "locate" ] [ "services" "locate" "package" ])

     

       17
        
           (lib.mkRemovedOptionModule [ "services" "locate" "includeStore" ] "Use services.locate.prunePaths")

     

       18
       +
           (lib.mkRemovedOptionModule [ "services" "locate" "localuser" ]

     

       19
       +
             "The services.locate.localuser option has been removed because support for findutils locate has been removed."

     

       20
       +
           )

     

       21
        
         ];

     

       22
        
       

     

       23
        
         options.services.locate = {

     
···

       30
        
             '';

     

       31
        
           };

     

       32
        
       

     

       33
       +
           package = lib.mkPackageOption pkgs [ "plocate" ] {

     

       34
        
             example = "mlocate";

     

       35
        
           };

     

       36
        
       

     
···

       66
        
             '';

     

       67
        
           };

     

       68
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       69
        
           pruneFS = lib.mkOption {

     

       70
        
             type = lib.types.listOf lib.types.str;

     

       71
        
             default = [

     
···

       172
        
       

     

       173
        
           pruneNames = lib.mkOption {

     

       174
        
             type = lib.types.listOf lib.types.str;

     

       175
       +
             default = [

     

       176
        
               ".bzr"

     

       177
        
               ".cache"

     

       178
        
               ".git"

     
···

       221
        
                 source = "${cfg.package}/bin/plocate";

     

       222
        
               };

     

       223
        
             in

     

       224
       +
             {

     

       225
        
               locate = lib.mkMerge [

     

       226
        
                 common

     

       227
        
                 mlocate

     
···

       245
        
             '';

     

       246
        
       

     

       247
        
             systemPackages = [ cfg.package ];

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       248
        
           };

     

       249
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       250
        
           systemd.services.update-locatedb = {

     

       251
        
             description = "Update Locate Database";

     

       0
        
       
     

       252
        
       

     

       253
        
             # mlocate's updatedb takes flags via a configuration file or

     

       254
        
             # on the command line, but not by environment variable.

     

       255
        
             script =

     

       256
       +
               let

     

       257
       +
                 toFlags =

     

       258
       +
                   x: lib.optional (cfg.${x} != [ ]) "--${lib.toLower x} '${lib.concatStringsSep " " cfg.${x}}'";

     

       259
       +
                 args = lib.concatLists (

     

       260
       +
                   map toFlags [

     

       261
       +
                     "pruneFS"

     

       262
       +
                     "pruneNames"

     

       263
       +
                     "prunePaths"

     

       264
       +
                   ]

     

       265
       +
                 );

     

       266
       +
               in

     

       267
       +
               ''

     

       268
       +
                 exec ${cfg.package}/bin/updatedb \

     

       269
       +
                   --output ${toString cfg.output} ${lib.concatStringsSep " " args} \

     

       270
       +
                   --prune-bind-mounts ${if cfg.pruneBindMounts then "yes" else "no"} \

     

       271
       +
                   ${lib.concatStringsSep " " cfg.extraFlags}

     

       272
       +
               '';

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       273
        
             serviceConfig = {

     

       274
        
               CapabilityBoundingSet = "CAP_DAC_READ_SEARCH CAP_CHOWN";

     

       275
        
               Nice = 19;