Merge pull request #205578 from dev-null-undefined/i3lock-yubikey

nixos/i3lock: i3lock program with u2fSupport option

Changed files
+62
nixos
modules
pkgs
applications
+1
nixos/modules/module-list.nix
···
./programs/hamster.nix
./programs/htop.nix
./programs/iftop.nix
+
./programs/i3lock.nix
./programs/iotop.nix
./programs/java.nix
./programs/k3b.nix
+58
nixos/modules/programs/i3lock.nix
···
+
{ config, lib, pkgs, ... }:
+
+
with lib;
+
+
let
+
+
cfg = config.programs.i3lock;
+
+
in {
+
+
###### interface
+
+
options = {
+
programs.i3lock = {
+
enable = mkEnableOption (mdDoc "i3lock");
+
package = mkOption {
+
type = types.package;
+
default = pkgs.i3lock;
+
defaultText = literalExpression "pkgs.i3lock";
+
example = literalExpression ''
+
pkgs.i3lock-color
+
'';
+
description = mdDoc ''
+
Specify which package to use for the i3lock program,
+
The i3lock package must include a i3lock file or link in its out directory in order for the u2fSupport option to work correctly.
+
'';
+
};
+
u2fSupport = mkOption {
+
type = types.bool;
+
default = false;
+
example = true;
+
description = mdDoc ''
+
Whether to enable U2F support in the i3lock program.
+
U2F enables authentication using a hardware device, such as a security key.
+
When U2F support is enabled, the i3lock program will set the setuid bit on the i3lock binary and enable the pam u2fAuth service,
+
'';
+
};
+
};
+
};
+
+
###### implementation
+
+
config = mkIf cfg.enable {
+
+
environment.systemPackages = [ cfg.package ];
+
+
security.wrappers.i3lock = mkIf cfg.u2fSupport {
+
setuid = true;
+
owner = "root";
+
group = "root";
+
source = "${cfg.package.out}/bin/i3lock";
+
};
+
+
security.pam.services.i3lock.u2fAuth = cfg.u2fSupport;
+
+
};
+
+
}
+1
pkgs/applications/window-managers/i3/lock-color.nix
···
installFlags = [ "PREFIX=\${out}" "SYSCONFDIR=\${out}/etc" "MANDIR=\${out}/share/man" ];
postInstall = ''
mv $out/bin/i3lock $out/bin/i3lock-color
+
ln -s $out/bin/i3lock-color $out/bin/i3lock
mv $out/share/man/man1/i3lock.1 $out/share/man/man1/i3lock-color.1
sed -i 's/\(^\|\s\|"\)i3lock\(\s\|$\)/\1i3lock-color\2/g' $out/share/man/man1/i3lock-color.1
'';
+1
pkgs/applications/window-managers/i3/lock-fancy-rapid.nix
···
installPhase = ''
install -D i3lock-fancy-rapid $out/bin/i3lock-fancy-rapid
+
ln -s $out/bin/i3lock-fancy-rapid $out/bin/i3lock
'';
meta = with lib; {
+1
pkgs/applications/window-managers/i3/lock-fancy.nix
···
installPhase = ''
mkdir -p $out/bin $out/share/i3lock-fancy/icons
cp i3lock-fancy $out/bin/i3lock-fancy
+
ln -s $out/bin/i3lock-fancy $out/bin/i3lock
cp icons/lock*.png $out/share/i3lock-fancy/icons
'';