commit 5624aa9f812aeccc6b70de9812a28df28996545a · pyrox.dev/nixpkgs

+25 -3

nixos/modules/security/sudo.nix

···

       61
        
               '';

     

       62
        
             };

     

       63
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       64
        
           security.sudo.configFile = mkOption {

     

       65
        
             type = types.lines;

     

       66
        
             # Note: if syntax errors are detected in this file, the NixOS

     
···

       216
        
               ${cfg.extraConfig}

     

       217
        
             '';

     

       218
        
       

     

       219
       -
           security.wrappers = {

     

       220
       -
             sudo.source = "${cfg.package.out}/bin/sudo";

     

       221
       -
             sudoedit.source = "${cfg.package.out}/bin/sudoedit";

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       222
        
           };

     

       223
        
       

     

       224
        
           environment.systemPackages = [ sudo ];

···

       61
        
               '';

     

       62
        
             };

     

       63
        
       

     

       64
       +
           security.sudo.execWheelOnly = mkOption {

     

       65
       +
             type = types.bool;

     

       66
       +
             default = false;

     

       67
       +
             description = ''

     

       68
       +
               Only allow members of the <code>wheel</code> group to execute sudo by

     

       69
       +
               setting the executable's permissions accordingly.

     

       70
       +
               This prevents users that are not members of <code>wheel</code> from

     

       71
       +
               exploiting vulnerabilities in sudo such as CVE-2021-3156.

     

       72
       +
             '';

     

       73
       +
           };

     

       74
       +
       

     

       75
        
           security.sudo.configFile = mkOption {

     

       76
        
             type = types.lines;

     

       77
        
             # Note: if syntax errors are detected in this file, the NixOS

     
···

       227
        
               ${cfg.extraConfig}

     

       228
        
             '';

     

       229
        
       

     

       230
       +
           security.wrappers = let

     

       231
       +
             owner = "root";

     

       232
       +
             group = if cfg.execWheelOnly then "wheel" else "root";

     

       233
       +
             setuid = true;

     

       234
       +
             permissions = if cfg.execWheelOnly then "u+rx,g+x" else "u+rx,g+x,o+x";

     

       235
       +
           in {

     

       236
       +
             sudo = {

     

       237
       +
               source = "${cfg.package.out}/bin/sudo";

     

       238
       +
               inherit owner group setuid permissions;

     

       239
       +
             };

     

       240
       +
             sudoedit = {

     

       241
       +
               source = "${cfg.package.out}/bin/sudoedit";

     

       242
       +
               inherit owner group setuid permissions;

     

       243
       +
             };

     

       244
        
           };

     

       245
        
       

     

       246
        
           environment.systemPackages = [ sudo ];

+20 -1

nixos/tests/sudo.nix

···

       10
        
             maintainers = [ lschuermann ];

     

       11
        
           };

     

       12
        
       

     

       13
       -
           machine =

     

       14
        
             { lib, ... }:

     

       15
        
             with lib;

     

       16
        
             {

     
···

       48
        
               };

     

       49
        
             };

     

       50
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       51
        
           testScript =

     

       52
        
             ''

     

       53
        
               with subtest("users in wheel group should have passwordless sudo"):

     
···

       79
        
       

     

       80
        
               with subtest("users in group 'barfoo' should not be able to keep their environment"):

     

       81
        
                   machine.fail("sudo -u test3 sudo -n -E -u root true")

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       82
        
             '';

     

       83
        
         })

···

       10
        
             maintainers = [ lschuermann ];

     

       11
        
           };

     

       12
        
       

     

       13
       +
           nodes.machine =

     

       14
        
             { lib, ... }:

     

       15
        
             with lib;

     

       16
        
             {

     
···

       48
        
               };

     

       49
        
             };

     

       50
        
       

     

       51
       +
           nodes.strict = { ... }: {

     

       52
       +
             users.users = {

     

       53
       +
               admin = { isNormalUser = true; extraGroups = [ "wheel" ]; };

     

       54
       +
               noadmin = { isNormalUser = true; };

     

       55
       +
             };

     

       56
       +
       

     

       57
       +
             security.sudo = {

     

       58
       +
               enable = true;

     

       59
       +
               wheelNeedsPassword = false;

     

       60
       +
               execWheelOnly = true;

     

       61
       +
             };

     

       62
       +
           };

     

       63
       +
       

     

       64
        
           testScript =

     

       65
        
             ''

     

       66
        
               with subtest("users in wheel group should have passwordless sudo"):

     
···

       92
        
       

     

       93
        
               with subtest("users in group 'barfoo' should not be able to keep their environment"):

     

       94
        
                   machine.fail("sudo -u test3 sudo -n -E -u root true")

     

       95
       +
       

     

       96
       +
               with subtest("users in wheel should be able to run sudo despite execWheelOnly"):

     

       97
       +
                   strict.succeed('su - admin -c "sudo -u root true"')

     

       98
       +
       

     

       99
       +
               with subtest("non-wheel users should be unable to run sudo thanks to execWheelOnly"):

     

       100
       +
                   strict.fail('su - noadmin -c "sudo --help"')

     

       101
        
             '';

     

       102
        
         })