commit 628e6a83d0f3b7ddc0592c88fef7978a7ee0063e · pyrox.dev/nixpkgs

+1 -1

nixos/modules/security/chromium-suid-sandbox.nix

···

       27
       27
        
       

     

       28
       28
        
         config = mkIf cfg.enable {

     

       29
       29
        
           environment.systemPackages = [ sandbox ];

     

       30
       30
       -
           security.setuidPrograms = [ sandbox.passthru.sandboxExecutableName ];

     

       30
       30
       +
           security.wrappers."${sandbox.passthru.sandboxExecutableName}".source = "${sandbox}/bin/${sandbox.passthru.sandboxExecutableName}";

     

       31
       31
        
         };

     

       32
       32
        
       }

+1 -1

nixos/modules/security/duosec.nix

···

       188
       188
        
       

     

       189
       189
        
            environment.systemPackages = [ pkgs.duo-unix ];

     

       190
       190
        
       

     

       191
       191
       -
            security.setuidPrograms = [ "login_duo" ];

     

       191
       191
       +
            security.wrappers.login_duo.source = "${pkgs.duo-unix.out}/bin/login_duo";

     

       192
       192
        
            environment.etc = loginCfgFile ++ pamCfgFile;

     

       193
       193
        
       

     

       194
       194
        
            /* If PAM *and* SSH are enabled, then don't do anything special.

+10 -5

nixos/modules/security/pam.nix

···

       472
       472
        
             ++ optionals config.security.pam.enableU2F [ pkgs.pam_u2f ]

     

       473
       473
        
             ++ optionals config.security.pam.enableEcryptfs [ pkgs.ecryptfs ];

     

       474
       474
        
       

     

       475
       475
       -
           security.setuidPrograms =

     

       475
       475
       +
           security.wrapperssetuidPrograms =

     

       476
       476
        
             optionals config.security.pam.enableEcryptfs [ "mount.ecryptfs_private" "umount.ecryptfs_private" ];

     

       477
       477
        
       

     

       478
       478
       -
           security.wrappers.unix_chkpwd = {

     

       479
       479
       -
             source = "${pkgs.pam}/sbin/unix_chkpwd.orig";

     

       480
       480
       -
             owner = "root";

     

       481
       481
       -
             setuid = true;

     

       478
       478
       +
           security.wrappers = {

     

       479
       479
       +
             unix_chkpwd = {

     

       480
       480
       +
               source = "${pkgs.pam}/sbin/unix_chkpwd.orig";

     

       481
       481
       +
               owner = "root";

     

       482
       482
       +
               setuid = true;

     

       483
       483
       +
             };

     

       484
       484
       +
           } // (mkIf config.security.pam.enableEcryptfs {

     

       485
       485
       +
             "mount.ecryptfs_private".source = "${pkgs.ecryptfs.out}/bin/mount.ecryptfs_private";

     

       486
       486
       +
              "umount.ecryptfs_private".source = "${pkgs.ecryptfs.out}/bin/umount.ecryptfs_private";

     

       482
       487
        
           };

     

       483
       488
        
       

     

       484
       489
        
           environment.etc =

+4 -1

nixos/modules/security/pam_usb.nix

···

       33
       33
        
         config = mkIf (cfg.enable || anyUsbAuth) {

     

       34
       34
        
       

     

       35
       35
        
           # Make sure pmount and pumount are setuid wrapped.

     

       36
       36
       -
           security.setuidPrograms = [ "pmount" "pumount" ];

     

       36
       36
       +
           security.wrappers = {

     

       37
       37
       +
             pmount.source = "${pkgs.pmount.out}/bin/pmount";

     

       38
       38
       +
             pumount.source = "${pkgs.pmount.out}/bin/pumount";

     

       39
       39
       +
           };

     

       37
       40
        
       

     

       38
       41
        
           environment.systemPackages = [ pkgs.pmount ];

     

       39
       42

+4 -2

nixos/modules/security/polkit.nix

···

       83
       83
        
       

     

       84
       84
        
           security.pam.services.polkit-1 = {};

     

       85
       85
        
       

     

       86
       86
       -
           security.setuidPrograms = [ "pkexec" ];

     

       87
       87
       -
           security.wrappers."polkit-agent-helper-1".source = "${pkgs.polkit.out}/lib/polkit-1/polkit-agent-helper-1";

     

       86
       86
       +
           security.wrappers = {

     

       87
       87
       +
             pkexec.source = "${pkgs.polkit.out}/bin/pkexec";

     

       88
       88
       +
             "polkit-agent-helper-1".source = "${pkgs.polkit.out}/lib/polkit-1/polkit-agent-helper-1";

     

       89
       89
       +
           };

     

       88
       90
        
       

     

       89
       91
        
           system.activationScripts.polkit =

     

       90
       92
        
             ''

+4 -1

nixos/modules/security/sudo.nix

···

       81
       81
        
               ${cfg.extraConfig}

     

       82
       82
        
             '';

     

       83
       83
        
       

     

       84
       84
       -
           security.setuidPrograms = [ "sudo" "sudoedit" ];

     

       84
       84
       +
           security.wrappers = {

     

       85
       85
       +
             sudo.source = "${pkgs.sudo.out}/bin/sudo";

     

       86
       86
       +
             sudoedit.source = "${pkgs.sudo.out}/bin/sudoedit";

     

       87
       87
       +
           };

     

       85
       88
        
       

     

       86
       89
        
           environment.systemPackages = [ sudo ];

     

       87
       90

+1 -23

nixos/modules/security/wrappers/default.nix

···

       4
       4
        
         inherit (config.security) wrapperDir wrappers setuidPrograms;

     

       5
       5
        
       

     

       6
       6
        
         programs =

     

       7
       7
       -
           (map (x: { program = x; owner = "root"; group = "root"; setuid = true; }) setuidPrograms)

     

       8
       8
       -
           ++

     

       9
       7
        
           (lib.mapAttrsToList

     

       10
       8
        
             (n: v: (if v ? "program" then v else v // {program=n;}))

     

       11
       9
        
             wrappers);

     

       12
       10
        
       

     

       13
       11
        
         mkWrapper = { program, source ? null, ...}: ''

     

       14
       14
       -
           if ! source=${if source != null || source != "" then source else "$(readlink -f $(PATH=$WRAPPER_PATH type -tP ${program}))"}; then

     

       15
       15
       -
               # If we can't find the program, fall back to the

     

       16
       16
       -
               # system profile.

     

       17
       17
       -
               source=/nix/var/nix/profiles/default/bin/${program}

     

       18
       18
       -
           fi

     

       19
       19
       -
       

     

       20
       12
        
           parentWrapperDir=$(dirname ${wrapperDir})

     

       21
       21
       -
       

     

       22
       22
       -
           gcc -Wall -O2 -DSOURCE_PROG=\"$source\" -DWRAPPER_DIR=\"$parentWrapperDir\" \

     

       13
       13
       +
           gcc -Wall -O2 -DSOURCE_PROG=\"${source}\" -DWRAPPER_DIR=\"$parentWrapperDir\" \

     

       23
       14
        
               -lcap-ng -lcap ${./wrapper.c} -o $out/bin/${program}.wrapper -L ${pkgs.libcap.lib}/lib -L ${pkgs.libcap_ng}/lib \

     

       24
       15
        
               -I ${pkgs.libcap.dev}/include -I ${pkgs.libcap_ng}/include -I ${pkgs.linuxHeaders}/include

     

       25
       16
        
         '';

     
···

       96
       87
        
         ###### interface

     

       97
       88
        
       

     

       98
       89
        
         options = {

     

       99
       99
       -
           security.setuidPrograms = lib.mkOption {

     

       100
       100
       -
             type = lib.types.listOf lib.types.str;

     

       101
       101
       -
             default = [];

     

       102
       102
       -
             example = ["passwd"];

     

       103
       103
       -
             description = ''

     

       104
       104
       -
               The Nix store cannot contain setuid/setgid programs directly.

     

       105
       105
       -
               For this reason, NixOS can automatically generate wrapper

     

       106
       106
       -
               programs that have the necessary privileges.  This option

     

       107
       107
       -
               lists the names of programs in the system environment for

     

       108
       108
       -
               which setuid root wrappers should be created.

     

       109
       109
       -
             '';

     

       110
       110
       -
           };

     

       111
       111
       -
       

     

       112
       90
        
           security.wrappers = lib.mkOption {

     

       113
       91
        
             type = lib.types.attrs;

     

       114
       92
        
             default = {};

+1 -1

nixos/modules/services/mail/exim.nix

···

       89
       89
        
             gid = config.ids.gids.exim;

     

       90
       90
        
           };

     

       91
       91
        
       

     

       92
       92
       -
           security.setuidPrograms = [ "exim" ];

     

       92
       92
       +
           security.wrappers.exim.source = "${exim}/bin/exim";

     

       93
       93
        
       

     

       94
       94
        
           systemd.services.exim = {

     

       95
       95
        
             description = "Exim Mail Daemon";

+4 -1

nixos/modules/services/networking/smokeping.nix

···

       273
       273
        
               message = "services.smokeping: sendmail and Mailhost cannot both be enabled.";

     

       274
       274
        
             }

     

       275
       275
        
           ];

     

       276
       276
       -
           security.setuidPrograms = [ "fping" "fping6" ];

     

       276
       276
       +
           security.wrappers = {

     

       277
       277
       +
             fping.source = "${pkgs.fping}/bin/fping";

     

       278
       278
       +
             "fping6".source = "${pkgs.fping}/bin/fping6";

     

       279
       279
       +
           };

     

       277
       280
        
           environment.systemPackages = [ pkgs.fping ];

     

       278
       281
        
           users.extraUsers = singleton {

     

       279
       282
        
             name = cfg.user;

+1 -1

nixos/modules/services/scheduling/cron.nix

···

       93
       93
        
       

     

       94
       94
        
           { services.cron.enable = mkDefault (allFiles != []); }

     

       95
       95
        
           (mkIf (config.services.cron.enable) {

     

       96
       96
       -
             security.setuidPrograms = [ "crontab" ];

     

       96
       96
       +
             security.wrappers.crontab.source = "${pkgs.cronNixosPkg.out}/bin/crontab";

     

       97
       97
        
             environment.systemPackages = [ cronNixosPkg ];

     

       98
       98
        
             environment.etc.crontab =

     

       99
       99
        
               { source = pkgs.runCommand "crontabs" { inherit allFiles; preferLocalBuild = true; }

+1 -1

nixos/modules/services/scheduling/fcron.nix

···

       106
       106
        
       

     

       107
       107
        
           environment.systemPackages = [ pkgs.fcron ];

     

       108
       108
        
       

     

       109
       109
       -
           security.setuidPrograms = [ "fcrontab" ];

     

       109
       109
       +
           security.wrappers.fcrontab.source = "${pkgs.fcron.out}/bin/fcrontab";

     

       110
       110
        
           systemd.services.fcron = {

     

       111
       111
        
             description = "fcron daemon";

     

       112
       112
        
             after = [ "local-fs.target" ];

+2 -1

nixos/modules/services/x11/desktop-managers/enlightenment.nix

···

       62
       62
        
             '';

     

       63
       63
        
           }];

     

       64
       64
        
       

     

       65
       65
       -
           security.setuidPrograms = [ "e_freqset" ];

     

       65
       65
       +
           security.wrappers.e_freqset.source = "${e.enlightenment.out}/bin/e_freqset";

     

       66
       66
       +
           

     

       66
       67
        
           environment.etc = singleton

     

       67
       68
        
             { source = "${pkgs.xkeyboard_config}/etc/X11/xkb";

     

       68
       69
        
               target = "X11/xkb";

+4 -3

nixos/modules/tasks/network-interfaces.nix

···

       912
       912
        
       

     

       913
       913
        
           # If the linux kernel IS older than 4.3, create setuid wrappers

     

       914
       914
        
           # for ping and ping6

     

       915
       915
       -
           security.setuidPrograms = mkIf (versionOlder (getVersion config.boot.kernelPackages.kernel) "4.3") [

     

       916
       916
       -
             "ping" "ping6"

     

       917
       917
       -
           ];

     

       915
       915
       +
           security.wrappers = mkIf (versionOlder (getVersion config.boot.kernelPackages.kernel) "4.3") {

     

       916
       916
       +
             ping.source = "${pkgs.iputils.out}/bin/ping";

     

       917
       917
       +
             "ping6".source = "${pkgs.iputils.out}/bin/ping6";

     

       918
       918
       +
           };

     

       918
       919
        
       

     

       919
       920
        
           # Set the host and domain names in the activation script.  Don't

     

       920
       921
        
           # clear it if it's not configured in the NixOS configuration,