···

       
202
       
 
       
      '';

     

       
203
       
 
       
    };

     

       
204
       
 
       


     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
205
       
 
       
    networking.dhcpcd.runHook = lib.mkOption {

     

       
206
       
 
       
      type = lib.types.lines;

     

       
207
       
 
       
      default = "";

     
···

       
213
       
 
       
        ::: {.note}

     

       
214
       
 
       
        To use sudo or similar tools in your script you may have to set:

     

       
215
       
 
       


     

       
216
       
-
       
            systemd.services.dhcpcd.serviceConfig.NoNewPrivileges = false;

     

       
217
       
 
       


     

       
218
       
 
       
        In addition, as most of the filesystem is inaccessible to dhcpcd

     

       
219
       
 
       
        by default, you may want to define some exceptions, e.g.

     
···

       
321
       
 
       
            "CAP_NET_RAW"

     

       
322
       
 
       
            "CAP_NET_BIND_SERVICE"

     

       
323
       
 
       
          ];

     

       
324
       
-
       
          CapabilityBoundingSet = [

     

       
325
       
 
       
            "CAP_NET_ADMIN"

     

       
326
       
 
       
            "CAP_NET_RAW"

     

       
327
       
 
       
            "CAP_NET_BIND_SERVICE"

     
···

       
335
       
 
       
          DeviceAllow = "";

     

       
336
       
 
       
          LockPersonality = true;

     

       
337
       
 
       
          MemoryDenyWriteExecute = true;

     

       
338
       
-
       
          NoNewPrivileges = lib.mkDefault true; # may be disabled for sudo in runHook

     

       
339
       
 
       
          PrivateDevices = true;

     

       
340
       
 
       
          PrivateMounts = true;

     

       
341
       
 
       
          PrivateTmp = true;

     
···

       
360
       
 
       
          RestrictNamespaces = true;

     

       
361
       
 
       
          RestrictRealtime = true;

     

       
362
       
 
       
          RestrictSUIDSGID = true;

     

       
363
       
-
       
          SystemCallFilter = [

     

       
364
       
-
       
            "@system-service"

     

       
365
       
-
       
            "~@aio"

     

       
366
       
-
       
            "~@keyring"

     

       
367
       
-
       
            "~@memlock"

     

       
368
       
-
       
            "~@mount"

     

       
369
       
-
       
            "~@privileged"

     

       
370
       
-
       
            "~@resources"

     

       
371
       
-
       
          ];

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
372
       
 
       
          SystemCallArchitectures = "native";

     

       
373
       
 
       
          UMask = "0027";

     

       
374
       
 
       
        };

     

···

       
202
       
 
       
      '';

     

       
203
       
 
       
    };

     

       
204
       
 
       


     

       
205
       
+
       
    networking.dhcpcd.allowSetuid = lib.mkOption {

     

       
206
       
+
       
      type = lib.types.bool;

     

       
207
       
+
       
      default = false;

     

       
208
       
+
       
      description = ''

     

       
209
       
+
       
        Whether to relax the security sandbox to allow running setuid

     

       
210
       
+
       
        binaries (e.g. `sudo`) in the dhcpcd hooks.

     

       
211
       
+
       
      '';

     

       
212
       
+
       
    };

     

       
213
       
+
       


     

       
214
       
 
       
    networking.dhcpcd.runHook = lib.mkOption {

     

       
215
       
 
       
      type = lib.types.lines;

     

       
216
       
 
       
      default = "";

     
···

       
222
       
 
       
        ::: {.note}

     

       
223
       
 
       
        To use sudo or similar tools in your script you may have to set:

     

       
224
       
 
       


     

       
225
       
+
       
            networking.dhcpcd.allowSetuid = true;

     

       
226
       
 
       


     

       
227
       
 
       
        In addition, as most of the filesystem is inaccessible to dhcpcd

     

       
228
       
 
       
        by default, you may want to define some exceptions, e.g.

     
···

       
330
       
 
       
            "CAP_NET_RAW"

     

       
331
       
 
       
            "CAP_NET_BIND_SERVICE"

     

       
332
       
 
       
          ];

     

       
333
       
+
       
          CapabilityBoundingSet = lib.optionals (!cfg.allowSetuid) [

     

       
334
       
 
       
            "CAP_NET_ADMIN"

     

       
335
       
 
       
            "CAP_NET_RAW"

     

       
336
       
 
       
            "CAP_NET_BIND_SERVICE"

     
···

       
344
       
 
       
          DeviceAllow = "";

     

       
345
       
 
       
          LockPersonality = true;

     

       
346
       
 
       
          MemoryDenyWriteExecute = true;

     

       
347
       
+
       
          NoNewPrivileges = lib.mkDefault (!cfg.allowSetuid); # may be disabled for sudo in runHook

     

       
348
       
 
       
          PrivateDevices = true;

     

       
349
       
 
       
          PrivateMounts = true;

     

       
350
       
 
       
          PrivateTmp = true;

     
···

       
369
       
 
       
          RestrictNamespaces = true;

     

       
370
       
 
       
          RestrictRealtime = true;

     

       
371
       
 
       
          RestrictSUIDSGID = true;

     

       
372
       
+
       
          SystemCallFilter =

     

       
373
       
+
       
            [

     

       
374
       
+
       
              "@system-service"

     

       
375
       
+
       
              "~@aio"

     

       
376
       
+
       
              "~@keyring"

     

       
377
       
+
       
              "~@memlock"

     

       
378
       
+
       
              "~@mount"

     

       
379
       
+
       
            ]

     

       
380
       
+
       
            ++ lib.optionals (!cfg.allowSetuid) [

     

       
381
       
+
       
              "~@privileged"

     

       
382
       
+
       
              "~@resources"

     

       
383
       
+
       
            ];

     

       
384
       
 
       
          SystemCallArchitectures = "native";

     

       
385
       
 
       
          UMask = "0027";

     

       
386
       
 
       
        };