nixos/sudo-rs: init

adds a new sudo-rs module that contains sudo-rs changes removed from sudo module

Changed files
+10 -9
nixos
modules
+1
nixos/modules/module-list.nix
···
./security/rngd.nix
./security/rtkit.nix
./security/sudo.nix
+
./security/sudo-rs.nix
./security/systemd-confinement.nix
./security/tpm2.nix
./security/wrappers/default.nix
+9 -9
nixos/modules/security/sudo-rs.nix
···
inherit (pkgs) sudo sudo-rs;
-
cfg = config.security.sudo;
+
cfg = config.security.sudo-rs;
enableSSHAgentAuth =
with config.security;
···
###### interface
-
options.security.sudo = {
+
options.security.sudo-rs = {
defaultOptions = mkOption {
type = with types; listOf str;
···
enable = mkOption {
type = types.bool;
-
default = true;
+
default = false;
description = mdDoc ''
Whether to enable the {command}`sudo` command, which
allows non-root users to execute commands as root.
···
package = mkOption {
type = types.package;
-
default = pkgs.sudo;
-
defaultText = literalExpression "pkgs.sudo";
+
default = pkgs.sudo-rs;
+
defaultText = literalExpression "pkgs.sudo-rs";
description = mdDoc ''
Which package to use for `sudo`.
'';
···
###### implementation
config = mkIf cfg.enable {
-
security.sudo.extraRules =
+
security.sudo-rs.extraRules =
let
defaultRule = { users ? [], groups ? [], opts ? [] }: [ {
inherit users groups;
···
}))
];
-
security.sudo.configFile = concatStringsSep "\n" (filter (s: s != "") [
+
security.sudo-rs.configFile = concatStringsSep "\n" (filter (s: s != "") [
''
-
# Don't edit this file. Set the NixOS options ‘security.sudo.configFile’
-
# or ‘security.sudo.extraRules’ instead.
+
# Don't edit this file. Set the NixOS options ‘security.sudo-rs.configFile’
+
# or ‘security.sudo-rs.extraRules’ instead.
''
(optionalString enableSSHAgentAuth ''
# Keep SSH_AUTH_SOCK so that pam_ssh_agent_auth.so can do its magic.