namecoind nixos module: security enhancements

Changed files
+24 -2
nixos
modules
misc
services
networking
+1 -1
nixos/modules/misc/ids.nix
···
riak = 205;
#shout = 206; #unused
gateone = 207;
-
#namecoin = 208; #unused
# When adding a gid, make sure it doesn't match an existing
# uid. Users and groups with the same name should have equal
···
riak = 205;
#shout = 206; #unused
gateone = 207;
+
namecoin = 208;
# When adding a gid, make sure it doesn't match an existing
# uid. Users and groups with the same name should have equal
+23 -1
nixos/modules/services/networking/namecoind.nix
···
type = types.path;
example = "/etc/namecoin/wallet.dat";
description = ''
-
Wallet file.
'';
};
···
USER=namecoin
PASSWORD=secret
</literal>
'';
};
···
createHome = true;
};
systemd.services.namecoind = {
description = "Namecoind Daemon";
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "simple";
User = "namecoin";
···
type = types.path;
example = "/etc/namecoin/wallet.dat";
description = ''
+
Wallet file. The ownership of the file has to be
+
namecoin:namecoin, and the permissions must be 0640.
'';
};
···
USER=namecoin
PASSWORD=secret
</literal>
+
The ownership of the file has to be namecoin:namecoin,
+
and the permissions must be 0640.
'';
};
···
createHome = true;
};
+
users.extraGroups = singleton
+
{ name = "namecoin";
+
gid = config.ids.gids.namecoin;
+
};
+
systemd.services.namecoind = {
description = "Namecoind Daemon";
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
+
preStart = ''
+
if [ "$(stat --printf '%u' ${cfg.userFile})" != "${toString config.ids.uids.namecoin}" \
+
-o "$(stat --printf '%g' ${cfg.userFile})" != "${toString config.ids.gids.namecoin}" \
+
-o "$(stat --printf '%a' ${cfg.userFile})" != "640" ]; then
+
echo "ERROR: bad ownership or rights on ${cfg.userFile}" >&2
+
exit 1
+
fi
+
if [ "$(stat --printf '%u' ${cfg.wallet})" != "${toString config.ids.uids.namecoin}" \
+
-o "$(stat --printf '%g' ${cfg.wallet})" != "${toString config.ids.gids.namecoin}" \
+
-o "$(stat --printf '%a' ${cfg.wallet})" != "640" ]; then
+
echo "ERROR: bad ownership or rights on ${cfg.wallet}" >&2
+
exit 1
+
fi
+
'';
serviceConfig = {
Type = "simple";
User = "namecoin";