commit a851b4d20ee0dad33395f85a092df47ac9b1cc3e · pyrox.dev/nixpkgs

+28 -15

nixos/modules/config/update-users-groups.pl

···

       1
       1
        
       use strict;

     

       2
       2
       +
       use warnings;

     

       2
       3
        
       use File::Path qw(make_path);

     

       3
       4
        
       use File::Slurp;

     

       5
       5
       +
       use Getopt::Long;

     

       4
       6
        
       use JSON;

     

       5
       5
       -
       

     

       6
       6
       -
       make_path("/var/lib/nixos", { mode => 0755 });

     

       7
       7
       -
       

     

       8
       7
        
       

     

       9
       8
        
       # Keep track of deleted uids and gids.

     

       10
       9
        
       my $uidMapFile = "/var/lib/nixos/uid-map";

     
···

       13
       12
        
       my $gidMapFile = "/var/lib/nixos/gid-map";

     

       14
       13
        
       my $gidMap = -e $gidMapFile ? decode_json(read_file($gidMapFile)) : {};

     

       15
       14
        
       

     

       15
       15
       +
       my $is_dry = ($ENV{'NIXOS_ACTION'} // "") eq "dry-activate";

     

       16
       16
       +
       GetOptions("dry-activate" => \$is_dry);

     

       17
       17
       +
       make_path("/var/lib/nixos", { mode => 0755 }) unless $is_dry;

     

       16
       18
        
       

     

       17
       19
        
       sub updateFile {

     

       18
       20
        
           my ($path, $contents, $perms) = @_;

     

       21
       21
       +
           return if $is_dry;

     

       19
       22
        
           write_file($path, { atomic => 1, binmode => ':utf8', perms => $perms // 0644 }, $contents) or die;

     

       20
       23
        
       }

     

       21
       24
        
       

     

       25
       25
       +
       sub nscdInvalidate {

     

       26
       26
       +
           system("nscd", "--invalidate", $_[0]) unless $is_dry;

     

       27
       27
       +
       }

     

       22
       28
        
       

     

       23
       29
        
       sub hashPassword {

     

       24
       30
        
           my ($password) = @_;

     
···

       26
       32
        
           my @chars = ('.', '/', 0..9, 'A'..'Z', 'a'..'z');

     

       27
       33
        
           $salt .= $chars[rand 64] for (1..8);

     

       28
       34
        
           return crypt($password, '$6$' . $salt . '$');

     

       35
       35
       +
       }

     

       36
       36
       +
       

     

       37
       37
       +
       sub dry_print {

     

       38
       38
       +
           if ($is_dry) {

     

       39
       39
       +
               print STDERR ("$_[1] $_[2]\n")

     

       40
       40
       +
           } else {

     

       41
       41
       +
               print STDERR ("$_[0] $_[2]\n")

     

       42
       42
       +
           }

     

       29
       43
        
       }

     

       30
       44
        
       

     

       31
       45
        
       

     
···

       51
       65
        
           my ($name) = @_;

     

       52
       66
        
           my $prevGid = $gidMap->{$name};

     

       53
       67
        
           if (defined $prevGid && !defined $gidsUsed{$prevGid}) {

     

       54
       54
       -
               print STDERR "reviving group '$name' with GID $prevGid\n";

     

       68
       68
       +
               dry_print("reviving", "would revive", "group '$name' with GID $prevGid");

     

       55
       69
        
               $gidsUsed{$prevGid} = 1;

     

       56
       70
        
               return $prevGid;

     

       57
       71
        
           }

     
···

       63
       77
        
           my ($min, $max, $up) = $isSystemUser ? (400, 999, 0) : (1000, 29999, 1);

     

       64
       78
        
           my $prevUid = $uidMap->{$name};

     

       65
       79
        
           if (defined $prevUid && $prevUid >= $min && $prevUid <= $max && !defined $uidsUsed{$prevUid}) {

     

       66
       66
       -
               print STDERR "reviving user '$name' with UID $prevUid\n";

     

       80
       80
       +
               dry_print("reviving", "would revive", "user '$name' with UID $prevUid");

     

       67
       81
        
               $uidsUsed{$prevUid} = 1;

     

       68
       82
        
               return $prevUid;

     

       69
       83
        
           }

     

       70
       84
        
           return allocId(\%uidsUsed, \%uidsPrevUsed, $min, $max, $up, sub { my ($uid) = @_; getpwuid($uid) });

     

       71
       85
        
       }

     

       72
       86
        
       

     

       73
       73
       -
       

     

       74
       74
       -
       # Read the declared users/groups.

     

       87
       87
       +
       # Read the declared users/groups

     

       75
       88
        
       my $spec = decode_json(read_file($ARGV[0]));

     

       76
       89
        
       

     

       77
       90
        
       # Don't allocate UIDs/GIDs that are manually assigned.

     
···

       134
       147
        
           if (defined $existing) {

     

       135
       148
        
               $g->{gid} = $existing->{gid} if !defined $g->{gid};

     

       136
       149
        
               if ($g->{gid} != $existing->{gid}) {

     

       137
       137
       -
                   warn "warning: not applying GID change of group ‘$name’ ($existing->{gid} -> $g->{gid})\n";

     

       150
       150
       +
                   dry_print("warning: not applying", "warning: would not apply", "GID change of group ‘$name’ ($existing->{gid} -> $g->{gid})");

     

       138
       151
        
                   $g->{gid} = $existing->{gid};

     

       139
       152
        
               }

     

       140
       153
        
               $g->{password} = $existing->{password}; # do we want this?

     
···

       163
       176
        
           my $g = $groupsCur{$name};

     

       164
       177
        
           next if defined $groupsOut{$name};

     

       165
       178
        
           if (!$spec->{mutableUsers} || defined $declGroups{$name}) {

     

       166
       166
       -
               print STDERR "removing group ‘$name’\n";

     

       179
       179
       +
               dry_print("removing group", "would remove group", "‘$name’");

     

       167
       180
        
           } else {

     

       168
       181
        
               $groupsOut{$name} = $g;

     

       169
       182
        
           }

     
···

       175
       188
        
           (sort { $a->{gid} <=> $b->{gid} } values(%groupsOut));

     

       176
       189
        
       updateFile($gidMapFile, to_json($gidMap));

     

       177
       190
        
       updateFile("/etc/group", \@lines);

     

       178
       178
       -
       system("nscd --invalidate group");

     

       191
       191
       +
       nscdInvalidate("group");

     

       179
       192
        
       

     

       180
       193
        
       # Generate a new /etc/passwd containing the declared users.

     

       181
       194
        
       my %usersOut;

     
···

       196
       209
        
           if (defined $existing) {

     

       197
       210
        
               $u->{uid} = $existing->{uid} if !defined $u->{uid};

     

       198
       211
        
               if ($u->{uid} != $existing->{uid}) {

     

       199
       199
       -
                   warn "warning: not applying UID change of user ‘$name’ ($existing->{uid} -> $u->{uid})\n";

     

       212
       212
       +
                   dry_print("warning: not applying", "warning: would not apply", "UID change of user ‘$name’ ($existing->{uid} -> $u->{uid})");

     

       200
       213
        
                   $u->{uid} = $existing->{uid};

     

       201
       214
        
               }

     

       202
       215
        
           } else {

     
···

       211
       224
        
       

     

       212
       225
        
           # Ensure home directory incl. ownership and permissions.

     

       213
       226
        
           if ($u->{createHome}) {

     

       214
       214
       -
               make_path($u->{home}, { mode => 0700 }) if ! -e $u->{home};

     

       227
       227
       +
               make_path($u->{home}, { mode => 0700 }) if ! -e $u->{home} and ! $is_dry;

     

       215
       228
        
               chown $u->{uid}, $u->{gid}, $u->{home};

     

       216
       229
        
               chmod 0700, $u->{home};

     

       217
       230
        
           }

     
···

       250
       263
        
           my $u = $usersCur{$name};

     

       251
       264
        
           next if defined $usersOut{$name};

     

       252
       265
        
           if (!$spec->{mutableUsers} || defined $declUsers{$name}) {

     

       253
       253
       -
               print STDERR "removing user ‘$name’\n";

     

       266
       266
       +
               dry_print("removing user", "would remove user", "‘$name’");

     

       254
       267
        
           } else {

     

       255
       268
        
               $usersOut{$name} = $u;

     

       256
       269
        
           }

     
···

       261
       274
        
           (sort { $a->{uid} <=> $b->{uid} } (values %usersOut));

     

       262
       275
        
       updateFile($uidMapFile, to_json($uidMap));

     

       263
       276
        
       updateFile("/etc/passwd", \@lines);

     

       264
       264
       -
       system("nscd --invalidate passwd");

     

       277
       277
       +
       nscdInvalidate("passwd");

     

       265
       278
        
       

     

       266
       279
        
       

     

       267
       280
        
       # Rewrite /etc/shadow to add new accounts or remove dead ones.

     
···

       293
       306
        
           my $uid = getpwnam "root";

     

       294
       307
        
           my $gid = getgrnam "shadow";

     

       295
       308
        
           my $path = "/etc/shadow";

     

       296
       296
       -
           chown($uid, $gid, $path) || die "Failed to change ownership of $path: $!";

     

       309
       309
       +
           (chown($uid, $gid, $path) || die "Failed to change ownership of $path: $!") unless $is_dry;

     

       297
       310
        
       }

     

       298
       311
        
       

     

       299
       312
        
       # Rewrite /etc/subuid & /etc/subgid to include default container mappings

+4 -2

nixos/modules/config/users-groups.nix

···

       561
       561
        
             shadow.gid = ids.gids.shadow;

     

       562
       562
        
           };

     

       563
       563
        
       

     

       564
       564
       -
           system.activationScripts.users = stringAfter [ "stdio" ]

     

       565
       565
       -
             ''

     

       564
       564
       +
           system.activationScripts.users = {

     

       565
       565
       +
             supportsDryActivation = true;

     

       566
       566
       +
             text = ''

     

       566
       567
        
               install -m 0700 -d /root

     

       567
       568
        
               install -m 0755 -d /home

     

       568
       569
        
       

     

       569
       570
        
               ${pkgs.perl.withPackages (p: [ p.FileSlurp p.JSON ])}/bin/perl \

     

       570
       571
        
               -w ${./update-users-groups.pl} ${spec}

     

       571
       572
        
             '';

     

       573
       573
       +
           };

     

       572
       574
        
       

     

       573
       575
        
           # for backwards compatibility

     

       574
       576
        
           system.activationScripts.groups = stringAfter [ "users" ] "";

+28

nixos/tests/mutable-users.nix

···

       12
       12
        
           };

     

       13
       13
        
           mutable = { ... }: {

     

       14
       14
        
             users.mutableUsers = true;

     

       15
       15
       +
             users.users.dry-test.isNormalUser = true;

     

       15
       16
        
           };

     

       16
       17
        
         };

     

       17
       18
        
       

     
···

       41
       42
        
                   "${mutableSystem}/bin/switch-to-configuration test"

     

       42
       43
        
               )

     

       43
       44
        
               assert "/run/wrappers/" in machine.succeed("which passwd")

     

       45
       45
       +
       

     

       46
       46
       +
           with subtest("dry-activation does not change files"):

     

       47
       47
       +
               machine.succeed('test -e /home/dry-test')  # home was created

     

       48
       48
       +
               machine.succeed('rm -rf /home/dry-test')

     

       49
       49
       +
       

     

       50
       50
       +
               files_to_check = ['/etc/group',

     

       51
       51
       +
                                 '/etc/passwd',

     

       52
       52
       +
                                 '/etc/shadow',

     

       53
       53
       +
                                 '/etc/subuid',

     

       54
       54
       +
                                 '/etc/subgid',

     

       55
       55
       +
                                 '/var/lib/nixos/uid-map',

     

       56
       56
       +
                                 '/var/lib/nixos/gid-map',

     

       57
       57
       +
                                 '/var/lib/nixos/declarative-groups',

     

       58
       58
       +
                                 '/var/lib/nixos/declarative-users'

     

       59
       59
       +
                                ]

     

       60
       60
       +
               expected_hashes = {}

     

       61
       61
       +
               expected_stats = {}

     

       62
       62
       +
               for file in files_to_check:

     

       63
       63
       +
                   expected_hashes[file] = machine.succeed(f"sha256sum {file}")

     

       64
       64
       +
                   expected_stats[file] = machine.succeed(f"stat {file}")

     

       65
       65
       +
       

     

       66
       66
       +
               machine.succeed("/run/current-system/bin/switch-to-configuration dry-activate")

     

       67
       67
       +
       

     

       68
       68
       +
               machine.fail('test -e /home/dry-test')  # home was not recreated

     

       69
       69
       +
               for file in files_to_check:

     

       70
       70
       +
                   assert machine.succeed(f"sha256sum {file}") == expected_hashes[file]

     

       71
       71
       +
                   assert machine.succeed(f"stat {file}") == expected_stats[file]

     

       44
       72
        
         '';

     

       45
       73
        
       })