pyrox.dev / nixpkgs
lol
fork atom

confinement: fix assert for serviceConfig.ProtectSystem

serviceConfig.ProtectSystem is usually a string so if set, the assert
itself would error out leaving no useable trace:

# nixos-rebuild switch --show-trace
building Nix...
building the system configuration...
error: while evaluating the attribute 'config.system.build.toplevel' at /nix/var/nix/profiles/per-user/root/channels/nixos/nixos/modules/system/activation/top-level.nix:293:5:
while evaluating 'foldr' at /nix/var/nix/profiles/per-user/root/channels/nixos/lib/lists.nix:52:20, called from /nix/var/nix/profiles/per-user/root/channels/nixos/nixos/modules/system/activation/top-level.nix:128:12:
while evaluating 'fold'' at /nix/var/nix/profiles/per-user/root/channels/nixos/lib/lists.nix:55:15, called from /nix/var/nix/profiles/per-user/root/channels/nixos/lib/lists.nix:59:8:
while evaluating anonymous function at /nix/var/nix/profiles/per-user/root/channels/nixos/nixos/modules/system/activation/top-level.nix:121:50, called from undefined position:
while evaluating the attribute 'assertion' at /nix/var/nix/profiles/per-user/root/channels/nixos/nixos/modules/security/systemd-confinement.nix:163:7:
value is a string while a Boolean was expected

Fix the check to give a sensible assert message instead; the attribute
should either be not set or false bool to pass.

Closes: #99000

Dominique Martinet f8d78b9f ffde8a8e

options
unified split
Changed files
+1 -1
nixos
modules
security
systemd-confinement.nix
+1 -1
nixos/modules/security/systemd-confinement.nix 
···

       
160

       
 

       
              + " the 'users.users' option instead as this combination is"


     

       
161

       
 

       
              + " currently not supported.";


     

       
162

       
 

       
    }


     

       
163

       
-

       
    { assertion = !cfg.serviceConfig.ProtectSystem or false;


     

       
164

       
 

       
      message = "${whatOpt "ProtectSystem"}. ProtectSystem is not compatible"


     

       
165

       
 

       
              + " with service confinement as it fails to remount /usr within"


     

       
166

       
 

       
              + " our chroot. Please disable the option.";


     
···

       
160

       
 

       
              + " the 'users.users' option instead as this combination is"


     

       
161

       
 

       
              + " currently not supported.";


     

       
162

       
 

       
    }


     

       
163

       
+

       
    { assertion = cfg.serviceConfig ? ProtectSystem -> cfg.serviceConfig.ProtectSystem == false;


     

       
164

       
 

       
      message = "${whatOpt "ProtectSystem"}. ProtectSystem is not compatible"


     

       
165

       
 

       
              + " with service confinement as it fails to remount /usr within"


     

       
166

       
 

       
              + " our chroot. Please disable the option.";