From 2a4417d637acb0769bdd9525a3f6881b6ad85384 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <eelco.dolstra@logicblox.com>
Date: Thu, 16 Aug 2007 15:09:06 +0000
Subject: [PATCH] * make-etc / activate-configuration: allow /etc files to be
 installed   as regular files instead of symlinks to the store. * Sudo
 configuration, enabled through security.sudo.enable (on by   default).  The
 contents of the sudoers file is specified in   security.sudo.configFile.  The
 default sudoers file allows members   of the new "wheel" group to run any
 command.

svn path=/nixos/trunk/; revision=9138
---
 configuration/rescue-cd.nix      |  5 +++++
 etc/default.nix                  | 11 +++++++++++
 helpers/make-etc.nix             |  1 +
 helpers/make-etc.sh              |  4 ++++
 installer/nixos-rebuild.sh       | 18 ++++++++++--------
 system/activate-configuration.sh | 10 +++++++++-
 system/ids.nix                   |  1 +
 system/options.nix               | 31 +++++++++++++++++++++++++++++++
 system/system.nix                |  4 +++-
 system/users-groups.nix          |  3 +++
 10 files changed, 78 insertions(+), 10 deletions(-)

diff --git a/configuration/rescue-cd.nix b/configuration/rescue-cd.nix
index 819eb6785db..5aa860ef9fb 100644
--- a/configuration/rescue-cd.nix
+++ b/configuration/rescue-cd.nix
@@ -76,6 +76,11 @@ rec {
       nixpkgsURL = http://nix.cs.uu.nl/dist/nix/ + nixpkgsRel;
     };
 
+    security = {
+      sudo = {
+        enable = false;
+      };
+    };
   };
 
 
diff --git a/etc/default.nix b/etc/default.nix
index c61e87c4c7e..33f85cb67a0 100644
--- a/etc/default.nix
+++ b/etc/default.nix
@@ -140,6 +140,17 @@ import ../helpers/make-etc.nix {
     target = "ldap.conf";
   })
     
+  # "sudo" configuration.
+  ++ (optional ["security" "sudo" "enable"] {
+    source = pkgs.runCommand "sudoers"
+      { src = pkgs.writeText "sudoers-in" (config.get ["security" "sudo" "configFile"]);
+      }
+      # Make sure that the sudoers file is syntactically valid.
+      "${pkgs.sudo}/sbin/visudo -f $src -c && cp $src $out";
+    target = "sudoers";
+    mode = "0440";
+  })
+    
   # A bunch of PAM configuration files for various programs.
   ++ (map
     (program:
diff --git a/helpers/make-etc.nix b/helpers/make-etc.nix
index 9785823248a..94ea248f669 100644
--- a/helpers/make-etc.nix
+++ b/helpers/make-etc.nix
@@ -8,4 +8,5 @@ stdenv.mkDerivation {
   /* !!! Use toXML. */
   sources = map (x: x.source) configFiles;
   targets = map (x: x.target) configFiles;
+  modes = map (x: if x ? mode then x.mode else "symlink") configFiles;
 }
diff --git a/helpers/make-etc.sh b/helpers/make-etc.sh
index 7834d553fdc..a7643b63c5b 100644
--- a/helpers/make-etc.sh
+++ b/helpers/make-etc.sh
@@ -4,7 +4,11 @@ ensureDir $out/etc
 
 sources_=($sources)
 targets_=($targets)
+modes_=($modes)
 for ((i = 0; i < ${#targets_[@]}; i++)); do
     ensureDir $out/etc/$(dirname ${targets_[$i]})
     ln -s ${sources_[$i]} $out/etc/${targets_[$i]}
+    if test "${modes_[$i]}" != symlink; then
+        echo "${modes_[$i]}" > $out/etc/${targets_[$i]}.mode
+    fi
 done
diff --git a/installer/nixos-rebuild.sh b/installer/nixos-rebuild.sh
index 33639daa568..190e21d371c 100644
--- a/installer/nixos-rebuild.sh
+++ b/installer/nixos-rebuild.sh
@@ -30,15 +30,17 @@ if test -z "$NIXOS_CONFIG"; then NIXOS_CONFIG=/etc/nixos/configuration.nix; fi
 
 # Pull the manifests defined in the configuration (the "manifests"
 # attribute).  Wonderfully hacky.
-manifests=$(nix-instantiate --eval-only --xml --strict \
-    $NIXOS/system/system.nix \
-    --arg configuration "import $NIXOS_CONFIG" \
-    -A manifests \
-    | grep '<string'  | sed 's^.*"\(.*\)".*^\1^g')
+if test -z "$NIXOS_NO_PULL"; then
+    manifests=$(nix-instantiate --eval-only --xml --strict \
+        $NIXOS/system/system.nix \
+        --arg configuration "import $NIXOS_CONFIG" \
+        -A manifests \
+        | grep '<string'  | sed 's^.*"\(.*\)".*^\1^g')
     
-for i in $manifests; do
-    NIX_DOWNLOAD_CACHE=/nix/var/nix/channel-cache nix-pull $i || true
-done
+    for i in $manifests; do
+        NIX_DOWNLOAD_CACHE=/nix/var/nix/channel-cache nix-pull $i || true
+    done
+fi
 
 
 # Either upgrade the configuration in the system profile (for "switch"
diff --git a/system/activate-configuration.sh b/system/activate-configuration.sh
index 124ab24459d..917d0b44b0b 100644
--- a/system/activate-configuration.sh
+++ b/system/activate-configuration.sh
@@ -20,7 +20,15 @@ ln -s @etc@/etc $staticEtc
 for i in $(cd $staticEtc && find * -type l); do
     mkdir -p /etc/$(dirname $i)
     rm -f /etc/$i
-    ln -s $staticEtc/$i /etc/$i
+    if test -e "$staticEtc/$i.mode"; then
+        # Create a regular file in /etc.
+        cp $staticEtc/$i /etc/$i
+        chown root.root /etc/$i
+        chmod "$(cat "$staticEtc/$i.mode")" /etc/$i
+    else
+        # Create a symlink in /etc.
+        ln -s $staticEtc/$i /etc/$i
+    fi
 done
 
 
diff --git a/system/ids.nix b/system/ids.nix
index cb48ffd10f8..8c8d44cddf4 100644
--- a/system/ids.nix
+++ b/system/ids.nix
@@ -13,6 +13,7 @@
 
   gids = {
     root = 0;
+    wheel = 1;
     haldaemon = 5;
     audio = 17;
     users = 100;
diff --git a/system/options.nix b/system/options.nix
index 04965de59f0..3130f6b5d5b 100644
--- a/system/options.nix
+++ b/system/options.nix
@@ -969,6 +969,37 @@
   }
 
 
+  {
+    name = ["security" "sudo" "enable"];
+    default = true;
+    description = "
+      Whether to enable the <command>sudo</command> command, which
+      allows non-root users to execute commands as root.
+    ";
+  }
+
+
+  {
+    name = ["security" "sudo" "configFile"];
+    default = "
+# WARNING: do not edit this file directly or with \"visudo\".  Instead,
+# edit the source file in /etc/nixos/nixos/etc/sudoers.
+
+# \"root\" is allowed to do anything.
+root        ALL=(ALL) SETENV: ALL
+
+# Users in the \"wheel\" group can do anything.
+%wheel      ALL=(ALL) SETENV: ALL
+    ";
+    description = "
+      This string contains the contents of the
+      <filename>sudoers</filename> file.  If syntax errors are
+      detected in this file, the NixOS configuration will fail to
+      build. 
+    ";
+  }
+
+
   {
     name = ["users" "ldap" "enable"];
     default = false;
diff --git a/system/system.nix b/system/system.nix
index d8d7d6e85ab..2f9104e2155 100644
--- a/system/system.nix
+++ b/system/system.nix
@@ -225,6 +225,7 @@ rec {
     nixosCheckout
     setuidWrapper
   ]
+  ++ pkgs.lib.optional (config.get ["security" "sudo" "enable"]) pkgs.sudo
   ++ pkgs.lib.concatLists (map (job: job.extraPath) upstartJobs.jobs)
   ++ (config.get ["environment" "extraPackages"]) pkgs;
 
@@ -260,7 +261,8 @@ rec {
     hostName = config.get ["networking" "hostName"];
     setuidPrograms =
       config.get ["security" "setuidPrograms"] ++
-      config.get ["security" "extraSetuidPrograms"];
+      config.get ["security" "extraSetuidPrograms"] ++
+      pkgs.lib.optional (config.get ["security" "sudo" "enable"]) "sudo";
     maxJobs = config.get ["nix" "maxJobs"];
     extraNixOptions = config.get ["nix" "extraOptions"];
 
diff --git a/system/users-groups.nix b/system/users-groups.nix
index 62c2a9d626d..1a77d302c5a 100644
--- a/system/users-groups.nix
+++ b/system/users-groups.nix
@@ -56,6 +56,9 @@ rec {
           { name = "root";
             gid = ids.gids.root;
           }
+          { name = "wheel";
+            gid = ids.gids.wheel;
+          }
           { name = "nogroup";
             gid = ids.gids.nogroup;
           }