public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Revert "apparmor: fix and improve the service"

Browse Source 
This reverts commit fb6d63f3fd.

I really hope this finally fixes #99236: evaluation on Hydra.
This time I really did check basically the same commit on Hydra:
https://hydra.nixos.org/eval/1618011

Right now I don't have energy to find what exactly is wrong in the
commit, and it doesn't seem important in comparison to nixos-unstable
channel being stuck on a commit over one week old.
This commit is contained in:
Vladimír Čunát
2020-10-07 12:22:18 +02:00
parent 3b0886c9af
commit 420f89ceb2
20 changed files with 164 additions and 791 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nixos/modules/security/pam.nix
-55
View File
@@ -834,61 +834,6 @@ in
runuser-l = { rootOK = true; unixAuth = false; };
};
security.apparmor.includes."abstractions/pam" = let
isEnabled = test: fold or false (map test (attrValues config.security.pam.services));
in ''
${lib.concatMapStringsSep "\n"
(name: "r ${config.environment.etc."pam.d/${name}".source},")
(attrNames config.security.pam.services)}
mr ${getLib pkgs.pam}/lib/security/pam_filter/*,
mr ${getLib pkgs.pam}/lib/security/pam_*.so,
r ${getLib pkgs.pam}/lib/security/,
${optionalString use_ldap
"mr ${pam_ldap}/lib/security/pam_ldap.so,"}
${optionalString config.services.sssd.enable
"mr ${pkgs.sssd}/lib/security/pam_sss.so,"}
${optionalString config.krb5.enable ''
mr ${pam_krb5}/lib/security/pam_krb5.so,
mr ${pam_ccreds}/lib/security/pam_ccreds.so,
''}
${optionalString (isEnabled (cfg: cfg.googleOsLoginAccountVerification)) ''
mr ${pkgs.google-compute-engine-oslogin}/lib/pam_oslogin_login.so,
mr ${pkgs.google-compute-engine-oslogin}/lib/pam_oslogin_admin.so,
''}
${optionalString (isEnabled (cfg: cfg.googleOsLoginAuthentication))
"mr ${pkgs.google-compute-engine-oslogin}/lib/pam_oslogin_login.so,"}
${optionalString (config.security.pam.enableSSHAgentAuth && isEnabled (cfg: cfg.sshAgentAuth))
"mr ${pkgs.pam_ssh_agent_auth}/libexec/pam_ssh_agent_auth.so,"}
${optionalString (isEnabled (cfg: cfg.fprintAuth))
"mr ${pkgs.fprintd}/lib/security/pam_fprintd.so,"}
${optionalString (isEnabled (cfg: cfg.u2fAuth))
"mr ${pkgs.pam_u2f}/lib/security/pam_u2f.so,"}
${optionalString (isEnabled (cfg: cfg.usbAuth))
"mr ${pkgs.pam_usb}/lib/security/pam_usb.so,"}
${optionalString (isEnabled (cfg: cfg.oathAuth))
"mr ${pkgs.oathToolkit}/lib/security/pam_oath.so,"}
${optionalString (isEnabled (cfg: cfg.yubicoAuth))
"mr ${pkgs.yubico-pam}/lib/security/pam_yubico.so,"}
${optionalString (isEnabled (cfg: cfg.duoSecurity.enable))
"mr ${pkgs.duo-unix}/lib/security/pam_duo.so,"}
${optionalString (isEnabled (cfg: cfg.otpwAuth))
"mr ${pkgs.otpw}/lib/security/pam_otpw.so,"}
${optionalString config.security.pam.enableEcryptfs
"mr ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so,"}
${optionalString (isEnabled (cfg: cfg.pamMount))
"mr ${pkgs.pam_mount}/lib/security/pam_mount.so,"}
${optionalString (isEnabled (cfg: cfg.enableGnomeKeyring))
"mr ${pkgs.gnome3.gnome-keyring}/lib/security/pam_gnome_keyring.so,"}
${optionalString (isEnabled (cfg: cfg.startSession))
"mr ${pkgs.systemd}/lib/security/pam_systemd.so,"}
${optionalString (isEnabled (cfg: cfg.enableAppArmor) && config.security.apparmor.enable)
"mr ${pkgs.apparmor-pam}/lib/security/pam_apparmor.so,"}
${optionalString (isEnabled (cfg: cfg.enableKwallet))
"mr ${pkgs.plasma5.kwallet-pam}/lib/security/pam_kwallet5.so,"}
${optionalString config.virtualisation.lxc.lxcfs.enable
"mr ${pkgs.lxc}/lib/security/pam_cgfs.so"}
'';
};
}