public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge commit staging+systemd into closure-size

Browse Source 
Many non-conflict problems weren't (fully) resolved in this commit yet.
This commit is contained in:
Vladimír Čunát
2015-10-03 13:33:37 +02:00
parent d6dd3b8bd1 33373d939a
commit 5227fb1dd5
6304 changed files with 708451 additions and 130034 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nixos/modules/security/apparmor.nix
-8
View File
@@ -37,13 +37,5 @@ in
) cfg.profiles;
};
};
security.pam.services.apparmor.text = ''
## AppArmor changes hats according to `order`: first try user, then
## group, and finally fall back to a hat called "DEFAULT"
##
## For now, enable debugging as this is an experimental feature.
session optional ${pkgs.apparmor-pam}/lib/security/pam_apparmor.so order=user,group,default debug
'';
};
}
nixos/modules/security/ca.nix
+3 -5
View File
@@ -22,7 +22,7 @@ in
security.pki.certificateFiles = mkOption {
type = types.listOf types.path;
default = [];
example = literalExample "[ \"\${pkgs.cacert}/etc/ca-bundle.crt\" ]";
example = literalExample "[ \"\${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt\" ]";
description = ''
A list of files containing trusted root certificates in PEM
format. These are concatenated to form
@@ -33,7 +33,7 @@ in
};
security.pki.certificates = mkOption {
type = types.listOf types.string;
type = types.listOf types.str;
default = [];
example = singleton ''
NixOS.org
@@ -53,7 +53,7 @@ in
config = {
security.pki.certificateFiles = [ "${pkgs.cacert}/etc/ca-bundle.crt" ];
security.pki.certificateFiles = [ "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt" ];
# NixOS canonical location + Debian/Ubuntu/Arch/Gentoo compatibility.
environment.etc."ssl/certs/ca-certificates.crt".source = caBundle;
@@ -66,8 +66,6 @@ in
environment.sessionVariables =
{ SSL_CERT_FILE = "/etc/ssl/certs/ca-certificates.crt";
# FIXME: unneeded - remove eventually.
OPENSSL_X509_CERT_FILE = "/etc/ssl/certs/ca-certificates.crt";
# FIXME: unneeded - remove eventually.
GIT_SSL_CAINFO = "/etc/ssl/certs/ca-certificates.crt";
};
nixos/modules/security/grsecurity.nix
+2 -2
View File
@@ -38,7 +38,7 @@ in
type = types.bool;
default = false;
description = ''
Enable the testing grsecurity patch, based on Linux 3.19.
Enable the testing grsecurity patch, based on Linux 4.0.
'';
};
@@ -223,7 +223,7 @@ in
message = ''
If grsecurity is enabled, you must select either the
stable patch (with kernel 3.14), or the testing patch (with
kernel 3.19) to continue.
kernel 4.0) to continue.
'';
}
{ assertion = !(cfg.stable && cfg.testing);
nixos/modules/security/pam.nix
+50 -4
View File
@@ -36,6 +36,16 @@ let
'';
};
u2fAuth = mkOption {
default = config.security.pam.enableU2F;
type = types.bool;
description = ''
If set, users listed in
<filename>~/.yubico/u2f_keys</filename> are able to log in
with the associated U2F key.
'';
};
usbAuth = mkOption {
default = config.security.pam.usb.enable;
type = types.bool;
@@ -116,6 +126,14 @@ let
'';
};
pamMount = mkOption {
default = config.security.pam.mount.enable;
type = types.bool;
description = ''
Enable PAM mount (pam_mount) system to mount fileystems on user login.
'';
};
allowNullPassword = mkOption {
default = false;
type = types.bool;
@@ -174,6 +192,16 @@ let
description = "Whether to log authentication failures in <filename>/var/log/faillog</filename>.";
};
enableAppArmor = mkOption {
default = false;
type = types.bool;
description = ''
Enable support for attaching AppArmor profiles at the
user/group level, e.g., as part of a role based access
control scheme.
'';
};
text = mkOption {
type = types.nullOr types.lines;
description = "Contents of the PAM service file.";
@@ -209,10 +237,14 @@ let
"auth sufficient ${pkgs.pam_ssh_agent_auth}/libexec/pam_ssh_agent_auth.so file=~/.ssh/authorized_keys:~/.ssh/authorized_keys2:/etc/ssh/authorized_keys.d/%u"}
${optionalString cfg.fprintAuth
"auth sufficient ${pkgs.fprintd}/lib/security/pam_fprintd.so"}
${optionalString cfg.u2fAuth
"auth sufficient ${pkgs.pam_u2f}/lib/security/pam_u2f.so"}
${optionalString cfg.usbAuth
"auth sufficient ${pkgs.pam_usb}/lib/security/pam_usb.so"}
${optionalString cfg.unixAuth
"auth ${if config.security.pam.enableEcryptfs then "required" else "sufficient"} pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} likeauth"}
"auth ${if (config.security.pam.enableEcryptfs || cfg.pamMount) then "required" else "sufficient"} pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} likeauth"}
${optionalString cfg.pamMount
"auth optional ${pkgs.pam_mount}/lib/security/pam_mount.so"}
${optionalString config.security.pam.enableEcryptfs
"auth required ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so unwrap"}
${optionalString cfg.otpwAuth
@@ -226,12 +258,14 @@ let
auth [default=die success=done] ${pam_ccreds}/lib/security/pam_ccreds.so action=validate use_first_pass
auth sufficient ${pam_ccreds}/lib/security/pam_ccreds.so action=store use_first_pass
''}
${optionalString (! config.security.pam.enableEcryptfs) "auth required pam_deny.so"}
${optionalString (!(config.security.pam.enableEcryptfs || cfg.pamMount)) "auth required pam_deny.so"}
# Password management.
password requisite pam_unix.so nullok sha512
${optionalString config.security.pam.enableEcryptfs
"password optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so"}
password requisite pam_unix.so nullok sha512
${optionalString cfg.pamMount
"password optional ${pkgs.pam_mount}/lib/security/pam_mount.so"}
${optionalString config.users.ldap.enable
"password sufficient ${pam_ldap}/lib/security/pam_ldap.so"}
${optionalString config.krb5.enable
@@ -268,6 +302,10 @@ let
"session required ${pkgs.pam}/lib/security/pam_limits.so conf=${makeLimitsConf cfg.limits}"}
${optionalString (cfg.showMotd && config.users.motd != null)
"session optional ${pkgs.pam}/lib/security/pam_motd.so motd=${motd}"}
${optionalString cfg.pamMount
"session optional ${pkgs.pam_mount}/lib/security/pam_mount.so"}
${optionalString (cfg.enableAppArmor && config.security.apparmor.enable)
"session optional ${pkgs.apparmor-pam}/lib/security/pam_apparmor.so order=user,group,default debug"}
'';
};
@@ -364,6 +402,13 @@ in
'';
};
security.pam.enableU2F = mkOption {
default = false;
description = ''
Enable the U2F PAM module.
'';
};
security.pam.enableEcryptfs = mkOption {
default = false;
description = ''
@@ -374,7 +419,7 @@ in
users.motd = mkOption {
default = null;
example = "Today is Sweetmorn, the 4th day of The Aftermath in the YOLD 3178.";
type = types.nullOr types.string;
type = types.nullOr types.lines;
description = "Message of the day shown to users when they log in.";
};
@@ -392,6 +437,7 @@ in
++ optionals config.krb5.enable [pam_krb5 pam_ccreds]
++ optionals config.security.pam.enableOTPW [ pkgs.otpw ]
++ optionals config.security.pam.enableOATH [ pkgs.oathToolkit ]
++ optionals config.security.pam.enableU2F [ pkgs.pam_u2f ]
++ optionals config.security.pam.enableEcryptfs [ pkgs.ecryptfs ];
security.setuidPrograms =
nixos/modules/security/pam_mount.nix
+72
View File
@@ -0,0 +1,72 @@
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.security.pam.mount;
anyPamMount = any (attrByPath ["pamMount"] false) (attrValues config.security.pam.services);
in
{
options = {
security.pam.mount = {
enable = mkOption {
type = types.bool;
default = false;
description = ''
Enable PAM mount system to mount fileystems on user login.
'';
};
extraVolumes = mkOption {
type = types.listOf types.str;
default = [];
description = ''
List of volume definitions for pam_mount.
For more information, visit <link
xlink:href="http://pam-mount.sourceforge.net/pam_mount.conf.5.html" />.
'';
};
};
};
config = mkIf (cfg.enable || anyPamMount) {
environment.systemPackages = [ pkgs.pam_mount ];
environment.etc = [{
target = "security/pam_mount.conf.xml";
source =
let
extraUserVolumes = filterAttrs (n: u: u.cryptHomeLuks != null) config.users.extraUsers;
userVolumeEntry = user: "<volume user=\"${user.name}\" path=\"${user.cryptHomeLuks}\" mountpoint=\"${user.home}\" />\n";
in
pkgs.writeText "pam_mount.conf.xml" ''
<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE pam_mount SYSTEM "pam_mount.conf.xml.dtd">
<!-- auto generated from Nixos: modules/config/users-groups.nix -->
<pam_mount>
<debug enable="0" />
${concatStrings (map userVolumeEntry (attrValues extraUserVolumes))}
${concatStringsSep "\n" cfg.extraVolumes}
<!-- if activated, requires ofl from hxtools to be present -->
<logout wait="0" hup="no" term="no" kill="no" />
<!-- set PATH variable for pam_mount module -->
<path>${pkgs.utillinux}/bin</path>
<!-- create mount point if not present -->
<mkmountpoint enable="1" remove="true" />
<!-- specify the binaries to be called -->
<cryptmount>${pkgs.pam_mount}/bin/mount.crypt %(VOLUME) %(MNTPT)</cryptmount>
<cryptumount>${pkgs.pam_mount}/bin/umount.crypt %(MNTPT)</cryptumount>
<pmvarrun>${pkgs.pam_mount}/bin/pmvarrun -u %(USER) -o %(OPERATION)</pmvarrun>
</pam_mount>
'';
}];
};
}
nixos/modules/security/prey.nix
+15 -6
View File
@@ -16,19 +16,28 @@ in {
default = false;
type = types.bool;
description = ''
Enables http://preyproject.com/ bash client. Be sure to specify api and device keys.
Once setup, cronjob will run evert 15 minutes and report status.
Enables the <link xlink:href="http://preyproject.com/" />
shell client. Be sure to specify both API and device keys.
Once enabled, a <command>cron</command> job will run every 15
minutes to report status information.
'';
};
deviceKey = mkOption {
type = types.string;
description = "Device Key obtained from https://panel.preyproject.com/devices (and clicking on the device)";
type = types.str;
description = ''
<literal>Device key</literal> obtained by visiting
<link xlink:href="https://panel.preyproject.com/devices" />
and clicking on your device.
'';
};
apiKey = mkOption {
type = types.string;
description = "API key obtained from https://panel.preyproject.com/profile";
type = types.str;
description = ''
<literal>API key</literal> obtained from
<link xlink:href="https://panel.preyproject.com/profile" />.
'';
};
};