public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #87576 from xtruder/pkgs/libvirtd/polkit

Browse Source 
libvirtd: polkit integration, security fixes
This commit is contained in:
Jaka Hudoklin
2020-05-13 21:00:51 +07:00
committed by GitHub
parent 2b51171fb6 056ab3d278
commit 9a29fe5808
2 changed files with 14 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nixos/modules/virtualisation/libvirtd.nix
+11 -4
View File
@@ -7,10 +7,8 @@ let
cfg = config.virtualisation.libvirtd; cfg = config.virtualisation.libvirtd;
vswitch = config.virtualisation.vswitch; vswitch = config.virtualisation.vswitch;
configFile = pkgs.writeText "libvirtd.conf" '' configFile = pkgs.writeText "libvirtd.conf" ''
unix_sock_group = "libvirtd" auth_unix_ro = "polkit"
unix_sock_rw_perms = "0770" auth_unix_rw = "polkit"
auth_unix_ro = "none"
auth_unix_rw = "none"
${cfg.extraConfig} ${cfg.extraConfig}
''; '';
qemuConfigFile = pkgs.writeText "qemu.conf" '' qemuConfigFile = pkgs.writeText "qemu.conf" ''
@@ -269,5 +267,14 @@ in {
systemd.sockets.libvirtd .wantedBy = [ "sockets.target" ]; systemd.sockets.libvirtd .wantedBy = [ "sockets.target" ];
systemd.sockets.libvirtd-tcp.wantedBy = [ "sockets.target" ]; systemd.sockets.libvirtd-tcp.wantedBy = [ "sockets.target" ];
security.polkit.extraConfig = ''
polkit.addRule(function(action, subject) {
if (action.id == "org.libvirt.unix.manage" &&
subject.isInGroup("libvirtd")) {
return polkit.Result.YES;
}
});
'';
}; };
} }
pkgs/development/libraries/libvirt/default.nix
+3 -2
View File
@@ -4,7 +4,7 @@
, iproute, iptables, readline, lvm2, utillinux, systemd, libpciaccess, gettext , iproute, iptables, readline, lvm2, utillinux, systemd, libpciaccess, gettext
, libtasn1, ebtables, libgcrypt, yajl, pmutils, libcap_ng, libapparmor , libtasn1, ebtables, libgcrypt, yajl, pmutils, libcap_ng, libapparmor
, dnsmasq, libnl, libpcap, libxslt, xhtml1, numad, numactl, perlPackages , dnsmasq, libnl, libpcap, libxslt, xhtml1, numad, numactl, perlPackages
, curl, libiconv, gmp, zfs, parted, bridge-utils, dmidecode , curl, libiconv, gmp, zfs, parted, bridge-utils, dmidecode, dbus
, enableXen ? false, xen ? null , enableXen ? false, xen ? null
, enableIscsi ? false, openiscsi , enableIscsi ? false, openiscsi
, enableCeph ? false, ceph , enableCeph ? false, ceph
@@ -36,7 +36,7 @@ in stdenv.mkDerivation rec {
nativeBuildInputs = [ makeWrapper pkgconfig docutils ] ++ optionals (!buildFromTarball) [ autoreconfHook ]; nativeBuildInputs = [ makeWrapper pkgconfig docutils ] ++ optionals (!buildFromTarball) [ autoreconfHook ];
buildInputs = [ buildInputs = [
libxml2 gnutls perl python2 readline gettext libtasn1 libgcrypt yajl libxml2 gnutls perl python2 readline gettext libtasn1 libgcrypt yajl
libxslt xhtml1 perlPackages.XMLXPath curl libpcap glib libxslt xhtml1 perlPackages.XMLXPath curl libpcap glib dbus
] ++ optionals stdenv.isLinux [ ] ++ optionals stdenv.isLinux [
libpciaccess lvm2 utillinux systemd libnl numad zfs libpciaccess lvm2 utillinux systemd libnl numad zfs
libapparmor libcap_ng numactl attr parted libapparmor libcap_ng numactl attr parted
@@ -74,6 +74,7 @@ in stdenv.mkDerivation rec {
"--with-test" "--with-test"
"--with-esx" "--with-esx"
"--with-remote" "--with-remote"
"--with-polkit"
] ++ optionals stdenv.isLinux [ ] ++ optionals stdenv.isLinux [
"QEMU_BRIDGE_HELPER=/run/wrappers/bin/qemu-bridge-helper" "QEMU_BRIDGE_HELPER=/run/wrappers/bin/qemu-bridge-helper"
"QEMU_PR_HELPER=/run/libvirt/nix-helpers/qemu-pr-helper" "QEMU_PR_HELPER=/run/libvirt/nix-helpers/qemu-pr-helper"