movefasta/nixpkgs
0
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-07-13 21:50:33 +03:00
Code Activity

nixos/lldap: set service UMask=0027 and StateDirectoryMode=0750

Browse source 
While `/var/lib/lldap` isn't technically accessible by unprivileged
users thanks to `DynamicUser=true`, a user might prefer and change it to
`DynamicUser=false`.

There is currently also a PR open that intends to make `DynamicUser`
configurable via module option.

As such, `jwt_secret_file`, if bootstrapped by the service start
procedure, might be rendered world-readable due to its permissions
(`0644/-rw-r--r--`) defaulting to the service's umask (`022`) and
`/var/lib/lldap` to `0755/drwxr-xr-x` due to `StateDirectoryMode=0755`.

This would usually be fixed by using `(umask 027; openssl ...)` instead
of just `openssl ...`.

However, it was found that another file (`users.db`), this time
bootstrapped by `lldap` itself, also had insufficient permissions
(`0644/-rw-r--r--`) inherited by the global umask and would be left
world-readable as well.

Due to this, we instead change the service's to `027`.

And to lower the impact for already bootstrapped files on existing
instances like `users.db`, set `StateDirectoryMode=0750`.
This commit is contained in:
emilylange 2024-03-10 18:39:43 +01:00 • committed by Bjørn Forsman
parent 7501889950
commit 08c37ba899
1 changed files with 2 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
nixos/modules/services/databases/lldap.nix
View file

@ -123,7 +123,9 @@ in
''; '';
serviceConfig = { serviceConfig = {
StateDirectory = "lldap"; StateDirectory = "lldap";
StateDirectoryMode = "0750";
WorkingDirectory = "%S/lldap"; WorkingDirectory = "%S/lldap";
UMask = "0027";
User = "lldap"; User = "lldap";
Group = "lldap"; Group = "lldap";
DynamicUser = true; DynamicUser = true;