movefasta/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-06-09 19:13:26 +03:00
Code Issues Projects Releases Packages Wiki Activity

nixos/wireshark: usbmon permissions

Browse source 
Add an usbmon.enable option (default false) for setting permissions for
capturing USB traffic.
Add a dumpcap.enable option (default true) for setting permissions for
capturing network traffic.
fixes #375657
This commit is contained in:
jan 2025-02-03 21:20:31 +01:00 • committed by Bjørn Forsman
parent d95b40ed10
commit 5deeee393a
1 changed files with 28 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

31
nixos/modules/programs/wireshark.nix
View file

@ -16,13 +16,32 @@ in
type = lib.types.bool;
default = false;
description = ''
Whether to add Wireshark to the global environment and configure a
setcap wrapper for 'dumpcap' for users in the 'wireshark' group.
Whether to add Wireshark to the global environment and create a 'wireshark'
group. To configure what users can capture, set the `dumpcap.enable` and
`usbmon.enable` options. By default, users in the 'wireshark' group are
allowed to capture network traffic but not USB traffic.
'';
};
package = lib.mkPackageOption pkgs "wireshark-cli" {
example = "wireshark";
};
dumpcap.enable = lib.mkOption {
type = lib.types.bool;
default = true;
description = ''
Whether to allow users in the 'wireshark' group to capture network traffic. This
configures a setcap wrapper for 'dumpcap' for users in the 'wireshark' group.
'';
};
usbmon.enable = lib.mkOption {
type = lib.types.bool;
default = false;
description = ''
Whether to allow users in the 'wireshark' group to capture USB traffic. This adds
udev rules to give users in the 'wireshark' group read permissions to all devices
in the usbmon subsystem.
'';
};
};
};
@ -30,12 +49,18 @@ in
environment.systemPackages = [ wireshark ];
users.groups.wireshark = { };
security.wrappers.dumpcap = {
security.wrappers.dumpcap = lib.mkIf cfg.dumpcap.enable {
source = "${wireshark}/bin/dumpcap";
capabilities = "cap_net_raw,cap_net_admin+eip";
owner = "root";
group = "wireshark";
permissions = "u+rx,g+x";
};
services.udev.packages = lib.mkIf cfg.usbmon.enable [
(pkgs.writeTextDir "etc/udev/rules.d/85-wireshark-usbmon.rules" ''
SUBSYSTEM=="usbmon", MODE="0640", GROUP="wireshark"
'')
];
};
}