mirror of
https://github.com/NixOS/nixpkgs.git
synced 2025-07-13 21:50:33 +03:00
Merge branch 'master' into staging-next
This commit is contained in:
Artturin
commit
60e9cffe2c
343 changed files with 6416 additions and 3095 deletions
|
|
@ -141,6 +141,10 @@ let
|
|||
magicOrExtension = ''\x00asm'';
|
||||
mask = ''\xff\xff\xff\xff'';
|
||||
};
|
||||
s390x-linux = {
|
||||
magicOrExtension = ''\x7fELF\x02\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x16'';
|
||||
mask = ''\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff'';
|
||||
};
|
||||
x86_64-windows.magicOrExtension = "MZ";
|
||||
i686-windows.magicOrExtension = "MZ";
|
||||
};
|
||||
|
|
|
|||
|
|
@ -5,6 +5,8 @@ let
|
|||
cfg = config.systemd.sysusers;
|
||||
userCfg = config.users;
|
||||
|
||||
systemUsers = lib.filterAttrs (_username: opts: !opts.isNormalUser) userCfg.users;
|
||||
|
||||
sysusersConfig = pkgs.writeTextDir "00-nixos.conf" ''
|
||||
# Type Name ID GECOS Home directory Shell
|
||||
|
||||
|
|
@ -16,7 +18,7 @@ let
|
|||
in
|
||||
''u ${username} ${uid}:${opts.group} "${opts.description}" ${opts.home} ${utils.toShellPath opts.shell}''
|
||||
)
|
||||
userCfg.users)
|
||||
systemUsers)
|
||||
}
|
||||
|
||||
# Groups
|
||||
|
|
@ -30,32 +32,12 @@ let
|
|||
}
|
||||
'';
|
||||
|
||||
staticSysusersCredentials = pkgs.runCommand "static-sysusers-credentials" { } ''
|
||||
mkdir $out; cd $out
|
||||
${lib.concatLines (
|
||||
(lib.mapAttrsToList
|
||||
(username: opts: "echo -n '${opts.initialHashedPassword}' > 'passwd.hashed-password.${username}'")
|
||||
(lib.filterAttrs (_username: opts: opts.initialHashedPassword != null) userCfg.users))
|
||||
++
|
||||
(lib.mapAttrsToList
|
||||
(username: opts: "echo -n '${opts.initialPassword}' > 'passwd.plaintext-password.${username}'")
|
||||
(lib.filterAttrs (_username: opts: opts.initialPassword != null) userCfg.users))
|
||||
++
|
||||
(lib.mapAttrsToList
|
||||
(username: opts: "cat '${opts.hashedPasswordFile}' > 'passwd.hashed-password.${username}'")
|
||||
(lib.filterAttrs (_username: opts: opts.hashedPasswordFile != null) userCfg.users))
|
||||
)
|
||||
}
|
||||
'';
|
||||
|
||||
staticSysusers = pkgs.runCommand "static-sysusers"
|
||||
{
|
||||
nativeBuildInputs = [ pkgs.systemd ];
|
||||
} ''
|
||||
mkdir $out
|
||||
export CREDENTIALS_DIRECTORY=${staticSysusersCredentials}
|
||||
systemd-sysusers --root $out ${sysusersConfig}/00-nixos.conf
|
||||
'';
|
||||
immutableEtc = config.system.etc.overlay.enable && !config.system.etc.overlay.mutable;
|
||||
# The location of the password files when using an immutable /etc.
|
||||
immutablePasswordFilesLocation = "/var/lib/nixos/etc";
|
||||
passwordFilesLocation = if immutableEtc then immutablePasswordFilesLocation else "/etc";
|
||||
# The filenames created by systemd-sysusers.
|
||||
passwordFiles = [ "passwd" "group" "shadow" "gshadow" ];
|
||||
|
||||
in
|
||||
|
||||
|
|
@ -90,95 +72,114 @@ in
|
|||
assertion = config.users.mutableUsers -> config.system.etc.overlay.enable;
|
||||
message = "config.users.mutableUsers requires config.system.etc.overlay.enable.";
|
||||
}
|
||||
];
|
||||
|
||||
systemd = lib.mkMerge [
|
||||
({
|
||||
|
||||
# Create home directories, do not create /var/empty even if that's a user's
|
||||
# home.
|
||||
tmpfiles.settings.home-directories = lib.mapAttrs'
|
||||
(username: opts: lib.nameValuePair opts.home {
|
||||
d = {
|
||||
mode = opts.homeMode;
|
||||
user = username;
|
||||
group = opts.group;
|
||||
};
|
||||
})
|
||||
(lib.filterAttrs (_username: opts: opts.home != "/var/empty") userCfg.users);
|
||||
|
||||
# Create uid/gid marker files for those without an explicit id
|
||||
tmpfiles.settings.nixos-uid = lib.mapAttrs'
|
||||
(username: opts: lib.nameValuePair "/var/lib/nixos/uid/${username}" {
|
||||
f = {
|
||||
user = username;
|
||||
};
|
||||
})
|
||||
(lib.filterAttrs (_username: opts: opts.uid == null) userCfg.users);
|
||||
|
||||
tmpfiles.settings.nixos-gid = lib.mapAttrs'
|
||||
(groupname: opts: lib.nameValuePair "/var/lib/nixos/gid/${groupname}" {
|
||||
f = {
|
||||
group = groupname;
|
||||
};
|
||||
})
|
||||
(lib.filterAttrs (_groupname: opts: opts.gid == null) userCfg.groups);
|
||||
] ++ (lib.mapAttrsToList
|
||||
(_username: opts: {
|
||||
assertion = !opts.isNormalUser;
|
||||
message = "systemd-sysusers doesn't create normal users. You can currently only use it to create system users.";
|
||||
})
|
||||
userCfg.users)
|
||||
++ lib.mapAttrsToList
|
||||
(username: opts: {
|
||||
assertion = (opts.password == opts.initialPassword || opts.password == null) &&
|
||||
(opts.hashedPassword == opts.initialHashedPassword || opts.hashedPassword == null);
|
||||
message = "${username} uses password or hashedPassword. systemd-sysupdate only supports initial passwords. It'll never update your passwords.";
|
||||
})
|
||||
systemUsers;
|
||||
|
||||
(lib.mkIf config.users.mutableUsers {
|
||||
additionalUpstreamSystemUnits = [
|
||||
"systemd-sysusers.service"
|
||||
];
|
||||
systemd = {
|
||||
|
||||
services.systemd-sysusers = {
|
||||
# Enable switch-to-configuration to restart the service.
|
||||
unitConfig.ConditionNeedsUpdate = [ "" ];
|
||||
requiredBy = [ "sysinit-reactivation.target" ];
|
||||
before = [ "sysinit-reactivation.target" ];
|
||||
restartTriggers = [ "${config.environment.etc."sysusers.d".source}" ];
|
||||
|
||||
serviceConfig = {
|
||||
LoadCredential = lib.mapAttrsToList
|
||||
(username: opts: "passwd.hashed-password.${username}:${opts.hashedPasswordFile}")
|
||||
(lib.filterAttrs (_username: opts: opts.hashedPasswordFile != null) userCfg.users);
|
||||
SetCredential = (lib.mapAttrsToList
|
||||
(username: opts: "passwd.hashed-password.${username}:${opts.initialHashedPassword}")
|
||||
(lib.filterAttrs (_username: opts: opts.initialHashedPassword != null) userCfg.users))
|
||||
++
|
||||
(lib.mapAttrsToList
|
||||
(username: opts: "passwd.plaintext-password.${username}:${opts.initialPassword}")
|
||||
(lib.filterAttrs (_username: opts: opts.initialPassword != null) userCfg.users))
|
||||
;
|
||||
# Create home directories, do not create /var/empty even if that's a user's
|
||||
# home.
|
||||
tmpfiles.settings.home-directories = lib.mapAttrs'
|
||||
(username: opts: lib.nameValuePair opts.home {
|
||||
d = {
|
||||
mode = opts.homeMode;
|
||||
user = username;
|
||||
group = opts.group;
|
||||
};
|
||||
})
|
||||
(lib.filterAttrs (_username: opts: opts.home != "/var/empty") systemUsers);
|
||||
|
||||
# Create uid/gid marker files for those without an explicit id
|
||||
tmpfiles.settings.nixos-uid = lib.mapAttrs'
|
||||
(username: opts: lib.nameValuePair "/var/lib/nixos/uid/${username}" {
|
||||
f = {
|
||||
user = username;
|
||||
};
|
||||
})
|
||||
(lib.filterAttrs (_username: opts: opts.uid == null) systemUsers);
|
||||
|
||||
tmpfiles.settings.nixos-gid = lib.mapAttrs'
|
||||
(groupname: opts: lib.nameValuePair "/var/lib/nixos/gid/${groupname}" {
|
||||
f = {
|
||||
group = groupname;
|
||||
};
|
||||
})
|
||||
(lib.filterAttrs (_groupname: opts: opts.gid == null) userCfg.groups);
|
||||
|
||||
additionalUpstreamSystemUnits = [
|
||||
"systemd-sysusers.service"
|
||||
];
|
||||
|
||||
services.systemd-sysusers = {
|
||||
# Enable switch-to-configuration to restart the service.
|
||||
unitConfig.ConditionNeedsUpdate = [ "" ];
|
||||
requiredBy = [ "sysinit-reactivation.target" ];
|
||||
before = [ "sysinit-reactivation.target" ];
|
||||
restartTriggers = [ "${config.environment.etc."sysusers.d".source}" ];
|
||||
|
||||
serviceConfig = {
|
||||
# When we have an immutable /etc we cannot write the files directly
|
||||
# to /etc so we write it to a different directory and symlink them
|
||||
# into /etc.
|
||||
#
|
||||
# We need to explicitly list the config file, otherwise
|
||||
# systemd-sysusers cannot find it when we also pass another flag.
|
||||
ExecStart = lib.mkIf immutableEtc
|
||||
[ "" "${config.systemd.package}/bin/systemd-sysusers --root ${builtins.dirOf immutablePasswordFilesLocation} /etc/sysusers.d/00-nixos.conf" ];
|
||||
|
||||
# Make the source files writable before executing sysusers.
|
||||
ExecStartPre = lib.mkIf (!userCfg.mutableUsers)
|
||||
(lib.map
|
||||
(file: "-${pkgs.util-linux}/bin/umount ${passwordFilesLocation}/${file}")
|
||||
passwordFiles);
|
||||
# Make the source files read-only after sysusers has finished.
|
||||
ExecStartPost = lib.mkIf (!userCfg.mutableUsers)
|
||||
(lib.map
|
||||
(file: "${pkgs.util-linux}/bin/mount --bind -o ro ${passwordFilesLocation}/${file} ${passwordFilesLocation}/${file}")
|
||||
passwordFiles);
|
||||
|
||||
LoadCredential = lib.mapAttrsToList
|
||||
(username: opts: "passwd.hashed-password.${username}:${opts.hashedPasswordFile}")
|
||||
(lib.filterAttrs (_username: opts: opts.hashedPasswordFile != null) systemUsers);
|
||||
SetCredential = (lib.mapAttrsToList
|
||||
(username: opts: "passwd.hashed-password.${username}:${opts.initialHashedPassword}")
|
||||
(lib.filterAttrs (_username: opts: opts.initialHashedPassword != null) systemUsers))
|
||||
++
|
||||
(lib.mapAttrsToList
|
||||
(username: opts: "passwd.plaintext-password.${username}:${opts.initialPassword}")
|
||||
(lib.filterAttrs (_username: opts: opts.initialPassword != null) systemUsers))
|
||||
;
|
||||
};
|
||||
})
|
||||
];
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
environment.etc = lib.mkMerge [
|
||||
(lib.mkIf (!userCfg.mutableUsers) {
|
||||
"passwd" = {
|
||||
source = "${staticSysusers}/etc/passwd";
|
||||
mode = "0644";
|
||||
};
|
||||
"group" = {
|
||||
source = "${staticSysusers}/etc/group";
|
||||
mode = "0644";
|
||||
};
|
||||
"shadow" = {
|
||||
source = "${staticSysusers}/etc/shadow";
|
||||
mode = "0000";
|
||||
};
|
||||
"gshadow" = {
|
||||
source = "${staticSysusers}/etc/gshadow";
|
||||
mode = "0000";
|
||||
};
|
||||
})
|
||||
|
||||
(lib.mkIf userCfg.mutableUsers {
|
||||
({
|
||||
"sysusers.d".source = sysusersConfig;
|
||||
})
|
||||
];
|
||||
|
||||
# Statically create the symlinks to immutablePasswordFilesLocation when
|
||||
# using an immutable /etc because we will not be able to do it at
|
||||
# runtime!
|
||||
(lib.mkIf immutableEtc (lib.listToAttrs (lib.map
|
||||
(file: lib.nameValuePair file {
|
||||
source = "${immutablePasswordFilesLocation}/${file}";
|
||||
mode = "direct-symlink";
|
||||
})
|
||||
passwordFiles)))
|
||||
];
|
||||
};
|
||||
|
||||
meta.maintainers = with lib.maintainers; [ nikstur ];
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue