movefasta/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-06-12 04:35:41 +03:00
Code Issues Projects Releases Packages Wiki Activity

stage-2 init: move /run/keys mount to boot.specialFileSystems

Browse source
This commit is contained in:
Nikolay Amiantov 2016-09-17 13:43:37 +03:00
parent bf5d2bc215
commit 79d4636d50
2 changed files with 4 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

10
nixos/modules/system/boot/stage-2-init.sh
View file

@ -111,16 +111,6 @@ rm -f /etc/{group,passwd,shadow}.lock
rm -rf /nix/var/nix/gcroots/tmp /nix/var/nix/temproots rm -rf /nix/var/nix/gcroots/tmp /nix/var/nix/temproots
# Create a ramfs on /run/keys to hold secrets that shouldn't be
# written to disk (generally used for NixOps, harmless elsewhere).
if ! mountpoint -q /run/keys; then
rm -rf /run/keys
mkdir /run/keys
mount -t ramfs ramfs /run/keys
chown 0:96 /run/keys
chmod 0750 /run/keys
fi
mkdir -m 0755 -p /run/lock mkdir -m 0755 -p /run/lock

5
nixos/modules/tasks/filesystems.nix
View file

@ -18,7 +18,7 @@ let
prioOption = prio: optionalString (prio != null) " pri=${toString prio}"; prioOption = prio: optionalString (prio != null) " pri=${toString prio}";
specialFSTypes = [ "proc" "sysfs" "tmpfs" "devtmpfs" "devpts" ]; specialFSTypes = [ "proc" "sysfs" "tmpfs" "ramfs" "devtmpfs" "devpts" ];
coreFileSystemOpts = { name, config, ... }: { coreFileSystemOpts = { name, config, ... }: {
@ -290,6 +290,9 @@ in
"/dev" = { fsType = "devtmpfs"; options = [ "nosuid" "strictatime" "mode=755" "size=${config.boot.devSize}" ]; }; "/dev" = { fsType = "devtmpfs"; options = [ "nosuid" "strictatime" "mode=755" "size=${config.boot.devSize}" ]; };
"/dev/shm" = { fsType = "tmpfs"; options = [ "nosuid" "nodev" "strictatime" "mode=1777" "size=${config.boot.devShmSize}" ]; }; "/dev/shm" = { fsType = "tmpfs"; options = [ "nosuid" "nodev" "strictatime" "mode=1777" "size=${config.boot.devShmSize}" ]; };
"/dev/pts" = { fsType = "devpts"; options = [ "nosuid" "noexec" "mode=620" "gid=${toString config.ids.gids.tty}" ]; }; "/dev/pts" = { fsType = "devpts"; options = [ "nosuid" "noexec" "mode=620" "gid=${toString config.ids.gids.tty}" ]; };
# To hold secrets that shouldn't be written to disk (generally used for NixOps, harmless elsewhere)
"/run/keys" = { fsType = "ramfs"; options = [ "nosuid" "nodev" "mode=750" "gid=${toString config.ids.gids.keys}" ]; };
} // optionalAttrs (!config.boot.isContainer) { } // optionalAttrs (!config.boot.isContainer) {
# systemd-nspawn populates /sys by itself, and remounting it causes all # systemd-nspawn populates /sys by itself, and remounting it causes all
# kinds of weird issues (most noticeably, waiting for host disk device # kinds of weird issues (most noticeably, waiting for host disk device