movefasta/nixpkgs
0
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-07-14 06:00:33 +03:00
Code Activity

nixos/sudo: Handle root's default rule through extraRules

Browse source 
This makes things more uniform; moreover, users can now inject rules before this.
This commit is contained in:
nicoo 2023-09-07 12:46:04 +00:00
parent 097115485a
commit 93011e31bd
1 changed files with 31 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

37
nixos/modules/security/sudo.nix
View file

@ -182,12 +182,26 @@ in
message = "The NixOS `sudo` module does not work with `sudo-rs` yet."; } message = "The NixOS `sudo` module does not work with `sudo-rs` yet."; }
]; ];
# We `mkOrder 600` so that the default rule shows up first, but there is security.sudo.extraRules =
# still enough room for a user to `mkBefore` it. let
security.sudo.extraRules = mkOrder 600 [ defaultRule = { users ? [], groups ? [], opts ? [] }: [ {
{ groups = [ "wheel" ]; inherit users groups;
commands = [ { command = "ALL"; options = (if cfg.wheelNeedsPassword then [ "SETENV" ] else [ "NOPASSWD" "SETENV" ]); } ]; commands = [ {
} command = "ALL";
options = opts ++ [ "SETENV" ];
} ];
} ];
in mkMerge [
# This is ordered before users' `mkBefore` rules,
# so as not to introduce unexpected changes.
(mkOrder 400 (defaultRule { users = [ "root" ]; }))
# This is ordered to show before (most) other rules, but
# late-enough for a user to `mkBefore` it.
(mkOrder 600 (defaultRule {
groups = [ "wheel" ];
opts = (optional (!cfg.wheelNeedsPassword) "NOPASSWD");
}))
]; ];
security.sudo.configFile = concatStringsSep "\n" (filter (s: s != "") [ security.sudo.configFile = concatStringsSep "\n" (filter (s: s != "") [
@ -195,13 +209,7 @@ in
# Don't edit this file. Set the NixOS options ‘security.sudo.configFile’ # Don't edit this file. Set the NixOS options ‘security.sudo.configFile’
# or ‘security.sudo.extraRules’ instead. # or ‘security.sudo.extraRules’ instead.
'' ''
'' (concatStringsSep "\n" (
# "root" is allowed to do anything.
root ALL=(ALL:ALL) SETENV: ALL
''
(optionalString (cfg.extraRules != []) ''
# extraRules
${concatStringsSep "\n" (
lists.flatten ( lists.flatten (
map ( map (
rule: optionals (length rule.commands != 0) [ rule: optionals (length rule.commands != 0) [
@ -210,8 +218,7 @@ in
] ]
) cfg.extraRules ) cfg.extraRules
) )
)} ) + "\n")
'')
(optionalString (cfg.extraConfig != "") '' (optionalString (cfg.extraConfig != "") ''
# extraConfig # extraConfig
${cfg.extraConfig} ${cfg.extraConfig}