movefasta/nixpkgs
0
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-07-13 21:50:33 +03:00
Code Activity

nixos/systemd/initrd: Fix emergencyAccess to work with null.

Browse source 
Implementation is now compatible with the option's .type already defined.

This allows us to pass `config.users.users.<user>.hashedPassword` even if this is null (the default).

Before:
true  => access
false => no access
hash  => access via password
null  => eval error

After:
true  => access
false => no access
hash  => access via password
null  => no access
This commit is contained in:
Eduard Bachmakov 2024-08-13 10:56:32 +02:00
parent 5e0ca22929
commit b33bf6b99a
1 changed files with 8 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

11
nixos/modules/system/boot/systemd/initrd.nix
View file

@ -226,8 +226,8 @@ in {
emergencyAccess = mkOption { emergencyAccess = mkOption {
type = with types; oneOf [ bool (nullOr (passwdEntry str)) ]; type = with types; oneOf [ bool (nullOr (passwdEntry str)) ];
description = '' description = ''
Set to true for unauthenticated emergency access, and false for Set to true for unauthenticated emergency access, and false or
no emergency access. null for no emergency access.
Can also be set to a hashed super user password to allow Can also be set to a hashed super user password to allow
authenticated access to the emergency mode. authenticated access to the emergency mode.
@ -429,7 +429,12 @@ in {
# We can use either ! or * to lock the root account in the # We can use either ! or * to lock the root account in the
# console, but some software like OpenSSH won't even allow you # console, but some software like OpenSSH won't even allow you
# to log in with an SSH key if you use ! so we use * instead # to log in with an SSH key if you use ! so we use * instead
"/etc/shadow".text = "root:${if isBool cfg.emergencyAccess then optionalString (!cfg.emergencyAccess) "*" else cfg.emergencyAccess}:::::::"; "/etc/shadow".text = let
ea = cfg.emergencyAccess;
access = ea != null && !(isBool ea && !ea);
passwd = if isString ea then ea else "";
in
"root:${if access then passwd else "*"}:::::::";
"/bin".source = "${initrdBinEnv}/bin"; "/bin".source = "${initrdBinEnv}/bin";
"/sbin".source = "${initrdBinEnv}/bin"; "/sbin".source = "${initrdBinEnv}/bin";