movefasta/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-06-12 04:35:41 +03:00
Code Issues Projects Releases Packages Wiki Activity

nixos/update-users-groups: let hashedPassword take precedence over initialHashedPassword

Browse source 
Without this change, users that have both `initialHashedPassword` and
`hashedPassword` set will have `initialHashedPassword` take precedence,
but only for the first time `/etc/passwd` is generated. After that,
`hashedPassword` takes precedence. This is surprising behavior as it
would generally be expected for `hashedPassword` to win if both are set.

This wouldn't be a noticeable problem (and an assert could just be made
instead) if the users-groups module did not default the
`root.intialHashedPassword` value to `!`, to prevent login by default.
That means that users who set `root.hashedPassword` and use an ephemeral
rootfs (i.e. `/etc/passwd` is created every boot) are not able to log in
to the root account by default, unless they switch to a new generation
during the same boot (i.e. `/etc/passwd` already exists and
`hashedPassword` is used instead of `initialHashedPassword`) or they set
`root.initialHashedPassword = null` (which is unintuitive and seems
redundant).
This commit is contained in:
Lily Foster 2023-01-07 20:42:11 -05:00 • committed by Winter
parent 2b268baced
commit bfa0bff644
1 changed files with 6 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

10
nixos/modules/config/update-users-groups.pl
View file

@ -215,10 +215,12 @@ foreach my $u (@{$spec->{users}}) {
} else { } else {
$u->{uid} = allocUid($name, $u->{isSystemUser}) if !defined $u->{uid}; $u->{uid} = allocUid($name, $u->{isSystemUser}) if !defined $u->{uid};
if (defined $u->{initialPassword}) { if (!defined $u->{hashedPassword}) {
$u->{hashedPassword} = hashPassword($u->{initialPassword}); if (defined $u->{initialPassword}) {
} elsif (defined $u->{initialHashedPassword}) { $u->{hashedPassword} = hashPassword($u->{initialPassword});
$u->{hashedPassword} = $u->{initialHashedPassword}; } elsif (defined $u->{initialHashedPassword}) {
$u->{hashedPassword} = $u->{initialHashedPassword};
}
} }
} }