movefasta/nixpkgs
0
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-07-13 13:40:28 +03:00
Code Activity

nixos/kerberos_server: disallow combining "all" with policies != "get-keys"

Browse source
This commit is contained in:
Nessdoor 2025-02-14 19:45:27 +01:00
parent 00a8c125b0
commit f500ae084a
2 changed files with 29 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

11
nixos/modules/services/system/kerberos/default.nix
View file

@ -55,6 +55,17 @@ in
assertion = lib.length (lib.attrNames cfg.settings.realms) <= 1;
message = "Only one realm per server is currently supported.";
}
{
assertion =
let
inherit (builtins) attrValues elem length;
realms = attrValues cfg.settings.realms;
accesses = lib.concatMap (r: map (a: a.access) r.acl) realms;
property = a: !elem "all" a || (length a <= 1) || (length a <= 2 && elem "get-keys" a);
in
builtins.all property accesses;
message = "Cannot specify \"all\" in a list with additional permissions other than \"get-keys\"";
}
];
systemd.slices.system-kerberos-server = { };