public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Silly, should just have one activation script

Browse Source
This commit is contained in:
Parnell Springmeyer 2017-01-26 01:03:18 -08:00
parent 48a0c5a3a7
commit 61fe8de40c
No known key found for this signature in database
GPG Key ID: DCCF89258EAD874A
1 changed files with 33 additions and 36 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

69
nixos/modules/security/permissions-wrappers/default.nix
View File

@ -61,37 +61,7 @@ let
''; '';
mkActivationScript = programsToWrap: mkActivationScript = programsToWrap:
lib.stringAfter [ "users" ] ;
''
# Look in the system path and in the default profile for
# programs to be wrapped.
PERMISSIONS_WRAPPER_PATH=${config.system.path}/bin:${config.system.path}/sbin
mkdir -p /run/permissions-wrapper-dirs
permissionsWrapperDir=$(mktemp --directory --tmpdir=/run/permissions-wrapper-dirs permissions-wrappers.XXXXXXXXXX)
chmod a+rx $permissionsWrapperDir
${programsToWrap}
if [ -L ${permissionsWrapperDir} ]; then
# Atomically replace the symlink
# See https://axialcorps.com/2013/07/03/atomically-replacing-files-and-directories/
old=$(readlink ${permissionsWrapperDir})
ln --symbolic --force --no-dereference $permissionsWrapperDir ${permissionsWrapperDir}-tmp
mv --no-target-directory ${permissionsWrapperDir}-tmp ${permissionsWrapperDir}
rm --force --recursive $old
elif [ -d ${permissionsWrapperDir} ]; then
# Compatibility with old state, just remove the folder and symlink
rm -f ${permissionsWrapperDir}/*
# if it happens to be a tmpfs
${pkgs.utillinux}/bin/umount ${permissionsWrapperDir} || true
rm -d ${permissionsWrapperDir}
ln -d --symbolic $permissionsWrapperDir ${permissionsWrapperDir}
else
# For initial setup
ln --symbolic $permissionsWrapperDir ${permissionsWrapperDir}
fi
'';
in in
{ {
@ -184,11 +154,38 @@ in
''; '';
###### setcap activation script ###### setcap activation script
system.activationScripts.setcap = system.activationScripts.permissions-wrappers =
mkActivationScript (lib.concatMapStrings configureSetcapWrapper (builtins.filter isNotNull cfg.setcap)); lib.stringAfter [ "users" ]
''
# Look in the system path and in the default profile for
# programs to be wrapped.
PERMISSIONS_WRAPPER_PATH=${config.system.path}/bin:${config.system.path}/sbin
###### setuid activation script mkdir -p /run/permissions-wrapper-dirs
system.activationScripts.setuid = permissionsWrapperDir=$(mktemp --directory --tmpdir=/run/permissions-wrapper-dirs permissions-wrappers.XXXXXXXXXX)
mkActivationScript (lib.concatMapStrings configureSetuidWrapper (builtins.filter isNotNull cfg.setuid)); chmod a+rx $permissionsWrapperDir
${lib.concatMapStrings configureSetcapWrapper (builtins.filter isNotNull cfg.setcap)}
${lib.concatMapStrings configureSetuidWrapper (builtins.filter isNotNull cfg.setuid)}
if [ -L ${permissionsWrapperDir} ]; then
# Atomically replace the symlink
# See https://axialcorps.com/2013/07/03/atomically-replacing-files-and-directories/
old=$(readlink ${permissionsWrapperDir})
ln --symbolic --force --no-dereference $permissionsWrapperDir ${permissionsWrapperDir}-tmp
mv --no-target-directory ${permissionsWrapperDir}-tmp ${permissionsWrapperDir}
rm --force --recursive $old
elif [ -d ${permissionsWrapperDir} ]; then
# Compatibility with old state, just remove the folder and symlink
rm -f ${permissionsWrapperDir}/*
# if it happens to be a tmpfs
${pkgs.utillinux}/bin/umount ${permissionsWrapperDir} || true
rm -d ${permissionsWrapperDir}
ln -d --symbolic $permissionsWrapperDir ${permissionsWrapperDir}
else
# For initial setup
ln --symbolic $permissionsWrapperDir ${permissionsWrapperDir}
fi
'';
}; };
} }