public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

programs.wireshark: use setcap wrapper

Browse Source
This commit is contained in:
Robin Gloster 2017-02-17 13:15:59 +01:00
parent 8f3e6fdd8c
commit 7ec5faa8a4
No known key found for this signature in database
GPG Key ID: 5E4C836C632C2882
2 changed files with 5 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
nixos/modules/misc/ids.nix
View File

@ -288,7 +288,6 @@
kresd = 270;
rpc = 271;
geoip = 272;
#wireshark = 273; # unused
# When adding a uid, make sure it doesn't match an existing gid. And don't use uids above 399!
@ -546,7 +545,6 @@
kresd = 270;
#rpc = 271; # unused
#geoip = 272; # unused
wireshark = 273;
# When adding a gid, make sure it doesn't match an existing
# uid. Users and groups with the same name should have equal

25
nixos/modules/programs/wireshark.nix
View File

@ -3,27 +3,19 @@
with lib;
let
cfg = config.programs.wireshark;
wireshark = cfg.package;
in
{
in {
options = {
programs.wireshark = {
enable = mkOption {
type = types.bool;
default = false;
description = ''
Whether to add Wireshark to the global environment and configure a
setuid wrapper for 'dumpcap' for users in the 'wireshark' group.
setcap wrapper for 'dumpcap' for users in the 'wireshark' group.
'';
};
package = mkOption {
type = types.package;
default = pkgs.wireshark-cli;
@ -32,26 +24,19 @@ in
Which Wireshark package to install in the global environment.
'';
};
};
};
config = mkIf cfg.enable {
environment.systemPackages = [ wireshark ];
users.extraGroups.wireshark = {};
security.wrappers.dumpcap = {
source = "${wireshark}/bin/dumpcap";
capabilities = "cap_net_raw+p";
owner = "root";
group = "wireshark";
setuid = true;
setgid = false;
permissions = "u+rx,g+x";
};
users.extraGroups.wireshark.gid = config.ids.gids.wireshark;
};
}