public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

programs.wireshark: use setcap wrapper

Browse Source
This commit is contained in:
Robin Gloster 2017-02-17 13:15:59 +01:00
parent 8f3e6fdd8c
commit 7ec5faa8a4
No known key found for this signature in database
GPG Key ID: 5E4C836C632C2882
2 changed files with 5 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
nixos/modules/misc/ids.nix
View File

@ -288,7 +288,6 @@
kresd = 270; kresd = 270;
rpc = 271; rpc = 271;
geoip = 272; geoip = 272;
#wireshark = 273; # unused
# When adding a uid, make sure it doesn't match an existing gid. And don't use uids above 399! # When adding a uid, make sure it doesn't match an existing gid. And don't use uids above 399!
@ -546,7 +545,6 @@
kresd = 270; kresd = 270;
#rpc = 271; # unused #rpc = 271; # unused
#geoip = 272; # unused #geoip = 272; # unused
wireshark = 273;
# When adding a gid, make sure it doesn't match an existing # When adding a gid, make sure it doesn't match an existing
# uid. Users and groups with the same name should have equal # uid. Users and groups with the same name should have equal

25
nixos/modules/programs/wireshark.nix
View File

@ -3,27 +3,19 @@
with lib; with lib;
let let
cfg = config.programs.wireshark; cfg = config.programs.wireshark;
wireshark = cfg.package; wireshark = cfg.package;
in {
in
{
options = { options = {
programs.wireshark = { programs.wireshark = {
enable = mkOption { enable = mkOption {
type = types.bool; type = types.bool;
default = false; default = false;
description = '' description = ''
Whether to add Wireshark to the global environment and configure a Whether to add Wireshark to the global environment and configure a
setuid wrapper for 'dumpcap' for users in the 'wireshark' group. setcap wrapper for 'dumpcap' for users in the 'wireshark' group.
''; '';
}; };
package = mkOption { package = mkOption {
type = types.package; type = types.package;
default = pkgs.wireshark-cli; default = pkgs.wireshark-cli;
@ -32,26 +24,19 @@ in
Which Wireshark package to install in the global environment. Which Wireshark package to install in the global environment.
''; '';
}; };
}; };
}; };
config = mkIf cfg.enable { config = mkIf cfg.enable {
environment.systemPackages = [ wireshark ]; environment.systemPackages = [ wireshark ];
users.extraGroups.wireshark = {};
security.wrappers.dumpcap = { security.wrappers.dumpcap = {
source = "${wireshark}/bin/dumpcap"; source = "${wireshark}/bin/dumpcap";
capabilities = "cap_net_raw+p";
owner = "root"; owner = "root";
group = "wireshark"; group = "wireshark";
setuid = true;
setgid = false;
permissions = "u+rx,g+x"; permissions = "u+rx,g+x";
}; };
users.extraGroups.wireshark.gid = config.ids.gids.wireshark;
}; };
} }