public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

systemd-boot: allow setting editor security option (#21853)

Browse Source
This commit is contained in:
Linus Heckemann 2017-01-21 13:24:26 +00:00 committed by Franz Pletz
parent 140d135ee2
commit 98bd722d1d
2 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
View File

@ -28,6 +28,8 @@ def write_loader_conf(generation):
if "@timeout@" != "": if "@timeout@" != "":
f.write("timeout @timeout@\n") f.write("timeout @timeout@\n")
f.write("default nixos-generation-%d\n" % generation) f.write("default nixos-generation-%d\n" % generation)
if not @editor@:
f.write("editor 0");
os.rename("@efiSysMountPoint@/loader/loader.conf.tmp", "@efiSysMountPoint@/loader/loader.conf") os.rename("@efiSysMountPoint@/loader/loader.conf.tmp", "@efiSysMountPoint@/loader/loader.conf")
def copy_from_profile(generation, name, dry_run=False): def copy_from_profile(generation, name, dry_run=False):

16
nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix
View File

@ -20,6 +20,8 @@ let
timeout = if config.boot.loader.timeout != null then config.boot.loader.timeout else ""; timeout = if config.boot.loader.timeout != null then config.boot.loader.timeout else "";
editor = if cfg.editor then "True" else "False";
inherit (efi) efiSysMountPoint canTouchEfiVariables; inherit (efi) efiSysMountPoint canTouchEfiVariables;
}; };
in { in {
@ -36,6 +38,20 @@ in {
description = "Whether to enable the systemd-boot (formerly gummiboot) EFI boot manager"; description = "Whether to enable the systemd-boot (formerly gummiboot) EFI boot manager";
}; };
editor = mkOption {
default = true;
type = types.bool;
description = ''
Whether to allow editing the kernel command-line before
boot. It is recommended to set this to false, as it allows
gaining root access by passing init=/bin/sh as a kernel
parameter. However, it is enabled by default for backwards
compatibility.
''
};
}; };
config = mkIf cfg.enable { config = mkIf cfg.enable {