public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #87576 from xtruder/pkgs/libvirtd/polkit

Browse Source 
libvirtd: polkit integration, security fixes
This commit is contained in:
Jaka Hudoklin 2020-05-13 21:00:51 +07:00 committed by GitHub
commit 9a29fe5808
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 14 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
nixos/modules/virtualisation/libvirtd.nix
View File

@ -7,10 +7,8 @@ let
cfg = config.virtualisation.libvirtd; cfg = config.virtualisation.libvirtd;
vswitch = config.virtualisation.vswitch; vswitch = config.virtualisation.vswitch;
configFile = pkgs.writeText "libvirtd.conf" '' configFile = pkgs.writeText "libvirtd.conf" ''
unix_sock_group = "libvirtd" auth_unix_ro = "polkit"
unix_sock_rw_perms = "0770" auth_unix_rw = "polkit"
auth_unix_ro = "none"
auth_unix_rw = "none"
${cfg.extraConfig} ${cfg.extraConfig}
''; '';
qemuConfigFile = pkgs.writeText "qemu.conf" '' qemuConfigFile = pkgs.writeText "qemu.conf" ''
@ -269,5 +267,14 @@ in {
systemd.sockets.libvirtd .wantedBy = [ "sockets.target" ]; systemd.sockets.libvirtd .wantedBy = [ "sockets.target" ];
systemd.sockets.libvirtd-tcp.wantedBy = [ "sockets.target" ]; systemd.sockets.libvirtd-tcp.wantedBy = [ "sockets.target" ];
security.polkit.extraConfig = ''
polkit.addRule(function(action, subject) {
if (action.id == "org.libvirt.unix.manage" &&
subject.isInGroup("libvirtd")) {
return polkit.Result.YES;
}
});
'';
}; };
} }

5
pkgs/development/libraries/libvirt/default.nix
View File

@ -4,7 +4,7 @@
, iproute, iptables, readline, lvm2, utillinux, systemd, libpciaccess, gettext , iproute, iptables, readline, lvm2, utillinux, systemd, libpciaccess, gettext
, libtasn1, ebtables, libgcrypt, yajl, pmutils, libcap_ng, libapparmor , libtasn1, ebtables, libgcrypt, yajl, pmutils, libcap_ng, libapparmor
, dnsmasq, libnl, libpcap, libxslt, xhtml1, numad, numactl, perlPackages , dnsmasq, libnl, libpcap, libxslt, xhtml1, numad, numactl, perlPackages
, curl, libiconv, gmp, zfs, parted, bridge-utils, dmidecode , curl, libiconv, gmp, zfs, parted, bridge-utils, dmidecode, dbus
, enableXen ? false, xen ? null , enableXen ? false, xen ? null
, enableIscsi ? false, openiscsi , enableIscsi ? false, openiscsi
, enableCeph ? false, ceph , enableCeph ? false, ceph
@ -36,7 +36,7 @@ in stdenv.mkDerivation rec {
nativeBuildInputs = [ makeWrapper pkgconfig docutils ] ++ optionals (!buildFromTarball) [ autoreconfHook ]; nativeBuildInputs = [ makeWrapper pkgconfig docutils ] ++ optionals (!buildFromTarball) [ autoreconfHook ];
buildInputs = [ buildInputs = [
libxml2 gnutls perl python2 readline gettext libtasn1 libgcrypt yajl libxml2 gnutls perl python2 readline gettext libtasn1 libgcrypt yajl
libxslt xhtml1 perlPackages.XMLXPath curl libpcap glib libxslt xhtml1 perlPackages.XMLXPath curl libpcap glib dbus
] ++ optionals stdenv.isLinux [ ] ++ optionals stdenv.isLinux [
libpciaccess lvm2 utillinux systemd libnl numad zfs libpciaccess lvm2 utillinux systemd libnl numad zfs
libapparmor libcap_ng numactl attr parted libapparmor libcap_ng numactl attr parted
@ -74,6 +74,7 @@ in stdenv.mkDerivation rec {
"--with-test" "--with-test"
"--with-esx" "--with-esx"
"--with-remote" "--with-remote"
"--with-polkit"
] ++ optionals stdenv.isLinux [ ] ++ optionals stdenv.isLinux [
"QEMU_BRIDGE_HELPER=/run/wrappers/bin/qemu-bridge-helper" "QEMU_BRIDGE_HELPER=/run/wrappers/bin/qemu-bridge-helper"
"QEMU_PR_HELPER=/run/libvirt/nix-helpers/qemu-pr-helper" "QEMU_PR_HELPER=/run/libvirt/nix-helpers/qemu-pr-helper"