From a6f410f1448404928f46e2bd8d1b8b42460494bb Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <eelco.dolstra@logicblox.com>
Date: Thu, 1 Mar 2012 20:10:46 +0000
Subject: [PATCH] * Obsolete security.extraSetuidPrograms.

svn path=/nixos/trunk/; revision=32723
---
 modules/rename.nix                   |  2 ++
 modules/security/setuid-wrappers.nix | 24 +++++++++---------------
 2 files changed, 11 insertions(+), 15 deletions(-)

diff --git a/modules/rename.nix b/modules/rename.nix
index 9f1d00dd648..b92e4e06da5 100644
--- a/modules/rename.nix
+++ b/modules/rename.nix
@@ -67,6 +67,8 @@ in zipModules ([]
 # ++ rename alias "services.xserver.slim.theme" "services.xserver.displayManager.slim.theme"
 ++ rename obsolete "environment.extraPackages" "environment.systemPackages"
 
+++ rename obsolete "security.extraSetuidPrograms" "security.setuidPrograms"
+
 # Old Grub-related options.
 ++ rename obsolete "boot.copyKernels" "boot.loader.grub.copyKernels"
 ++ rename obsolete "boot.extraGrubEntries" "boot.loader.grub.extraEntries"
diff --git a/modules/security/setuid-wrappers.nix b/modules/security/setuid-wrappers.nix
index ebd9e1ed537..a81376517eb 100644
--- a/modules/security/setuid-wrappers.nix
+++ b/modules/security/setuid-wrappers.nix
@@ -27,17 +27,11 @@ in
     security.setuidPrograms = mkOption {
       default = [];
       description = ''
-        Only the programs from system path listed here will be made
-        setuid root (through a wrapper program).
-      '';
-    };
-
-    security.extraSetuidPrograms = mkOption {
-      default = [];
-      example = ["fusermount"];
-      description = ''
-        This option lists additional programs that must be made setuid
-        root. Obsolete, use setuidPrograms instead.
+        The Nix store cannot contain setuid/setgid programs directly.
+        For this reason, NixOS can automatically generate wrapper
+        programs that have the necessary privileges.  This option
+        lists the names of programs in the system environment for
+        which setuid root wrappers should be created.
       '';
     };
 
@@ -62,8 +56,9 @@ in
       default = "/var/setuid-wrappers";
       description = ''
         This option defines the path to the setuid wrappers.  It
-        should generally not be overriden. Some packages in nixpkgs rely on
-        wrapperDir == /var/setuid-wrappers
+        should generally not be overriden. Some packages in Nixpkgs
+        expect that <option>wrapperDir</option> is
+        <filename>/var/setuid-wrappers</filename>.
       '';
     };
 
@@ -81,8 +76,7 @@ in
       let
         setuidPrograms =
           (map (x: { program = x; owner = "root"; group = "root"; setuid = true; })
-            (config.security.setuidPrograms ++
-             config.security.extraSetuidPrograms))
+            config.security.setuidPrograms)
           ++ config.security.setuidOwners;
 
         makeSetuidWrapper =