public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #74084 from WilliButz/systemd-services/use-correct-groups

Browse Source 
dont use nogroup for networkd, resolved and timesyncd
This commit is contained in:
Florian Klink 2019-11-25 20:05:25 +01:00 committed by GitHub
commit e6aba99c54
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 15 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
nixos/modules/system/boot/networkd.nix
View File

@ -924,6 +924,8 @@ in
config = mkIf config.systemd.network.enable { config = mkIf config.systemd.network.enable {
users.users.systemd-network.group = "systemd-network";
systemd.additionalUpstreamSystemUnits = [ systemd.additionalUpstreamSystemUnits = [
"systemd-networkd.service" "systemd-networkd-wait-online.service" "systemd-networkd.service" "systemd-networkd-wait-online.service"
]; ];

2
nixos/modules/system/boot/resolved.nix
View File

@ -136,6 +136,8 @@ in
} }
]; ];
users.users.resolved.group = "systemd-resolve";
systemd.additionalUpstreamSystemUnits = [ systemd.additionalUpstreamSystemUnits = [
"systemd-resolved.service" "systemd-resolved.service"
]; ];

5
nixos/modules/system/boot/timesyncd.nix
View File

@ -50,7 +50,10 @@ with lib;
${config.services.timesyncd.extraConfig} ${config.services.timesyncd.extraConfig}
''; '';
users.users.systemd-timesync.uid = config.ids.uids.systemd-timesync; users.users.systemd-timesync = {
uid = config.ids.uids.systemd-timesync;
group = "systemd-timesync";
};
users.groups.systemd-timesync.gid = config.ids.gids.systemd-timesync; users.groups.systemd-timesync.gid = config.ids.gids.systemd-timesync;
system.activationScripts.systemd-timesyncd-migration = mkIf (versionOlder config.system.stateVersion "19.09") '' system.activationScripts.systemd-timesyncd-migration = mkIf (versionOlder config.system.stateVersion "19.09") ''

11
nixos/tests/systemd-networkd-wireguard.nix
View File

@ -1,4 +1,4 @@
let generateNodeConf = { lib, pkgs, config, privkpath, pubk, peerId, nodeId, ...}: { let generateNodeConf = { lib, pkgs, config, privk, pubk, peerId, nodeId, ...}: {
imports = [ common/user-account.nix ]; imports = [ common/user-account.nix ];
systemd.services.systemd-networkd.environment.SYSTEMD_LOG_LEVEL = "debug"; systemd.services.systemd-networkd.environment.SYSTEMD_LOG_LEVEL = "debug";
networking.useNetworkd = true; networking.useNetworkd = true;
@ -7,13 +7,16 @@ let generateNodeConf = { lib, pkgs, config, privkpath, pubk, peerId, nodeId, ...
virtualisation.vlans = [ 1 ]; virtualisation.vlans = [ 1 ];
environment.systemPackages = with pkgs; [ wireguard-tools ]; environment.systemPackages = with pkgs; [ wireguard-tools ];
boot.extraModulePackages = [ config.boot.kernelPackages.wireguard ]; boot.extraModulePackages = [ config.boot.kernelPackages.wireguard ];
systemd.tmpfiles.rules = [
"f /run/wg_priv 0640 root systemd-network - ${privk}"
];
systemd.network = { systemd.network = {
enable = true; enable = true;
netdevs = { netdevs = {
"90-wg0" = { "90-wg0" = {
netdevConfig = { Kind = "wireguard"; Name = "wg0"; }; netdevConfig = { Kind = "wireguard"; Name = "wg0"; };
wireguardConfig = { wireguardConfig = {
PrivateKeyFile = privkpath ; PrivateKeyFile = "/run/wg_priv";
ListenPort = 51820; ListenPort = 51820;
FwMark = 42; FwMark = 42;
}; };
@ -53,7 +56,7 @@ in import ./make-test-python.nix ({pkgs, ... }: {
nodes = { nodes = {
node1 = { pkgs, ... }@attrs: node1 = { pkgs, ... }@attrs:
let localConf = { let localConf = {
privkpath = pkgs.writeText "priv.key" "GDiXWlMQKb379XthwX0haAbK6hTdjblllpjGX0heP00="; privk = "GDiXWlMQKb379XthwX0haAbK6hTdjblllpjGX0heP00=";
pubk = "iRxpqj42nnY0Qz8MAQbSm7bXxXP5hkPqWYIULmvW+EE="; pubk = "iRxpqj42nnY0Qz8MAQbSm7bXxXP5hkPqWYIULmvW+EE=";
nodeId = "1"; nodeId = "1";
peerId = "2"; peerId = "2";
@ -62,7 +65,7 @@ in import ./make-test-python.nix ({pkgs, ... }: {
node2 = { pkgs, ... }@attrs: node2 = { pkgs, ... }@attrs:
let localConf = { let localConf = {
privkpath = pkgs.writeText "priv.key" "eHxSI2jwX/P4AOI0r8YppPw0+4NZnjOxfbS5mt06K2k="; privk = "eHxSI2jwX/P4AOI0r8YppPw0+4NZnjOxfbS5mt06K2k=";
pubk = "27s0OvaBBdHoJYkH9osZpjpgSOVNw+RaKfboT/Sfq0g="; pubk = "27s0OvaBBdHoJYkH9osZpjpgSOVNw+RaKfboT/Sfq0g=";
nodeId = "2"; nodeId = "2";
peerId = "1"; peerId = "1";