First implementation of subuid/subgid manipulation module

This commit is contained in:
Paul Colomiets 2014-06-26 03:11:28 +03:00
parent fb948c4f28
commit 08b214a8f2

View file

@ -100,6 +100,36 @@ let
description = "The path to the user's shell.";
};
subUidRanges = mkOption {
type = types.listOf types.optionSet;
default = [];
example = [
{ startUid = 1000; count = 1; }
{ startUid = 100001; count = 65534; }
];
options = [ subordinateUidRange ];
description = ''
Subordinate user ids that user is allowed to use.
They are set into <filename>/etc/subuid</filename> and are used
by <literal>newuidmap</literal> for user namespaces.
'';
};
subGidRanges = mkOption {
type = types.listOf types.optionSet;
default = [];
example = [
{ startGid = 100; count = 1; }
{ startGid = 1001; count = 999; }
];
options = [ subordinateGidRange ];
description = ''
Subordinate group ids that user is allowed to use.
They are set into <filename>/etc/subgid</filename> and are used
by <literal>newgidmap</literal> for user namespaces.
'';
};
createHome = mkOption {
type = types.bool;
default = false;
@ -211,6 +241,36 @@ let
};
subordinateUidRange = {
startUid = mkOption {
type = types.int;
description = ''
Start of the range of subordinate user ids that user is
allowed to use.
'';
};
count = mkOption {
type = types.int;
default = 1;
description = ''Count of subordinate user ids'';
};
};
subordinateGidRange = {
startGid = mkOption {
type = types.int;
description = ''
Start of the range of subordinate group ids that user is
allowed to use.
'';
};
count = mkOption {
type = types.int;
default = 1;
description = ''Count of subordinate group ids'';
};
};
getGroup = gname:
let
groups = mapAttrsToList (n: g: g) (
@ -265,6 +325,20 @@ let
))
);
mkSubuidEntry = user: concatStrings (
map (range: "${user.name}:${toString range.startUid}:${toString range.count}\n")
user.subUidRanges);
subuidFile = concatStrings (map mkSubuidEntry (
sortOn "uid" (attrValues cfg.extraUsers)));
mkSubgidEntry = user: concatStrings (
map (range: "${user.name}:${toString range.startGid}:${toString range.count}\n")
user.subGidRanges);
subgidFile = concatStrings (map mkSubgidEntry (
sortOn "uid" (attrValues cfg.extraUsers)));
# If mutableUsers is true, this script adds all users/groups defined in
# users.extra{Users,Groups} to /etc/{passwd,group} iff there isn't any
# existing user/group with the same name in those files.
@ -504,6 +578,15 @@ in {
# for backwards compatibility
system.activationScripts.groups = stringAfter [ "users" ] "";
environment.etc."subuid" = {
text = subuidFile;
mode = "0644";
};
environment.etc."subgid" = {
text = subgidFile;
mode = "0644";
};
assertions = [
{ assertion = !cfg.enforceIdUniqueness || (uidsAreUnique && gidsAreUnique);
message = "uids and gids must be unique!";