Addressing PR feedback

This commit is contained in:
Parnell Springmeyer 2017-01-28 20:48:03 -08:00
parent 9de070e620
commit e92b8402b0
No known key found for this signature in database
GPG key ID: DCCF89258EAD874A
70 changed files with 320 additions and 510 deletions

View file

@ -202,7 +202,7 @@ following incompatible changes:</para>
<listitem> <listitem>
<para>The directory container setuid wrapper programs, <para>The directory container setuid wrapper programs,
<filename>/var/permissions-wrappers</filename>, <link <filename>/var/setuid-wrappers</filename>, <link
xlink:href="https://github.com/NixOS/nixpkgs/pull/18124">is now xlink:href="https://github.com/NixOS/nixpkgs/pull/18124">is now
updated atomically to prevent failures if the switch to a new updated atomically to prevent failures if the switch to a new
configuration is interrupted.</link></para> configuration is interrupted.</link></para>

View file

@ -15,6 +15,14 @@ has the following highlights: </para>
xlink:href="https://nixos.org/nixpkgs/manual/#sec-overlays-install">Nixpkgs xlink:href="https://nixos.org/nixpkgs/manual/#sec-overlays-install">Nixpkgs
manual</link> for more information.</para> manual</link> for more information.</para>
</listitem> </listitem>
<listitem>
<para>Setting capabilities on programs is now supported with a
<literal>setcap-wrapper</literal> functionality. This
functionality and the <literal>setuid-wrapper</literal> are merged
into a single "wrappers" module.</para>
</listitem>
</itemizedlist> </itemizedlist>
<para>The following new services were added since the last release:</para> <para>The following new services were added since the last release:</para>

View file

@ -168,8 +168,8 @@ in
${cfg.extraInit} ${cfg.extraInit}
# The setuid wrappers override other bin directories. # The setuid/setcap wrappers override other bin directories.
export PATH="${config.security.permissionsWrapperDir}:$PATH" export PATH="${config.security.wrapperDir}:$PATH"
# ~/bin if it exists overrides other bin directories. # ~/bin if it exists overrides other bin directories.
export PATH="$HOME/bin:$PATH" export PATH="$HOME/bin:$PATH"

View file

@ -343,7 +343,7 @@ foreach my $fs (read_file("/proc/self/mountinfo")) {
# Skip special filesystems. # Skip special filesystems.
next if in($mountPoint, "/proc") || in($mountPoint, "/dev") || in($mountPoint, "/sys") || in($mountPoint, "/run") || $mountPoint eq "/var/lib/nfs/rpc_pipefs"; next if in($mountPoint, "/proc") || in($mountPoint, "/dev") || in($mountPoint, "/sys") || in($mountPoint, "/run") || $mountPoint eq "/var/lib/nfs/rpc_pipefs";
next if $mountPoint eq "/var/permissions-wrappers"; next if $mountPoint eq "/run/wrappers";
# Skip the optional fields. # Skip the optional fields.
my $n = 6; $n++ while $fields[$n] ne "-"; $n++; my $n = 6; $n++ while $fields[$n] ne "-"; $n++;

View file

@ -92,14 +92,13 @@ fi
mkdir -m 0755 -p $mountPoint/dev $mountPoint/proc $mountPoint/sys $mountPoint/etc $mountPoint/run $mountPoint/home mkdir -m 0755 -p $mountPoint/dev $mountPoint/proc $mountPoint/sys $mountPoint/etc $mountPoint/run $mountPoint/home
mkdir -m 01777 -p $mountPoint/tmp mkdir -m 01777 -p $mountPoint/tmp
mkdir -m 0755 -p $mountPoint/tmp/root mkdir -m 0755 -p $mountPoint/tmp/root
mkdir -m 0755 -p $mountPoint/var/permissions-wrappers mkdir -m 0755 -p $mountPoint/var
mkdir -m 0700 -p $mountPoint/root mkdir -m 0700 -p $mountPoint/root
mount --rbind /dev $mountPoint/dev mount --rbind /dev $mountPoint/dev
mount --rbind /proc $mountPoint/proc mount --rbind /proc $mountPoint/proc
mount --rbind /sys $mountPoint/sys mount --rbind /sys $mountPoint/sys
mount --rbind / $mountPoint/tmp/root mount --rbind / $mountPoint/tmp/root
mount -t tmpfs -o "mode=0755" none $mountPoint/run mount -t tmpfs -o "mode=0755" none $mountPoint/run
mount -t tmpfs -o "mode=0755" none $mountPoint/var/permissions-wrappers
rm -rf $mountPoint/var/run rm -rf $mountPoint/var/run
ln -s /run $mountPoint/var/run ln -s /run $mountPoint/var/run
for f in /etc/resolv.conf /etc/hosts; do rm -f $mountPoint/$f; [ -f "$f" ] && cp -Lf $f $mountPoint/etc/; done for f in /etc/resolv.conf /etc/hosts; do rm -f $mountPoint/$f; [ -f "$f" ] && cp -Lf $f $mountPoint/etc/; done
@ -260,9 +259,9 @@ chroot $mountPoint /nix/var/nix/profiles/system/activate
# Ask the user to set a root password. # Ask the user to set a root password.
if [ -z "$noRootPasswd" ] && chroot $mountPoint [ -x /var/permissions-wrappers/passwd ] && [ -t 0 ]; then if [ -z "$noRootPasswd" ] && chroot $mountPoint [ -x /run/wrappers/passwd ] && [ -t 0 ]; then
echo "setting root password..." echo "setting root password..."
chroot $mountPoint /var/permissions-wrappers/passwd chroot $mountPoint /run/wrappers/passwd
fi fi

View file

@ -113,7 +113,7 @@
./security/prey.nix ./security/prey.nix
./security/rngd.nix ./security/rngd.nix
./security/rtkit.nix ./security/rtkit.nix
./security/permissions-wrappers ./security/wrappers
./security/sudo.nix ./security/sudo.nix
./services/amqp/activemq/default.nix ./services/amqp/activemq/default.nix
./services/amqp/rabbitmq.nix ./services/amqp/rabbitmq.nix

View file

@ -11,13 +11,6 @@ in
config = mkIf cfg.enable { config = mkIf cfg.enable {
environment.systemPackages = [ pkgs.kbdlight ]; environment.systemPackages = [ pkgs.kbdlight ];
security.setuidPrograms = [ "kbdlight" ];
security.permissionsWrappers.setuid =
[ { program = "kbdlight";
source = "${pkgs.kbdlight.out}/bin/kbdlight";
owner = "root";
group = "root";
setuid = true;
}];
}; };
} }

View file

@ -21,13 +21,6 @@ in
config = mkIf cfg.enable { config = mkIf cfg.enable {
environment.systemPackages = [ pkgs.light ]; environment.systemPackages = [ pkgs.light ];
security.setuidPrograms = [ "light" ];
security.permissionsWrappers.setuid =
[ { program = "light";
source = "${pkgs.light.out}/bin/light";
owner = "root";
group = "root";
setuid = true;
}];
}; };
} }

View file

@ -101,49 +101,9 @@ in
chpasswd = { rootOK = true; }; chpasswd = { rootOK = true; };
}; };
security.setuidPrograms = [
security.permissionsWrappers.setuid = "su" "chfn" "newuidmap" "newgidmap"
[ ] ++ lib.optionals config.users.mutableUsers
{ program = "su"; [ "passwd" "sg" "newgrp" ];
source = "${pkgs.shadow.su}/bin/su";
owner = "root";
group = "root";
setuid = true;
}
{ program = "chfn";
source = "${pkgs.shadow.out}/bin/chfn";
owner = "root";
group = "root";
setuid = true;
}
] ++
(lib.optionals config.users.mutableUsers
map (x: x // { owner = "root";
group = "root";
setuid = true;
})
[
{ program = "passwd";
source = "${pkgs.shadow.out}/bin/passwd";
}
{ program = "sg";
source = "${pkgs.shadow.out}/bin/sg";
}
{ program = "newgrp";
source = "${pkgs.shadow.out}/bin/newgrp";
}
{ program = "newuidmap";
source = "${pkgs.shadow.out}/bin/newuidmap";
}
{ program = "newgidmap";
source = "${pkgs.shadow.out}/bin/newgidmap";
}
]
);
}; };
} }

View file

@ -19,7 +19,7 @@ with lib;
config = mkIf (cfg.confineSUIDApplications) { config = mkIf (cfg.confineSUIDApplications) {
security.apparmor.profiles = [ (pkgs.writeText "ping" '' security.apparmor.profiles = [ (pkgs.writeText "ping" ''
#include <tunables/global> #include <tunables/global>
/var/permissions-wrappers/ping { /run/wrappers/ping {
#include <abstractions/base> #include <abstractions/base>
#include <abstractions/consoles> #include <abstractions/consoles>
#include <abstractions/nameservice> #include <abstractions/nameservice>
@ -33,7 +33,7 @@ with lib;
${pkgs.attr.out}/lib/libattr.so* mr, ${pkgs.attr.out}/lib/libattr.so* mr,
${pkgs.iputils}/bin/ping mixr, ${pkgs.iputils}/bin/ping mixr,
/var/permissions-wrappers/ping.real r, /run/wrappers/ping.real r,
#/etc/modules.conf r, #/etc/modules.conf r,

View file

@ -27,10 +27,6 @@ in
config = mkIf cfg.enable { config = mkIf cfg.enable {
environment.systemPackages = [ sandbox ]; environment.systemPackages = [ sandbox ];
security.permissionsWrappers.setuid = [ security.setuidPrograms = [ sandbox.passthru.sandboxExecutableName ];
{ program = sandbox.passthru.sandboxExecutableName;
source = "${sandbox}/bin/${sandbox.passthru.sandboxExecutableName}";
}
];
}; };
} }

View file

@ -188,16 +188,7 @@ in
environment.systemPackages = [ pkgs.duo-unix ]; environment.systemPackages = [ pkgs.duo-unix ];
security.permissionsWrappers.setuid = security.setuidPrograms = [ "login_duo" ];
[
{ program = "login_duo";
source = "${pkgs.duo-unix.out}/bin/login_duo";
owner = "root";
group = "root";
setuid = true;
}
];
environment.etc = loginCfgFile ++ pamCfgFile; environment.etc = loginCfgFile ++ pamCfgFile;
/* If PAM *and* SSH are enabled, then don't do anything special. /* If PAM *and* SSH are enabled, then don't do anything special.

View file

@ -472,33 +472,14 @@ in
++ optionals config.security.pam.enableU2F [ pkgs.pam_u2f ] ++ optionals config.security.pam.enableU2F [ pkgs.pam_u2f ]
++ optionals config.security.pam.enableEcryptfs [ pkgs.ecryptfs ]; ++ optionals config.security.pam.enableEcryptfs [ pkgs.ecryptfs ];
security.permissionsWrappers.setuid = security.setuidPrograms =
[ optionals config.security.pam.enableEcryptfs [ "mount.ecryptfs_private" "umount.ecryptfs_private" ];
{ program = "unix_chkpwd";
source = "${pkgs.pam}/sbin/unix_chkpwd.orig";
owner = "root";
group = "root";
setuid = true;
}
security.wrappers.unix_chkpwd = {
source = "${pkgs.pam}/sbin/unix_chkpwd.orig";
] ++ (optional config.security.pam.enableEcryptfs owner = "root";
{ program = "umount.ecryptfs_private"; setuid = true;
source = "${pkgs.ecryptfs.out}/bin/umount.ecryptfs_private"; };
owner = "root";
group = "root";
setuid = true;
}
) ++ (optional config.security.pam.enableEcryptfs
{ program = "mount.ecryptfs_private";
source = "${pkgs.ecryptfs.out}/bin/mount.ecryptfs_private";
owner = "root";
group = "root";
setuid = true;
}
);
environment.etc = environment.etc =
mapAttrsToList (n: v: makePAMService v) config.security.pam.services; mapAttrsToList (n: v: makePAMService v) config.security.pam.services;

View file

@ -33,22 +33,7 @@ in
config = mkIf (cfg.enable || anyUsbAuth) { config = mkIf (cfg.enable || anyUsbAuth) {
# Make sure pmount and pumount are setuid wrapped. # Make sure pmount and pumount are setuid wrapped.
security.permissionsWrappers.setuid = security.setuidPrograms = [ "pmount" "pumount" ];
[
{ program = "pmount";
source = "${pkgs.pmount.out}/bin/pmount";
owner = "root";
group = "root";
setuid = true;
}
{ program = "pumount";
source = "${pkgs.pmount.out}/bin/pumount";
owner = "root";
group = "root";
setuid = true;
}
];
environment.systemPackages = [ pkgs.pmount ]; environment.systemPackages = [ pkgs.pmount ];

View file

@ -1,191 +0,0 @@
{ config, lib, pkgs, ... }:
let
inherit (config.security) run-permissionsWrapperDir permissionsWrapperDir;
isNotNull = v: if v != null then true else false;
cfg = config.security.permissionsWrappers;
setcapWrappers = import ./setcap-wrapper-drv.nix {
inherit config lib pkgs;
};
setuidWrappers = import ./setuid-wrapper-drv.nix {
inherit config lib pkgs;
};
###### Activation script for the setcap wrappers
configureSetcapWrapper =
{ program
, capabilities
, source ? null
, owner ? "nobody"
, group ? "nogroup"
}: ''
cp ${setcapWrappers}/bin/${program}.wrapper $permissionsWrapperDir/${program}
# Prevent races
chmod 0000 $permissionsWrapperDir/${program}
chown ${owner}.${group} $permissionsWrapperDir/${program}
# Set desired capabilities on the file plus cap_setpcap so
# the wrapper program can elevate the capabilities set on
# its file into the Ambient set.
#
# Only set the capabilities though if we're being told to
# do so.
${pkgs.libcap.out}/bin/setcap "cap_setpcap,${capabilities}" $permissionsWrapperDir/${program}
# Set the executable bit
chmod u+rx,g+x,o+x $permissionsWrapperDir/${program}
'';
###### Activation script for the setuid wrappers
configureSetuidWrapper =
{ program
, source ? null
, owner ? "nobody"
, group ? "nogroup"
, setuid ? false
, setgid ? false
, permissions ? "u+rx,g+x,o+x"
}: ''
cp ${setuidWrappers}/bin/${program}.wrapper $permissionsWrapperDir/${program}
# Prevent races
chmod 0000 $permissionsWrapperDir/${program}
chown ${owner}.${group} $permissionsWrapperDir/${program}
chmod "u${if setuid then "+" else "-"}s,g${if setgid then "+" else "-"}s,${permissions}" $permissionsWrapperDir/${program}
'';
in
{
###### interface
options = {
security.permissionsWrappers.setcap = lib.mkOption {
type = lib.types.listOf lib.types.attrs;
default = [];
example =
[ { program = "ping";
source = "${pkgs.iputils.out}/bin/ping";
owner = "nobody";
group = "nogroup";
capabilities = "cap_net_raw+ep";
}
];
description = ''
This option sets capabilities on a wrapper program that
propagates those capabilities down to the wrapped, real
program.
The `program` attribute is the name of the program to be
wrapped. If no `source` attribute is provided, specifying the
absolute path to the program, then the program will be
searched for in the path environment variable.
NOTE: cap_setpcap, which is required for the wrapper program
to be able to raise caps into the Ambient set is NOT raised to
the Ambient set so that the real program cannot modify its own
capabilities!! This may be too restrictive for cases in which
the real program needs cap_setpcap but it at least leans on
the side security paranoid vs. too relaxed.
'';
};
security.permissionsWrappers.setuid = lib.mkOption {
type = lib.types.listOf lib.types.attrs;
default = [];
example =
[ { program = "sendmail";
source = "/nix/store/.../bin/sendmail";
owner = "nobody";
group = "postdrop";
setuid = false;
setgid = true;
permissions = "u+rx,g+x,o+x";
}
];
description = ''
This option allows the ownership and permissions on the setuid
wrappers for specific programs to be overridden from the
default (setuid root, but not setgid root).
'';
};
security.permissionsWrapperDir = lib.mkOption {
type = lib.types.path;
default = "/var/permissions-wrappers";
internal = true;
description = ''
This option defines the path to the permissions wrappers. It
should not be overriden.
'';
};
security.run-permissionsWrapperDir = lib.mkOption {
type = lib.types.path;
default = "/run/permissions-wrapper-dirs";
internal = true;
description = ''
This option defines the run path to the permissions
wrappers. It should not be overriden.
'';
};
};
###### implementation
config = {
# Make sure our setcap-wrapper dir exports to the PATH env
# variable when initializing the shell
environment.extraInit = ''
# The permissions wrappers override other bin directories.
export PATH="${permissionsWrapperDir}:$PATH"
'';
system.activationScripts.wrapper-dir = ''
mkdir -p "${permissionsWrapperDir}"
'';
###### setcap activation script
system.activationScripts.permissions-wrappers =
lib.stringAfter [ "users" ]
''
# Look in the system path and in the default profile for
# programs to be wrapped.
PERMISSIONS_WRAPPER_PATH=${config.system.path}/bin:${config.system.path}/sbin
mkdir -p ${run-permissionsWrapperDir}
permissionsWrapperDir=$(mktemp --directory --tmpdir=${run-permissionsWrapperDir} permissions-wrappers.XXXXXXXXXX)
chmod a+rx $permissionsWrapperDir
${lib.concatMapStrings configureSetcapWrapper (builtins.filter isNotNull cfg.setcap)}
${lib.concatMapStrings configureSetuidWrapper (builtins.filter isNotNull cfg.setuid)}
if [ -L ${permissionsWrapperDir} ]; then
# Atomically replace the symlink
# See https://axialcorps.com/2013/07/03/atomically-replacing-files-and-directories/
old=$(readlink ${permissionsWrapperDir})
ln --symbolic --force --no-dereference $permissionsWrapperDir ${permissionsWrapperDir}-tmp
mv --no-target-directory ${permissionsWrapperDir}-tmp ${permissionsWrapperDir}
rm --force --recursive $old
elif [ -d ${permissionsWrapperDir} ]; then
# Compatibility with old state, just remove the folder and symlink
rm -f ${permissionsWrapperDir}/*
# if it happens to be a tmpfs
${pkgs.utillinux}/bin/umount ${permissionsWrapperDir} || true
rm -d ${permissionsWrapperDir}
ln -d --symbolic $permissionsWrapperDir ${permissionsWrapperDir}
else
# For initial setup
ln --symbolic $permissionsWrapperDir ${permissionsWrapperDir}
fi
'';
};
}

View file

@ -83,22 +83,8 @@ in
security.pam.services.polkit-1 = {}; security.pam.services.polkit-1 = {};
security.permissionsWrappers.setuid = security.setuidPrograms = [ "pkexec" ];
[ security.wrappers."polkit-agent-helper-1".source = "${pkgs.polkit.out}/lib/polkit-1/polkit-agent-helper-1";
{ program = "pkexec";
source = "${pkgs.polkit.out}/bin/pkexec";
owner = "root";
group = "root";
setuid = true;
}
{ program = "polkit-agent-helper-1";
owner = "root";
group = "root";
setuid = true;
source = "${pkgs.polkit.out}/lib/polkit-1/polkit-agent-helper-1";
}
];
system.activationScripts.polkit = system.activationScripts.polkit =
'' ''

View file

@ -81,22 +81,7 @@ in
${cfg.extraConfig} ${cfg.extraConfig}
''; '';
security.permissionsWrappers.setuid = security.setuidPrograms = [ "sudo" "sudoedit" ];
[
{ program = "sudo";
source = "${pkgs.sudo.out}/bin/sudo";
owner = "root";
group = "root";
setuid = true;
}
{ program = "sudoedit";
source = "${pkgs.sudo.out}/bin/sudoedit";
owner = "root";
group = "root";
setuid = true;
}
];
environment.systemPackages = [ sudo ]; environment.systemPackages = [ sudo ];

View file

@ -0,0 +1,191 @@
{ config, lib, pkgs, ... }:
let
inherit (config.security) wrapperDir;
isNotNull = v: if v != null || v != "" then true else false;
cfg = config.security.wrappers;
setcapWrappers = import ./setcap-wrapper-drv.nix {
inherit config lib pkgs;
};
setuidWrappers = import ./setuid-wrapper-drv.nix {
inherit config lib pkgs;
};
###### Activation script for the setcap wrappers
mkSetcapProgram =
{ program
, capabilities
, source ? null
, owner ? "nobody"
, group ? "nogroup"
...
}: ''
cp ${setcapWrappers}/bin/${program}.wrapper $wrapperDir/${program}
# Prevent races
chmod 0000 $wrapperDir/${program}
chown ${owner}.${group} $wrapperDir/${program}
# Set desired capabilities on the file plus cap_setpcap so
# the wrapper program can elevate the capabilities set on
# its file into the Ambient set.
#
# Only set the capabilities though if we're being told to
# do so.
${pkgs.libcap.out}/bin/setcap "cap_setpcap,${capabilities}" $wrapperDir/${program}
# Set the executable bit
chmod u+rx,g+x,o+x $wrapperDir/${program}
'';
###### Activation script for the setuid wrappers
mkSetuidProgram =
{ program
, source ? null
, owner ? "nobody"
, group ? "nogroup"
, setuid ? false
, setgid ? false
, permissions ? "u+rx,g+x,o+x"
...
}: ''
cp ${setuidWrappers}/bin/${program}.wrapper $wrapperDir/${program}
# Prevent races
chmod 0000 $wrapperDir/${program}
chown ${owner}.${group} $wrapperDir/${program}
chmod "u${if setuid then "+" else "-"}s,g${if setgid then "+" else "-"}s,${permissions}" $wrapperDir/${program}
'';
in
{
###### interface
options = {
security.wrappers.setcap = lib.mkOption {
type = lib.types.listOf lib.types.attrs;
default = [];
example =
[ { program = "ping";
source = "${pkgs.iputils.out}/bin/ping";
owner = "nobody";
group = "nogroup";
capabilities = "cap_net_raw+ep";
}
];
description = ''
This option sets capabilities on a wrapper program that
propagates those capabilities down to the wrapped, real
program.
The <literal>program</literal> attribute is the name of the
program to be wrapped. If no <literal>source</literal>
attribute is provided, specifying the absolute path to the
program, then the program will be searched for in the path
environment variable.
NOTE: cap_setpcap, which is required for the wrapper program
to be able to raise caps into the Ambient set is NOT raised to
the Ambient set so that the real program cannot modify its own
capabilities!! This may be too restrictive for cases in which
the real program needs cap_setpcap but it at least leans on
the side security paranoid vs. too relaxed.
'';
};
security.setuidPrograms = mkOption {
type = types.listOf types.str;
default = [];
example = ["passwd"];
description = ''
The Nix store cannot contain setuid/setgid programs directly.
For this reason, NixOS can automatically generate wrapper
programs that have the necessary privileges. This option
lists the names of programs in the system environment for
which setuid root wrappers should be created.
'';
};
security.wrappers = lib.mkOption {
type = lib.types.attrs;
default = {};
example = {
sendmail.source = "/nix/store/.../bin/sendmail";
};
description = ''
This option allows the ownership and permissions on the setuid
wrappers for specific programs to be overridden from the
default (setuid root, but not setgid root).
'';
};
security.old-wrapperDir = lib.mkOption {
type = lib.types.path;
default = "/var/setuid-wrappers";
internal = true;
description = ''
This option defines the path to the wrapper programs. It
should not be overriden.
'';
};
security.wrapperDir = lib.mkOption {
type = lib.types.path;
default = "/run/wrappers";
internal = true;
description = ''
This option defines the path to the wrapper programs. It
should not be overriden.
'';
};
};
###### implementation
config = {
# Make sure our setcap-wrapper dir exports to the PATH env
# variable when initializing the shell
environment.extraInit = ''
# The permissions wrappers override other bin directories.
export PATH="${wrapperDir}:$PATH"
'';
###### setcap activation script
system.activationScripts.wrappers =
let
programs =
(map (x: { program = x; owner = "root"; group = "root"; setuid = true; })
config.security.setuidPrograms)
++ lib.mapAttrsToList
(n: v: (if v ? "program" then v else v // {program=n;}))
cfg.wrappers;
wrapperPrograms =
builtins.map
(s: if (s ? "setuid" && s.setuid == true) ||
(s ? "setguid" && s.setguid == true) ||
(s ? "permissions")
then mkSetuidProgram s
else if (s ? "capabilities")
then mkSetcapProgram s
else ""
) programs;
in lib.stringAfter [ "users" ]
''
# Look in the system path and in the default profile for
# programs to be wrapped.
WRAPPER_PATH=${config.system.path}/bin:${config.system.path}/sbin
mkdir -p ${wrapperDir}
wrapperDir=$(mktemp --directory --tmpdir=${wrapperDir} wrappers.XXXXXXXXXX)
chmod a+rx $wrapperDir
${lib.concatStringsSep "\n" (builtins.filter isNotNull cfg.wrappers)}
'';
};
}

View file

@ -1,7 +1,7 @@
{ config, lib, pkgs, ... }: { config, lib, pkgs, ... }:
let let
cfg = config.security.permissionsWrappers; cfg = config.security.wrappers;
# Produce a shell-code splice intended to be stitched into one of # Produce a shell-code splice intended to be stitched into one of
# the build or install phases within the derivation. # the build or install phases within the derivation.
@ -12,7 +12,7 @@ let
source=/nix/var/nix/profiles/default/bin/${program} source=/nix/var/nix/profiles/default/bin/${program}
fi fi
gcc -Wall -O2 -DWRAPPER_SETCAP=1 -DSOURCE_PROG=\"$source\" -DWRAPPER_DIR=\"${config.security.run-permissionsWrapperDir}\" \ gcc -Wall -O2 -DWRAPPER_SETCAP=1 -DSOURCE_PROG=\"$source\" -DWRAPPER_DIR=\"${config.security.run-wrapperDir}\" \
-lcap-ng -lcap ${./permissions-wrapper.c} -o $out/bin/${program}.wrapper -L ${pkgs.libcap.lib}/lib -L ${pkgs.libcap_ng}/lib \ -lcap-ng -lcap ${./permissions-wrapper.c} -o $out/bin/${program}.wrapper -L ${pkgs.libcap.lib}/lib -L ${pkgs.libcap_ng}/lib \
-I ${pkgs.libcap.dev}/include -I ${pkgs.libcap_ng}/include -I ${pkgs.linuxHeaders}/include -I ${pkgs.libcap.dev}/include -I ${pkgs.libcap_ng}/include -I ${pkgs.linuxHeaders}/include
''; '';

View file

@ -1,18 +1,18 @@
{ config, lib, pkgs, ... }: { config, lib, pkgs, ... }:
let let
cfg = config.security.permissionsWrappers; cfg = config.security.wrappers;
# Produce a shell-code splice intended to be stitched into one of # Produce a shell-code splice intended to be stitched into one of
# the build or install phases within the derivation. # the build or install phases within the derivation.
mkSetuidWrapper = { program, source ? null, ...}: '' mkSetuidWrapper = { program, source ? null, ...}: ''
if ! source=${if source != null then source else "$(readlink -f $(PATH=$PERMISSIONS_WRAPPER_PATH type -tP ${program}))"}; then if ! source=${if source != null then source else "$(readlink -f $(PATH=$WRAPPER_PATH type -tP ${program}))"}; then
# If we can't find the program, fall back to the # If we can't find the program, fall back to the
# system profile. # system profile.
source=/nix/var/nix/profiles/default/bin/${program} source=/nix/var/nix/profiles/default/bin/${program}
fi fi
gcc -Wall -O2 -DWRAPPER_SETUID=1 -DSOURCE_PROG=\"$source\" -DWRAPPER_DIR=\"${config.security.run-permissionsWrapperDir}\" \ gcc -Wall -O2 -DWRAPPER_SETUID=1 -DSOURCE_PROG=\"$source\" -DWRAPPER_DIR=\"${config.security.run-wrapperDir}\" \
-lcap-ng -lcap ${./permissions-wrapper.c} -o $out/bin/${program}.wrapper -L ${pkgs.libcap.lib}/lib -L ${pkgs.libcap_ng}/lib \ -lcap-ng -lcap ${./permissions-wrapper.c} -o $out/bin/${program}.wrapper -L ${pkgs.libcap.lib}/lib -L ${pkgs.libcap_ng}/lib \
-I ${pkgs.libcap.dev}/include -I ${pkgs.libcap_ng}/include -I ${pkgs.linuxHeaders}/include -I ${pkgs.libcap.dev}/include -I ${pkgs.libcap_ng}/include -I ${pkgs.linuxHeaders}/include
''; '';

View file

@ -29,8 +29,8 @@ let
}; };
cronJob = '' cronJob = ''
@reboot logcheck env PATH=/var/permissions-wrappers:$PATH nice -n10 ${pkgs.logcheck}/sbin/logcheck -R ${flags} @reboot logcheck env PATH=/run/wrappers:$PATH nice -n10 ${pkgs.logcheck}/sbin/logcheck -R ${flags}
2 ${cfg.timeOfDay} * * * logcheck env PATH=/var/permissions-wrappers:$PATH nice -n10 ${pkgs.logcheck}/sbin/logcheck ${flags} 2 ${cfg.timeOfDay} * * * logcheck env PATH=/run/wrappers:$PATH nice -n10 ${pkgs.logcheck}/sbin/logcheck ${flags}
''; '';
writeIgnoreRule = name: {level, regex, ...}: writeIgnoreRule = name: {level, regex, ...}:

View file

@ -13,7 +13,7 @@ let
'' ''
base_dir = ${baseDir} base_dir = ${baseDir}
protocols = ${concatStringsSep " " cfg.protocols} protocols = ${concatStringsSep " " cfg.protocols}
sendmail_path = /var/permissions-wrappers/sendmail sendmail_path = /run/wrappers/sendmail
'' ''
(if isNull cfg.sslServerCert then '' (if isNull cfg.sslServerCert then ''

View file

@ -70,7 +70,7 @@ in
etc."exim.conf".text = '' etc."exim.conf".text = ''
exim_user = ${cfg.user} exim_user = ${cfg.user}
exim_group = ${cfg.group} exim_group = ${cfg.group}
exim_path = /var/permissions-wrappers/exim exim_path = /run/wrappers/exim
spool_directory = ${cfg.spoolDir} spool_directory = ${cfg.spoolDir}
${cfg.config} ${cfg.config}
''; '';
@ -89,15 +89,7 @@ in
gid = config.ids.gids.exim; gid = config.ids.gids.exim;
}; };
security.permissionsWrappers.setuid = security.setuidPrograms = [ "exim" ];
[
{ program = "exim";
source = "${pkgs.exim.out}/bin/exim";
owner = "root";
group = "root";
setuid = true;
}
];
systemd.services.exim = { systemd.services.exim = {
description = "Exim Mail Daemon"; description = "Exim Mail Daemon";

View file

@ -26,7 +26,7 @@ with lib;
config = mkIf (config.services.mail.sendmailSetuidWrapper != null) { config = mkIf (config.services.mail.sendmailSetuidWrapper != null) {
security.permissionsWrappers.setuid = [ config.services.mail.sendmailSetuidWrapper ]; security.wrappers.setuid = [ config.services.mail.sendmailSetuidWrapper ];
}; };

View file

@ -34,7 +34,7 @@ let
cap=$(sed -nr 's/.*#%#\s+capabilities\s*=\s*(.+)/\1/p' $file) cap=$(sed -nr 's/.*#%#\s+capabilities\s*=\s*(.+)/\1/p' $file)
wrapProgram $file \ wrapProgram $file \
--set PATH "/var/permissions-wrappers:/run/current-system/sw/bin:/run/current-system/sw/bin" \ --set PATH "/run/wrappers:/run/current-system/sw/bin:/run/current-system/sw/bin" \
--set MUNIN_LIBDIR "${pkgs.munin}/lib" \ --set MUNIN_LIBDIR "${pkgs.munin}/lib" \
--set MUNIN_PLUGSTATE "/var/run/munin" --set MUNIN_PLUGSTATE "/var/run/munin"
@ -183,7 +183,7 @@ in
mkdir -p /etc/munin/plugins mkdir -p /etc/munin/plugins
rm -rf /etc/munin/plugins/* rm -rf /etc/munin/plugins/*
PATH="/var/permissions-wrappers:/run/current-system/sw/bin:/run/current-system/sw/bin" ${pkgs.munin}/sbin/munin-node-configure --shell --families contrib,auto,manual --config ${nodeConf} --libdir=${muninPlugins} --servicedir=/etc/munin/plugins 2>/dev/null | ${pkgs.bash}/bin/bash PATH="/run/wrappers:/run/current-system/sw/bin:/run/current-system/sw/bin" ${pkgs.munin}/sbin/munin-node-configure --shell --families contrib,auto,manual --config ${nodeConf} --libdir=${muninPlugins} --servicedir=/etc/munin/plugins 2>/dev/null | ${pkgs.bash}/bin/bash
''; '';
serviceConfig = { serviceConfig = {
ExecStart = "${pkgs.munin}/sbin/munin-node --config ${nodeConf} --servicedir /etc/munin/plugins/"; ExecStart = "${pkgs.munin}/sbin/munin-node --config ${nodeConf} --servicedir /etc/munin/plugins/";

View file

@ -124,7 +124,7 @@ in
}; };
mailer = mkOption { mailer = mkOption {
default = "/var/permissions-wrappers/sendmail"; default = "/run/wrappers/sendmail";
type = types.path; type = types.path;
description = '' description = ''
Sendmail-compatible binary to be used to send the messages. Sendmail-compatible binary to be used to send the messages.

View file

@ -30,7 +30,7 @@ let
'' ''
[ global ] [ global ]
security = ${cfg.securityType} security = ${cfg.securityType}
passwd program = /var/permissions-wrappers/passwd %u passwd program = /run/wrappers/passwd %u
pam password change = ${smbToString cfg.syncPasswordsByPam} pam password change = ${smbToString cfg.syncPasswordsByPam}
invalid users = ${smbToString cfg.invalidUsers} invalid users = ${smbToString cfg.invalidUsers}

View file

@ -141,7 +141,7 @@ in
setgid = false; setgid = false;
}; };
security.permissionsWrappers.setuid = [ cfg.setuidWrapper ]; security.wrappers.setuid = [ cfg.setuidWrapper ];
systemd.services.gale-galed = { systemd.services.gale-galed = {
description = "Gale messaging daemon"; description = "Gale messaging daemon";

View file

@ -18,7 +18,7 @@ let
var_prefix = "${stateDir}" var_prefix = "${stateDir}"
prayer_user = "${prayerUser}" prayer_user = "${prayerUser}"
prayer_group = "${prayerGroup}" prayer_group = "${prayerGroup}"
sendmail_path = "/var/permissions-wrappers/sendmail" sendmail_path = "/run/wrappers/sendmail"
use_http_port ${cfg.port} use_http_port ${cfg.port}

View file

@ -219,14 +219,14 @@ in
type = types.string; type = types.string;
default = '' default = ''
+ FPing + FPing
binary = ${config.security.permissionsWrapperDir}/fping binary = ${config.security.wrapperDir}/fping
''; '';
description = "Probe configuration"; description = "Probe configuration";
}; };
sendmail = mkOption { sendmail = mkOption {
type = types.nullOr types.path; type = types.nullOr types.path;
default = null; default = null;
example = "/var/permissions-wrappers/sendmail"; example = "/run/wrappers/sendmail";
description = "Use this sendmail compatible script to deliver alerts"; description = "Use this sendmail compatible script to deliver alerts";
}; };
smokeMailTemplate = mkOption { smokeMailTemplate = mkOption {
@ -273,21 +273,7 @@ in
message = "services.smokeping: sendmail and Mailhost cannot both be enabled."; message = "services.smokeping: sendmail and Mailhost cannot both be enabled.";
} }
]; ];
security.permissionsWrappers.setuid = [ security.setuidPrograms = [ "fping" "fping6" ];
{ program = "fping";
source = "${pkgs.fping}/bin/fping";
owner = "root";
group = "root";
setuid = true;
}
{ program = "fping";
source = "${pkgs.fping}/bin/fping6";
owner = "root";
group = "root";
setuid = true;
}
];
environment.systemPackages = [ pkgs.fping ]; environment.systemPackages = [ pkgs.fping ];
users.extraUsers = singleton { users.extraUsers = singleton {
name = cfg.user; name = cfg.user;

View file

@ -42,7 +42,7 @@ in
config = mkIf cfg.enable { config = mkIf cfg.enable {
security.permissionsWrappers.setuid = map (program: { security.wrappers.setuid = map (program: {
inherit program; inherit program;
source = "${pkgs.atd}/bin/${program}"; source = "${pkgs.atd}/bin/${program}";

View file

@ -20,7 +20,7 @@ let
cronNixosPkg = pkgs.cron.override { cronNixosPkg = pkgs.cron.override {
# The mail.nix nixos module, if there is any local mail system enabled, # The mail.nix nixos module, if there is any local mail system enabled,
# should have sendmail in this path. # should have sendmail in this path.
sendmailPath = "/var/permissions-wrappers/sendmail"; sendmailPath = "/run/wrappers/sendmail";
}; };
allFiles = allFiles =
@ -61,7 +61,7 @@ in
A list of Cron jobs to be appended to the system-wide A list of Cron jobs to be appended to the system-wide
crontab. See the manual page for crontab for the expected crontab. See the manual page for crontab for the expected
format. If you want to get the results mailed you must setuid format. If you want to get the results mailed you must setuid
sendmail. See <option>security.permissionsWrappers.setuid</option> sendmail. See <option>security.wrappers.setuid</option>
If neither /var/cron/cron.deny nor /var/cron/cron.allow exist only root If neither /var/cron/cron.deny nor /var/cron/cron.allow exist only root
will is allowed to have its own crontab file. The /var/cron/cron.deny file will is allowed to have its own crontab file. The /var/cron/cron.deny file
@ -92,21 +92,9 @@ in
config = mkMerge [ config = mkMerge [
{ services.cron.enable = mkDefault (allFiles != []); } { services.cron.enable = mkDefault (allFiles != []); }
(mkIf (config.services.cron.enable) { (mkIf (config.services.cron.enable) {
security.setuidPrograms = [ "crontab" ];
security.permissionsWrappers.setuid =
[
{ program = "crontab";
source = "${pkgs.cronNixosPkg.out}/bin/crontab";
owner = "root";
group = "root";
setuid = true;
}
];
environment.systemPackages = [ cronNixosPkg ]; environment.systemPackages = [ cronNixosPkg ];
environment.etc.crontab = environment.etc.crontab =
{ source = pkgs.runCommand "crontabs" { inherit allFiles; preferLocalBuild = true; } { source = pkgs.runCommand "crontabs" { inherit allFiles; preferLocalBuild = true; }
'' ''

View file

@ -96,7 +96,7 @@ in
fcronallow = /etc/fcron.allow fcronallow = /etc/fcron.allow
fcrondeny = /etc/fcron.deny fcrondeny = /etc/fcron.deny
shell = /bin/sh shell = /bin/sh
sendmail = /var/permissions-wrappers/sendmail sendmail = /run/wrappers/sendmail
editor = /run/current-system/sw/bin/vi editor = /run/current-system/sw/bin/vi
''; '';
target = "fcron.conf"; target = "fcron.conf";
@ -106,16 +106,7 @@ in
environment.systemPackages = [ pkgs.fcron ]; environment.systemPackages = [ pkgs.fcron ];
security.permissionsWrappers.setuid = security.setuidPrograms = [ "fcrontab" ];
[
{ program = "fcrontab";
source = "${pkgs.fcron.out}/bin/fcrontab";
owner = "root";
group = "root";
setuid = true;
}
];
systemd.services.fcron = { systemd.services.fcron = {
description = "fcron daemon"; description = "fcron daemon";
after = [ "local-fs.target" ]; after = [ "local-fs.target" ];

View file

@ -38,7 +38,7 @@ let
sed -ri "s@/etc/dbus-1/(system|session)-@$out/\1-@" $out/{system,session}.conf sed -ri "s@/etc/dbus-1/(system|session)-@$out/\1-@" $out/{system,session}.conf
sed '${./dbus-system-local.conf.in}' \ sed '${./dbus-system-local.conf.in}' \
-e 's,@servicehelper@,${config.security.permissionsWrapperDir}/dbus-daemon-launch-helper,g' \ -e 's,@servicehelper@,${config.security.wrapperDir}/dbus-daemon-launch-helper,g' \
-e 's,@extra@,${systemExtraxml},' \ -e 's,@extra@,${systemExtraxml},' \
> "$out/system-local.conf" > "$out/system-local.conf"
@ -114,7 +114,7 @@ in
systemd.packages = [ pkgs.dbus.daemon ]; systemd.packages = [ pkgs.dbus.daemon ];
security.permissionsWrappers.setuid = singleton security.wrappers.setuid = singleton
{ program = "dbus-daemon-launch-helper"; { program = "dbus-daemon-launch-helper";
source = "${pkgs.dbus.daemon}/libexec/dbus-daemon-launch-helper"; source = "${pkgs.dbus.daemon}/libexec/dbus-daemon-launch-helper";
owner = "root"; owner = "root";

View file

@ -62,16 +62,7 @@ in
''; '';
}]; }];
security.permissionsWrappers.setuid = security.setuidPrograms = [ "e_freqset" ];
[
{ program = "e_freqset";
source = "${e.enlightenment.out}/bin/e_freqset";
owner = "root";
group = "root";
setuid = true;
}
];
environment.etc = singleton environment.etc = singleton
{ source = "${pkgs.xkeyboard_config}/etc/X11/xkb"; { source = "${pkgs.xkeyboard_config}/etc/X11/xkb";
target = "X11/xkb"; target = "X11/xkb";

View file

@ -131,7 +131,7 @@ in
''; '';
}; };
security.permissionsWrappers.setuid = singleton security.wrappers.setuid = singleton
{ program = "kcheckpass"; { program = "kcheckpass";
source = "${kde_workspace}/lib/kde4/libexec/kcheckpass"; source = "${kde_workspace}/lib/kde4/libexec/kcheckpass";
owner = "root"; owner = "root";

View file

@ -68,7 +68,7 @@ in
''; '';
}; };
security.permissionsWrappers.setuid = [ security.wrappers.setuid = [
{ {
program = "kcheckpass"; program = "kcheckpass";
source = "${kde5.plasma-workspace.out}/lib/libexec/kcheckpass"; source = "${kde5.plasma-workspace.out}/lib/libexec/kcheckpass";

View file

@ -131,10 +131,10 @@ if [ -n "@useHostResolvConf@" -a -e /etc/resolv.conf ]; then
cat /etc/resolv.conf | resolvconf -m 1000 -a host cat /etc/resolv.conf | resolvconf -m 1000 -a host
fi fi
# Create /var/permissions-wrappers as a tmpfs. # Create /run/wrappers as a tmpfs.
rm -rf /var/permissions-wrappers rm -rf /run/wrappers
mkdir -m 0755 -p /var/permissions-wrappers mkdir -m 0755 -p /run/wrappers
mount -t tmpfs -o "mode=0755" tmpfs /var/permissions-wrappers mount -t tmpfs -o "mode=0755" tmpfs /run/wrappers
# Log the script output to /dev/kmsg or /run/log/stage-2-init.log. # Log the script output to /dev/kmsg or /run/log/stage-2-init.log.
# Only at this point are all the necessary prerequisites ready for these commands. # Only at this point are all the necessary prerequisites ready for these commands.

View file

@ -898,38 +898,23 @@ in
# Capabilities won't work unless we have at-least a 4.3 Linux # Capabilities won't work unless we have at-least a 4.3 Linux
# kernel because we need the ambient capability # kernel because we need the ambient capability
security.permissionsWrappers.setcap = mkIf (versionAtLeast (getVersion config.boot.kernelPackages.kernel) "4.3") ( security.wrappers = mkIf (versionAtLeast (getVersion config.boot.kernelPackages.kernel) "4.3") {
[ ping = {
{ program = "ping"; source = "${pkgs.iputils.out}/bin/ping";
source = "${pkgs.iputils.out}/bin/ping"; capabilities = "cap_net_raw+p";
capabilities = "cap_net_raw+p"; };
}
{ program = "ping6"; ping6 = {
source = "${pkgs.iputils.out}/bin/ping6"; source = "${pkgs.iputils.out}/bin/ping6";
capabilities = "cap_net_raw+p"; capabilities = "cap_net_raw+p";
} };
] };
);
# If our linux kernel IS older than 4.3, let's setuid ping and ping6 # If the linux kernel IS older than 4.3, create setuid wrappers
security.permissionsWrappers.setuid = mkIf (versionOlder (getVersion config.boot.kernelPackages.kernel) "4.3") ( # for ping and ping6
[ security.setuidPrograms = mkIf (versionOlder (getVersion config.boot.kernelPackages.kernel) "4.3") [
{ program = "ping"; "ping" "ping6"
source = "${pkgs.iputils.out}/bin/ping"; ];
owner = "root";
group = "root";
setuid = true;
}
{ program = "ping6";
source = "${pkgs.iputils.out}/bin/ping6";
owner = "root";
group = "root";
setuid = true;
}
]
);
# Set the host and domain names in the activation script. Don't # Set the host and domain names in the activation script. Don't
# clear it if it's not configured in the NixOS configuration, # clear it if it's not configured in the NixOS configuration,

View file

@ -68,7 +68,7 @@ in
boot.extraModulePackages = [ kernelModules ]; boot.extraModulePackages = [ kernelModules ];
environment.systemPackages = [ virtualbox ]; environment.systemPackages = [ virtualbox ];
security.permissionsWrappers.setuid = let security.wrappers.setuid = let
mkSuid = program: { mkSuid = program: {
inherit program; inherit program;
source = "${virtualbox}/libexec/virtualbox/${program}"; source = "${virtualbox}/libexec/virtualbox/${program}";
@ -99,7 +99,7 @@ in
SUBSYSTEM=="usb", ACTION=="remove", ENV{DEVTYPE}=="usb_device", RUN+="${virtualbox}/libexec/virtualbox/VBoxCreateUSBNode.sh --remove $major $minor" SUBSYSTEM=="usb", ACTION=="remove", ENV{DEVTYPE}=="usb_device", RUN+="${virtualbox}/libexec/virtualbox/VBoxCreateUSBNode.sh --remove $major $minor"
''; '';
# Since we lack the right setuid binaries, set up a host-only network by default. # Since we lack the right setuid/setcap binaries, set up a host-only network by default.
} (mkIf cfg.addNetworkInterface { } (mkIf cfg.addNetworkInterface {
systemd.services."vboxnet0" = systemd.services."vboxnet0" =
{ description = "VirtualBox vboxnet0 Interface"; { description = "VirtualBox vboxnet0 Interface";

View file

@ -14,7 +14,7 @@ import ./make-test.nix ({ pkgs, ...} : {
mailHost = "127.0.0.2"; mailHost = "127.0.0.2";
probeConfig = '' probeConfig = ''
+ FPing + FPing
binary = /var/permissions-wrappers/fping binary = /run/wrappers/fping
offset = 0% offset = 0%
''; '';
}; };

View file

@ -1,5 +1,5 @@
{ fetchurl, stdenv, glib, xorg, cairo, gtk2, pango, makeWrapper, openssl, bzip2, { fetchurl, stdenv, glib, xorg, cairo, gtk2, pango, makeWrapper, openssl, bzip2,
pkexecPath ? "/var/permissions-wrappers/pkexec", libredirect, pkexecPath ? "/run/wrappers/pkexec", libredirect,
gksuSupport ? false, gksu}: gksuSupport ? false, gksu}:
assert stdenv.system == "i686-linux" || stdenv.system == "x86_64-linux"; assert stdenv.system == "i686-linux" || stdenv.system == "x86_64-linux";

View file

@ -83,9 +83,9 @@ in stdenv.mkDerivation {
ed -v -s "$out/bin/chromium" << EOF ed -v -s "$out/bin/chromium" << EOF
2i 2i
if [ -x "/var/permissions-wrappers/${sandboxExecutableName}" ] if [ -x "/run/wrappers/${sandboxExecutableName}" ]
then then
export CHROME_DEVEL_SANDBOX="/var/permissions-wrappers/${sandboxExecutableName}" export CHROME_DEVEL_SANDBOX="/run/wrappers/${sandboxExecutableName}"
else else
export CHROME_DEVEL_SANDBOX="$sandbox/bin/${sandboxExecutableName}" export CHROME_DEVEL_SANDBOX="$sandbox/bin/${sandboxExecutableName}"
fi fi

View file

@ -26,7 +26,7 @@ index 50e8ad8..eec0ed2 100644
+ is_nixos=no + is_nixos=no
+fi +fi
+ +
+if [ -u /var/permissions-wrappers/gksign ]; then +if [ -u /run/wrappers/gksign ]; then
+ cat <<EOM + cat <<EOM
+ +
+Gale appears to have already been set up via the NixOS module system (check +Gale appears to have already been set up via the NixOS module system (check

View file

@ -11,7 +11,7 @@ index a9d8ac4..85f13f5 100644
- # # arguments: '-i -t' - # # arguments: '-i -t'
- # # } - # # }
+ config.action_mailer.sendmail_settings = { + config.action_mailer.sendmail_settings = {
+ location: '/var/permissions-wrappers/sendmail', + location: '/run/wrappers/sendmail',
+ arguments: '-i -t' + arguments: '-i -t'
+ } + }
config.action_mailer.perform_deliveries = true config.action_mailer.perform_deliveries = true

View file

@ -96,7 +96,7 @@ index 95dc9a7..39170bc 100644
/* get the path to the executable */ /* get the path to the executable */
char szPath[RTPATH_MAX]; char szPath[RTPATH_MAX];
- RTPathAppPrivateArch(szPath, sizeof(szPath) - 1); - RTPathAppPrivateArch(szPath, sizeof(szPath) - 1);
+ RTStrCopy(szPath, sizeof(szPath) - 1, "/var/permissions-wrappers"); + RTStrCopy(szPath, sizeof(szPath) - 1, "/run/wrappers");
size_t cchBufLeft = strlen(szPath); size_t cchBufLeft = strlen(szPath);
szPath[cchBufLeft++] = RTPATH_DELIMITER; szPath[cchBufLeft++] = RTPATH_DELIMITER;
szPath[cchBufLeft] = 0; szPath[cchBufLeft] = 0;
@ -154,7 +154,7 @@ index be2ad8f..7ddf105 100644
+RTDECL(int) RTPathSuidDir(char *pszPath, size_t cchPath) +RTDECL(int) RTPathSuidDir(char *pszPath, size_t cchPath)
+{ +{
+ return RTStrCopy(pszPath, cchPath, "/var/permissions-wrappers"); + return RTStrCopy(pszPath, cchPath, "/run/wrappers");
+} +}
+ +
+ +
@ -174,7 +174,7 @@ index 7bde6af..2656cae 100644
+ * will cut off everything after the rightmost / as this function is analogous + * will cut off everything after the rightmost / as this function is analogous
+ * to RTProcGetExecutablePath(). + * to RTProcGetExecutablePath().
+ */ + */
+#define SUIDDIR "/var/permissions-wrappers/" +#define SUIDDIR "/run/wrappers/"
+ +
+RTR3DECL(char *) RTProcGetSuidPath(char *pszExecPath, size_t cbExecPath) +RTR3DECL(char *) RTProcGetSuidPath(char *pszExecPath, size_t cbExecPath)
+{ +{

View file

@ -51,7 +51,7 @@ let
export PS1='${name}-chrootenv:\u@\h:\w\$ ' export PS1='${name}-chrootenv:\u@\h:\w\$ '
export LOCALE_ARCHIVE='/usr/lib/locale/locale-archive' export LOCALE_ARCHIVE='/usr/lib/locale/locale-archive'
export LD_LIBRARY_PATH='/run/opengl-driver/lib:/run/opengl-driver-32/lib:/usr/lib:/usr/lib32' export LD_LIBRARY_PATH='/run/opengl-driver/lib:/run/opengl-driver-32/lib:/usr/lib:/usr/lib32'
export PATH='/var/permissions-wrappers:/usr/bin:/usr/sbin' export PATH='/run/wrappers:/usr/bin:/usr/sbin'
export PKG_CONFIG_PATH=/usr/lib/pkgconfig export PKG_CONFIG_PATH=/usr/lib/pkgconfig
# Force compilers to look in default search paths # Force compilers to look in default search paths

View file

@ -42,13 +42,13 @@ stdenv.mkDerivation rec {
# this is a hack and without this cpufreq module is not working. does the following: # this is a hack and without this cpufreq module is not working. does the following:
# 1. moves the "freqset" binary to "e_freqset", # 1. moves the "freqset" binary to "e_freqset",
# 2. linkes "e_freqset" to enlightenment/bin so that, # 2. linkes "e_freqset" to enlightenment/bin so that,
# 3. permissionsWrappers.setuid detects it and places wrappers in /var/permissions-wrappers/e_freqset, # 3. wrappers.setuid detects it and places wrappers in /run/wrappers/e_freqset,
# 4. and finally, links /var/permissions-wrappers/e_freqset to original destination where enlightenment wants it # 4. and finally, links /run/wrappers/e_freqset to original destination where enlightenment wants it
postInstall = '' postInstall = ''
export CPUFREQ_DIRPATH=`readlink -f $out/lib/enlightenment/modules/cpufreq/linux-gnu-*`; export CPUFREQ_DIRPATH=`readlink -f $out/lib/enlightenment/modules/cpufreq/linux-gnu-*`;
mv $CPUFREQ_DIRPATH/freqset $CPUFREQ_DIRPATH/e_freqset mv $CPUFREQ_DIRPATH/freqset $CPUFREQ_DIRPATH/e_freqset
ln -sv $CPUFREQ_DIRPATH/e_freqset $out/bin/e_freqset ln -sv $CPUFREQ_DIRPATH/e_freqset $out/bin/e_freqset
ln -sv /var/permissions-wrappers/e_freqset $CPUFREQ_DIRPATH/freqset ln -sv /run/wrappers/e_freqset $CPUFREQ_DIRPATH/freqset
''; '';
meta = with stdenv.lib; { meta = with stdenv.lib; {

View file

@ -7,7 +7,7 @@ Index: kinit-5.24.0/src/start_kdeinit/start_kdeinit_wrapper.c
#include <unistd.h> #include <unistd.h>
-#define EXECUTE CMAKE_INSTALL_FULL_LIBEXECDIR_KF5 "/start_kdeinit" -#define EXECUTE CMAKE_INSTALL_FULL_LIBEXECDIR_KF5 "/start_kdeinit"
+#define EXECUTE "/var/permissions-wrappers/start_kdeinit" +#define EXECUTE "/run/wrappers/start_kdeinit"
#if KDEINIT_OOM_PROTECT #if KDEINIT_OOM_PROTECT

View file

@ -57,8 +57,8 @@ stdenv.mkDerivation rec {
# Fix some binary paths # Fix some binary paths
sed -i -e 's|/usr/bin/xauth|${xauth}/bin/xauth|g' libgksu/gksu-run-helper.c libgksu/libgksu.c sed -i -e 's|/usr/bin/xauth|${xauth}/bin/xauth|g' libgksu/gksu-run-helper.c libgksu/libgksu.c
sed -i -e 's|/usr/bin/sudo|/var/permissions-wrappers/sudo|g' libgksu/libgksu.c sed -i -e 's|/usr/bin/sudo|/run/wrappers/sudo|g' libgksu/libgksu.c
sed -i -e 's|/bin/su\([^d]\)|/var/permissions-wrappers/su\1|g' libgksu/libgksu.c sed -i -e 's|/bin/su\([^d]\)|/run/wrappers/su\1|g' libgksu/libgksu.c
touch NEWS README touch NEWS README
''; '';

View file

@ -5,7 +5,7 @@
let let
system = "/var/run/current-system/sw"; system = "/var/run/current-system/sw";
setuid = "/var/permissions-wrappers"; #TODO: from <nixos> config.security.wrapperDir; setuid = "/run/wrappers"; #TODO: from <nixos> config.security.wrapperDir;
foolVars = { foolVars = {
SYSCONF = "/etc"; SYSCONF = "/etc";

View file

@ -94,7 +94,7 @@ in stdenv.mkDerivation rec {
unitydir="$out/opt/Unity/Editor" unitydir="$out/opt/Unity/Editor"
mkdir -p $unitydir mkdir -p $unitydir
mv Editor/* $unitydir mv Editor/* $unitydir
ln -sf /var/permissions-wrappers/${chromium.sandboxExecutableName} $unitydir/chrome-sandbox ln -sf /run/wrappers/${chromium.sandboxExecutableName} $unitydir/chrome-sandbox
mkdir -p $out/share/applications mkdir -p $out/share/applications
sed "/^Exec=/c\Exec=$out/bin/unity-editor" \ sed "/^Exec=/c\Exec=$out/bin/unity-editor" \

View file

@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
# Ensure that FUSE calls the setuid wrapper, not # Ensure that FUSE calls the setuid wrapper, not
# $out/bin/fusermount. It falls back to calling fusermount in # $out/bin/fusermount. It falls back to calling fusermount in
# $PATH, so it should also work on non-NixOS systems. # $PATH, so it should also work on non-NixOS systems.
export NIX_CFLAGS_COMPILE="-DFUSERMOUNT_DIR=\"/var/permissions-wrappers\"" export NIX_CFLAGS_COMPILE="-DFUSERMOUNT_DIR=\"/run/wrappers\""
sed -e 's@/bin/@${utillinux}/bin/@g' -i lib/mount_util.c sed -e 's@/bin/@${utillinux}/bin/@g' -i lib/mount_util.c
sed -e 's@CONFIG_RPATH=/usr/share/gettext/config.rpath@CONFIG_RPATH=${gettext}/share/gettext/config.rpath@' -i makeconf.sh sed -e 's@CONFIG_RPATH=/usr/share/gettext/config.rpath@CONFIG_RPATH=${gettext}/share/gettext/config.rpath@' -i makeconf.sh

View file

@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
preConfigure = '' preConfigure = ''
sed -e 's@/lib/udev@''${out}/lib/udev@' \ sed -e 's@/lib/udev@''${out}/lib/udev@' \
-e 's@ -Werror @ @' \ -e 's@ -Werror @ @' \
-e 's@/usr/sbin/sendmail@/var/permissions-wrappers/sendmail@' -i Makefile -e 's@/usr/sbin/sendmail@/run/wrappers/sendmail@' -i Makefile
''; '';
meta = { meta = {

View file

@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
preConfigure = '' preConfigure = ''
sed -e 's@/lib/udev@''${out}/lib/udev@' \ sed -e 's@/lib/udev@''${out}/lib/udev@' \
-e 's@ -Werror @ @' \ -e 's@ -Werror @ @' \
-e 's@/usr/sbin/sendmail@/var/permissions-wrappers/sendmail@' -i Makefile -e 's@/usr/sbin/sendmail@/run/wrappers/sendmail@' -i Makefile
''; '';
meta = { meta = {

View file

@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
postInstall = '' postInstall = ''
mv -v $out/sbin/unix_chkpwd{,.orig} mv -v $out/sbin/unix_chkpwd{,.orig}
ln -sv /var/permissions-wrappers/unix_chkpwd $out/sbin/unix_chkpwd ln -sv /run/wrappers/unix_chkpwd $out/sbin/unix_chkpwd
''; /* ''; /*
rm -rf $out/etc rm -rf $out/etc
mkdir -p $modules/lib mkdir -p $modules/lib

View file

@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
--enable-last --enable-last
--enable-mesg --enable-mesg
--disable-use-tty-group --disable-use-tty-group
--enable-fs-paths-default=/var/permissions-wrappers:/var/run/current-system/sw/bin:/sbin --enable-fs-paths-default=/run/wrappers:/var/run/current-system/sw/bin:/sbin
${if ncurses == null then "--without-ncurses" else ""} ${if ncurses == null then "--without-ncurses" else ""}
${if systemd == null then "" else '' ${if systemd == null then "" else ''
--with-systemd --with-systemd

View file

@ -30,7 +30,7 @@ buildGoPackage rec {
-e 's|/bin/chown|${coreutils}/bin/chown|' \ -e 's|/bin/chown|${coreutils}/bin/chown|' \
-e 's|/bin/date|${coreutils}/bin/date|' \ -e 's|/bin/date|${coreutils}/bin/date|' \
-e 's|/sbin/poweroff|${systemd}/sbin/poweroff|' \ -e 's|/sbin/poweroff|${systemd}/sbin/poweroff|' \
-e 's|/usr/bin/sudo|/var/permissions-wrappers/sudo|' \ -e 's|/usr/bin/sudo|/run/wrappers/sudo|' \
-e 's|/sbin/cryptsetup|${cryptsetup}/bin/cryptsetup|' -e 's|/sbin/cryptsetup|${cryptsetup}/bin/cryptsetup|'
''; '';
} }

View file

@ -1,4 +1,4 @@
{ stdenv, fetchurl, flex, bison, sendmailPath ? "/var/permissions-wrappers/sendmail" }: { stdenv, fetchurl, flex, bison, sendmailPath ? "/run/wrappers/sendmail" }:
stdenv.mkDerivation rec { stdenv.mkDerivation rec {
name = "petidomo-4.3"; name = "petidomo-4.3";

View file

@ -16,8 +16,8 @@ stdenv.mkDerivation rec {
# configured on the build machine). # configured on the build machine).
preConfigure= " preConfigure= "
configureFlagsArray=( configureFlagsArray=(
--with-ping-command='/var/permissions-wrappers/ping -n -U -w %d -c %d %s' --with-ping-command='/run/wrappers/ping -n -U -w %d -c %d %s'
--with-ping6-command='/var/permissions-wrappers/ping6 -n -U -w %d -c %d %s' --with-ping6-command='/run/wrappers/ping6 -n -U -w %d -c %d %s'
) )
"; ";

View file

@ -20,10 +20,10 @@ stdenv.mkDerivation rec {
configureFlags="--mandir=$out/share/man" configureFlags="--mandir=$out/share/man"
substituteInPlace x11vnc/unixpw.c \ substituteInPlace x11vnc/unixpw.c \
--replace '"/bin/su"' '"/var/permissions-wrappers/su"' \ --replace '"/bin/su"' '"/run/wrappers/su"' \
--replace '"/bin/true"' '"${coreutils}/bin/true"' --replace '"/bin/true"' '"${coreutils}/bin/true"'
sed -i -e '/#!\/bin\/sh/a"PATH=${xorg.xdpyinfo}\/bin:${xorg.xauth}\/bin:$PATH\\n"' -e 's|/bin/su|/var/permissions-wrappers/su|g' x11vnc/ssltools.h sed -i -e '/#!\/bin\/sh/a"PATH=${xorg.xdpyinfo}\/bin:${xorg.xauth}\/bin:$PATH\\n"' -e 's|/bin/su|/run/wrappers/su|g' x11vnc/ssltools.h
''; '';
meta = { meta = {

View file

@ -31,7 +31,7 @@ python2Packages.buildPythonApplication rec {
buildInputs = [ dialog ] ++ (with python2Packages; [ nose mock gnureadline ]); buildInputs = [ dialog ] ++ (with python2Packages; [ nose mock gnureadline ]);
patchPhase = '' patchPhase = ''
substituteInPlace certbot/notify.py --replace "/usr/sbin/sendmail" "/var/permissions-wrappers/sendmail" substituteInPlace certbot/notify.py --replace "/usr/sbin/sendmail" "/run/wrappers/sendmail"
substituteInPlace certbot/util.py --replace "sw_vers" "/usr/bin/sw_vers" substituteInPlace certbot/util.py --replace "sw_vers" "/usr/bin/sw_vers"
''; '';

View file

@ -2,7 +2,7 @@
, FileDesktopEntry, libxslt, docbook_xsl, makeWrapper , FileDesktopEntry, libxslt, docbook_xsl, makeWrapper
, python3Packages , python3Packages
, perlPackages, curl, gnupg, diffutils , perlPackages, curl, gnupg, diffutils
, sendmailPath ? "/var/permissions-wrappers/sendmail" , sendmailPath ? "/run/wrappers/sendmail"
}: }:
let let

View file

@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
}; };
# TODO: replace wrapperDir below with from <nixos> config.security.wrapperDir; # TODO: replace wrapperDir below with from <nixos> config.security.wrapperDir;
wrapperDir = "/var/permissions-wrappers"; wrapperDir = "/run/wrappers";
postPatch = '' postPatch = ''
FILES="$(grep -r '/bin/sh' src/utils -l; find src -name \*.c)" FILES="$(grep -r '/bin/sh' src/utils -l; find src -name \*.c)"

View file

@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
buildInputs = [ makeWrapper ]; buildInputs = [ makeWrapper ];
# Do not hardcode PATH to ${ecryptfs} as we need the script to invoke executables from /var/permissions-wrappers # Do not hardcode PATH to ${ecryptfs} as we need the script to invoke executables from /run/wrappers
installPhase = '' installPhase = ''
mkdir -p $out/bin $out/libexec mkdir -p $out/bin $out/libexec
cp $src $out/libexec/ecryptfs-helper.py cp $src $out/libexec/ecryptfs-helper.py

View file

@ -1,5 +1,5 @@
{ stdenv, fetchurl, coreutils, pam, groff { stdenv, fetchurl, coreutils, pam, groff
, sendmailPath ? "/var/permissions-wrappers/sendmail" , sendmailPath ? "/run/wrappers/sendmail"
, withInsults ? false , withInsults ? false
}: }:

View file

@ -1,4 +1,4 @@
{ fetchurl, stdenv, bison, flex, pam, sendmailPath ? "/var/permissions-wrappers/sendmail" }: { fetchurl, stdenv, bison, flex, pam, sendmailPath ? "/run/wrappers/sendmail" }:
stdenv.mkDerivation { stdenv.mkDerivation {
name = "at-3.1.16"; name = "at-3.1.16";

View file

@ -23,7 +23,7 @@ stdenv.mkDerivation {
#define _PATH_SENDMAIL "${sendmailPath}" #define _PATH_SENDMAIL "${sendmailPath}"
#undef _PATH_DEFPATH #undef _PATH_DEFPATH
#define _PATH_DEFPATH "/var/permissions-wrappers:/nix/var/nix/profiles/default/bin:/nix/var/nix/profiles/default/sbin:/run/current-system/sw/bin:/run/current-system/sw/sbin:/usr/bin:/bin" #define _PATH_DEFPATH "/run/wrappers:/nix/var/nix/profiles/default/bin:/nix/var/nix/profiles/default/sbin:/run/current-system/sw/bin:/run/current-system/sw/sbin:/usr/bin:/bin"
__EOT__ __EOT__
# Implicit saved uids do not work here due to way NixOS uses setuid wrappers # Implicit saved uids do not work here due to way NixOS uses setuid wrappers

View file

@ -1,5 +1,5 @@
{stdenv, fetchurl, {stdenv, fetchurl,
sendmailPath ? "/var/permissions-wrappers/sendmail" }: sendmailPath ? "/run/wrappers/sendmail" }:
stdenv.mkDerivation rec { stdenv.mkDerivation rec {