Commit graph

764 commits

Author SHA1 Message Date
Alyssa Ross 9e400a8b93 nixos/users-groups: check format of passwd entries
Things will get quite broken if an /etc/passwd entry contains a
colon (which terminates a field), or a newline (which terminates a
record).  I know because I just accidentally made a user whose home
directory path contained a newline!

So let's make sure that can't happen.
2021-04-22 13:18:38 +00:00
Bernardo Meurer 411d6aeb06
nixos/modules/config/iproute2: avoid using iproute alias 2021-04-20 01:01:33 -07:00
Symphorien Gibol 7a87973b4c nixos/users: require one of users.users.name.{isSystemUser,isNormalUser}
As the only consequence of isSystemUser is that if the uid is null then
it's allocated below 500, if a user has uid = something below 500 then
we don't require isSystemUser to be set.

Motivation: https://github.com/NixOS/nixpkgs/issues/112647
2021-04-14 20:40:00 +02:00
Jan Tojnar c04a14edd6 Merge branch 'master' into staging-next 2021-04-06 16:01:14 +02:00
Lassulus e2080b39e6
Merge pull request #89951 from KoviRobi/nixos-user-name-not-attr-name
nixos/users-groups: Use user name not attribute name for /etc/profiles/…
2021-04-05 13:52:25 +02:00
rnhmjoj 61b7cab481
treewide: use perl.withPackages when possible
Since 03eaa48 added perl.withPackages, there is a canonical way to
create a perl interpreter from a list of libraries, for use in script
shebangs or generic build inputs. This method is declarative (what we
are doing is clear), produces short shebangs[1] and needs not to wrap
existing scripts.

Unfortunately there are a few exceptions that I've found:

  1. Scripts that are calling perl with the -T switch. This makes perl
  ignore PERL5LIB, which is what perl.withPackages is using to inform
  the interpreter of the library paths.

  2. Perl packages that depends on libraries in their own path. This
  is not possible because perl.withPackages works at build time. The
  workaround is to add `-I $out/${perl.libPrefix}` to the shebang.

In all other cases I propose to switch to perl.withPackages.

[1]: https://lwn.net/Articles/779997/
2021-03-31 21:35:37 +02:00
Samuel Gräfenstein e6cd793a74
nixos/config: move nano to defaultPackages
Some people already have another editor installed and may want to
get rid of applications they don't use.
2021-03-30 11:50:03 +02:00
Jaakko Luttinen 099a9e809c nixos/update-users-groups: read access to /etc/shadow for group shadow 2021-03-18 00:08:35 -07:00
Kovacsics Robert af4adb1dd2 nixos/users-groups: Use user name not attribute name for /etc/profiles/...
This cropped up, because I have a set-up where my work username is
different to my home desktop username, and I am using a parameterized
config for both, so I have something akin to

    config.users.users.default-user = ...;

and using

    config.users.users.default-user.{name, home}

in certain places to cope with this. Noticed my home-manager bought in
packages (which use the users.users.<name>.packages hence NixOS issue
not home-manager) weren't present.
2021-02-27 12:45:49 +00:00
Florian Klink 47589ade46
Merge pull request #113804 from rnhmjoj/no-udev-settle-2
nixos/console: fix console setting reloading
2021-02-22 23:22:04 +01:00
rnhmjoj 9be0529210
nixos/console: fix console setting reloading
It's a dull and boring day, it's cold outside and I'm stuck at home: let
me tell you the story of systemd-vconsole-setup.

In the beginnings of NixOS[1], systemd-vconsole-setup was a powerful
sysinit.target unit, installed and running at boot to set up fonts
keyboard layouts and even colors of the virtual consoles. If needed, the
service would also be restarted after a configuration change, consoles
were happy and everything was good, well, almost.

Since the service had no way to specify the dependency "ttys are ready",
modesetting could sometimes happen *after* systemd-vconsole-setup had
started, leaving the console in a broken state. So abbradar worked
around that by putting a systemd-udev-settle `After=`.

In the meanwhile, probably realizing their mistake, systemd added a
shiny udev rule to start the systemd-udev-settle at the right time[2].
However, the rule bypassed systemd by directly running the binary
`systemd-udev-settle`, and the service - though still installed - fell
into disuse.

Two years would pass before a good samaritan, seeing the poor jobless
systemd-udev-settle service, decided to give it the coup de grâs[3] by
unlisting it from the installed units.
This, combined with another bug, caused quite a commotion[4] in NixOS;
to see why remember the fact that `WantedBy=` in upstream units doesn't
work[5], so it had to be added manually in cc542110, but while systemd
removed it, the NixOS unit continued to install and restart the service,
making a lot of fuss when switching configuration.

After at least thee different tentative fixes, deedrah realised[6] what
the root cause was and fpletz put the final nail[7] in the coffin of
systemd-udev-settle. The service would never see the light of a boot
again, NixOS would not restart it all the time but thanks to udev
consoles would still get their pretty fonts and playful colors.

The En..

..no, wait! You should ask what came of systemd-udev-settle, first.
And why is the service even around if udev is doing all the work?

Udev-settle, like the deceitful snake that he is, laid hidden for years.
He looks innocuous doesn't it? A little hack. Only until it leaves his
den and a poor user[8] drops dead. Obviously, it serves no purpose, as
the service is not part of the boot process anymore, so let's remove it
for good!

About the service, it may not be useful at boot, but it can be started
to pick up changes in vconsole.conf and set the consoles accordingly.
But wait, this doesn't work anymore: the service is never started at
boot (remember f76d2aa6), so switch-to-configuration.pl will not restart
it. Fortunately it can be repaired: here I install a new unit which
does *nothing* on start, but restarts the real service when reloaded.
This perfectly reproduces the original behavior, hopefully without the
original bugs too.

The End?

[1]: cc54211069
[2]: f6ba8671d8 (diff-84849fddcef81458f69725dc18c6614aade5c4f41a032b6908ebcf1ee6740636)
[3]: 8125e8d38e
[4]: https://web.archive.org/web/20180603130107/https://github.com/NixOS/nixpkgs/issues/22470
[5]: https://github.com/NixOS/nixpkgs/issues/81138
[6]: https://web.archive.org/web/20180603130107/https://github.com/NixOS/nixpkgs/issues/22470#issuecomment-330930456
[7]: f76d2aa6e3
[8]: https://github.com/NixOS/nixpkgs/issues/107341
2021-02-21 10:27:34 +01:00
nicoo c8dcbfc047 nixos/swap: Remove dependency on rngd (module removed) 2021-02-21 01:33:50 +01:00
Lassulus 2489d95c1c
Merge pull request #110627 from 4z3/use-real-user-name-for-per-user-packages
nixos/users: use proper name for per-user packages
2021-02-15 12:45:24 +01:00
Yorick van Pelt 9df9c1992b
beam-packages: move wxSupport arg up to package set, add beam_nox
This allows us to override the erlang wxSupport argument globally from
an overlay, fixing builds for e.g. rabbitmq with noXlibs set.
2021-01-24 21:04:52 +01:00
volth bc0d605cf1 treewide: fix double quoted strings in meta.description
Signed-off-by: Ben Siraphob <bensiraphob@gmail.com>
2021-01-24 19:56:59 +07:00
tv 530d3ffbcc nixos/users: use proper name for per-user packages
Fixes #107353
2021-01-23 21:36:14 +01:00
Scriptkiddi 1572940688
networking, chrony, ntpd, timesyncd: add timeServers option type 2021-01-20 10:54:24 +01:00
WORLDofPEACE 35ad1687a7
Merge pull request #109060 from MetaDark/nixos/xdg/portal
nixos/xdg/portal: fix loading portals from systemd service
2021-01-20 03:29:16 -05:00
Pavol Rusnak 66dc9dbb59
nixos/modules: stdenv.lib -> lib 2021-01-17 21:40:51 +01:00
Kira Bruneau a13064ae27 nixos/xdg/portal: fix loading portals from systemd service 2021-01-11 19:22:22 -05:00
Masanori Ogino d1d6403cb5 nixos/networking: make /etc/netgroup by default
This will prevent nscd from complaining /etc/netgroup being absent.

Signed-off-by: Masanori Ogino <167209+omasanori@users.noreply.github.com>
2021-01-10 11:01:48 +09:00
Benjamin Asbach e02bf0737b nufraw: init at 0.43-3
`nufraw` is used to manipulate raw images.
`nufraw-thumbnailer` is used to generate thumbnails for raw images.

relates #108444
2021-01-07 22:41:34 +01:00
Florian Klink 88738dd72d
Merge pull request #106787 from flokli/console-optional-display-manager
nixos/console: fix Before= on the systemd-vconsole-setup unit
2021-01-02 11:04:14 +01:00
Niklas Hambüchen 9206c0d115
Merge pull request #41966 from aneeshusa/allow-mutable-shells-for-declarative-users
nixos/users: Allow mutable shells for declarative users
2020-12-31 02:03:22 +01:00
rnhmjoj 9728907cd3
console: remove console.extraTTYs option
This closes issue #88085
2020-12-17 21:29:33 +01:00
Klemens Nanni 8833983f26 nixos/users-groups: createHome: Ensure HOME permissions, fix description
configuration.nix(1) states

    users.extraUsers.<name>.createHome
        [...] If [...] the home directory already exists but is not
        owned by the user, directory owner and group will be changed to
        match the user.

i.e. ownership would change only if the user mismatched;  the code
however ignores the owner, it is sufficient to enable `createHome`:

    if ($u->{createHome}) {
        make_path($u->{home}, { mode => 0700 }) if ! -e $u->{home};
        chown $u->{uid}, $u->{gid}, $u->{home};
    }

Furthermore, permissions are ignored on already existing directories and
therefore may allow others to read private data eventually.

Given that createHome already acts as switch to not only create but
effectively own the home directory, manage permissions in the same
manner to ensure the intended default and cover all primary attributes.

Avoid yet another configuration option to have administrators make a
clear and simple choice between securely managing home directories
and optionally defering management to own code (taking care of custom
location, ownership, mode, extended attributes, etc.).

While here, simplify and thereby fix misleading documentation.
2020-12-16 03:40:29 +01:00
Florian Klink 536988b35e nixos/console: fix Before= on the systemd-vconsole-setup unit
Only set Before=display-manager.service if it is actually present.

On headless systems, `systemctl list-units --state not-found` will
otherwise show display-manager.service.

Reported-In: https://github.com/NixOS/nixpkgs/issues/88597
2020-12-12 21:21:51 +01:00
Linus Heckemann f448ec3365
Merge pull request #98731 from mayflower/ldap-nss-optional
config.users.ldap: do not include nss module if turned off
2020-12-12 10:53:39 +01:00
Aaron Andersen 9826371e44
Merge pull request #101224 from aanderse/ldap
nixos/ldap: restart nslcd when configuration changes
2020-12-11 17:18:12 -05:00
Luke Granger-Brown ad62155cb6 nixos/zram: add zramSwap.memoryMax option
This allows capping the total amount of memory that will be used for
zram-swap, in addition to the percentage-based calculation, which is
useful when blanket-applying a configuration to many machines.

This is based off the strategy used by Fedora for their rollout of
zram-swap-by-default in Fedora 33
(https://fedoraproject.org/wiki/Changes/SwapOnZRAM), which caps the
maximum amount of memory used for zram at 4GiB.

In future it might be good to port this to the systemd zram-generator,
instead of using this separate infrastructure.
2020-11-25 13:43:38 +00:00
Graham Christensen bc49a0815a
utillinux: rename to util-linux 2020-11-24 12:42:06 -05:00
Joachim F 547d660f64
Merge pull request #104052 from TredwellGit/nixos/malloc
nixos/malloc: fix Scudo
2020-11-21 14:31:58 +00:00
Graham Christensen 75d7828724
Merge pull request #98544 from Mic92/unfuck-update-user-group
nixos/update-user-groups: Fix encoding issues + atomic writes
2020-11-20 10:28:52 -05:00
TredwellGit fc6948cd47 nixos/malloc: fix Scudo
Fixes segmentation faults.
https://github.com/NixOS/nixpkgs/issues/100799
2020-11-17 09:11:31 -05:00
Gabriel Ebner 753656bbbc
Merge pull request #103225 from gebner/hsphfpd
pulseaudio: add hsphfpd support
2020-11-11 19:56:35 +01:00
WORLDofPEACE fcef646736
Merge pull request #93431 from sorki/audio/pulseJack
nixos/jack,pulseaudio: fix pulse connection to jackd service
2020-11-09 19:40:12 -05:00
Edmund Wu 0e4d0d95d0 treewide: generate pulseaudio pulseDir 2020-11-09 19:24:42 +01:00
Ivan Tham f6136d06ff
fontdir: add ttc to font regex
.ttc fonts are used by noto-fonts-cjk
2020-10-26 10:45:22 +08:00
Klemens Nanni 3216b85713 nixos/system-path: Add mkpasswd(1)
Generating password hashes, e.g. when adding new users to the system
configuration, should work out-of-the-box and offline.
2020-10-26 03:40:11 +01:00
Aaron Andersen ae02e1fe53 nixos/ldap: minor cosmetic fixes 2020-10-20 19:50:18 -04:00
Aaron Andersen a1acbfbfcb nixos/ldap: add missing types 2020-10-20 19:50:18 -04:00
Aaron Andersen d89aff670a nixos/ldap: restart nslcd when configuration changes 2020-10-20 19:50:17 -04:00
Florian Klink 6e5ccaa34f
Merge pull request #100657 from flokli/network-manager-sstp
networkmanager-sstp: init at unstable-2020-04-20, bump sstp from 1.0.12 to 1.0.13
2020-10-21 00:33:13 +02:00
Florian Klink e992089137 nixos/no-x-libs: add networkmanager-sstp 2020-10-21 00:04:02 +02:00
David Reiss 49a749c729 nixos/pam_mount: add pamMount attribute to users
This attribute is a generalized version of cryptHomeLuks for creating an
entry in /etc/security/pam_mount.conf.xml. It lets the configuration
control all the attributes of the <volume> entry, instead of just the
path. The default path remains the value of cryptHomeLuks, for
compatibility.
2020-10-14 22:55:55 -07:00
Frederik Rietdijk ec28e32c9e Merge master into staging-next 2020-10-08 21:47:26 +02:00
Vladimír Čunát 420f89ceb2
Revert "apparmor: fix and improve the service"
This reverts commit fb6d63f3fd.

I really hope this finally fixes #99236: evaluation on Hydra.
This time I really did check basically the same commit on Hydra:
https://hydra.nixos.org/eval/1618011

Right now I don't have energy to find what exactly is wrong in the
commit, and it doesn't seem important in comparison to nixos-unstable
channel being stuck on a commit over one week old.
2020-10-07 12:22:18 +02:00
Frederik Rietdijk 692d219a93 Merge staging-next into staging 2020-10-06 10:25:58 +02:00
Emilio Perez 52f028f2d9 nixos/xwayland: add new module and allow configuring a default font path
- Add option `programs.xwayland.defaultFontPath`
- Modify sway to enable Xwayland
2020-10-04 14:56:30 +01:00
Emilio Perez f41f53dc49 nixos/fontdir: add option to decompress fonts
This will let Xwayland use the global font folder as font path
2020-10-04 14:56:30 +01:00