nixpkgs/nixos
Florian Klink 3c74e48d9c nixos/filesystems: ensure keys gid on /run/keys mountpoint
boot.specialFileSystems is used to describe mount points to be set up in
stage 1 and 2.

We use it to create /run/keys already there, so sshd-in-initrd scenarios
can consume keys sent over through nixops send-keys.

However, it seems the kernel only supports the gid=… option for tmpfs,
not ramfs, causing /run/keys to be owned by the root group, not keys
group.

This was/is worked around in nixops by running a chown root:keys
/run/keys whenever pushing keys [1], and as machines had to have pushed keys
to be usable, this was pretty much always the case.

This is causing regressions in setups not provisioned via nixops, that
still use /run/keys for secrets (through cloud provider startup scripts
for example), as suddenly being an owner of the "keys" group isn't
enough to access the folder.

This PR removes the defunct gid=… option in the mount script called in
stage 1 and 2, and introduces a tmpfiles rule which takes care of fixing
up permissions as part of sysinit.target (very early in systemd bootup,
so before regular services are started).

In case of nixops deployments, this doesn't change anything.
nixops-based deployments receiving secrets from nixops send-keys in
initrd will simply have the permissions already set once tmpfiles is
started.

Fixes #42344

[1]: 884d6c3994/nixops/backends/__init__.py (L267-L269)
2020-02-05 01:53:26 +01:00
..
doc sqldeveloper: {17.4.1.054.0712,18.2.0.183.1748} -> 19.4.0.354.1759 2020-02-04 13:51:52 +01:00
lib Merge pull request #59855 from volth/qemu-cpu-passthru 2020-02-01 22:59:37 -05:00
maintainers maintainers/create-azure.sh: run from anywhere 2020-01-09 20:54:28 +00:00
modules nixos/filesystems: ensure keys gid on /run/keys mountpoint 2020-02-05 01:53:26 +01:00
tests Merge pull request #79141 from thefloweringash/openstack-tests 2020-02-03 18:17:02 +01:00
COPYING
default.nix nixos: export packages of the current configuration (its pkgs argument) 2018-02-09 19:35:27 +00:00
README
release-combined.nix nixos/release: rename iso_graphical to iso_plasma5 2020-01-27 16:34:37 -05:00
release-small.nix nixos/containers-ip: Test both ipv4 and ipv6 in the same script 2019-11-27 09:13:02 +01:00
release.nix nixos/release: rename iso_graphical to iso_plasma5 2020-01-27 16:34:37 -05:00

*** NixOS ***

NixOS is a Linux distribution based on the purely functional package
management system Nix.  More information can be found at
http://nixos.org/nixos and in the manual in doc/manual.