nixpkgs/nixos/modules/programs
aszlig 3e49487c1a
virtualbox: Enable hardening by default.
VirtualBox with hardening support requires the main binaries to be
setuid root. Using VBOX_WITH_RUNPATH, we ensure that the RPATHs are
pointing to the libexec directory and we also need to unset
VBOX_WITH_ORIGIN to make sure that the build system is actually setting
those RPATHs.

The hardened.patch implements two things:

 * Set the binary directory to the setuid-wrappers dir so that
   VboxSVC calls them instead of the binaries from the store path. The
   reason behind this is because nothing in the Nix store can have the
   setuid flag.
 * Excempt /nix/store from the group permission check, because while it
   is group-writeable indeed it also has the sticky bit set (and also
   the whole store is mounted read-only on most NixOS systems), so we're
   checking on that as well.

Right now, the hardened.patch uses /nix/store and /var/setuid-wrappers
directly, so someone would ever want to change those on a NixOS system,
please provide a patch to set those paths on build time. However, for
simplicity, it's best to do it when we _really_ need it.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2014-11-29 19:21:46 +01:00
..
bash Remove the option ‘programs.bash.enable’ 2014-04-29 19:00:39 +02:00
zsh Remove obsolete zsh help text 2014-04-30 11:26:39 +02:00
atop.nix nixos: add some missing '.' in option descriptions 2014-06-24 21:25:11 +02:00
blcr.nix Get all lib functions from lib, not pkgs.lib, in modules 2014-07-02 12:28:18 -04:00
dconf.nix gdm: Add very experimental display manager 2014-08-12 11:23:42 +02:00
environment.nix Don't set $MANPATH 2014-11-27 17:36:46 +01:00
freetds.nix Simple nixos module to enable configuration of freetds and setup the expected environment variables 2014-06-22 14:24:54 +02:00
info.nix Fix info command 2014-07-08 15:19:08 +02:00
light.nix Add "light" package and setuid wrapper 2014-11-09 19:45:43 -07:00
nano.nix nano: support system-wide nanorc 2014-08-01 18:19:03 +02:00
screen.nix Get all lib functions from lib, not pkgs.lib, in modules 2014-07-02 12:28:18 -04:00
shadow.nix Merge pull request #2644 from lethalman/pam_tally 2014-09-02 00:58:30 +04:00
shell.nix Rewrite ‘with pkgs.lib’ -> ‘with lib’ 2014-04-14 16:26:48 +02:00
ssh.nix ssh-agent: use types.nullOr 2014-11-15 12:33:01 +01:00
ssmtp.nix ssmtp: add 'root' option 2014-11-05 02:47:59 +03:00
uim.nix More pkgs.lib -> lib fixes 2014-09-29 09:45:59 -04:00
venus.nix Rewrite ‘with pkgs.lib’ -> ‘with lib’ 2014-04-14 16:26:48 +02:00
virtualbox-host.nix virtualbox: Enable hardening by default. 2014-11-29 19:21:46 +01:00
virtualbox.nix nixos: Add enable option for programs/virtualbox. 2014-11-27 18:42:22 +01:00
wvdial.nix Rewrite ‘with pkgs.lib’ -> ‘with lib’ 2014-04-14 16:26:48 +02:00