nixpkgs/nixos/modules/config
Klemens Nanni 8833983f26 nixos/users-groups: createHome: Ensure HOME permissions, fix description
configuration.nix(1) states

    users.extraUsers.<name>.createHome
        [...] If [...] the home directory already exists but is not
        owned by the user, directory owner and group will be changed to
        match the user.

i.e. ownership would change only if the user mismatched;  the code
however ignores the owner, it is sufficient to enable `createHome`:

    if ($u->{createHome}) {
        make_path($u->{home}, { mode => 0700 }) if ! -e $u->{home};
        chown $u->{uid}, $u->{gid}, $u->{home};
    }

Furthermore, permissions are ignored on already existing directories and
therefore may allow others to read private data eventually.

Given that createHome already acts as switch to not only create but
effectively own the home directory, manage permissions in the same
manner to ensure the intended default and cover all primary attributes.

Avoid yet another configuration option to have administrators make a
clear and simple choice between securely managing home directories
and optionally defering management to own code (taking care of custom
location, ownership, mode, extended attributes, etc.).

While here, simplify and thereby fix misleading documentation.
2020-12-16 03:40:29 +01:00
..
fonts fontdir: add ttc to font regex 2020-10-26 10:45:22 +08:00
gtk gtk-icon-cache: get native gtk3 for icon cache 2020-03-06 00:45:48 -05:00
krb5 nixos/krb5: add list to example configuration 2020-08-25 17:18:56 +02:00
xdg nixos: add freedesktop/gnome/myself maintainers 2020-04-01 20:53:09 -04:00
appstream.nix nixos/modules: remove trailing whitespace 2020-08-07 14:45:39 +01:00
console.nix nixos/console: set colors using kernel parameters 2019-12-20 00:27:35 +01:00
debug-info.nix Set $NIX_DEBUG_INFO_DIRS when environment.enableDebugInfo is enabled 2017-10-10 12:04:57 +02:00
gnu.nix treewide: isArm -> isAarch32 2018-04-25 15:28:55 -04:00
i18n.nix nixos i18n.supportedLocales: increase systemPackages priority 2020-06-11 10:22:20 +02:00
iproute2.nix alternative for iproute module (#41801) 2018-09-01 20:28:23 +02:00
ldap.nix Merge pull request #98731 from mayflower/ldap-nss-optional 2020-12-12 10:53:39 +01:00
locale.nix timezone.nix -> locale.nix 2019-08-12 11:56:40 -04:00
malloc.nix nixos/malloc: fix Scudo 2020-11-17 09:11:31 -05:00
networking.nix nixos/networking: Add the FQDN and hostname to /etc/hosts 2020-05-25 14:06:25 +02:00
no-x-libs.nix nixos/no-x-libs: add networkmanager-sstp 2020-10-21 00:04:02 +02:00
nsswitch.nix nixos/nsswitch: improve error message 2020-05-11 16:14:51 +02:00
power-management.nix nixos/power-management: always run systemctl of the currently running systemd 2020-05-21 10:28:29 +02:00
pulseaudio.nix Merge pull request #103225 from gebner/hsphfpd 2020-11-11 19:56:35 +01:00
qt5.nix nixos/qt5: support adwaita-dark theme 2020-04-05 08:38:08 +03:00
resolvconf.nix nixos/resolvconf: always run systemctl of the currently running systemd 2020-05-21 10:29:22 +02:00
shells-environment.nix nixos: default environment.homeBinInPath to false 2019-11-26 12:44:12 +01:00
swap.nix utillinux: rename to util-linux 2020-11-24 12:42:06 -05:00
sysctl.nix nixos/sysctl: reduce prio of "kernel.kptr_restrict" to mkDefault 2019-09-26 10:09:31 +01:00
system-environment.nix nixos/system-environment: prepend wrapperDir to PATH (#70430) 2019-10-15 13:17:38 +02:00
system-path.nix utillinux: rename to util-linux 2020-11-24 12:42:06 -05:00
terminfo.nix nixos/terminfo: use profileRelativeSessionVariables 2019-09-18 11:13:42 -04:00
unix-odbc-drivers.nix Fix documentation typo 2019-10-09 19:43:12 +09:00
update-users-groups.pl nixos/users-groups: createHome: Ensure HOME permissions, fix description 2020-12-16 03:40:29 +01:00
users-groups.nix nixos/users-groups: createHome: Ensure HOME permissions, fix description 2020-12-16 03:40:29 +01:00
vte.nix nixos: add freedesktop/gnome/myself maintainers 2020-04-01 20:53:09 -04:00
zram.nix nixos/zram: add zramSwap.memoryMax option 2020-11-25 13:43:38 +00:00