My nixpkgs mirror for patching things.
Go to file
Jamey Sharp f7c776760b nixos/nscd: only drop privs after nss module init
NixOS usually needs nscd just to have a single place where
LD_LIBRARY_PATH can be set to include all NSS modules, but nscd is also
useful if some of the NSS modules need to read files which are only
accessible by root.

For example, nixos/modules/config/ldap.nix needs this when
  users.ldap.enable = true;
  users.ldap.daemon.enable = false;
and users.ldap.bind.passwordFile exists. In that case, the module
creates an /etc/ldap.conf which is only readable by root, but which the
NSS module needs to read in order to find out what LDAP server to
connect to and with what credentials.

If nscd is started as root and configured with the server-user option in
nscd.conf, then it gives each NSS module the opportunity to initialize
itself before dropping privileges. The initialization happens in the
glibc-internal __nss_disable_nscd function, which pre-loads all the
configured NSS modules for passwd, group, hosts, and services (but not
netgroup for some reason?) and, for each loaded module, calls an init
function if one is defined. After that finishes, nscd's main() calls
nscd_init() which ends by calling finish_drop_privileges().

There are provisions in systemd for using DynamicUser with a service
which needs to drop privileges itself, so this patch does that.
2019-07-07 08:43:41 -07:00
.github PULL_REQUEST_TEMPLATE: "Assured whether" -> "Ensured that" 2019-07-01 11:22:48 +01:00
doc Merge pull request #61385 from eraserhd/kakoune-plugins 2019-06-26 20:36:17 +00:00
lib treewide: remove unused variables (#63177) 2019-06-16 19:59:05 +00:00
maintainers Merge pull request #63656 from killercup/dua-2.1.3 2019-07-03 07:03:12 -04:00
nixos nixos/nscd: only drop privs after nss module init 2019-07-07 08:43:41 -07:00
pkgs way-cooler: Mark as broken (#64138) 2019-07-03 18:51:02 +02:00
.editorconfig
.gitattributes
.gitignore
.version 19.09 is Loris. 2019-02-25 23:21:14 +01:00
COPYING COPYING: include 2019 2019-03-18 19:55:33 -07:00
default.nix
README.md README: 18.09 -> 19.03 2019-04-28 19:15:08 +02:00

logo

Code Triagers Badge

Nixpkgs is a collection of packages for the Nix package manager. It is periodically built and tested by the Hydra build daemon as so-called channels. To get channel information via git, add nixpkgs-channels as a remote:

% git remote add channels https://github.com/NixOS/nixpkgs-channels.git

For stability and maximum binary package support, it is recommended to maintain custom changes on top of one of the channels, e.g. nixos-19.03 for the latest release and nixos-unstable for the latest successful build of master:

% git remote update channels
% git rebase channels/nixos-19.03

For pull requests, please rebase onto nixpkgs master.

NixOS Linux distribution source code is located inside nixos/ folder.

Communication:

Note: MIT license does not apply to the packages built by Nixpkgs, merely to the package descriptions (Nix expressions, build scripts, and so on). It also might not apply to patches included in Nixpkgs, which may be derivative works of the packages to which they apply. The aforementioned artifacts are all covered by the licenses of the respective packages.