Something went wrong. Try again.
What happens if I push all of nixpkgs
Something went wrong. Try again.
Nix
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301{ config, lib, pkgs, ...}:let cfg = config.security.doas;
inherit (pkgs) doas;
mkUsrString = user: toString user;
mkGrpString = group: ":${toString group}";
mkOpts = rule: lib.concatStringsSep " " [ (lib.optionalString rule.noPass "nopass") (lib.optionalString rule.noLog "nolog") (lib.optionalString rule.persist "persist") (lib.optionalString rule.keepEnv "keepenv") "setenv { SSH_AUTH_SOCK TERMINFO TERMINFO_DIRS ${lib.concatStringsSep " " rule.setEnv} }" ];
mkArgs = rule: if (rule.args == null) then "" else if (lib.length rule.args == 0) then "args" else "args ${lib.concatStringsSep " " rule.args}";
mkRule = rule: let opts = mkOpts rule;
as = lib.optionalString (rule.runAs != null) "as ${rule.runAs}";
cmd = lib.optionalString (rule.cmd != null) "cmd ${rule.cmd}";
args = mkArgs rule; in lib.optionals (lib.length cfg.extraRules > 0) [ (lib.optionalString (lib.length rule.users > 0) ( map (usr: "permit ${opts} ${mkUsrString usr} ${as} ${cmd} ${args}") rule.users )) (lib.optionalString (lib.length rule.groups > 0) ( map (grp: "permit ${opts} ${mkGrpString grp} ${as} ${cmd} ${args}") rule.groups )) ];in{
###### interface
options.security.doas = {
enable = lib.mkOption { type = with lib.types; bool; default = false; description = '' Whether to enable the {command}`doas` command, which allows non-root users to execute commands as root. ''; };
wheelNeedsPassword = lib.mkOption { type = with lib.types; bool; default = true; description = '' Whether users of the `wheel` group must provide a password to run commands as super user via {command}`doas`. ''; };
extraRules = lib.mkOption { default = [ ]; description = '' Define specific rules to be set in the {file}`/etc/doas.conf` file. More specific rules should come after more general ones in order to yield the expected behavior. You can use `mkBefore` and/or `mkAfter` to ensure this is the case when configuration options are merged. Be aware that this option cannot be used to override the behaviour allowing passwordless operation for root. ''; example = lib.literalExpression '' [ # Allow execution of any command by any user in group doas, requiring # a password and keeping any previously-defined environment variables. { groups = [ "doas" ]; noPass = false; keepEnv = true; }
# Allow execution of "/home/root/secret.sh" by user `backup` OR user # `database` OR any member of the group with GID `1006`, without a # password. { users = [ "backup" "database" ]; groups = [ 1006 ]; cmd = "/home/root/secret.sh"; noPass = true; }
# Allow any member of group `bar` to run `/home/baz/cmd1.sh` as user # `foo` with argument `hello-doas`. { groups = [ "bar" ]; runAs = "foo"; cmd = "/home/baz/cmd1.sh"; args = [ "hello-doas" ]; }
# Allow any member of group `bar` to run `/home/baz/cmd2.sh` as user # `foo` with no arguments. { groups = [ "bar" ]; runAs = "foo"; cmd = "/home/baz/cmd2.sh"; args = [ ]; }
# Allow user `abusers` to execute "nano" and unset the value of # SSH_AUTH_SOCK, override the value of ALPHA to 1, and inherit the # value of BETA from the current environment. { users = [ "abusers" ]; cmd = "nano"; setEnv = [ "-SSH_AUTH_SOCK" "ALPHA=1" "BETA" ]; } ] ''; type = with lib.types; listOf (submodule { options = {
noPass = lib.mkOption { type = with types; bool; default = false; description = '' If `true`, the user is not required to enter a password. ''; };
noLog = lib.mkOption { type = with types; bool; default = false; description = '' If `true`, successful executions will not be logged to {manpage}`syslogd(8)`. ''; };
persist = lib.mkOption { type = with types; bool; default = false; description = '' If `true`, do not ask for a password again for some time after the user successfully authenticates. ''; };
keepEnv = lib.mkOption { type = with types; bool; default = false; description = '' If `true`, environment variables other than those listed in {manpage}`doas(1)` are kept when creating the environment for the new process. ''; };
setEnv = lib.mkOption { type = with types; listOf str; default = [ ]; description = '' Keep or set the specified variables. Variables may also be removed with a leading '-' or set using `variable=value`. If the first character of `value` is a '$', the value to be set is taken from the existing environment variable of the indicated name. This option is processed after the default environment has been created.
NOTE: All rules have `setenv { SSH_AUTH_SOCK }` by default. To prevent `SSH_AUTH_SOCK` from being inherited, add `"-SSH_AUTH_SOCK"` anywhere in this list. ''; };
users = lib.mkOption { type = with types; listOf (either str int); default = [ ]; description = "The usernames / UIDs this rule should apply for."; };
groups = lib.mkOption { type = with types; listOf (either str int); default = [ ]; description = "The groups / GIDs this rule should apply for."; };
runAs = lib.mkOption { type = with types; nullOr str; default = null; description = '' Which user or group the specified command is allowed to run as. When set to `null` (the default), all users are allowed.
A user can be specified using just the username: `"foo"`. It is also possible to only allow running as a specific group with `":bar"`. ''; };
cmd = lib.mkOption { type = with types; nullOr str; default = null; description = '' The command the user is allowed to run. When set to `null` (the default), all commands are allowed.
NOTE: It is best practice to specify absolute paths. If a relative path is specified, only a restricted PATH will be searched. ''; };
args = lib.mkOption { type = with types; nullOr (listOf str); default = null; description = '' Arguments that must be provided to the command. When set to `[]`, the command must be run without any arguments. ''; }; }; }); };
extraConfig = lib.mkOption { type = with lib.types; lines; default = ""; description = '' Extra configuration text appended to {file}`doas.conf`. Be aware that this option cannot be used to override the behaviour allowing passwordless operation for root. ''; }; };
###### implementation
config = lib.mkIf cfg.enable {
security.doas.extraRules = lib.mkOrder 600 [ { groups = [ "wheel" ]; noPass = !cfg.wheelNeedsPassword; } ];
security.wrappers.doas = { setuid = true; owner = "root"; group = "root"; source = "${doas}/bin/doas"; };
environment.systemPackages = [ doas ];
security.pam.services.doas = { allowNullPassword = true; sshAgentAuth = true; };
environment.etc."doas.conf" = { source = pkgs.runCommand "doas-conf" { src = pkgs.writeText "doas-conf-in" '' # To modify this file, set the NixOS options # `security.doas.extraRules` or `security.doas.extraConfig`. To # completely replace the contents of this file, use # `environment.etc."doas.conf"`.
# extraRules ${lib.concatStringsSep "\n" (lib.lists.flatten (map mkRule cfg.extraRules))}
# extraConfig ${cfg.extraConfig}
# "root" is allowed to do anything. permit nopass keepenv root ''; preferLocalBuild = true; } # Make sure that the doas.conf file is syntactically valid. "${pkgs.buildPackages.doas}/bin/doas -C $src && cp $src $out"; mode = "0440"; };
};
meta.maintainers = with lib.maintainers; [ cole-h ];}