MirrorHub/nixpkgs
0
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2024-11-16 14:54:29 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

systemd-boot: allow setting editor security option (#21853)

Browse source
This commit is contained in:
Linus Heckemann 2017-01-21 13:24:26 +00:00 committed by Franz Pletz
parent 140d135ee2
commit 98bd722d1d
2 changed files with 18 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
View file

@ -28,6 +28,8 @@ def write_loader_conf(generation):
if "@timeout@" != "":
f.write("timeout @timeout@\n")
f.write("default nixos-generation-%d\n" % generation)
if not @editor@:
f.write("editor 0");
os.rename("@efiSysMountPoint@/loader/loader.conf.tmp", "@efiSysMountPoint@/loader/loader.conf")
def copy_from_profile(generation, name, dry_run=False):

16
nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix
View file

@ -20,6 +20,8 @@ let
timeout = if config.boot.loader.timeout != null then config.boot.loader.timeout else "";
editor = if cfg.editor then "True" else "False";
inherit (efi) efiSysMountPoint canTouchEfiVariables;
};
in {
@ -36,6 +38,20 @@ in {
description = "Whether to enable the systemd-boot (formerly gummiboot) EFI boot manager";
};
editor = mkOption {
default = true;
type = types.bool;
description = ''
Whether to allow editing the kernel command-line before
boot. It is recommended to set this to false, as it allows
gaining root access by passing init=/bin/sh as a kernel
parameter. However, it is enabled by default for backwards
compatibility.
''
};
};
config = mkIf cfg.enable {