Commit graph

17 commits

Author SHA1 Message Date
Eelco Dolstra
a6f410f144 * Obsolete security.extraSetuidPrograms.
svn path=/nixos/trunk/; revision=32723
2012-03-01 20:10:46 +00:00
Peter Simons
20b364f4de Reverting revisions 30103-30106: "always set nixpkgs.config.{state,store}Dir", etc.
After the change from revision 30103, nixos-rebuild suddenly consumed
freaky amounts of memory. I had to abort the process after it had
allocated well in excess of 30GB(!) of RAM. I'm not sure what is causing
this behavior, but undoing that assignment fixes the problem. The other
two commits needed to be revoked, too, because they depend on 30103.

svn path=/nixos/trunk/; revision=30127
2011-10-30 15:19:58 +00:00
Shea Levy
09cf6ce70c find modules | fgrep .nix | fgrep -v .svn | fgrep -v nixpkgs.nix | xargs sed -i -e 's|/nix/var|${config.nixpkgs.config.nix.stateDir}|g' -e 's|/nix/store|${config.nixpkgs.config.nix.storeDir}|g'
Don't assume /nix/store or /nix/var in NixOS modules, this is configurable

svn path=/nixos/trunk/; revision=30104
2011-10-29 21:03:57 +00:00
Peter Simons
eb6e1310b8 strip trailing whitespace; no functional change
svn path=/nixos/trunk/; revision=29285
2011-09-14 18:20:50 +00:00
Michael Raskin
f6bc3d61cf To prevent glibc bug exploitation, make setuid-wrappers unreadable to non-root users
svn path=/nixos/trunk/; revision=24378
2010-10-20 09:29:02 +00:00
Lluís Batlle i Rossell
79ded36abf Making cron/fcron set their setuid wrappers. And made fcron use the nixos systemCrontabJobs by
default.
It does not look very modular, and the manual may not look very good, but I think it
works better than before. And setting cron.enable = false and fcron.enable = true works fine.


svn path=/nixos/trunk/; revision=24199
2010-10-10 11:35:15 +00:00
Eelco Dolstra
f729f12e4e Some cleanups in the activation script:
* Moved some scriptlets to the appropriate modules.
* Put the scriptlet that sets the default path at the start, since it
  never makes sense not to have it there.  It no longer needs to be
  declared as a dependency.
* If a scriptlet has no dependencies, it can be denoted as a plain
  string (i.e., `noDepEntry' is not needed anymore).

svn path=/nixos/trunk/; revision=23762
2010-09-13 15:41:38 +00:00
Yury G. Kudryashov
f0eb823a34 Add unix_chkpwd suid wrapper
svn path=/nixos/trunk/; revision=23165
2010-08-13 14:07:34 +00:00
Eelco Dolstra
c089738bdc * Use the shadow' package instead of pwdutils', `pam_login' and
`su'.
* The `usermod' from `shadow' allows setting a supplementary group
  equal to the user's primary group, so the special hack for the
  `nixbld' group is no longer needed.
* Removed /etc/default/passwd since it's not used by the new passwd.
  The hash is configured in pam_unix.
* Move some values for `security.setuidPrograms' and
  `security.pam.services' to the appropriate modules.

svn path=/nixos/trunk/; revision=22107
2010-06-02 21:10:48 +00:00
Eelco Dolstra
540c673364 * Enable the `chfn' program. Note that by default non-root users are
still not permitted to change their account information, as
  specified in login.defs.

svn path=/nixos/trunk/; revision=22049
2010-05-28 14:59:34 +00:00
Yury G. Kudryashov
7ae39feedb Get rid of extraSetuidPrograms.
Also state in description that it is obsolete.

svn path=/nixos/trunk/; revision=21777
2010-05-14 21:01:06 +00:00
Eelco Dolstra
26439de75b * security.setuidPrograms: don't set the default in the "default"
mkOption argument, because then we lose them if somebody sets
  security.setuidPrograms somewhere else.  (Shouldn't "default" be
  merged as well?)

svn path=/nixos/trunk/; revision=16734
2009-08-16 21:11:04 +00:00
Eelco Dolstra
dba1964122 * setuid-wrappers: support setting the mode. For instance, some
programs require that the mode is 4550 so that execution of the
  setuid program can be restricted to members of a group.
* setuid-wrappers: remove a race condition in the creation of the
  wrappers if the ownership or mode was different than root:root and
  4555.
* setuid-wrappers: allow the full path of the wrapped program to be
  specified, rather than looking it up in $PATH.

svn path=/nixos/trunk/; revision=16733
2009-08-16 17:24:59 +00:00
Eelco Dolstra
2884c9a836 * Style change.
svn path=/nixos/trunk/; revision=16730
2009-08-16 14:54:31 +00:00
Nicolas Pierron
47f70fda2f Fix fullDepEntry location in setuid-wrappers.nix.
svn path=/nixos/branches/modular-nixos/; revision=15733
2009-05-26 14:10:20 +00:00
Eelco Dolstra
c96f0d75f0 * Move the setuid wrappers activation scriptlet to
modules/security/setuid-wrappers.nix.
* Removed the "path" activation scriptlet.  The partial ordering was
  underspecified (there was nothing ensuring that it came near the end
  of the activation script), and it wasn't needed in any case.

svn path=/nixos/branches/modular-nixos/; revision=15726
2009-05-25 15:36:57 +00:00
Eelco Dolstra
a65aae0140 * Moved more modules.
svn path=/nixos/branches/modular-nixos/; revision=15722
2009-05-25 13:42:46 +00:00
Renamed from system/nixos-security.nix (Browse further)