Léo Gaspard
66e54f25a1
dhparams module: condition on enable option ( #23661 )
...
Hence, the init/cleanup service only runs when the dhparams module is enabled.
2017-03-17 01:56:13 +01:00
zetok
4ca17dd6c0
gresecurity docs: fix incorrect option ( #23789 )
2017-03-12 15:05:14 +01:00
Parnell Springmeyer
4c751ced37
security-wrapper: Don't remove the old paths yet as that can create migration pain
2017-03-08 08:57:52 -06:00
Jesper Geertsen Jonsson
056e57678d
grsecurity docs: fix syntax and indentation errors
...
Closes https://github.com/NixOS/nixpkgs/pull/23515
2017-03-05 16:05:43 +01:00
Thomas Tuegel
8eb4d2afbc
Remove top-level kde5 attribute
...
- There is no such thing as KDE 5
2017-02-27 11:49:10 -06:00
Robin Gloster
940492cef5
Merge pull request #22634 from Ekleog/dhparams
...
dhparams module: initialize
2017-02-23 17:16:04 +01:00
Vladimír Čunát
4509487e82
nixos polkit: fixup setuid wrapper of pkexec
...
Broken in 628e6a8Fixes #23083 .
2017-02-22 23:04:21 +01:00
Nikolay Amiantov
2cc4703a2d
wrappers service: make /run/wrappers a mountpoint
...
Also remove some compatibility code because the directory in question would be
shadowed by a mountpoint anyway.
2017-02-21 12:13:35 +03:00
Robin Gloster
12b4556642
Merge pull request #22882 from bjornfor/wireshark
...
nixos: add programs.wireshark option
2017-02-20 14:03:30 +01:00
Joachim F
6dbe55ca68
Merge pull request #20456 from ericsagnes/feat/loaf-dep-1
...
Use attrsOf in place of loaOf when relevant
2017-02-19 15:49:25 +01:00
Léo Gaspard
e2c78910d1
dhparams module: initialize
2017-02-18 00:07:03 +01:00
Robin Gloster
070825d443
setcapWrapper: add support for setting permissions
2017-02-17 15:42:54 +01:00
Benjamin Staffin
463e90273f
pam: add optional pam_kwallet5 integration
2017-02-16 02:26:42 -05:00
Bjørn Forsman
ce0a52f9bf
nixos/security.wrappers: improve documentation
...
* The source attribute is mandatory, not optional
* The program attribute is optional
* Move the info about the mandatory attribute first (most important,
IMHO)
2017-02-15 20:05:27 +01:00
Bjørn Forsman
f9cb2b5640
nixos/security.wrappers: use literalExample in documentation
...
It's much more readable when the example attrset is pretty printed
instead of written as one line.
2017-02-15 09:08:41 +01:00
Bjørn Forsman
448acd8e5e
nixos: remove remaining reference to setuidPrograms
...
The option doesn't exist anymore.
2017-02-15 07:25:33 +01:00
Parnell Springmeyer
1f83f1c878
security-wrapper: Wrap <para> tags in a <note> tag
2017-02-14 21:30:04 -06:00
Parnell Springmeyer
69794e333a
Using para tags for manual formatting
2017-02-14 08:53:30 -06:00
Parnell Springmeyer
794b3721bc
Syntax wibble
2017-02-14 08:42:08 -06:00
Parnell Springmeyer
e856d6efe8
Default should be to set owner and group to root on setcap wrappers too
2017-02-14 08:40:12 -06:00
Parnell Springmeyer
c01689f8da
Fixing ref to old-wrappersDir
2017-02-14 08:33:07 -06:00
Parnell Springmeyer
f8b8c353ff
Simplifying the wrapper program derivation
2017-02-14 08:27:40 -06:00
Parnell Springmeyer
fb6d13c01a
Addressing feedback and fixing a bug
2017-02-14 07:38:45 -06:00
Parnell Springmeyer
ba499e3aa0
Removing unused module option old-wrapperDir
2017-02-14 07:30:21 -06:00
Parnell Springmeyer
a27f35993d
Derp, correctly write the source program's path
2017-02-13 18:28:13 -06:00
Parnell Springmeyer
cca2e11556
Resurrecting the single-wrapper read from sibling .real file behavior
2017-02-13 18:03:06 -06:00
Parnell Springmeyer
9e36a58649
Merging against upstream master
2017-02-13 17:16:28 -06:00
Graham Christensen
96d767de62
pam_oath: require OATH and pam_unix credentials to be valid
2017-02-12 18:27:11 -05:00
Joachim Fasting
0c31286f75
grsecurity docs: some polish
...
Fix minor formatting issues, excessive punctuation, and also some
improved wording.
2017-02-03 18:47:07 +01:00
Parnell Springmeyer
128bdac94f
Conditionally logging debug messages based on the WRAPPER_DEBUG env var being set (or not)
2017-01-30 12:59:29 -06:00
Parnell Springmeyer
d8ecd5eb0d
Switching to individually generated derivations
2017-01-30 12:26:56 -06:00
Parnell Springmeyer
264db4e309
Set merge + mkIf always surprises me
2017-01-29 17:10:32 -06:00
Parnell Springmeyer
f2f3f1479e
Derp, wrong path name
2017-01-29 16:54:27 -06:00
Parnell Springmeyer
0f728de67e
More migration cleanup + todos for cleanup
2017-01-29 16:52:23 -06:00
Parnell Springmeyer
4856b42ab6
Gotta provide sane defaults! This is what I get for 5AM coding
2017-01-29 16:47:14 -06:00
Parnell Springmeyer
cfe4351c33
I'm clearly very tired
2017-01-29 05:39:54 -06:00
Parnell Springmeyer
1cc500ea8e
Syntax wibble
2017-01-29 05:34:50 -06:00
Parnell Springmeyer
628e6a83d0
More derp
2017-01-29 05:33:56 -06:00
Parnell Springmeyer
70b8167d4a
A few more tweaks
2017-01-29 05:05:30 -06:00
Parnell Springmeyer
4aa0923009
Getting rid of the var indirection and using a bin path instead
2017-01-29 04:11:01 -06:00
Parnell Springmeyer
af3b9a3d46
More wibbles?
2017-01-29 01:41:39 -06:00
Parnell Springmeyer
48564d1ae5
Another wibble
2017-01-29 01:31:33 -06:00
Parnell Springmeyer
5077699605
Derp derp
2017-01-29 01:27:11 -06:00
Parnell Springmeyer
0707a3eaa2
Qualify with lib
2017-01-29 01:23:10 -06:00
Parnell Springmeyer
8e159b9d1e
Qualify mkOption with lib
2017-01-29 01:22:47 -06:00
Parnell Springmeyer
70ec24093c
Removing dead code
2017-01-29 01:22:19 -06:00
Parnell Springmeyer
82de4c0fad
setcap-wrapper: Syntax wibble
2017-01-29 01:20:02 -06:00
Parnell Springmeyer
7680a40a37
setcap-wrapper: Syntax wibble
2017-01-29 01:16:04 -06:00
Parnell Springmeyer
2f113ee90a
setcap-wrapper: Minor refactor
2017-01-29 01:08:36 -06:00
Parnell Springmeyer
3fe7b1a4c9
setcap-wrapper: Addressing more PR feedback, unifying drvs, and cleaning up a bit
2017-01-29 01:07:12 -06:00
Parnell Springmeyer
e92b8402b0
Addressing PR feedback
2017-01-28 20:48:03 -08:00
Parnell Springmeyer
9de070e620
Setuid wrapper should not be constrained to a specific linux kernel version
2017-01-26 09:39:37 -08:00
Parnell Springmeyer
01e6b82f3f
Removing dead code
2017-01-26 09:20:15 -08:00
Parnell Springmeyer
189a0c2579
Wrap with quotes as-per GCC's recommendation
2017-01-26 02:07:36 -08:00
Parnell Springmeyer
c30cf645f8
Make setting of the wrapper macros a compile-time error
2017-01-26 02:06:24 -08:00
Parnell Springmeyer
a26a796d5c
Merging against master - updating smokingpig, rebase was going to be messy
2017-01-26 02:00:04 -08:00
Parnell Springmeyer
ad8fde5e5d
Andddd more derp
2017-01-26 01:33:25 -08:00
Parnell Springmeyer
ce36b58e21
Derp
2017-01-26 01:31:49 -08:00
Parnell Springmeyer
f64b06a3e0
Hmmm
2017-01-26 01:13:19 -08:00
Parnell Springmeyer
fd974085bf
It's clearly quite late
2017-01-26 01:04:12 -08:00
Parnell Springmeyer
61fe8de40c
Silly, should just have one activation script
2017-01-26 01:03:18 -08:00
Parnell Springmeyer
48a0c5a3a7
More fixing
2017-01-26 01:00:46 -08:00
Parnell Springmeyer
21368c4c67
Hmm, unnecessary
2017-01-26 00:58:44 -08:00
Parnell Springmeyer
a4f905afc2
Enhhh I think compile time macros are gross
2017-01-26 00:41:00 -08:00
Parnell Springmeyer
785684f6c2
Ahhh, my compile-time macros confused me...of course they did...
2017-01-26 00:39:17 -08:00
Parnell Springmeyer
1ad541171e
Hmm
2017-01-26 00:36:35 -08:00
Parnell Springmeyer
e8bec4c75f
Implicit declared function...
2017-01-26 00:35:01 -08:00
Parnell Springmeyer
a20e65724b
Fixing
2017-01-26 00:32:59 -08:00
Parnell Springmeyer
025555d7f1
More fixes and improvements
2017-01-26 00:05:40 -08:00
Parnell Springmeyer
bae00e8aa8
setcap-wrapper: Merging with upstream master and resolving conflicts
2017-01-25 11:08:05 -08:00
Franz Pletz
516760a6fb
nixos/acme: add random delay to timer
...
This way we behave like good citizens and won't overload Let's Encrypt
with lots of cert renewal requests at the same time.
2017-01-25 19:15:04 +01:00
Jörg Thalheim
30a554acfb
apparmor: support for lxc profiles
2017-01-10 23:01:03 +01:00
teh
a878365b77
nixos docs: update for Nginx + ACME ( #21320 )
...
Closes #20698 .
2017-01-09 06:39:10 +01:00
Alexander Kahl
61d125b842
sssd: init at 1.14.2
...
perlPackages.TextWrapI18N: init at 0.06
perlPackages.Po4a: init at 0.47
jade: init at 1.2.1
ding-libs: init at 0.6.0
Switch nscd to no-caching mode if SSSD is enabled.
abbradar: disable jade parallel building.
Closes #21150
2017-01-04 03:07:20 +03:00
Joachim Fasting
f39d13cd3e
grsecurity doc: describe work-around for gitlab
...
Fixes https://github.com/NixOS/nixpkgs/issues/20959
2016-12-08 11:59:57 +01:00
Joachim Fasting
984d9ebb56
hidepid: polkit and systemd-logind compatibility
...
`systemd.hideProcessInformation = true`, would break interactions
requiring polkit arbitration such as initating poweroff/reboot as a
normal user; the polkit daemon cannot be expected to make decisions
about processes that don't exist as far as it is concerned.
systemd-logind lacks the `sys_ptrace` capability and so needs to be part
of the designated proc gid, even though it runs as root.
Fixes https://github.com/NixOS/nixpkgs/issues/20948
2016-12-07 01:12:05 +01:00
Joachim Fasting
0e765c72e5
grsecurity: enable module hardening
2016-12-06 01:23:58 +01:00
Joachim Fasting
31d79afbe5
grsecurity docs: note that pax_sanitize_slab defaults to fast
2016-12-06 01:23:51 +01:00
Joachim Fasting
071fbcda24
grsecurity: enable optional sysfs restrictions
...
Fairly severe, but can be disabled at bootup via
grsec_sysfs_restrict=0. For the NixOS module we ensure that it is
disabled, for systemd compatibility.
2016-12-06 01:23:36 +01:00
Joachim Fasting
8c1f5afdf3
grsecurity: delay toggling of sysctls until system is up
...
We generally trust init, so there's little point in having these enabled
during early bootup; it accomplishes little except fill our logs with
spam.
2016-12-06 01:22:53 +01:00
Domen Kožar
75f131da02
acme: ensure nginx challenges directory is writeable
2016-11-29 15:56:01 +01:00
Joachim Fasting
e99228db30
grsecurity module: force a known good kernel package set
...
Previously, we would only set a default value, on the theory that
`boot.kernelPackages` could be used to sanely configure a custom grsec
kernel. Regrettably, this is not the case and users who expect e.g.,
`boot.kernelPackages = pkgs.linuxPackages_latest` to work will end up
with a non-grsec kernel (this problem has come up twice on the bug
tracker recently).
With this patch, `security.grsecurity.enable = true` implies
`boot.kernelPackages = linuxPackages_grsec_nixos` and any customization
must be done via package override or by eschewing the module.
2016-11-28 12:11:04 +01:00
Joachim Fasting
2eb6ec1bc4
grsecurity module: remove code pertaining to zfs
...
I don't know if it still the case that zfs fails to boot; either way,
that's the user's responsibility to contend with.
2016-11-20 23:01:22 +01:00
Joachim Fasting
98935c7103
grsecurity module: remove requiredKernelConfig
...
Using a custom package set with the NixOS module is no longer
something I wish to support. It's still *possible* but not
advertised. Secondly, the requiredKernelConfig didn't really
do anything (setting kernelPackages to a non-grsec kernel would
just silently let the user boot into a non-grsec setup ...).
2016-11-20 23:00:41 +01:00
Joachim Fasting
5ad8a56d16
grsecurity module: remove use of mkEnableOption
2016-11-20 23:00:24 +01:00
Eric Sagnes
9513ab45aa
duosec module: use enum
2016-11-16 22:36:05 +09:00
Eric Sagnes
e5b7975fe3
acme module: certs option loaOf -> attrsOf
2016-11-16 16:28:27 +09:00
Timofei Kushnir
faa6f9b6b3
grsecurity: fix 'isYes' and 'isNo'
2016-10-29 14:26:06 +03:00
Domen Kožar
41c490b75e
acme: we do want to support ipv4 afterall
2016-10-21 13:25:11 +02:00
Domen Kožar
d8f21b3ca3
acme: provide full nginx example
...
(cherry picked from commit 2af7382f76a6523f1220637b3ec49ad25a02b040)
Signed-off-by: Domen Kožar <domen@dev.si>
2016-10-21 13:19:04 +02:00
Alexander Ried
d91365d714
audit module: only enable service if kernel has audit ( #19569 )
2016-10-15 16:03:41 +02:00
Franz Pletz
0d59fc1169
cacerts: refactor, add blacklist option
...
Previously, the list of CA certificates was generated with a perl script
which is included in curl. As this script is not very flexible, this commit
refactors the expression to use the python script that Debian uses to
generate their CA certificates from Mozilla's trust store in NSS.
Additionally, an option was added to the cacerts derivation and the
`security.pki` module to blacklist specific CAs.
2016-10-09 02:00:18 +02:00
Ricardo M. Correia
1623476904
nixos.acme: make timer persistent
...
This makes sure that if the system was powered off when the timer was
supposed to trigger, it will run the next time the system boots up.
2016-10-03 19:31:42 +02:00
Joachim Fasting
98e2b90cf3
grsecurity doc: note that module autoload hardening is disabled
2016-10-02 19:25:58 +02:00
Joachim Fasting
1bb7b44cd7
grsecurity: make GRKERNSEC y and PAX y implicit
...
These options should always be specified. Note, an implication of this
change is that not specifying any grsec/PaX options results in a build
failure.
2016-10-02 19:25:58 +02:00
Joachim F
7e80c42b0e
Merge pull request #18511 from ericsagnes/feat/remove-optionSet
...
modules: optionSet -> submodule
2016-10-01 17:57:45 +02:00
Shea Levy
3f02cbbcaf
Merge branch 'rngd-wantedBy' of git://github.com/srp/nixpkgs-1
2016-09-19 19:06:51 -04:00
Scott R. Parish
a560223119
rngd: update modalias to match cpu type
...
It looks like the cpu type part of modalias might have changed, my
systems (4.4.20 and 4.7.2) show something like the following:
```
cpu:type:x86,ven0000fam0006mod003F:feature:,0000,0001,0002,0003,0004,0005,0006,0007,0008,0009,000B,000C,000D,000E,000F,0010,0011,0013,0017,0018,0019,001A,001C,002B,0034,003B,003D,0068,006F,0070,0072,0074,0075,0076,007D,0080,0081,0089,008C,008D,0091,0093,0094,0095,0096,0097,0098,0099,009A,009B,009C,009D,009E,009F,00C0,00C5,0120,0123,0125,0127,0128,0129,012A,0140
```
Update the rngd modalias rule to match this so udev properly has
systemd start rngd.
2016-09-17 18:36:57 -07:00
Thomas Tuegel
9300b4903f
Revert "nixos/pam: clean up generated files (no functional change) ( #18580 )"
...
This reverts commit 1010271c63e85e51d41f
2016-09-17 16:39:49 -05:00
aszlig
e85e51d41f
nixos/pam: Fix wrong string concatenation
...
Regression introduced by 1010271c63
2016-09-16 15:36:31 +02:00
