Philip Potter
2216728979
add support for pam_u2f to nixos pam module
...
This adds support for authenticating using a U2F device such as a
yubikey neo.
2015-05-03 19:22:00 +01:00
Austin Seipp
8d3b8d0dc8
Merge pull request #7149 from joachifm/grsec-gradm-optional
...
grsecurity module: configure gradm iff RBAC is enabled
2015-04-13 17:11:29 -05:00
Austin Seipp
b86f6a3ed6
Merge pull request #7148 from joachifm/grsec-trivial
...
grsecurity module: trivial improvements
2015-04-13 17:10:47 -05:00
Nicolas B. Pierron
6de931a0f8
Merge rename.nix changes.
2015-04-03 23:12:12 +02:00
Arseniy Seroka
8592c6c004
Merge pull request #7150 from joachifm/grsec-types
...
grsecurity module: use types.enum
2015-04-03 16:03:49 +03:00
Joachim Fasting
3e847d512d
grsecurity module: configure gradm iff RBAC is enabled
2015-04-03 13:45:57 +02:00
Joachim Fasting
ba93a75724
grsecurity module: use types.enum
...
Also
- set desktop as default system
- make virtualisationSoftware nullOr
- make virtualisationConfig nullOr
2015-04-03 13:45:45 +02:00
Joachim Fasting
66c4f51046
grsecurity module: simplify assertion
2015-04-03 13:38:32 +02:00
Joachim Fasting
2e88605a91
grsecurity module: remove reference to systemd-sysctl
...
First, that's not what the service is called, and secondly it's
most likely irrelevant to the user.
2015-04-03 13:38:32 +02:00
Arseniy Seroka
4fa554e32b
Merge pull request #7017 from obadz/sg+sudo-g
...
Ability to switch groups with sg and sudo -g
2015-04-02 02:11:10 +03:00
obadz
be7f104502
sg: add setuid wrapper. (newgrp is a symlink to sg and was already setuid).
...
sudo: add ability for wheel users to change group (as well as user)
2015-03-30 23:50:45 +01:00
Austin Seipp
3ff22a924f
Merge pull request #6871 from joachifm/apparmor-fixups
...
Apparmor fixups
2015-03-20 15:36:42 -05:00
Joachim Fasting
532337d673
Cleanup AppArmor module
...
Remove excessive whitespace & comment sections
2015-03-18 12:07:43 +01:00
Austin Seipp
ef95600372
Merge pull request #6771 from joachifm/apparmor-2.9
...
Apparmor 2.9
2015-03-15 14:16:24 -05:00
Ricardo M. Correia
7c8247a8c5
grsecurity: Update stable and test patches
...
stable: 3.1-3.14.35-201503071140 -> 3.1-3.14.35-201503092203
test: 3.1-3.18.9-201503071142 -> 3.1-3.19.1-201503122205
2015-03-15 03:49:58 +01:00
Shea Levy
1d62ad4746
modules.nix: Generate the extra argument set from the configuration
...
This allows for module arguments to be handled modularly, in particular
allowing the nixpkgs module to handle the nixpkgs import internally.
This creates the __internal option namespace, which should only be added
to by the module system itself.
2015-03-12 23:42:57 +01:00
Joachim Fasting
7a9a24a95e
Update AppArmor service module
...
- Use AppArmor 2.9
- Enable PAM support
2015-03-12 11:49:05 +01:00
obadz
e5d4624420
PAM/eCryptfs now able to mount ecryptfs'd home directories on login
2015-03-08 16:03:51 -07:00
lethalman
c97d7819ab
Merge pull request #6624 from joachifm/grsec-lock
...
nixos: grsec-lock service fixes
2015-03-02 18:49:39 +01:00
Joachim Fasting
18320d3b21
nixos: fix grsec-lock requires
2015-03-02 18:39:04 +01:00
Joachim Fasting
ccd6f5a313
nixos: make the grsec-lock unit depend on the path it writes to
...
The grsec-lock unit fails unless /proc/sys/kernel/grsecurity/grsec_lock
exists and so prevents switching into a new configuration after enabling
grsecurity.sysctl.
2015-03-02 18:39:01 +01:00
Lluís Batlle i Rossell
b26e939111
fix pam (OATH related)
...
the pam config was wrong.
Issue #6551
2015-02-24 17:52:41 +01:00
Lluís Batlle i Rossell
4e99901961
nixos: Adding OATH in pam.
...
(cherry picked from commit cb3cba54a1b87c376d0801238cb827eadb18e39e)
Conflicts:
nixos/modules/security/pam.nix
2015-02-22 15:25:38 +01:00
Eelco Dolstra
5092d625d6
/etc/ssl/certs/ca-bundle.crt -> ca-certificates.crt
...
Even though there is no "official" standard location, it's better to
stick to what most distros are using.
2015-02-15 19:06:31 +01:00
Eelco Dolstra
75e1b5e317
Provide symlinks to ca-bundle.crt for compat with other distros
...
There is no "standard" location for the certificate bundle, so many
programs/libraries have various hard-coded default locations that
don't exist on NixOS. To make these more likely to work, provide
some symlinks.
2015-02-15 19:06:31 +01:00
Eelco Dolstra
d2bfb5ceb0
Add options for installing additional root certificates
2015-02-05 18:08:35 +01:00
Ricardo M. Correia
a11dc2f0a3
grsecurity: Add denyUSB
option to grsec NixOS module
...
The option had been added to the grsec build-support code,
but it hadn't been added to the grsec module.
After this commit, grsec module users will be able to change
the default value. It also serves to document that this option
exists and that NixOS will disable it by default.
2015-01-20 19:18:06 +01:00
Luca Bruno
804a958663
pam: add pam_wheel
2015-01-14 18:32:08 +01:00
Shea Levy
cca8bae86e
Merge branch 'rngd-fix' of git://github.com/abbradar/nixpkgs
2015-01-08 09:36:29 -05:00
Nikolay Amiantov
dbc0395b2b
nixos/rngd: some fixes
2015-01-06 17:27:07 +03:00
Nikolay Amiantov
a164a0b4c5
nixos/fprintd: add service and pam support
2015-01-03 19:50:40 +03:00
Tobias Geerinckx-Rice
c64257b8e5
Fix user-facing typos (mainly in descriptions)
2014-12-30 03:31:03 +01:00
Ricardo M. Correia
1d44322d53
grsecurity: Update stable and test patches
...
stable: 3.0-3.14.27-201412211908 -> 3.0-3.14.27-201412280859
test: 3.0-3.17.7-201412211910 -> 3.0-3.18.1-201412281149
2014-12-29 03:00:47 +01:00
Eelco Dolstra
89697b0fc1
Improve /etc/sudoers message
2014-12-18 11:51:42 +01:00
wmertens
3cecef15d7
Revert $GIT_SSL_CAINFO removal
...
Users have an older git in their user environment and it doesn't work without it. We should keep it around for a while.
2014-12-01 23:07:50 +01:00
wmertens
45c1b9147f
Merge pull request #5130 from wmertens/git-ssl-env
...
Let git use $SSL_CERT_FILE
2014-11-27 13:24:08 +01:00
Wout Mertens
72b81cf8bb
Remove unnecessary $GIT_SSL_CAINFO from sys env
2014-11-26 00:30:07 +01:00
Ricardo M. Correia
389143d808
grsecurity: Update assertion msg to correct major kernel versions
2014-11-16 18:52:39 +01:00
Mathijs Kwik
f356cee747
sudo: allow adding extra configuration options to the bottom of sudoers
...
from sudoers (5):
When multiple entries match for a user, they are applied in order.
Where there are multiple matches, the last match is used (which is not necessarily the most specific match).
2014-11-02 13:27:05 +01:00
Ricardo M. Correia
10348a0f2c
grsecurity: Update documentation to mention correct kernels
2014-10-22 16:50:36 +02:00
Eelco Dolstra
bb9ee6a13f
Remove some setuid wrappers for non-standard programs
2014-09-05 14:46:36 +02:00
Eelco Dolstra
cd7129a037
Revert "nixos: add setuid wrappers for some networked filesystems' helpers"
...
This reverts commit 26a4001a98
. It
breaks the NFS test:
http://hydra.nixos.org/build/13943148
Also, having more setuid programs is a bad thing security-wise.
2014-09-05 14:43:11 +02:00
Michael Raskin
419031bcfc
Merge pull request #2644 from lethalman/pam_tally
...
pam: Add logFailures option for adding pam_tally to su
2014-09-02 00:58:30 +04:00
Jan Malakhovski
26a4001a98
nixos: add setuid wrappers for some networked filesystems' helpers
...
So that `user` mount option would work allowing normal users to mount
and umount stuff marked with it in `fileSystems.<name>.options`.
2014-09-01 10:33:48 +04:00
Jan Malakhovski
8f50d803ef
nixos: add support for mkhomedir in PAM
2014-09-01 10:33:48 +04:00
Eelco Dolstra
785ed2b528
Don't silently ignore errors from the activation script
2014-08-15 02:14:34 +02:00
Vladimír Čunát
87c3c0e885
Merge master into #2129
...
Conflicts (easy, just UID shifted):
nixos/modules/misc/ids.nix
nixos/modules/module-list.nix
2014-08-12 19:24:08 +02:00
Eelco Dolstra
36f99a9a82
Set $SSL_CERT_FILE
...
It's more standard than $OPENSSL_X509_CERT_FILE (which I guess was a
totally unnecessary patch to OpenSSL). Since curl respects
$SSL_CERT_FILE, it's no longer needed to set $CURL_CA_BUNDLE. Git
unfortunately doesn't.
2014-07-28 19:09:32 +02:00
Rastus Vernon
d5daa8ae6f
Fix repeated typo
...
"Can either by" should be "Can either be". There are three occurrences of this mistake, all in descriptions of configuration options.
2014-07-11 23:14:53 -04:00
Jaka Hudoklin
16f801cba9
nixos/pam: make pam_loginuid optional if in container
2014-06-30 11:08:39 +02:00