f40f98a732
Change order of pam_mount.conf.xml so that users can override the preset configs.
My use case is to mount a gocryptfs (a fuse program) volume. I can not do that in current order.
Because even if I change the `<fusermount>` and `<fuserumount>` by add below to extraVolumes
```
<fusemount>${pkgs.fuse}/bin/mount.fuse %(VOLUME) %(MNTPT) "%(before=\"-o \" OPTIONS)"</fusemount>
<fuseumount>${pkgs.fuse}/bin/fusermount -u %(MNTPT)</fuseumount>
```
mount.fuse still does not work because it can not find `fusermount`. pam_mount will told stat /bin/fusermount failed.
Fine, I can add a `<path>` section to extraVolumes
```
<path>${pkgs.fuse}/bin:${pkgs.coreutils}/bin:${pkgs.utillinux}/bin</path>
```
but then the `<path>` section is overridden by the hardcoded `<path>${pkgs.utillinux}/bin</path>` below. So it still does not work.
72 lines
2.3 KiB
Nix
72 lines
2.3 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
with lib;
|
|
|
|
let
|
|
cfg = config.security.pam.mount;
|
|
|
|
anyPamMount = any (attrByPath ["pamMount"] false) (attrValues config.security.pam.services);
|
|
in
|
|
|
|
{
|
|
options = {
|
|
|
|
security.pam.mount = {
|
|
enable = mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
description = ''
|
|
Enable PAM mount system to mount fileystems on user login.
|
|
'';
|
|
};
|
|
|
|
extraVolumes = mkOption {
|
|
type = types.listOf types.str;
|
|
default = [];
|
|
description = ''
|
|
List of volume definitions for pam_mount.
|
|
For more information, visit <link
|
|
xlink:href="http://pam-mount.sourceforge.net/pam_mount.conf.5.html" />.
|
|
'';
|
|
};
|
|
};
|
|
|
|
};
|
|
|
|
config = mkIf (cfg.enable || anyPamMount) {
|
|
|
|
environment.systemPackages = [ pkgs.pam_mount ];
|
|
environment.etc = [{
|
|
target = "security/pam_mount.conf.xml";
|
|
source =
|
|
let
|
|
extraUserVolumes = filterAttrs (n: u: u.cryptHomeLuks != null) config.users.users;
|
|
userVolumeEntry = user: "<volume user=\"${user.name}\" path=\"${user.cryptHomeLuks}\" mountpoint=\"${user.home}\" />\n";
|
|
in
|
|
pkgs.writeText "pam_mount.conf.xml" ''
|
|
<?xml version="1.0" encoding="utf-8" ?>
|
|
<!DOCTYPE pam_mount SYSTEM "pam_mount.conf.xml.dtd">
|
|
<!-- auto generated from Nixos: modules/config/users-groups.nix -->
|
|
<pam_mount>
|
|
<debug enable="0" />
|
|
|
|
<!-- if activated, requires ofl from hxtools to be present -->
|
|
<logout wait="0" hup="no" term="no" kill="no" />
|
|
<!-- set PATH variable for pam_mount module -->
|
|
<path>${pkgs.utillinux}/bin</path>
|
|
<!-- create mount point if not present -->
|
|
<mkmountpoint enable="1" remove="true" />
|
|
|
|
<!-- specify the binaries to be called -->
|
|
<cryptmount>${pkgs.pam_mount}/bin/mount.crypt %(VOLUME) %(MNTPT)</cryptmount>
|
|
<cryptumount>${pkgs.pam_mount}/bin/umount.crypt %(MNTPT)</cryptumount>
|
|
<pmvarrun>${pkgs.pam_mount}/bin/pmvarrun -u %(USER) -o %(OPERATION)</pmvarrun>
|
|
|
|
${concatStrings (map userVolumeEntry (attrValues extraUserVolumes))}
|
|
${concatStringsSep "\n" cfg.extraVolumes}
|
|
</pam_mount>
|
|
'';
|
|
}];
|
|
|
|
};
|
|
}
|