commit 8d977ead386cf29b8b395caca536bfaec9c36efe · pyrox.dev/nixpkgs

pyrox.dev / nixpkgs

lol

setuid-wrappers : Prepare permissions for running wrappers

The new setuid-wrappers in /run cannot be executed by users due to:

1) the temporary directory does not allow access
2) the /run is mounted nosuid

authored by Karn Kallio and committed by Joachim Fasting 9 years ago 8d977ead d3ee483b

+2 -1

2 changed files

expand all

unified split

nixos

modules

security

setuid-wrappers.nix

tasks

filesystems.nix

nixos/modules/security/setuid-wrappers.nix

··· 117 117 118 118 mkdir -p /run/setuid-wrapper-dirs 119 119 wrapperDir=$(mktemp --directory --tmpdir=/run/setuid-wrapper-dirs setuid-wrappers.XXXXXXXXXX) 120 + chmod a+rx $wrapperDir 120 121 121 122 ${concatMapStrings makeSetuidWrapper setuidPrograms} 122 123

+1 -1

nixos/modules/tasks/filesystems.nix

··· 287 287 boot.specialFileSystems = { 288 288 "/proc" = { fsType = "proc"; options = [ "nosuid" "noexec" "nodev" ]; }; 289 289 "/sys" = { fsType = "sysfs"; options = [ "nosuid" "noexec" "nodev" ]; }; 290 - "/run" = { fsType = "tmpfs"; options = [ "nosuid" "nodev" "strictatime" "mode=755" "size=${config.boot.runSize}" ]; }; 290 + "/run" = { fsType = "tmpfs"; options = [ "nodev" "strictatime" "mode=755" "size=${config.boot.runSize}" ]; }; 291 291 "/dev" = { fsType = "devtmpfs"; options = [ "nosuid" "strictatime" "mode=755" "size=${config.boot.devSize}" ]; }; 292 292 "/dev/shm" = { fsType = "tmpfs"; options = [ "nosuid" "nodev" "strictatime" "mode=1777" "size=${config.boot.devShmSize}" ]; }; 293 293 "/dev/pts" = { fsType = "devpts"; options = [ "nosuid" "noexec" "mode=620" "gid=${toString config.ids.gids.tty}" ]; };