pyrox.dev / nixpkgs
lol
fork atom

namecoind nixos module: security enhancements

Thomas Strobel 8db7c14e 13e2d224

+24 -2
unified split
+1 -1
nixos/modules/misc/ids.nix
··· 437 riak = 205; 438 #shout = 206; #unused 439 gateone = 207; 440 - #namecoin = 208; #unused 441 442 # When adding a gid, make sure it doesn't match an existing 443 # uid. Users and groups with the same name should have equal
··· 437 riak = 205; 438 #shout = 206; #unused 439 gateone = 207; 440 + namecoin = 208; 441 442 # When adding a gid, make sure it doesn't match an existing 443 # uid. Users and groups with the same name should have equal
+23 -1
nixos/modules/services/networking/namecoind.nix
··· 45 type = types.path; 46 example = "/etc/namecoin/wallet.dat"; 47 description = '' 48 - Wallet file. 49 ''; 50 }; 51 ··· 61 USER=namecoin 62 PASSWORD=secret 63 </literal> 64 ''; 65 }; 66 ··· 107 createHome = true; 108 }; 109 110 systemd.services.namecoind = { 111 description = "Namecoind Daemon"; 112 after = [ "network.target" ]; 113 wantedBy = [ "multi-user.target" ]; 114 serviceConfig = { 115 Type = "simple"; 116 User = "namecoin";
··· 45 type = types.path; 46 example = "/etc/namecoin/wallet.dat"; 47 description = '' 48 + Wallet file. The ownership of the file has to be 49 + namecoin:namecoin, and the permissions must be 0640. 50 ''; 51 }; 52 ··· 62 USER=namecoin 63 PASSWORD=secret 64 </literal> 65 + The ownership of the file has to be namecoin:namecoin, 66 + and the permissions must be 0640. 67 ''; 68 }; 69 ··· 110 createHome = true; 111 }; 112 113 + users.extraGroups = singleton 114 + { name = "namecoin"; 115 + gid = config.ids.gids.namecoin; 116 + }; 117 + 118 systemd.services.namecoind = { 119 description = "Namecoind Daemon"; 120 after = [ "network.target" ]; 121 wantedBy = [ "multi-user.target" ]; 122 + preStart = '' 123 + if [ "$(stat --printf '%u' ${cfg.userFile})" != "${toString config.ids.uids.namecoin}" \ 124 + -o "$(stat --printf '%g' ${cfg.userFile})" != "${toString config.ids.gids.namecoin}" \ 125 + -o "$(stat --printf '%a' ${cfg.userFile})" != "640" ]; then 126 + echo "ERROR: bad ownership or rights on ${cfg.userFile}" >&2 127 + exit 1 128 + fi 129 + if [ "$(stat --printf '%u' ${cfg.wallet})" != "${toString config.ids.uids.namecoin}" \ 130 + -o "$(stat --printf '%g' ${cfg.wallet})" != "${toString config.ids.gids.namecoin}" \ 131 + -o "$(stat --printf '%a' ${cfg.wallet})" != "640" ]; then 132 + echo "ERROR: bad ownership or rights on ${cfg.wallet}" >&2 133 + exit 1 134 + fi 135 + ''; 136 serviceConfig = { 137 Type = "simple"; 138 User = "namecoin";