lol

nixos/nullmailer: allow users in the nullmailer group to send mails

In combination with https://github.com/NixOS/nixpkgs/pull/231673 this
allows hardened services to use nullmailer's sendmail.

+6 -6
+6 -6
nixos/modules/services/mail/nullmailer.nix
··· 203 203 users = { 204 204 users.${cfg.user} = { 205 205 description = "Nullmailer relay-only mta user"; 206 - group = cfg.group; 206 + inherit (cfg) group; 207 207 isSystemUser = true; 208 208 }; 209 209 ··· 211 211 }; 212 212 213 213 systemd.tmpfiles.rules = [ 214 - "d /var/spool/nullmailer - ${cfg.user} - - -" 215 - "d /var/spool/nullmailer/failed 750 ${cfg.user} - - -" 216 - "d /var/spool/nullmailer/queue 750 ${cfg.user} - - -" 217 - "d /var/spool/nullmailer/tmp 750 ${cfg.user} - - -" 214 + "d /var/spool/nullmailer - ${cfg.user} ${cfg.group} - -" 215 + "d /var/spool/nullmailer/failed 770 ${cfg.user} ${cfg.group} - -" 216 + "d /var/spool/nullmailer/queue 770 ${cfg.user} ${cfg.group} - -" 217 + "d /var/spool/nullmailer/tmp 770 ${cfg.user} ${cfg.group} - -" 218 218 ]; 219 219 220 220 systemd.services.nullmailer = { ··· 238 238 program = "sendmail"; 239 239 source = "${pkgs.nullmailer}/bin/sendmail"; 240 240 owner = cfg.user; 241 - group = cfg.group; 241 + inherit (cfg) group; 242 242 setuid = true; 243 243 setgid = true; 244 244 };