diff options
author | Bjørn Forsman <bjorn.forsman@gmail.com> | 2017-02-15 19:51:12 +0100 |
---|---|---|
committer | Bjørn Forsman <bjorn.forsman@gmail.com> | 2017-02-15 20:05:27 +0100 |
commit | ce0a52f9bfd5bdc5e2e0ed09ee1abaa9b088638e (patch) | |
tree | 69c258a4b3240c6a43ba035d47af8c59722c9ba2 /nixos/modules/security/wrappers | |
parent | aba35a5c2df62876c4835c551ef315c245055088 (diff) | |
download | nixlib-ce0a52f9bfd5bdc5e2e0ed09ee1abaa9b088638e.tar nixlib-ce0a52f9bfd5bdc5e2e0ed09ee1abaa9b088638e.tar.gz nixlib-ce0a52f9bfd5bdc5e2e0ed09ee1abaa9b088638e.tar.bz2 nixlib-ce0a52f9bfd5bdc5e2e0ed09ee1abaa9b088638e.tar.lz nixlib-ce0a52f9bfd5bdc5e2e0ed09ee1abaa9b088638e.tar.xz nixlib-ce0a52f9bfd5bdc5e2e0ed09ee1abaa9b088638e.tar.zst nixlib-ce0a52f9bfd5bdc5e2e0ed09ee1abaa9b088638e.zip |
nixos/security.wrappers: improve documentation
* The source attribute is mandatory, not optional * The program attribute is optional * Move the info about the mandatory attribute first (most important, IMHO)
Diffstat (limited to 'nixos/modules/security/wrappers')
-rw-r--r-- | nixos/modules/security/wrappers/default.nix | 14 |
1 files changed, 8 insertions, 6 deletions
diff --git a/nixos/modules/security/wrappers/default.nix b/nixos/modules/security/wrappers/default.nix index 98913a974fc9..861ce225257d 100644 --- a/nixos/modules/security/wrappers/default.nix +++ b/nixos/modules/security/wrappers/default.nix @@ -116,16 +116,18 @@ in default (setuid root, but not setgid root). <note> + <para>The sub-attribute <literal>source</literal> is mandatory, + it must be the absolute path to the program to be wrapped. + </para> + + <para>The sub-attribute <literal>program</literal> is optional and + can give the wrapper program a new name. The default name is the same + as the attribute name itself.</para> + <para>Additionally, this option can set capabilities on a wrapper program that propagates those capabilities down to the wrapped, real program.</para> - <para>The <literal>program</literal> attribute is the name of - the program to be wrapped. If no <literal>source</literal> - attribute is provided, specifying the absolute path to the - program, then the program will be searched for in the path - environment variable.</para> - <para>NOTE: cap_setpcap, which is required for the wrapper program to be able to raise caps into the Ambient set is NOT raised to the Ambient set so that the real program cannot |