diff options
author | Jaka Hudoklin <offlinehacker@users.noreply.github.com> | 2020-05-13 21:00:51 +0700 |
---|---|---|
committer | GitHub <noreply@github.com> | 2020-05-13 21:00:51 +0700 |
commit | 9a29fe5808ce0c29c234e86fc562be622d9941ce (patch) | |
tree | fe9d88a278a7d8457cc5ffdf92bcd96bd2154916 /nixos/modules | |
parent | 2b51171fb6eadbe0909dc5f3726371a149044f77 (diff) | |
parent | 056ab3d27898cf4483bb48dbc9b5b28e9f320341 (diff) | |
download | nixlib-9a29fe5808ce0c29c234e86fc562be622d9941ce.tar nixlib-9a29fe5808ce0c29c234e86fc562be622d9941ce.tar.gz nixlib-9a29fe5808ce0c29c234e86fc562be622d9941ce.tar.bz2 nixlib-9a29fe5808ce0c29c234e86fc562be622d9941ce.tar.lz nixlib-9a29fe5808ce0c29c234e86fc562be622d9941ce.tar.xz nixlib-9a29fe5808ce0c29c234e86fc562be622d9941ce.tar.zst nixlib-9a29fe5808ce0c29c234e86fc562be622d9941ce.zip |
Merge pull request #87576 from xtruder/pkgs/libvirtd/polkit
libvirtd: polkit integration, security fixes
Diffstat (limited to 'nixos/modules')
-rw-r--r-- | nixos/modules/virtualisation/libvirtd.nix | 15 |
1 files changed, 11 insertions, 4 deletions
diff --git a/nixos/modules/virtualisation/libvirtd.nix b/nixos/modules/virtualisation/libvirtd.nix index 4f22099443f4..f89e5d544b22 100644 --- a/nixos/modules/virtualisation/libvirtd.nix +++ b/nixos/modules/virtualisation/libvirtd.nix @@ -7,10 +7,8 @@ let cfg = config.virtualisation.libvirtd; vswitch = config.virtualisation.vswitch; configFile = pkgs.writeText "libvirtd.conf" '' - unix_sock_group = "libvirtd" - unix_sock_rw_perms = "0770" - auth_unix_ro = "none" - auth_unix_rw = "none" + auth_unix_ro = "polkit" + auth_unix_rw = "polkit" ${cfg.extraConfig} ''; qemuConfigFile = pkgs.writeText "qemu.conf" '' @@ -269,5 +267,14 @@ in { systemd.sockets.libvirtd .wantedBy = [ "sockets.target" ]; systemd.sockets.libvirtd-tcp.wantedBy = [ "sockets.target" ]; + + security.polkit.extraConfig = '' + polkit.addRule(function(action, subject) { + if (action.id == "org.libvirt.unix.manage" && + subject.isInGroup("libvirtd")) { + return polkit.Result.YES; + } + }); + ''; }; } |