about summary refs log tree commit diff
path: root/nixos/modules
diff options
context:
space:
mode:
authorJaka Hudoklin <offlinehacker@users.noreply.github.com>2020-05-13 21:00:51 +0700
committerGitHub <noreply@github.com>2020-05-13 21:00:51 +0700
commit9a29fe5808ce0c29c234e86fc562be622d9941ce (patch)
treefe9d88a278a7d8457cc5ffdf92bcd96bd2154916 /nixos/modules
parent2b51171fb6eadbe0909dc5f3726371a149044f77 (diff)
parent056ab3d27898cf4483bb48dbc9b5b28e9f320341 (diff)
downloadnixlib-9a29fe5808ce0c29c234e86fc562be622d9941ce.tar
nixlib-9a29fe5808ce0c29c234e86fc562be622d9941ce.tar.gz
nixlib-9a29fe5808ce0c29c234e86fc562be622d9941ce.tar.bz2
nixlib-9a29fe5808ce0c29c234e86fc562be622d9941ce.tar.lz
nixlib-9a29fe5808ce0c29c234e86fc562be622d9941ce.tar.xz
nixlib-9a29fe5808ce0c29c234e86fc562be622d9941ce.tar.zst
nixlib-9a29fe5808ce0c29c234e86fc562be622d9941ce.zip
Merge pull request #87576 from xtruder/pkgs/libvirtd/polkit
libvirtd: polkit integration, security fixes
Diffstat (limited to 'nixos/modules')
-rw-r--r--nixos/modules/virtualisation/libvirtd.nix15
1 files changed, 11 insertions, 4 deletions
diff --git a/nixos/modules/virtualisation/libvirtd.nix b/nixos/modules/virtualisation/libvirtd.nix
index 4f22099443f4..f89e5d544b22 100644
--- a/nixos/modules/virtualisation/libvirtd.nix
+++ b/nixos/modules/virtualisation/libvirtd.nix
@@ -7,10 +7,8 @@ let
   cfg = config.virtualisation.libvirtd;
   vswitch = config.virtualisation.vswitch;
   configFile = pkgs.writeText "libvirtd.conf" ''
-    unix_sock_group = "libvirtd"
-    unix_sock_rw_perms = "0770"
-    auth_unix_ro = "none"
-    auth_unix_rw = "none"
+    auth_unix_ro = "polkit"
+    auth_unix_rw = "polkit"
     ${cfg.extraConfig}
   '';
   qemuConfigFile = pkgs.writeText "qemu.conf" ''
@@ -269,5 +267,14 @@ in {
 
     systemd.sockets.libvirtd    .wantedBy = [ "sockets.target" ];
     systemd.sockets.libvirtd-tcp.wantedBy = [ "sockets.target" ];
+
+    security.polkit.extraConfig = ''
+      polkit.addRule(function(action, subject) {
+        if (action.id == "org.libvirt.unix.manage" &&
+          subject.isInGroup("libvirtd")) {
+          return polkit.Result.YES;
+        }
+      });
+    '';
   };
 }