diff options
| author | Niklas Hambüchen <mail@nh2.me> | 2023-09-06 01:14:52 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-09-06 01:14:52 +0200 |
| commit | 4a7f846937eaa5ab5202cd83c8bdad876fce6d18 (patch) | |
| tree | b8239f6cc402d56bfcf2f190d61b70d1d8d0979f /nixos | |
| parent | b74282e0506b051261ac580a0a5b20cf9b6ad509 (diff) | |
| parent | 5d778d1f030ace7e20548a48323120e7c97b7309 (diff) | |
| download | nixlib-4a7f846937eaa5ab5202cd83c8bdad876fce6d18.tar nixlib-4a7f846937eaa5ab5202cd83c8bdad876fce6d18.tar.gz nixlib-4a7f846937eaa5ab5202cd83c8bdad876fce6d18.tar.bz2 nixlib-4a7f846937eaa5ab5202cd83c8bdad876fce6d18.tar.lz nixlib-4a7f846937eaa5ab5202cd83c8bdad876fce6d18.tar.xz nixlib-4a7f846937eaa5ab5202cd83c8bdad876fce6d18.tar.zst nixlib-4a7f846937eaa5ab5202cd83c8bdad876fce6d18.zip | |
Merge pull request #190944 from nh2/ecryptfs-security-wrapper
Add `programs.ecryptfs` for mount wrappers
Diffstat (limited to 'nixos')
| -rw-r--r-- | nixos/modules/module-list.nix | 1 | ||||
| -rw-r--r-- | nixos/modules/programs/ecryptfs.nix | 31 |
2 files changed, 32 insertions, 0 deletions
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index abe0847ade21..d650e5ec76b4 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -163,6 +163,7 @@ ./programs/direnv.nix ./programs/dmrconfig.nix ./programs/droidcam.nix + ./programs/ecryptfs.nix ./programs/environment.nix ./programs/evince.nix ./programs/extra-container.nix diff --git a/nixos/modules/programs/ecryptfs.nix b/nixos/modules/programs/ecryptfs.nix new file mode 100644 index 000000000000..63c1a3ad4419 --- /dev/null +++ b/nixos/modules/programs/ecryptfs.nix @@ -0,0 +1,31 @@ +{ config, lib, pkgs, ... }: + +with lib; + +let + cfg = config.programs.ecryptfs; + +in { + options.programs.ecryptfs = { + enable = mkEnableOption (lib.mdDoc "ecryptfs setuid mount wrappers"); + }; + + config = mkIf cfg.enable { + security.wrappers = { + + "mount.ecryptfs_private" = { + setuid = true; + owner = "root"; + group = "root"; + source = "${lib.getBin pkgs.ecryptfs}/bin/mount.ecryptfs_private"; + }; + "umount.ecryptfs_private" = { + setuid = true; + owner = "root"; + group = "root"; + source = "${lib.getBin pkgs.ecryptfs}/bin/umount.ecryptfs_private"; + }; + + }; + }; +} |