diff options
| author | William A. Kennington III <william@wkennington.com> | 2014-06-24 17:09:27 -0500 |
|---|---|---|
| committer | William A. Kennington III <william@wkennington.com> | 2014-08-13 15:08:08 -0500 |
| commit | 4fbf120e8454d722df72ac1a49f1a8d707c0b46f (patch) | |
| tree | a05aa8392db1c243c2597f9de2055eec3b146053 /nixos | |
| parent | 56228e56147a9679994480a00cd813479ff392da (diff) | |
| download | nixlib-4fbf120e8454d722df72ac1a49f1a8d707c0b46f.tar nixlib-4fbf120e8454d722df72ac1a49f1a8d707c0b46f.tar.gz nixlib-4fbf120e8454d722df72ac1a49f1a8d707c0b46f.tar.bz2 nixlib-4fbf120e8454d722df72ac1a49f1a8d707c0b46f.tar.lz nixlib-4fbf120e8454d722df72ac1a49f1a8d707c0b46f.tar.xz nixlib-4fbf120e8454d722df72ac1a49f1a8d707c0b46f.tar.zst nixlib-4fbf120e8454d722df72ac1a49f1a8d707c0b46f.zip | |
nixos/dhcpd: Add the ability to drop privileges
Diffstat (limited to 'nixos')
| -rw-r--r-- | nixos/modules/services/networking/dhcpd.nix | 22 |
1 files changed, 21 insertions, 1 deletions
diff --git a/nixos/modules/services/networking/dhcpd.nix b/nixos/modules/services/networking/dhcpd.nix index d796dcf70326..0c6783760de1 100644 --- a/nixos/modules/services/networking/dhcpd.nix +++ b/nixos/modules/services/networking/dhcpd.nix @@ -66,6 +66,24 @@ in "; }; + user = mkOption { + default = "nobody"; + type = types.nullOr types.str; + description = '' + The user to drop privileges to after the daemon has started. + A value of null disables the user privilege change. + ''; + }; + + group = mkOption { + default = "nogroup"; + type = types.nullOr types.str; + description = '' + The group to drop privileges to after the daemon has started. + A value of null disables the group privilege change. + ''; + }; + configFile = mkOption { default = null; description = " @@ -120,8 +138,10 @@ in touch ${stateDir}/dhcpd.leases - exec ${pkgs.dhcp}/sbin/dhcpd -f -cf ${configFile} \ + exec ${pkgs.dhcp}/sbin/dhcpd -f --no-pid -cf ${configFile} \ -lf ${stateDir}/dhcpd.leases \ + ${optionalString (cfg.user != null) "-user ${cfg.user}"} \ + ${optionalString (cfg.group != null) "-group ${cfg.group}"} \ ${toString cfg.interfaces} ''; }; |