diff options
author | Eelco Dolstra <eelco.dolstra@logicblox.com> | 2016-09-07 11:18:49 +0200 |
---|---|---|
committer | GitHub <noreply@github.com> | 2016-09-07 11:18:49 +0200 |
commit | 70be99c6459b236bf4cc12eb11182f9a72438085 (patch) | |
tree | 585b5694c3dc0f37231f8319dc7f0f73fae71a39 /nixos | |
parent | 4a265a68bd44c7c98389f06f70236e13c674c28f (diff) | |
parent | 8f95e6f6aa8ac62e809a5d1cba6af2b6707d90dd (diff) | |
download | nixlib-70be99c6459b236bf4cc12eb11182f9a72438085.tar nixlib-70be99c6459b236bf4cc12eb11182f9a72438085.tar.gz nixlib-70be99c6459b236bf4cc12eb11182f9a72438085.tar.bz2 nixlib-70be99c6459b236bf4cc12eb11182f9a72438085.tar.lz nixlib-70be99c6459b236bf4cc12eb11182f9a72438085.tar.xz nixlib-70be99c6459b236bf4cc12eb11182f9a72438085.tar.zst nixlib-70be99c6459b236bf4cc12eb11182f9a72438085.zip |
Merge pull request #18365 from NixOS/fix-sshd-failure
Make /var/empty immutable (with chattr +i)
Diffstat (limited to 'nixos')
-rw-r--r-- | nixos/modules/system/activation/activation-script.nix | 21 |
1 files changed, 14 insertions, 7 deletions
diff --git a/nixos/modules/system/activation/activation-script.nix b/nixos/modules/system/activation/activation-script.nix index 1c587413121e..60298362d767 100644 --- a/nixos/modules/system/activation/activation-script.nix +++ b/nixos/modules/system/activation/activation-script.nix @@ -12,11 +12,13 @@ let ''; }); - path = map getBin - [ pkgs.coreutils pkgs.gnugrep pkgs.findutils - pkgs.glibc # needed for getent - pkgs.shadow - pkgs.nettools # needed for hostname + path = with pkgs; map getBin + [ coreutils + gnugrep + findutils + glibc # needed for getent + shadow + nettools # needed for hostname ]; in @@ -137,8 +139,13 @@ in mkdir -m 1777 -p /var/tmp - # Empty, read-only home directory of many system accounts. - mkdir -m 0555 -p /var/empty + # Empty, immutable home directory of many system accounts. + mkdir -p /var/empty + # Make sure it's really empty + ${pkgs.e2fsprogs}/bin/chattr -i /var/empty + find /var/empty -mindepth 1 -delete + chmod 0555 /var/empty + ${pkgs.e2fsprogs}/bin/chattr +i /var/empty ''; system.activationScripts.usrbinenv = if config.environment.usrbinenv != null |