summary refs log tree commit diff
path: root/nixos/modules/security
Commit message (Collapse)AuthorAge
* security.pam.usb: link to wiki on github.comTristan Helmich2017-09-28
| | | | pamusb.org no longer serves the intended content.
* nixos/lock-kernel-modules: fix deferred fileSystem mountsJoachim Fasting2017-09-22
| | | | | | | Ensure that modules required by all declared fileSystems are explicitly loaded. A little ugly but fixes the deferred mount test. See also https://github.com/NixOS/nixpkgs/issues/29019
* nixos/hardened: simplify scriptJoachim Fasting2017-09-22
|
* fuse3: init at 3.1.1Michael Weiss2017-09-21
| | | | | | | | | | | | | | | | | | | | | | | This includes fuse-common (fusePackages.fuse_3.common) as recommended by upstream. But while fuse(2) and fuse3 would normally depend on fuse-common we can't do that in nixpkgs while fuse-common is just another output from the fuse3 multiple-output derivation (i.e. this would result in a circular dependency). To avoid building fuse3 twice I decided it would be best to copy the shared files (i.e. the ones provided by fuse(2) and fuse3) from fuse-common to fuse (version 2) and avoid collision warnings by defining priorities. Now it should be possible to install an arbitrary combination of "fuse", "fuse3", and "fuse-common" without getting any collision warnings. The end result should be the same and all changes should be backwards compatible (assuming that mount.fuse from fuse3 is backwards compatible as stated by upstream [0] - if not this might break some /etc/fstab definitions but that should be very unlikely). My tests with sshfs (version 2 and 3) didn't show any problems. See #28409 for some additional information. [0]: https://github.com/libfuse/libfuse/releases/tag/fuse-3.0.0
* nixos/chromium-suid-sandbox: remove reference to grsecurityJoachim Fasting2017-09-02
|
* nixos: purge remaining grsecurity bitsJoachim Fasting2017-09-02
| | | | | | :( Fixes https://github.com/NixOS/nixpkgs/issues/28859
* nixos: Fix pam_kwallet5 integrationBenjamin Staffin2017-08-22
| | | | Fixes #28469
* nixos/auditd: break ordering cycle (#27577)Christian Albrecht2017-08-01
| | | | | | | | auditd creates an ordering cycle by adding wantedBy = [ "basic.target" ], because of this the job job systemd-update-utmp.service/start is deleted. Adding unitConfig.DefaultDependencies = false; to the auditd service unbreaks the cycle. See also #11864
* nixos/auditd: init at 2.7.6 (#27261)Christian Albrecht2017-07-09
| | | | | | | | | | | | | #11864 Support Linux audit subsystem Add the auditd.service as NixOS module to be able to generate profiles from /var/log/audit/audit.log with apparmor-utils. auditd needs the folder /var/log/audit to be present on start so this is generated in ExecPreStart. auditd starts with -s nochange so that effective audit processing is managed by the audit.service.
* Merge pull request #26897 from layus/nixos-terminfoJörg Thalheim2017-07-01
|\ | | | | terminfo: symlink terminfo to /etc for ncurses
| * terminfo: symlink terminfo to /etc for ncursesGuillaume Maudoux2017-06-30
| |
* | security-wrapper: run activation script after specialfstv2017-06-26
|/ | | | | | Ensures that parentWrapperDir exists before it is used. Closes #26851
* Fixing attribute name mistake: setguid => setgidParnell Springmeyer2017-06-15
|
* nixos/acme: improve documentationBjørn Forsman2017-06-09
| | | | | * Use literalExample for better readability * Clarify a bit wrt. 'webroot' and 'allowKeysForGroup'
* nixos/acme: support "full.pem" (for lighttpd)Bjørn Forsman2017-06-09
| | | | | | | | | * Create "full.pem" from selfsigned certificate * Tell simp_le to create "full.pem" * Inject service dependency between lighttpd and the generation of certificates Side note: According to the internet these servers also use the "full.pem" format: pound, ejabberd, pure-ftpd.
* nixos/security/acme: fix acme folder permissionslassulus2017-05-11
|
* nixos/lock-kernel-modules: fix typo in unitConfigJoachim Fasting2017-04-30
| | | | I managed to miss this one somehow ... meh
* nixos: add option to lock kernel modulesJoachim Fasting2017-04-30
| | | | | | | | | | | | | | | | | | | | | | Adds an option `security.lockKernelModules` that, when enabled, disables kernel module loading once the system reaches its normal operating state. The rationale for this over simply setting the sysctl knob is to allow some legitmate kernel module loading to occur; the naive solution breaks too much to be useful. The benefit to the user is to help ensure the integrity of the kernel runtime: only code loaded as part of normal system initialization will be available in the kernel for the duration of the boot session. This helps prevent injection of malicious code or unexpected loading of legitimate but normally unused modules that have exploitable bugs (e.g., DCCP use after free CVE-2017-6074, n_hldc CVE-2017-2636, XFRM framework CVE-2017-7184, L2TPv3 CVE-2016-10200). From an aestethic point of view, enabling this option helps make the configuration more "declarative". Closes https://github.com/NixOS/nixpkgs/pull/24681
* grsecurity: discontinue supportJoachim Fasting2017-04-28
| | | | | | | | | | | | | Upstream has decided to make -testing patches private, effectively ceasing free support for grsecurity/PaX [1]. Consequently, we can no longer responsibly support grsecurity on NixOS. This patch turns the kernel and patch expressions into build errors and adds a warning to the manual, but retains most of the infrastructure, in an effort to make the transition smoother. For 17.09 all of it should probably be pruned. [1]: https://grsecurity.net/passing_the_baton.php
* acme: Add "domain" option to separate domain from nameedanaher2017-04-11
| | | Fixes #24731.
* network-link-*.service: Set stopIfChanged = falseEelco Dolstra2017-04-04
| | | | | | | | | | | | This reduces the time window during which IP addresses are gone during switch-to-configuration. A complication is that with stopIfChanged = true, preStop would try to delete the *new* IP addresses rather than the old one (since the preStop script now runs after the switch to the new configuration). So we now record the actually configured addresses in /run/nixos/network/addresses/<interface>. This is more robust in any case. Issue https://github.com/NixOS/nixops/issues/640.
* acme: Use `chown -R` for challenges directory. Fixes #24529.Niklas Hambüchen2017-04-01
| | | | | | | | Commit 75f131da02c00027b9a8240fb74d117cb0f9d9cf added `chown 'nginx:nginx' '/var/lib/acme'` to the pre-start script, but since it doesn't use `chown -R`, it is possible that there are older existing subdirs (like `acme-challenge`) that are owned to `root` from before that commit went it.
* security-wrapper: link old wrapper dir to new oneRobin Gloster2017-03-23
| | | | | | This makes setuid wrappers not fail after upgrading. references #23641, #22914, #19862, #16654
* Revert "security-wrapper: Don't remove the old paths yet as that can create ↵Robin Gloster2017-03-23
| | | | | | | | migration pain" This reverts commit 4c751ced376e0042ddd4f2aa8bd40754b9ea8926. This does not fix the issue as /run is now mounted with nosuid.
* Merge pull request #23641 from awakenetworks/parnell/fix-wrapper-migrationRobin Gloster2017-03-21
|\ | | | | security-wrapper: Don't remove the old paths yet as that can create migration pain
| * security-wrapper: Don't remove the old paths yet as that can create ↵Parnell Springmeyer2017-03-08
| | | | | | | | migration pain
* | nixos/treewide: systemd.time is in manvolume 7Franz Pletz2017-03-21
| | | | | | | | cc #23396
* | nixos/treewide: remove boolean examples for optionsFranz Pletz2017-03-17
| | | | | | | | | | | | | | They contain no useful information and increase the length of the autogenerated options documentation. See discussion in #18816.
* | dhparams module: condition on enable option (#23661)Léo Gaspard2017-03-17
| | | | | | Hence, the init/cleanup service only runs when the dhparams module is enabled.
* | gresecurity docs: fix incorrect option (#23789)zetok2017-03-12
|/
* grsecurity docs: fix syntax and indentation errorsJesper Geertsen Jonsson2017-03-05
| | | | Closes https://github.com/NixOS/nixpkgs/pull/23515
* Remove top-level kde5 attributeThomas Tuegel2017-02-27
| | | | - There is no such thing as KDE 5
* Merge pull request #22634 from Ekleog/dhparamsRobin Gloster2017-02-23
|\ | | | | dhparams module: initialize
| * dhparams module: initializeLéo Gaspard2017-02-18
| |
* | nixos polkit: fixup setuid wrapper of pkexecVladimír Čunát2017-02-22
| | | | | | | | Broken in 628e6a8. Fixes #23083.
* | wrappers service: make /run/wrappers a mountpointNikolay Amiantov2017-02-21
| | | | | | | | | | Also remove some compatibility code because the directory in question would be shadowed by a mountpoint anyway.
* | Merge pull request #22882 from bjornfor/wiresharkRobin Gloster2017-02-20
|\ \ | | | | | | nixos: add programs.wireshark option
| * | setcapWrapper: add support for setting permissionsRobin Gloster2017-02-17
| | |
* | | Merge pull request #20456 from ericsagnes/feat/loaf-dep-1Joachim F2017-02-19
|\ \ \ | |/ / |/| | Use attrsOf in place of loaOf when relevant
| * | acme module: certs option loaOf -> attrsOfEric Sagnes2016-11-16
| | |
* | | pam: add optional pam_kwallet5 integrationBenjamin Staffin2017-02-16
| | |
* | | nixos/security.wrappers: improve documentationBjørn Forsman2017-02-15
| | | | | | | | | | | | | | | | | | | | | * The source attribute is mandatory, not optional * The program attribute is optional * Move the info about the mandatory attribute first (most important, IMHO)
* | | nixos/security.wrappers: use literalExample in documentationBjørn Forsman2017-02-15
| | | | | | | | | | | | | | | It's much more readable when the example attrset is pretty printed instead of written as one line.
* | | nixos: remove remaining reference to setuidProgramsBjørn Forsman2017-02-15
| | | | | | | | | | | | The option doesn't exist anymore.
* | | security-wrapper: Wrap <para> tags in a <note> tagParnell Springmeyer2017-02-14
| | |
* | | Using para tags for manual formattingParnell Springmeyer2017-02-14
| | |
* | | Syntax wibbleParnell Springmeyer2017-02-14
| | |
* | | Default should be to set owner and group to root on setcap wrappers tooParnell Springmeyer2017-02-14
| | |
* | | Fixing ref to old-wrappersDirParnell Springmeyer2017-02-14
| | |
* | | Simplifying the wrapper program derivationParnell Springmeyer2017-02-14
| | |
generated by cgit-pink 1.4.1 (git 2.36.1) at 2024-07-19 19:24:25 +0000