summary refs log tree commit diff
path: root/nixos/modules/security
Commit message (Collapse)AuthorAge
* nixos/auditd: init at 2.7.6 (#27261)Christian Albrecht2017-07-09
| | | | | | | | | | | | | #11864 Support Linux audit subsystem Add the auditd.service as NixOS module to be able to generate profiles from /var/log/audit/audit.log with apparmor-utils. auditd needs the folder /var/log/audit to be present on start so this is generated in ExecPreStart. auditd starts with -s nochange so that effective audit processing is managed by the audit.service.
* Merge pull request #26897 from layus/nixos-terminfoJörg Thalheim2017-07-01
|\ | | | | terminfo: symlink terminfo to /etc for ncurses
| * terminfo: symlink terminfo to /etc for ncursesGuillaume Maudoux2017-06-30
| |
* | security-wrapper: run activation script after specialfstv2017-06-26
|/ | | | | | Ensures that parentWrapperDir exists before it is used. Closes #26851
* Fixing attribute name mistake: setguid => setgidParnell Springmeyer2017-06-15
|
* nixos/acme: improve documentationBjørn Forsman2017-06-09
| | | | | * Use literalExample for better readability * Clarify a bit wrt. 'webroot' and 'allowKeysForGroup'
* nixos/acme: support "full.pem" (for lighttpd)Bjørn Forsman2017-06-09
| | | | | | | | | * Create "full.pem" from selfsigned certificate * Tell simp_le to create "full.pem" * Inject service dependency between lighttpd and the generation of certificates Side note: According to the internet these servers also use the "full.pem" format: pound, ejabberd, pure-ftpd.
* nixos/security/acme: fix acme folder permissionslassulus2017-05-11
|
* nixos/lock-kernel-modules: fix typo in unitConfigJoachim Fasting2017-04-30
| | | | I managed to miss this one somehow ... meh
* nixos: add option to lock kernel modulesJoachim Fasting2017-04-30
| | | | | | | | | | | | | | | | | | | | | | Adds an option `security.lockKernelModules` that, when enabled, disables kernel module loading once the system reaches its normal operating state. The rationale for this over simply setting the sysctl knob is to allow some legitmate kernel module loading to occur; the naive solution breaks too much to be useful. The benefit to the user is to help ensure the integrity of the kernel runtime: only code loaded as part of normal system initialization will be available in the kernel for the duration of the boot session. This helps prevent injection of malicious code or unexpected loading of legitimate but normally unused modules that have exploitable bugs (e.g., DCCP use after free CVE-2017-6074, n_hldc CVE-2017-2636, XFRM framework CVE-2017-7184, L2TPv3 CVE-2016-10200). From an aestethic point of view, enabling this option helps make the configuration more "declarative". Closes https://github.com/NixOS/nixpkgs/pull/24681
* grsecurity: discontinue supportJoachim Fasting2017-04-28
| | | | | | | | | | | | | Upstream has decided to make -testing patches private, effectively ceasing free support for grsecurity/PaX [1]. Consequently, we can no longer responsibly support grsecurity on NixOS. This patch turns the kernel and patch expressions into build errors and adds a warning to the manual, but retains most of the infrastructure, in an effort to make the transition smoother. For 17.09 all of it should probably be pruned. [1]: https://grsecurity.net/passing_the_baton.php
* acme: Add "domain" option to separate domain from nameedanaher2017-04-11
| | | Fixes #24731.
* network-link-*.service: Set stopIfChanged = falseEelco Dolstra2017-04-04
| | | | | | | | | | | | This reduces the time window during which IP addresses are gone during switch-to-configuration. A complication is that with stopIfChanged = true, preStop would try to delete the *new* IP addresses rather than the old one (since the preStop script now runs after the switch to the new configuration). So we now record the actually configured addresses in /run/nixos/network/addresses/<interface>. This is more robust in any case. Issue https://github.com/NixOS/nixops/issues/640.
* acme: Use `chown -R` for challenges directory. Fixes #24529.Niklas Hambüchen2017-04-01
| | | | | | | | Commit 75f131da02c00027b9a8240fb74d117cb0f9d9cf added `chown 'nginx:nginx' '/var/lib/acme'` to the pre-start script, but since it doesn't use `chown -R`, it is possible that there are older existing subdirs (like `acme-challenge`) that are owned to `root` from before that commit went it.
* security-wrapper: link old wrapper dir to new oneRobin Gloster2017-03-23
| | | | | | This makes setuid wrappers not fail after upgrading. references #23641, #22914, #19862, #16654
* Revert "security-wrapper: Don't remove the old paths yet as that can create ↵Robin Gloster2017-03-23
| | | | | | | | migration pain" This reverts commit 4c751ced376e0042ddd4f2aa8bd40754b9ea8926. This does not fix the issue as /run is now mounted with nosuid.
* Merge pull request #23641 from awakenetworks/parnell/fix-wrapper-migrationRobin Gloster2017-03-21
|\ | | | | security-wrapper: Don't remove the old paths yet as that can create migration pain
| * security-wrapper: Don't remove the old paths yet as that can create ↵Parnell Springmeyer2017-03-08
| | | | | | | | migration pain
* | nixos/treewide: systemd.time is in manvolume 7Franz Pletz2017-03-21
| | | | | | | | cc #23396
* | nixos/treewide: remove boolean examples for optionsFranz Pletz2017-03-17
| | | | | | | | | | | | | | They contain no useful information and increase the length of the autogenerated options documentation. See discussion in #18816.
* | dhparams module: condition on enable option (#23661)Léo Gaspard2017-03-17
| | | | | | Hence, the init/cleanup service only runs when the dhparams module is enabled.
* | gresecurity docs: fix incorrect option (#23789)zetok2017-03-12
|/
* grsecurity docs: fix syntax and indentation errorsJesper Geertsen Jonsson2017-03-05
| | | | Closes https://github.com/NixOS/nixpkgs/pull/23515
* Remove top-level kde5 attributeThomas Tuegel2017-02-27
| | | | - There is no such thing as KDE 5
* Merge pull request #22634 from Ekleog/dhparamsRobin Gloster2017-02-23
|\ | | | | dhparams module: initialize
| * dhparams module: initializeLéo Gaspard2017-02-18
| |
* | nixos polkit: fixup setuid wrapper of pkexecVladimír Čunát2017-02-22
| | | | | | | | Broken in 628e6a8. Fixes #23083.
* | wrappers service: make /run/wrappers a mountpointNikolay Amiantov2017-02-21
| | | | | | | | | | Also remove some compatibility code because the directory in question would be shadowed by a mountpoint anyway.
* | Merge pull request #22882 from bjornfor/wiresharkRobin Gloster2017-02-20
|\ \ | | | | | | nixos: add programs.wireshark option
| * | setcapWrapper: add support for setting permissionsRobin Gloster2017-02-17
| | |
* | | Merge pull request #20456 from ericsagnes/feat/loaf-dep-1Joachim F2017-02-19
|\ \ \ | |/ / |/| | Use attrsOf in place of loaOf when relevant
| * | acme module: certs option loaOf -> attrsOfEric Sagnes2016-11-16
| | |
* | | pam: add optional pam_kwallet5 integrationBenjamin Staffin2017-02-16
| | |
* | | nixos/security.wrappers: improve documentationBjørn Forsman2017-02-15
| | | | | | | | | | | | | | | | | | | | | * The source attribute is mandatory, not optional * The program attribute is optional * Move the info about the mandatory attribute first (most important, IMHO)
* | | nixos/security.wrappers: use literalExample in documentationBjørn Forsman2017-02-15
| | | | | | | | | | | | | | | It's much more readable when the example attrset is pretty printed instead of written as one line.
* | | nixos: remove remaining reference to setuidProgramsBjørn Forsman2017-02-15
| | | | | | | | | | | | The option doesn't exist anymore.
* | | security-wrapper: Wrap <para> tags in a <note> tagParnell Springmeyer2017-02-14
| | |
* | | Using para tags for manual formattingParnell Springmeyer2017-02-14
| | |
* | | Syntax wibbleParnell Springmeyer2017-02-14
| | |
* | | Default should be to set owner and group to root on setcap wrappers tooParnell Springmeyer2017-02-14
| | |
* | | Fixing ref to old-wrappersDirParnell Springmeyer2017-02-14
| | |
* | | Simplifying the wrapper program derivationParnell Springmeyer2017-02-14
| | |
* | | Addressing feedback and fixing a bugParnell Springmeyer2017-02-14
| | |
* | | Removing unused module option old-wrapperDirParnell Springmeyer2017-02-14
| | |
* | | Derp, correctly write the source program's pathParnell Springmeyer2017-02-13
| | |
* | | Resurrecting the single-wrapper read from sibling .real file behaviorParnell Springmeyer2017-02-13
| | |
* | | Merging against upstream masterParnell Springmeyer2017-02-13
|\ \ \
| * | | pam_oath: require OATH and pam_unix credentials to be validGraham Christensen2017-02-12
| | |/ | |/|
| * | grsecurity docs: some polishJoachim Fasting2017-02-03
| | | | | | | | | | | | | | | Fix minor formatting issues, excessive punctuation, and also some improved wording.
* | | Conditionally logging debug messages based on the WRAPPER_DEBUG env var ↵Parnell Springmeyer2017-01-30
| | | | | | | | | | | | being set (or not)
generated by cgit-pink 1.4.1 (git 2.36.1) at 2024-07-11 07:26:41 +0000