blob: 1da47349c0771b7bf695ed93b27fe2046ef50bd6 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
|
# Upower daemon.
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.services.upower;
in
{
###### interface
options = {
services.upower = {
enable = mkOption {
type = types.bool;
default = false;
description = ''
Whether to enable Upower, a DBus service that provides power
management support to applications.
'';
};
package = mkOption {
type = types.package;
default = pkgs.upower;
defaultText = "pkgs.upower";
example = lib.literalExample "pkgs.upower";
description = ''
Which upower package to use.
'';
};
};
};
###### implementation
config = mkIf cfg.enable {
environment.systemPackages = [ cfg.package ];
services.dbus.packages = [ cfg.package ];
services.udev.packages = [ cfg.package ];
systemd.services.upower =
{ description = "Power Management Daemon";
path = [ pkgs.glib.out ]; # needed for gdbus
serviceConfig =
{ Type = "dbus";
BusName = "org.freedesktop.UPower";
ExecStart = "@${cfg.package}/libexec/upowerd upowerd";
Restart = "on-failure";
# Upstream lockdown:
# Filesystem lockdown
ProtectSystem = "strict";
# Needed by keyboard backlight support
ProtectKernelTunables = false;
ProtectControlGroups = true;
ReadWritePaths = "/var/lib/upower";
ProtectHome = true;
PrivateTmp = true;
# Network
# PrivateNetwork=true would block udev's netlink socket
RestrictAddressFamilies = "AF_UNIX AF_NETLINK";
# Execute Mappings
MemoryDenyWriteExecute = true;
# Modules
ProtectKernelModules = true;
# Real-time
RestrictRealtime = true;
# Privilege escalation
NoNewPrivileges = true;
};
};
system.activationScripts.upower =
''
mkdir -m 0755 -p /var/lib/upower
'';
# The upower daemon seems to get stuck after doing a suspend
# (i.e. subsequent suspend requests will say "Sleep has already
# been requested and is pending"). So as a workaround, restart
# the daemon.
powerManagement.resumeCommands =
''
${config.systemd.package}/bin/systemctl try-restart upower
'';
};
}
|