diff options
author | Paul Colomiets <paul@colomiets.name> | 2014-06-26 03:11:28 +0300 |
---|---|---|
committer | Paul Colomiets <paul@colomiets.name> | 2014-08-01 21:27:20 +0300 |
commit | 08b214a8f2b6c9101636df43ded09c07ea9b8259 (patch) | |
tree | 3d78cec991e6619f9e5b8a12ca9ab92e331d3c64 /nixos/modules/config/users-groups.nix | |
parent | fb948c4f28a8e42758467b5fe23a27bca182b481 (diff) |
First implementation of subuid/subgid manipulation module
Diffstat (limited to 'nixos/modules/config/users-groups.nix')
-rw-r--r-- | nixos/modules/config/users-groups.nix | 83 |
1 files changed, 83 insertions, 0 deletions
diff --git a/nixos/modules/config/users-groups.nix b/nixos/modules/config/users-groups.nix index 5de81a773424..1fd5735fb74f 100644 --- a/nixos/modules/config/users-groups.nix +++ b/nixos/modules/config/users-groups.nix @@ -100,6 +100,36 @@ let description = "The path to the user's shell."; }; + subUidRanges = mkOption { + type = types.listOf types.optionSet; + default = []; + example = [ + { startUid = 1000; count = 1; } + { startUid = 100001; count = 65534; } + ]; + options = [ subordinateUidRange ]; + description = '' + Subordinate user ids that user is allowed to use. + They are set into <filename>/etc/subuid</filename> and are used + by <literal>newuidmap</literal> for user namespaces. + ''; + }; + + subGidRanges = mkOption { + type = types.listOf types.optionSet; + default = []; + example = [ + { startGid = 100; count = 1; } + { startGid = 1001; count = 999; } + ]; + options = [ subordinateGidRange ]; + description = '' + Subordinate group ids that user is allowed to use. + They are set into <filename>/etc/subgid</filename> and are used + by <literal>newgidmap</literal> for user namespaces. + ''; + }; + createHome = mkOption { type = types.bool; default = false; @@ -211,6 +241,36 @@ let }; + subordinateUidRange = { + startUid = mkOption { + type = types.int; + description = '' + Start of the range of subordinate user ids that user is + allowed to use. + ''; + }; + count = mkOption { + type = types.int; + default = 1; + description = ''Count of subordinate user ids''; + }; + }; + + subordinateGidRange = { + startGid = mkOption { + type = types.int; + description = '' + Start of the range of subordinate group ids that user is + allowed to use. + ''; + }; + count = mkOption { + type = types.int; + default = 1; + description = ''Count of subordinate group ids''; + }; + }; + getGroup = gname: let groups = mapAttrsToList (n: g: g) ( @@ -265,6 +325,20 @@ let )) ); + mkSubuidEntry = user: concatStrings ( + map (range: "${user.name}:${toString range.startUid}:${toString range.count}\n") + user.subUidRanges); + + subuidFile = concatStrings (map mkSubuidEntry ( + sortOn "uid" (attrValues cfg.extraUsers))); + + mkSubgidEntry = user: concatStrings ( + map (range: "${user.name}:${toString range.startGid}:${toString range.count}\n") + user.subGidRanges); + + subgidFile = concatStrings (map mkSubgidEntry ( + sortOn "uid" (attrValues cfg.extraUsers))); + # If mutableUsers is true, this script adds all users/groups defined in # users.extra{Users,Groups} to /etc/{passwd,group} iff there isn't any # existing user/group with the same name in those files. @@ -504,6 +578,15 @@ in { # for backwards compatibility system.activationScripts.groups = stringAfter [ "users" ] ""; + environment.etc."subuid" = { + text = subuidFile; + mode = "0644"; + }; + environment.etc."subgid" = { + text = subgidFile; + mode = "0644"; + }; + assertions = [ { assertion = !cfg.enforceIdUniqueness || (uidsAreUnique && gidsAreUnique); message = "uids and gids must be unique!"; |