From a74b3012678ab9640b2bc6062ac37fe6805c2f15 Mon Sep 17 00:00:00 2001 From: Aaron Jheng Date: Sat, 23 Sep 2023 20:32:36 +0800 Subject: [PATCH 01/82] mysql-shell-innovation: init at 8.1.1 --- .../tools/mysql-shell/innovation.nix | 130 ++++++++++++++++++ pkgs/top-level/all-packages.nix | 9 ++ 2 files changed, 139 insertions(+) create mode 100644 pkgs/development/tools/mysql-shell/innovation.nix diff --git a/pkgs/development/tools/mysql-shell/innovation.nix b/pkgs/development/tools/mysql-shell/innovation.nix new file mode 100644 index 000000000000..dda169be32da --- /dev/null +++ b/pkgs/development/tools/mysql-shell/innovation.nix @@ -0,0 +1,130 @@ +{ lib +, stdenv +, pkg-config +, cmake +, fetchurl +, git +, cctools +, developer_cmds +, DarwinTools +, makeWrapper +, CoreServices +, bison +, openssl +, protobuf +, curl +, zlib +, libssh +, zstd +, lz4 +, boost +, readline +, libtirpc +, rpcsvc-proto +, libedit +, libevent +, icu +, re2 +, ncurses +, libfido2 +, python3 +, cyrus_sasl +, openldap +, antlr +}: + +let + pythonDeps = with python3.pkgs; [ certifi paramiko pyyaml ]; + + mysqlShellVersion = "8.1.1"; + mysqlServerVersion = "8.1.0"; +in +stdenv.mkDerivation (finalAttrs: { + pname = "mysql-shell-innovation"; + version = mysqlShellVersion; + + srcs = [ + (fetchurl { + url = "https://cdn.mysql.com//Downloads/MySQL-${lib.versions.majorMinor mysqlServerVersion}/mysql-${mysqlServerVersion}.tar.gz"; + hash = "sha256-PdAXqUBzSqkHlqTGXhJeZxL2S7u+M4jTZGneqoe1mes="; + }) + (fetchurl { + url = "https://cdn.mysql.com//Downloads/MySQL-Shell/mysql-shell-${finalAttrs.version}-src.tar.gz"; + hash = "sha256-X7A2h9PWgQgNg7h64oD+Th/KsqP3UGpJ2etaP2B0VuY="; + }) + ]; + + sourceRoot = "mysql-shell-${finalAttrs.version}-src"; + + postUnpack = '' + mv mysql-${mysqlServerVersion} mysql + ''; + + postPatch = '' + substituteInPlace ../mysql/cmake/libutils.cmake --replace /usr/bin/libtool libtool + substituteInPlace ../mysql/cmake/os/Darwin.cmake --replace /usr/bin/libtool libtool + + substituteInPlace cmake/libutils.cmake --replace /usr/bin/libtool libtool + ''; + + nativeBuildInputs = [ pkg-config cmake git bison makeWrapper ] + ++ lib.optionals (!stdenv.isDarwin) [ rpcsvc-proto ] + ++ lib.optionals stdenv.isDarwin [ cctools developer_cmds DarwinTools ]; + + buildInputs = [ + boost + curl + libedit + libssh + lz4 + openssl + protobuf + readline + zlib + zstd + libevent + icu + re2 + ncurses + libfido2 + cyrus_sasl + openldap + python3 + antlr.runtime.cpp + ] ++ pythonDeps + ++ lib.optionals stdenv.isLinux [ libtirpc ] + ++ lib.optionals stdenv.isDarwin [ CoreServices ]; + + preConfigure = '' + # Build MySQL + echo "Building mysqlclient mysqlxclient" + + cmake -DWITH_BOOST=system -DWITH_SYSTEM_LIBS=ON -DWITH_ROUTER=OFF -DWITH_UNIT_TESTS=OFF \ + -DFORCE_UNSUPPORTED_COMPILER=1 -S ../mysql -B ../mysql/build + + cmake --build ../mysql/build --parallel ''${NIX_BUILD_CORES:-1} --target mysqlclient mysqlxclient + ''; + + cmakeFlags = [ + "-DMYSQL_SOURCE_DIR=../mysql" + "-DMYSQL_BUILD_DIR=../mysql/build" + "-DMYSQL_CONFIG_EXECUTABLE=../../mysql/build/scripts/mysql_config" + "-DWITH_ZSTD=system" + "-DWITH_LZ4=system" + "-DWITH_ZLIB=system" + "-DWITH_PROTOBUF=${protobuf}" + "-DHAVE_PYTHON=1" + ]; + + postFixup = '' + wrapProgram $out/bin/mysqlsh --set PYTHONPATH "${lib.makeSearchPath python3.sitePackages pythonDeps}" + ''; + + meta = with lib; { + homepage = "https://dev.mysql.com/doc/mysql-shell/${lib.versions.majorMinor finalAttrs.version}/en/"; + description = "A new command line scriptable shell for MySQL"; + license = licenses.gpl2; + maintainers = with maintainers; [ aaronjheng ]; + mainProgram = "mysqlsh"; + }; +}) diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 55eca3490d96..712bf2e2fc63 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -1080,6 +1080,15 @@ with pkgs; icu = icu69; }; + mysql-shell-innovation = callPackage ../development/tools/mysql-shell/innovation.nix { + inherit (darwin) cctools developer_cmds DarwinTools; + inherit (darwin.apple_sdk.frameworks) CoreServices; + antlr = antlr4_10; + boost = boost177; # Configure checks for specific version. + icu = icu69; + protobuf = protobuf3_21; + }; + broadlink-cli = callPackage ../tools/misc/broadlink-cli { }; fetchpatch = callPackage ../build-support/fetchpatch { From dd458977a005ed068d8b2fe1664049b9092e2d22 Mon Sep 17 00:00:00 2001 From: Majiir Paktu Date: Sun, 24 Sep 2023 15:39:21 -0400 Subject: [PATCH 02/82] nixos/pam: clean up rules Makes the rules more uniform in structure and style. This makes it easier to automate subsequent commits. No behavior changes. --- nixos/modules/security/pam.nix | 38 ++++++++++++++-------------------- 1 file changed, 16 insertions(+), 22 deletions(-) diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix index d83259ccbebc..a28ee276ce3a 100644 --- a/nixos/modules/security/pam.nix +++ b/nixos/modules/security/pam.nix @@ -484,14 +484,11 @@ let optionalString cfg.mysqlAuth '' account sufficient ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf '' + - optionalString (config.services.kanidm.enablePam) '' + optionalString config.services.kanidm.enablePam '' account sufficient ${pkgs.kanidm}/lib/pam_kanidm.so ignore_unknown_user '' + - optionalString (config.services.sssd.enable && cfg.sssdStrictAccess==false) '' - account sufficient ${pkgs.sssd}/lib/security/pam_sss.so - '' + - optionalString (config.services.sssd.enable && cfg.sssdStrictAccess) '' - account [default=bad success=ok user_unknown=ignore] ${pkgs.sssd}/lib/security/pam_sss.so + optionalString config.services.sssd.enable '' + account ${if cfg.sssdStrictAccess then "[default=bad success=ok user_unknown=ignore]" else "sufficient"} ${pkgs.sssd}/lib/security/pam_sss.so '' + optionalString config.security.pam.krb5.enable '' account sufficient ${pam_krb5}/lib/security/pam_krb5.so @@ -532,10 +529,9 @@ let (let p11 = config.security.pam.p11; in optionalString cfg.p11Auth '' auth ${p11.control} ${pkgs.pam_p11}/lib/security/pam_p11.so ${pkgs.opensc}/lib/opensc-pkcs11.so '') + - (let u2f = config.security.pam.u2f; in optionalString cfg.u2fAuth ('' - auth ${u2f.control} ${pkgs.pam_u2f}/lib/security/pam_u2f.so ${optionalString u2f.debug "debug"} ${optionalString (u2f.authFile != null) "authfile=${u2f.authFile}"} '' - + ''${optionalString u2f.interactive "interactive"} ${optionalString u2f.cue "cue"} ${optionalString (u2f.appId != null) "appid=${u2f.appId}"} ${optionalString (u2f.origin != null) "origin=${u2f.origin}"} - '')) + + (let u2f = config.security.pam.u2f; in optionalString cfg.u2fAuth '' + auth ${u2f.control} ${pkgs.pam_u2f}/lib/security/pam_u2f.so ${optionalString u2f.debug "debug"} ${optionalString (u2f.authFile != null) "authfile=${u2f.authFile}"} ${optionalString u2f.interactive "interactive"} ${optionalString u2f.cue "cue"} ${optionalString (u2f.appId != null) "appid=${u2f.appId}"} ${optionalString (u2f.origin != null) "origin=${u2f.origin}"} + '') + optionalString cfg.usbAuth '' auth sufficient ${pkgs.pam_usb}/lib/security/pam_usb.so '' + @@ -593,13 +589,13 @@ let auth optional ${pkgs.pam_mount}/lib/security/pam_mount.so disable_interactive '' + optionalString cfg.enableKwallet '' - auth optional ${pkgs.plasma5Packages.kwallet-pam}/lib/security/pam_kwallet5.so kwalletd=${pkgs.plasma5Packages.kwallet.bin}/bin/kwalletd5 + auth optional ${pkgs.plasma5Packages.kwallet-pam}/lib/security/pam_kwallet5.so kwalletd=${pkgs.plasma5Packages.kwallet.bin}/bin/kwalletd5 '' + optionalString cfg.enableGnomeKeyring '' auth optional ${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so '' + optionalString cfg.gnupg.enable '' - auth optional ${pkgs.pam_gnupg}/lib/security/pam_gnupg.so ${optionalString cfg.gnupg.storeOnly " store-only"} + auth optional ${pkgs.pam_gnupg}/lib/security/pam_gnupg.so ${optionalString cfg.gnupg.storeOnly "store-only"} '' + optionalString cfg.failDelay.enable '' auth optional ${pkgs.pam}/lib/security/pam_faildelay.so delay=${toString cfg.failDelay.delay} @@ -641,7 +637,8 @@ let '' + optionalString config.services.homed.enable '' password sufficient ${config.systemd.package}/lib/security/pam_systemd_home.so - '' + '' + '' + + '' password sufficient pam_unix.so nullok yescrypt '' + optionalString config.security.pam.enableEcryptfs '' @@ -687,12 +684,9 @@ let optionalString cfg.setLoginUid '' session ${if config.boot.isContainer then "optional" else "required"} pam_loginuid.so '' + - optionalString cfg.ttyAudit.enable (concatStringsSep " \\\n " ([ - "session required ${pkgs.pam}/lib/security/pam_tty_audit.so" - ] ++ optional cfg.ttyAudit.openOnly "open_only" - ++ optional (cfg.ttyAudit.enablePattern != null) "enable=${cfg.ttyAudit.enablePattern}" - ++ optional (cfg.ttyAudit.disablePattern != null) "disable=${cfg.ttyAudit.disablePattern}" - )) + + optionalString cfg.ttyAudit.enable '' + session required ${pkgs.pam}/lib/security/pam_tty_audit.so ${optionalString cfg.ttyAudit.openOnly "open_only"} ${optionalString (cfg.ttyAudit.enablePattern != null) "enable=${cfg.ttyAudit.enablePattern}"} ${optionalString (cfg.ttyAudit.disablePattern != null) "disable=${cfg.ttyAudit.disablePattern}"} + '' + optionalString config.services.homed.enable '' session required ${config.systemd.package}/lib/security/pam_systemd_home.so '' + @@ -753,16 +747,16 @@ let optionalString (cfg.enableAppArmor && config.security.apparmor.enable) '' session optional ${pkgs.apparmor-pam}/lib/security/pam_apparmor.so order=user,group,default debug '' + - optionalString (cfg.enableKwallet) '' + optionalString cfg.enableKwallet '' session optional ${pkgs.plasma5Packages.kwallet-pam}/lib/security/pam_kwallet5.so kwalletd=${pkgs.plasma5Packages.kwallet.bin}/bin/kwalletd5 '' + - optionalString (cfg.enableGnomeKeyring) '' + optionalString cfg.enableGnomeKeyring '' session optional ${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so auto_start '' + optionalString cfg.gnupg.enable '' session optional ${pkgs.pam_gnupg}/lib/security/pam_gnupg.so ${optionalString cfg.gnupg.noAutostart " no-autostart"} '' + - optionalString (config.virtualisation.lxc.lxcfs.enable) '' + optionalString config.virtualisation.lxc.lxcfs.enable '' session optional ${pkgs.lxc}/lib/security/pam_cgfs.so -c all '' ); From 0f9d719d8ab58642d30aec627aa628efe44aa207 Mon Sep 17 00:00:00 2001 From: Majiir Paktu Date: Sun, 24 Sep 2023 17:42:47 -0400 Subject: [PATCH 03/82] nixos/pam: split rule lists into individual rules --- nixos/modules/security/pam.nix | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix index a28ee276ce3a..2f4f6605548a 100644 --- a/nixos/modules/security/pam.nix +++ b/nixos/modules/security/pam.nix @@ -495,6 +495,8 @@ let '' + optionalString cfg.googleOsLoginAccountVerification '' account [success=ok ignore=ignore default=die] ${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_login.so + '' + + optionalString cfg.googleOsLoginAccountVerification '' account [success=ok default=ignore] ${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_admin.so '' + optionalString config.services.homed.enable '' @@ -627,7 +629,11 @@ let '' + optionalString config.security.pam.krb5.enable '' auth [default=ignore success=1 service_err=reset] ${pam_krb5}/lib/security/pam_krb5.so use_first_pass + '' + + optionalString config.security.pam.krb5.enable '' auth [default=die success=done] ${pam_ccreds}/lib/security/pam_ccreds.so action=validate use_first_pass + '' + + optionalString config.security.pam.krb5.enable '' auth sufficient ${pam_ccreds}/lib/security/pam_ccreds.so action=store use_first_pass '' + '' @@ -705,10 +711,14 @@ let # anyways. # See also https://github.com/google/fscrypt/issues/95 session [success=1 default=ignore] pam_succeed_if.so service = systemd-user + '' + + optionalString config.security.pam.enableFscrypt '' session optional ${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so '' + optionalString cfg.zfs '' session [success=1 default=ignore] pam_succeed_if.so service = systemd-user + '' + + optionalString cfg.zfs '' session optional ${config.boot.zfs.package}/lib/security/pam_zfs_key.so homes=${config.security.pam.zfs.homes} ${optionalString config.security.pam.zfs.noUnmount "nounmount"} '' + optionalString cfg.pamMount '' From 2ab8087018e2829faf5a4a1e22be4c382fba8d9a Mon Sep 17 00:00:00 2001 From: Nicolas Benes Date: Thu, 28 Sep 2023 08:58:11 +0200 Subject: [PATCH 04/82] python3Packages.click-aliases: 1.0.1 -> 1.0.2 --- .../0001-Fix-quotes-in-test.patch | 39 ------------------- .../python-modules/click-aliases/default.nix | 11 ++++-- 2 files changed, 7 insertions(+), 43 deletions(-) delete mode 100644 pkgs/development/python-modules/click-aliases/0001-Fix-quotes-in-test.patch diff --git a/pkgs/development/python-modules/click-aliases/0001-Fix-quotes-in-test.patch b/pkgs/development/python-modules/click-aliases/0001-Fix-quotes-in-test.patch deleted file mode 100644 index 13cc6a68e8d3..000000000000 --- a/pkgs/development/python-modules/click-aliases/0001-Fix-quotes-in-test.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Nicolas Benes -Date: Mon, 12 Jun 2023 11:29:32 +0200 -Subject: [PATCH] Fix quotes in test - - -diff --git a/tests/test_basic.py b/tests/test_basic.py -index 077e6c0..90bbdc3 100644 ---- a/tests/test_basic.py -+++ b/tests/test_basic.py -@@ -43,8 +43,8 @@ def test_foobar(runner): - - TEST_INVALID = """Usage: cli [OPTIONS] COMMAND [ARGS]... - {} --Error: No such command "bar". --""".format('Try "cli --help" for help.\n' if _click7 else '') -+Error: No such command 'bar'. -+""".format("Try 'cli --help' for help.\n" if _click7 else '') - - - def test_invalid(runner): -diff --git a/tests/test_foobar.py b/tests/test_foobar.py -index fd6c4e6..ab0ad5d 100644 ---- a/tests/test_foobar.py -+++ b/tests/test_foobar.py -@@ -44,8 +44,8 @@ def test_foobar(runner): - - TEST_INVALID = """Usage: cli [OPTIONS] COMMAND [ARGS]... - {} --Error: No such command "baz". --""".format('Try "cli --help" for help.\n' if _click7 else '') -+Error: No such command 'baz'. -+""".format("Try 'cli --help' for help.\n" if _click7 else '') - - - def test_invalid(runner): --- -2.40.1 - diff --git a/pkgs/development/python-modules/click-aliases/default.nix b/pkgs/development/python-modules/click-aliases/default.nix index 677cb1309fd7..7e2ed9b1bf5a 100644 --- a/pkgs/development/python-modules/click-aliases/default.nix +++ b/pkgs/development/python-modules/click-aliases/default.nix @@ -1,23 +1,26 @@ { lib , buildPythonPackage , fetchFromGitHub +, poetry-core , click , pytestCheckHook }: buildPythonPackage rec { pname = "click-aliases"; - version = "1.0.1"; + version = "1.0.2"; + + pyproject = true; src = fetchFromGitHub { owner = "click-contrib"; repo = "click-aliases"; rev = "v${version}"; - hash = "sha256-vzWlCb4m9TdRaVz4DrlRRZ60+9gj60NoiALgvaIG0gA="; + hash = "sha256-ZrNdxUMLRre0U9xCyyU8HjByNGMSXiuMDVjW9e88eyk="; }; - patches = [ - ./0001-Fix-quotes-in-test.patch + nativeBuildInputs = [ + poetry-core ]; propagatedBuildInputs = [ From d6bb805932ae8fdea7e516f40b2455109d4b4013 Mon Sep 17 00:00:00 2001 From: Majiir Paktu Date: Fri, 15 Sep 2023 22:25:18 -0400 Subject: [PATCH 05/82] nixos/pam: extract header comments Unblocks converting the rules from one big string to a rich data structure. --- nixos/modules/security/pam.nix | 409 ++++++++++++++++++--------------- 1 file changed, 227 insertions(+), 182 deletions(-) diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix index 2f4f6605548a..4e12d7fc0691 100644 --- a/nixos/modules/security/pam.nix +++ b/nixos/modules/security/pam.nix @@ -6,6 +6,15 @@ with lib; let + + mkRulesTypeOption = type: mkOption { + # This option is experimental and subject to breaking changes without notice. + description = lib.mdDoc '' + PAM `${type}` rules for this service. + ''; + type = types.listOf types.str; + }; + parentConfig = config; pamOpts = { config, name, ... }: let cfg = config; in let config = parentConfig; in { @@ -18,6 +27,28 @@ let description = lib.mdDoc "Name of the PAM service."; }; + rules = mkOption { + # This option is experimental and subject to breaking changes without notice. + visible = false; + + description = lib.mdDoc '' + PAM rules for this service. + + ::: {.warning} + This option and its suboptions are experimental and subject to breaking changes without notice. + + If you use this option in your system configuration, you will need to manually monitor this module for any changes. Otherwise, failure to adjust your configuration properly could lead to you being locked out of your system, or worse, your system could be left wide open to attackers. + + If you share configuration examples that use this option, you MUST include this warning so that users are informed. + + You may freely use this option within `nixpkgs`, and future changes will account for those use sites. + ::: + ''; + type = types.submodule { + options = genAttrs [ "account" "auth" "password" "session" ] mkRulesTypeOption; + }; + }; + unixAuth = mkOption { default = true; type = types.bool; @@ -470,88 +501,104 @@ let setLoginUid = mkDefault cfg.startSession; limits = mkDefault config.security.pam.loginLimits; + text = let + formatRules = type: pipe cfg.rules.${type} [ + (map (removeSuffix "\n")) + (concatStringsSep "\n") + ]; + in mkDefault '' + # Account management. + ${formatRules "account"} + + # Authentication management. + ${formatRules "auth"} + + # Password management. + ${formatRules "password"} + + # Session management. + ${formatRules "session"} + ''; + # !!! TODO: move the LDAP stuff to the LDAP module, and the # Samba stuff to the Samba module. This requires that the PAM # module provides the right hooks. - text = mkDefault - ( - '' - # Account management. - '' + - optionalString use_ldap '' + rules = { + account = + optional use_ldap '' account sufficient ${pam_ldap}/lib/security/pam_ldap.so - '' + - optionalString cfg.mysqlAuth '' + '' ++ + optional cfg.mysqlAuth '' account sufficient ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf - '' + - optionalString config.services.kanidm.enablePam '' + '' ++ + optional config.services.kanidm.enablePam '' account sufficient ${pkgs.kanidm}/lib/pam_kanidm.so ignore_unknown_user - '' + - optionalString config.services.sssd.enable '' + '' ++ + optional config.services.sssd.enable '' account ${if cfg.sssdStrictAccess then "[default=bad success=ok user_unknown=ignore]" else "sufficient"} ${pkgs.sssd}/lib/security/pam_sss.so - '' + - optionalString config.security.pam.krb5.enable '' + '' ++ + optional config.security.pam.krb5.enable '' account sufficient ${pam_krb5}/lib/security/pam_krb5.so - '' + - optionalString cfg.googleOsLoginAccountVerification '' + '' ++ + optional cfg.googleOsLoginAccountVerification '' account [success=ok ignore=ignore default=die] ${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_login.so - '' + - optionalString cfg.googleOsLoginAccountVerification '' + '' ++ + optional cfg.googleOsLoginAccountVerification '' account [success=ok default=ignore] ${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_admin.so - '' + - optionalString config.services.homed.enable '' + '' ++ + optional config.services.homed.enable '' account sufficient ${config.systemd.package}/lib/security/pam_systemd_home.so - '' + + '' ++ # The required pam_unix.so module has to come after all the sufficient modules # because otherwise, the account lookup will fail if the user does not exist # locally, for example with MySQL- or LDAP-auth. - '' + singleton '' account required pam_unix.so + ''; - # Authentication management. - '' + - optionalString cfg.googleOsLoginAuthentication '' + auth = + optional cfg.googleOsLoginAuthentication '' auth [success=done perm_denied=die default=ignore] ${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_login.so - '' + - optionalString cfg.rootOK '' + '' ++ + optional cfg.rootOK '' auth sufficient pam_rootok.so - '' + - optionalString cfg.requireWheel '' + '' ++ + optional cfg.requireWheel '' auth required pam_wheel.so use_uid - '' + - optionalString cfg.logFailures '' + '' ++ + optional cfg.logFailures '' auth required pam_faillock.so - '' + - optionalString cfg.mysqlAuth '' + '' ++ + optional cfg.mysqlAuth '' auth sufficient ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf - '' + - optionalString (config.security.pam.enableSSHAgentAuth && cfg.sshAgentAuth) '' + '' ++ + optional (config.security.pam.enableSSHAgentAuth && cfg.sshAgentAuth) '' auth sufficient ${pkgs.pam_ssh_agent_auth}/libexec/pam_ssh_agent_auth.so file=${lib.concatStringsSep ":" config.services.openssh.authorizedKeysFiles} - '' + - (let p11 = config.security.pam.p11; in optionalString cfg.p11Auth '' + '' ++ + (let p11 = config.security.pam.p11; in optional cfg.p11Auth '' auth ${p11.control} ${pkgs.pam_p11}/lib/security/pam_p11.so ${pkgs.opensc}/lib/opensc-pkcs11.so - '') + - (let u2f = config.security.pam.u2f; in optionalString cfg.u2fAuth '' + '') ++ + (let u2f = config.security.pam.u2f; in optional cfg.u2fAuth '' auth ${u2f.control} ${pkgs.pam_u2f}/lib/security/pam_u2f.so ${optionalString u2f.debug "debug"} ${optionalString (u2f.authFile != null) "authfile=${u2f.authFile}"} ${optionalString u2f.interactive "interactive"} ${optionalString u2f.cue "cue"} ${optionalString (u2f.appId != null) "appid=${u2f.appId}"} ${optionalString (u2f.origin != null) "origin=${u2f.origin}"} - '') + - optionalString cfg.usbAuth '' + '') ++ + optional cfg.usbAuth '' auth sufficient ${pkgs.pam_usb}/lib/security/pam_usb.so - '' + - (let ussh = config.security.pam.ussh; in optionalString (config.security.pam.ussh.enable && cfg.usshAuth) '' + '' ++ + (let ussh = config.security.pam.ussh; in optional (config.security.pam.ussh.enable && cfg.usshAuth) '' auth ${ussh.control} ${pkgs.pam_ussh}/lib/security/pam_ussh.so ${optionalString (ussh.caFile != null) "ca_file=${ussh.caFile}"} ${optionalString (ussh.authorizedPrincipals != null) "authorized_principals=${ussh.authorizedPrincipals}"} ${optionalString (ussh.authorizedPrincipalsFile != null) "authorized_principals_file=${ussh.authorizedPrincipalsFile}"} ${optionalString (ussh.group != null) "group=${ussh.group}"} - '') + - (let oath = config.security.pam.oath; in optionalString cfg.oathAuth '' + '') ++ + (let oath = config.security.pam.oath; in optional cfg.oathAuth '' auth requisite ${pkgs.oath-toolkit}/lib/security/pam_oath.so window=${toString oath.window} usersfile=${toString oath.usersFile} digits=${toString oath.digits} - '') + - (let yubi = config.security.pam.yubico; in optionalString cfg.yubicoAuth '' + '') ++ + (let yubi = config.security.pam.yubico; in optional cfg.yubicoAuth '' auth ${yubi.control} ${pkgs.yubico-pam}/lib/security/pam_yubico.so mode=${toString yubi.mode} ${optionalString (yubi.challengeResponsePath != null) "chalresp_path=${yubi.challengeResponsePath}"} ${optionalString (yubi.mode == "client") "id=${toString yubi.id}"} ${optionalString yubi.debug "debug"} - '') + - (let dp9ik = config.security.pam.dp9ik; in optionalString dp9ik.enable '' + '') ++ + (let dp9ik = config.security.pam.dp9ik; in optional dp9ik.enable '' auth ${dp9ik.control} ${pkgs.pam_dp9ik}/lib/security/pam_p9.so ${dp9ik.authserver} - '') + - optionalString cfg.fprintAuth '' + '') ++ + optional cfg.fprintAuth '' auth sufficient ${pkgs.fprintd}/lib/security/pam_fprintd.so - '' + + '' ++ # Modules in this block require having the password set in PAM_AUTHTOK. # pam_unix is marked as 'sufficient' on NixOS which means nothing will run # after it succeeds. Certain modules need to run after pam_unix @@ -560,7 +607,7 @@ let # We use try_first_pass the second time to avoid prompting password twice. # # The same principle applies to systemd-homed - (optionalString ((cfg.unixAuth || config.services.homed.enable) && + (optionals ((cfg.unixAuth || config.services.homed.enable) && (config.security.pam.enableEcryptfs || config.security.pam.enableFscrypt || cfg.pamMount @@ -572,204 +619,202 @@ let || cfg.duoSecurity.enable || cfg.zfs)) ( - optionalString config.services.homed.enable '' + optional config.services.homed.enable '' auth optional ${config.systemd.package}/lib/security/pam_systemd_home.so - '' + - optionalString cfg.unixAuth '' + '' ++ + optional cfg.unixAuth '' auth optional pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} ${optionalString cfg.nodelay "nodelay"} likeauth - '' + - optionalString config.security.pam.enableEcryptfs '' + '' ++ + optional config.security.pam.enableEcryptfs '' auth optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so unwrap - '' + - optionalString config.security.pam.enableFscrypt '' + '' ++ + optional config.security.pam.enableFscrypt '' auth optional ${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so - '' + - optionalString cfg.zfs '' + '' ++ + optional cfg.zfs '' auth optional ${config.boot.zfs.package}/lib/security/pam_zfs_key.so homes=${config.security.pam.zfs.homes} - '' + - optionalString cfg.pamMount '' + '' ++ + optional cfg.pamMount '' auth optional ${pkgs.pam_mount}/lib/security/pam_mount.so disable_interactive - '' + - optionalString cfg.enableKwallet '' + '' ++ + optional cfg.enableKwallet '' auth optional ${pkgs.plasma5Packages.kwallet-pam}/lib/security/pam_kwallet5.so kwalletd=${pkgs.plasma5Packages.kwallet.bin}/bin/kwalletd5 - '' + - optionalString cfg.enableGnomeKeyring '' + '' ++ + optional cfg.enableGnomeKeyring '' auth optional ${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so - '' + - optionalString cfg.gnupg.enable '' + '' ++ + optional cfg.gnupg.enable '' auth optional ${pkgs.pam_gnupg}/lib/security/pam_gnupg.so ${optionalString cfg.gnupg.storeOnly "store-only"} - '' + - optionalString cfg.failDelay.enable '' + '' ++ + optional cfg.failDelay.enable '' auth optional ${pkgs.pam}/lib/security/pam_faildelay.so delay=${toString cfg.failDelay.delay} - '' + - optionalString cfg.googleAuthenticator.enable '' + '' ++ + optional cfg.googleAuthenticator.enable '' auth required ${pkgs.google-authenticator}/lib/security/pam_google_authenticator.so no_increment_hotp - '' + - optionalString cfg.duoSecurity.enable '' + '' ++ + optional cfg.duoSecurity.enable '' auth required ${pkgs.duo-unix}/lib/security/pam_duo.so '' - )) + - optionalString config.services.homed.enable '' + )) ++ + optional config.services.homed.enable '' auth sufficient ${config.systemd.package}/lib/security/pam_systemd_home.so - '' + - optionalString cfg.unixAuth '' + '' ++ + optional cfg.unixAuth '' auth sufficient pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} ${optionalString cfg.nodelay "nodelay"} likeauth try_first_pass - '' + - optionalString cfg.otpwAuth '' + '' ++ + optional cfg.otpwAuth '' auth sufficient ${pkgs.otpw}/lib/security/pam_otpw.so - '' + - optionalString use_ldap '' + '' ++ + optional use_ldap '' auth sufficient ${pam_ldap}/lib/security/pam_ldap.so use_first_pass - '' + - optionalString config.services.kanidm.enablePam '' + '' ++ + optional config.services.kanidm.enablePam '' auth sufficient ${pkgs.kanidm}/lib/pam_kanidm.so ignore_unknown_user use_first_pass - '' + - optionalString config.services.sssd.enable '' + '' ++ + optional config.services.sssd.enable '' auth sufficient ${pkgs.sssd}/lib/security/pam_sss.so use_first_pass - '' + - optionalString config.security.pam.krb5.enable '' + '' ++ + optional config.security.pam.krb5.enable '' auth [default=ignore success=1 service_err=reset] ${pam_krb5}/lib/security/pam_krb5.so use_first_pass - '' + - optionalString config.security.pam.krb5.enable '' + '' ++ + optional config.security.pam.krb5.enable '' auth [default=die success=done] ${pam_ccreds}/lib/security/pam_ccreds.so action=validate use_first_pass - '' + - optionalString config.security.pam.krb5.enable '' + '' ++ + optional config.security.pam.krb5.enable '' auth sufficient ${pam_ccreds}/lib/security/pam_ccreds.so action=store use_first_pass - '' + - '' + '' ++ + singleton '' auth required pam_deny.so + ''; - # Password management. - '' + - optionalString config.services.homed.enable '' + password = + optional config.services.homed.enable '' password sufficient ${config.systemd.package}/lib/security/pam_systemd_home.so - '' + - '' + '' ++ + singleton '' password sufficient pam_unix.so nullok yescrypt - '' + - optionalString config.security.pam.enableEcryptfs '' + '' ++ + optional config.security.pam.enableEcryptfs '' password optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so - '' + - optionalString config.security.pam.enableFscrypt '' + '' ++ + optional config.security.pam.enableFscrypt '' password optional ${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so - '' + - optionalString cfg.zfs '' + '' ++ + optional cfg.zfs '' password optional ${config.boot.zfs.package}/lib/security/pam_zfs_key.so homes=${config.security.pam.zfs.homes} - '' + - optionalString cfg.pamMount '' + '' ++ + optional cfg.pamMount '' password optional ${pkgs.pam_mount}/lib/security/pam_mount.so - '' + - optionalString use_ldap '' + '' ++ + optional use_ldap '' password sufficient ${pam_ldap}/lib/security/pam_ldap.so - '' + - optionalString cfg.mysqlAuth '' + '' ++ + optional cfg.mysqlAuth '' password sufficient ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf - '' + - optionalString config.services.kanidm.enablePam '' + '' ++ + optional config.services.kanidm.enablePam '' password sufficient ${pkgs.kanidm}/lib/pam_kanidm.so - '' + - optionalString config.services.sssd.enable '' + '' ++ + optional config.services.sssd.enable '' password sufficient ${pkgs.sssd}/lib/security/pam_sss.so - '' + - optionalString config.security.pam.krb5.enable '' + '' ++ + optional config.security.pam.krb5.enable '' password sufficient ${pam_krb5}/lib/security/pam_krb5.so use_first_pass - '' + - optionalString cfg.enableGnomeKeyring '' + '' ++ + optional cfg.enableGnomeKeyring '' password optional ${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so use_authtok - '' + - '' + ''; - # Session management. - '' + - optionalString cfg.setEnvironment '' + session = + optional cfg.setEnvironment '' session required pam_env.so conffile=/etc/pam/environment readenv=0 - '' + - '' + '' ++ + singleton '' session required pam_unix.so - '' + - optionalString cfg.setLoginUid '' + '' ++ + optional cfg.setLoginUid '' session ${if config.boot.isContainer then "optional" else "required"} pam_loginuid.so - '' + - optionalString cfg.ttyAudit.enable '' + '' ++ + optional cfg.ttyAudit.enable '' session required ${pkgs.pam}/lib/security/pam_tty_audit.so ${optionalString cfg.ttyAudit.openOnly "open_only"} ${optionalString (cfg.ttyAudit.enablePattern != null) "enable=${cfg.ttyAudit.enablePattern}"} ${optionalString (cfg.ttyAudit.disablePattern != null) "disable=${cfg.ttyAudit.disablePattern}"} - '' + - optionalString config.services.homed.enable '' + '' ++ + optional config.services.homed.enable '' session required ${config.systemd.package}/lib/security/pam_systemd_home.so - '' + - optionalString cfg.makeHomeDir '' + '' ++ + optional cfg.makeHomeDir '' session required ${pkgs.pam}/lib/security/pam_mkhomedir.so silent skel=${config.security.pam.makeHomeDir.skelDirectory} umask=${config.security.pam.makeHomeDir.umask} - '' + - optionalString cfg.updateWtmp '' + '' ++ + optional cfg.updateWtmp '' session required ${pkgs.pam}/lib/security/pam_lastlog.so silent - '' + - optionalString config.security.pam.enableEcryptfs '' + '' ++ + optional config.security.pam.enableEcryptfs '' session optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so - '' + - optionalString config.security.pam.enableFscrypt '' + '' ++ + optional config.security.pam.enableFscrypt '' # Work around https://github.com/systemd/systemd/issues/8598 # Skips the pam_fscrypt module for systemd-user sessions which do not have a password # anyways. # See also https://github.com/google/fscrypt/issues/95 session [success=1 default=ignore] pam_succeed_if.so service = systemd-user - '' + - optionalString config.security.pam.enableFscrypt '' + '' ++ + optional config.security.pam.enableFscrypt '' session optional ${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so - '' + - optionalString cfg.zfs '' + '' ++ + optional cfg.zfs '' session [success=1 default=ignore] pam_succeed_if.so service = systemd-user - '' + - optionalString cfg.zfs '' + '' ++ + optional cfg.zfs '' session optional ${config.boot.zfs.package}/lib/security/pam_zfs_key.so homes=${config.security.pam.zfs.homes} ${optionalString config.security.pam.zfs.noUnmount "nounmount"} - '' + - optionalString cfg.pamMount '' + '' ++ + optional cfg.pamMount '' session optional ${pkgs.pam_mount}/lib/security/pam_mount.so disable_interactive - '' + - optionalString use_ldap '' + '' ++ + optional use_ldap '' session optional ${pam_ldap}/lib/security/pam_ldap.so - '' + - optionalString cfg.mysqlAuth '' + '' ++ + optional cfg.mysqlAuth '' session optional ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf - '' + - optionalString config.services.kanidm.enablePam '' + '' ++ + optional config.services.kanidm.enablePam '' session optional ${pkgs.kanidm}/lib/pam_kanidm.so - '' + - optionalString config.services.sssd.enable '' + '' ++ + optional config.services.sssd.enable '' session optional ${pkgs.sssd}/lib/security/pam_sss.so - '' + - optionalString config.security.pam.krb5.enable '' + '' ++ + optional config.security.pam.krb5.enable '' session optional ${pam_krb5}/lib/security/pam_krb5.so - '' + - optionalString cfg.otpwAuth '' + '' ++ + optional cfg.otpwAuth '' session optional ${pkgs.otpw}/lib/security/pam_otpw.so - '' + - optionalString cfg.startSession '' + '' ++ + optional cfg.startSession '' session optional ${config.systemd.package}/lib/security/pam_systemd.so - '' + - optionalString cfg.forwardXAuth '' + '' ++ + optional cfg.forwardXAuth '' session optional pam_xauth.so xauthpath=${pkgs.xorg.xauth}/bin/xauth systemuser=99 - '' + - optionalString (cfg.limits != []) '' + '' ++ + optional (cfg.limits != []) '' session required ${pkgs.pam}/lib/security/pam_limits.so conf=${makeLimitsConf cfg.limits} - '' + - optionalString (cfg.showMotd && (config.users.motd != null || config.users.motdFile != null)) '' + '' ++ + optional (cfg.showMotd && (config.users.motd != null || config.users.motdFile != null)) '' session optional ${pkgs.pam}/lib/security/pam_motd.so motd=${motd} - '' + - optionalString (cfg.enableAppArmor && config.security.apparmor.enable) '' + '' ++ + optional (cfg.enableAppArmor && config.security.apparmor.enable) '' session optional ${pkgs.apparmor-pam}/lib/security/pam_apparmor.so order=user,group,default debug - '' + - optionalString cfg.enableKwallet '' + '' ++ + optional cfg.enableKwallet '' session optional ${pkgs.plasma5Packages.kwallet-pam}/lib/security/pam_kwallet5.so kwalletd=${pkgs.plasma5Packages.kwallet.bin}/bin/kwalletd5 - '' + - optionalString cfg.enableGnomeKeyring '' + '' ++ + optional cfg.enableGnomeKeyring '' session optional ${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so auto_start - '' + - optionalString cfg.gnupg.enable '' + '' ++ + optional cfg.gnupg.enable '' session optional ${pkgs.pam_gnupg}/lib/security/pam_gnupg.so ${optionalString cfg.gnupg.noAutostart " no-autostart"} - '' + - optionalString config.virtualisation.lxc.lxcfs.enable '' + '' ++ + optional config.virtualisation.lxc.lxcfs.enable '' session optional ${pkgs.lxc}/lib/security/pam_cgfs.so -c all - '' - ); + ''; + }; }; }; From 3c85d159f780250cd95cc0f50b13ad169399b92b Mon Sep 17 00:00:00 2001 From: Majiir Paktu Date: Fri, 15 Sep 2023 22:15:24 -0400 Subject: [PATCH 06/82] nixos/pam: automatically populate rule type Eliminates a redundancy between the 'rules' suboptions and the type specified in each rule. We eventually want to give each rule a name so that we can merge config overrides. The PAM name is a natural choice for rule name, but a PAM is often used in multiple rule types. Organizing rules by type and rule name avoids name collisions. --- nixos/modules/security/pam.nix | 174 +++++++++++++++++---------------- 1 file changed, 88 insertions(+), 86 deletions(-) diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix index 4e12d7fc0691..87b5afcf0bdc 100644 --- a/nixos/modules/security/pam.nix +++ b/nixos/modules/security/pam.nix @@ -503,7 +503,9 @@ let text = let formatRules = type: pipe cfg.rules.${type} [ - (map (removeSuffix "\n")) + (map (rule: concatStringsSep " " + [ type (removeSuffix "\n" rule) ] + )) (concatStringsSep "\n") ]; in mkDefault '' @@ -526,78 +528,78 @@ let rules = { account = optional use_ldap '' - account sufficient ${pam_ldap}/lib/security/pam_ldap.so + sufficient ${pam_ldap}/lib/security/pam_ldap.so '' ++ optional cfg.mysqlAuth '' - account sufficient ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf + sufficient ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf '' ++ optional config.services.kanidm.enablePam '' - account sufficient ${pkgs.kanidm}/lib/pam_kanidm.so ignore_unknown_user + sufficient ${pkgs.kanidm}/lib/pam_kanidm.so ignore_unknown_user '' ++ optional config.services.sssd.enable '' - account ${if cfg.sssdStrictAccess then "[default=bad success=ok user_unknown=ignore]" else "sufficient"} ${pkgs.sssd}/lib/security/pam_sss.so + ${if cfg.sssdStrictAccess then "[default=bad success=ok user_unknown=ignore]" else "sufficient"} ${pkgs.sssd}/lib/security/pam_sss.so '' ++ optional config.security.pam.krb5.enable '' - account sufficient ${pam_krb5}/lib/security/pam_krb5.so + sufficient ${pam_krb5}/lib/security/pam_krb5.so '' ++ optional cfg.googleOsLoginAccountVerification '' - account [success=ok ignore=ignore default=die] ${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_login.so + [success=ok ignore=ignore default=die] ${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_login.so '' ++ optional cfg.googleOsLoginAccountVerification '' - account [success=ok default=ignore] ${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_admin.so + [success=ok default=ignore] ${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_admin.so '' ++ optional config.services.homed.enable '' - account sufficient ${config.systemd.package}/lib/security/pam_systemd_home.so + sufficient ${config.systemd.package}/lib/security/pam_systemd_home.so '' ++ # The required pam_unix.so module has to come after all the sufficient modules # because otherwise, the account lookup will fail if the user does not exist # locally, for example with MySQL- or LDAP-auth. singleton '' - account required pam_unix.so + required pam_unix.so ''; auth = optional cfg.googleOsLoginAuthentication '' - auth [success=done perm_denied=die default=ignore] ${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_login.so + [success=done perm_denied=die default=ignore] ${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_login.so '' ++ optional cfg.rootOK '' - auth sufficient pam_rootok.so + sufficient pam_rootok.so '' ++ optional cfg.requireWheel '' - auth required pam_wheel.so use_uid + required pam_wheel.so use_uid '' ++ optional cfg.logFailures '' - auth required pam_faillock.so + required pam_faillock.so '' ++ optional cfg.mysqlAuth '' - auth sufficient ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf + sufficient ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf '' ++ optional (config.security.pam.enableSSHAgentAuth && cfg.sshAgentAuth) '' - auth sufficient ${pkgs.pam_ssh_agent_auth}/libexec/pam_ssh_agent_auth.so file=${lib.concatStringsSep ":" config.services.openssh.authorizedKeysFiles} + sufficient ${pkgs.pam_ssh_agent_auth}/libexec/pam_ssh_agent_auth.so file=${lib.concatStringsSep ":" config.services.openssh.authorizedKeysFiles} '' ++ (let p11 = config.security.pam.p11; in optional cfg.p11Auth '' - auth ${p11.control} ${pkgs.pam_p11}/lib/security/pam_p11.so ${pkgs.opensc}/lib/opensc-pkcs11.so + ${p11.control} ${pkgs.pam_p11}/lib/security/pam_p11.so ${pkgs.opensc}/lib/opensc-pkcs11.so '') ++ (let u2f = config.security.pam.u2f; in optional cfg.u2fAuth '' - auth ${u2f.control} ${pkgs.pam_u2f}/lib/security/pam_u2f.so ${optionalString u2f.debug "debug"} ${optionalString (u2f.authFile != null) "authfile=${u2f.authFile}"} ${optionalString u2f.interactive "interactive"} ${optionalString u2f.cue "cue"} ${optionalString (u2f.appId != null) "appid=${u2f.appId}"} ${optionalString (u2f.origin != null) "origin=${u2f.origin}"} + ${u2f.control} ${pkgs.pam_u2f}/lib/security/pam_u2f.so ${optionalString u2f.debug "debug"} ${optionalString (u2f.authFile != null) "authfile=${u2f.authFile}"} ${optionalString u2f.interactive "interactive"} ${optionalString u2f.cue "cue"} ${optionalString (u2f.appId != null) "appid=${u2f.appId}"} ${optionalString (u2f.origin != null) "origin=${u2f.origin}"} '') ++ optional cfg.usbAuth '' - auth sufficient ${pkgs.pam_usb}/lib/security/pam_usb.so + sufficient ${pkgs.pam_usb}/lib/security/pam_usb.so '' ++ (let ussh = config.security.pam.ussh; in optional (config.security.pam.ussh.enable && cfg.usshAuth) '' - auth ${ussh.control} ${pkgs.pam_ussh}/lib/security/pam_ussh.so ${optionalString (ussh.caFile != null) "ca_file=${ussh.caFile}"} ${optionalString (ussh.authorizedPrincipals != null) "authorized_principals=${ussh.authorizedPrincipals}"} ${optionalString (ussh.authorizedPrincipalsFile != null) "authorized_principals_file=${ussh.authorizedPrincipalsFile}"} ${optionalString (ussh.group != null) "group=${ussh.group}"} + ${ussh.control} ${pkgs.pam_ussh}/lib/security/pam_ussh.so ${optionalString (ussh.caFile != null) "ca_file=${ussh.caFile}"} ${optionalString (ussh.authorizedPrincipals != null) "authorized_principals=${ussh.authorizedPrincipals}"} ${optionalString (ussh.authorizedPrincipalsFile != null) "authorized_principals_file=${ussh.authorizedPrincipalsFile}"} ${optionalString (ussh.group != null) "group=${ussh.group}"} '') ++ (let oath = config.security.pam.oath; in optional cfg.oathAuth '' - auth requisite ${pkgs.oath-toolkit}/lib/security/pam_oath.so window=${toString oath.window} usersfile=${toString oath.usersFile} digits=${toString oath.digits} + requisite ${pkgs.oath-toolkit}/lib/security/pam_oath.so window=${toString oath.window} usersfile=${toString oath.usersFile} digits=${toString oath.digits} '') ++ (let yubi = config.security.pam.yubico; in optional cfg.yubicoAuth '' - auth ${yubi.control} ${pkgs.yubico-pam}/lib/security/pam_yubico.so mode=${toString yubi.mode} ${optionalString (yubi.challengeResponsePath != null) "chalresp_path=${yubi.challengeResponsePath}"} ${optionalString (yubi.mode == "client") "id=${toString yubi.id}"} ${optionalString yubi.debug "debug"} + ${yubi.control} ${pkgs.yubico-pam}/lib/security/pam_yubico.so mode=${toString yubi.mode} ${optionalString (yubi.challengeResponsePath != null) "chalresp_path=${yubi.challengeResponsePath}"} ${optionalString (yubi.mode == "client") "id=${toString yubi.id}"} ${optionalString yubi.debug "debug"} '') ++ (let dp9ik = config.security.pam.dp9ik; in optional dp9ik.enable '' - auth ${dp9ik.control} ${pkgs.pam_dp9ik}/lib/security/pam_p9.so ${dp9ik.authserver} + ${dp9ik.control} ${pkgs.pam_dp9ik}/lib/security/pam_p9.so ${dp9ik.authserver} '') ++ optional cfg.fprintAuth '' - auth sufficient ${pkgs.fprintd}/lib/security/pam_fprintd.so + sufficient ${pkgs.fprintd}/lib/security/pam_fprintd.so '' ++ # Modules in this block require having the password set in PAM_AUTHTOK. # pam_unix is marked as 'sufficient' on NixOS which means nothing will run @@ -620,199 +622,199 @@ let || cfg.zfs)) ( optional config.services.homed.enable '' - auth optional ${config.systemd.package}/lib/security/pam_systemd_home.so + optional ${config.systemd.package}/lib/security/pam_systemd_home.so '' ++ optional cfg.unixAuth '' - auth optional pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} ${optionalString cfg.nodelay "nodelay"} likeauth + optional pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} ${optionalString cfg.nodelay "nodelay"} likeauth '' ++ optional config.security.pam.enableEcryptfs '' - auth optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so unwrap + optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so unwrap '' ++ optional config.security.pam.enableFscrypt '' - auth optional ${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so + optional ${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so '' ++ optional cfg.zfs '' - auth optional ${config.boot.zfs.package}/lib/security/pam_zfs_key.so homes=${config.security.pam.zfs.homes} + optional ${config.boot.zfs.package}/lib/security/pam_zfs_key.so homes=${config.security.pam.zfs.homes} '' ++ optional cfg.pamMount '' - auth optional ${pkgs.pam_mount}/lib/security/pam_mount.so disable_interactive + optional ${pkgs.pam_mount}/lib/security/pam_mount.so disable_interactive '' ++ optional cfg.enableKwallet '' - auth optional ${pkgs.plasma5Packages.kwallet-pam}/lib/security/pam_kwallet5.so kwalletd=${pkgs.plasma5Packages.kwallet.bin}/bin/kwalletd5 + optional ${pkgs.plasma5Packages.kwallet-pam}/lib/security/pam_kwallet5.so kwalletd=${pkgs.plasma5Packages.kwallet.bin}/bin/kwalletd5 '' ++ optional cfg.enableGnomeKeyring '' - auth optional ${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so + optional ${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so '' ++ optional cfg.gnupg.enable '' - auth optional ${pkgs.pam_gnupg}/lib/security/pam_gnupg.so ${optionalString cfg.gnupg.storeOnly "store-only"} + optional ${pkgs.pam_gnupg}/lib/security/pam_gnupg.so ${optionalString cfg.gnupg.storeOnly "store-only"} '' ++ optional cfg.failDelay.enable '' - auth optional ${pkgs.pam}/lib/security/pam_faildelay.so delay=${toString cfg.failDelay.delay} + optional ${pkgs.pam}/lib/security/pam_faildelay.so delay=${toString cfg.failDelay.delay} '' ++ optional cfg.googleAuthenticator.enable '' - auth required ${pkgs.google-authenticator}/lib/security/pam_google_authenticator.so no_increment_hotp + required ${pkgs.google-authenticator}/lib/security/pam_google_authenticator.so no_increment_hotp '' ++ optional cfg.duoSecurity.enable '' - auth required ${pkgs.duo-unix}/lib/security/pam_duo.so + required ${pkgs.duo-unix}/lib/security/pam_duo.so '' )) ++ optional config.services.homed.enable '' - auth sufficient ${config.systemd.package}/lib/security/pam_systemd_home.so + sufficient ${config.systemd.package}/lib/security/pam_systemd_home.so '' ++ optional cfg.unixAuth '' - auth sufficient pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} ${optionalString cfg.nodelay "nodelay"} likeauth try_first_pass + sufficient pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} ${optionalString cfg.nodelay "nodelay"} likeauth try_first_pass '' ++ optional cfg.otpwAuth '' - auth sufficient ${pkgs.otpw}/lib/security/pam_otpw.so + sufficient ${pkgs.otpw}/lib/security/pam_otpw.so '' ++ optional use_ldap '' - auth sufficient ${pam_ldap}/lib/security/pam_ldap.so use_first_pass + sufficient ${pam_ldap}/lib/security/pam_ldap.so use_first_pass '' ++ optional config.services.kanidm.enablePam '' - auth sufficient ${pkgs.kanidm}/lib/pam_kanidm.so ignore_unknown_user use_first_pass + sufficient ${pkgs.kanidm}/lib/pam_kanidm.so ignore_unknown_user use_first_pass '' ++ optional config.services.sssd.enable '' - auth sufficient ${pkgs.sssd}/lib/security/pam_sss.so use_first_pass + sufficient ${pkgs.sssd}/lib/security/pam_sss.so use_first_pass '' ++ optional config.security.pam.krb5.enable '' - auth [default=ignore success=1 service_err=reset] ${pam_krb5}/lib/security/pam_krb5.so use_first_pass + [default=ignore success=1 service_err=reset] ${pam_krb5}/lib/security/pam_krb5.so use_first_pass '' ++ optional config.security.pam.krb5.enable '' - auth [default=die success=done] ${pam_ccreds}/lib/security/pam_ccreds.so action=validate use_first_pass + [default=die success=done] ${pam_ccreds}/lib/security/pam_ccreds.so action=validate use_first_pass '' ++ optional config.security.pam.krb5.enable '' - auth sufficient ${pam_ccreds}/lib/security/pam_ccreds.so action=store use_first_pass + sufficient ${pam_ccreds}/lib/security/pam_ccreds.so action=store use_first_pass '' ++ singleton '' - auth required pam_deny.so + required pam_deny.so ''; password = optional config.services.homed.enable '' - password sufficient ${config.systemd.package}/lib/security/pam_systemd_home.so + sufficient ${config.systemd.package}/lib/security/pam_systemd_home.so '' ++ singleton '' - password sufficient pam_unix.so nullok yescrypt + sufficient pam_unix.so nullok yescrypt '' ++ optional config.security.pam.enableEcryptfs '' - password optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so + optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so '' ++ optional config.security.pam.enableFscrypt '' - password optional ${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so + optional ${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so '' ++ optional cfg.zfs '' - password optional ${config.boot.zfs.package}/lib/security/pam_zfs_key.so homes=${config.security.pam.zfs.homes} + optional ${config.boot.zfs.package}/lib/security/pam_zfs_key.so homes=${config.security.pam.zfs.homes} '' ++ optional cfg.pamMount '' - password optional ${pkgs.pam_mount}/lib/security/pam_mount.so + optional ${pkgs.pam_mount}/lib/security/pam_mount.so '' ++ optional use_ldap '' - password sufficient ${pam_ldap}/lib/security/pam_ldap.so + sufficient ${pam_ldap}/lib/security/pam_ldap.so '' ++ optional cfg.mysqlAuth '' - password sufficient ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf + sufficient ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf '' ++ optional config.services.kanidm.enablePam '' - password sufficient ${pkgs.kanidm}/lib/pam_kanidm.so + sufficient ${pkgs.kanidm}/lib/pam_kanidm.so '' ++ optional config.services.sssd.enable '' - password sufficient ${pkgs.sssd}/lib/security/pam_sss.so + sufficient ${pkgs.sssd}/lib/security/pam_sss.so '' ++ optional config.security.pam.krb5.enable '' - password sufficient ${pam_krb5}/lib/security/pam_krb5.so use_first_pass + sufficient ${pam_krb5}/lib/security/pam_krb5.so use_first_pass '' ++ optional cfg.enableGnomeKeyring '' - password optional ${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so use_authtok + optional ${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so use_authtok ''; session = optional cfg.setEnvironment '' - session required pam_env.so conffile=/etc/pam/environment readenv=0 + required pam_env.so conffile=/etc/pam/environment readenv=0 '' ++ singleton '' - session required pam_unix.so + required pam_unix.so '' ++ optional cfg.setLoginUid '' - session ${if config.boot.isContainer then "optional" else "required"} pam_loginuid.so + ${if config.boot.isContainer then "optional" else "required"} pam_loginuid.so '' ++ optional cfg.ttyAudit.enable '' - session required ${pkgs.pam}/lib/security/pam_tty_audit.so ${optionalString cfg.ttyAudit.openOnly "open_only"} ${optionalString (cfg.ttyAudit.enablePattern != null) "enable=${cfg.ttyAudit.enablePattern}"} ${optionalString (cfg.ttyAudit.disablePattern != null) "disable=${cfg.ttyAudit.disablePattern}"} + required ${pkgs.pam}/lib/security/pam_tty_audit.so ${optionalString cfg.ttyAudit.openOnly "open_only"} ${optionalString (cfg.ttyAudit.enablePattern != null) "enable=${cfg.ttyAudit.enablePattern}"} ${optionalString (cfg.ttyAudit.disablePattern != null) "disable=${cfg.ttyAudit.disablePattern}"} '' ++ optional config.services.homed.enable '' - session required ${config.systemd.package}/lib/security/pam_systemd_home.so + required ${config.systemd.package}/lib/security/pam_systemd_home.so '' ++ optional cfg.makeHomeDir '' - session required ${pkgs.pam}/lib/security/pam_mkhomedir.so silent skel=${config.security.pam.makeHomeDir.skelDirectory} umask=${config.security.pam.makeHomeDir.umask} + required ${pkgs.pam}/lib/security/pam_mkhomedir.so silent skel=${config.security.pam.makeHomeDir.skelDirectory} umask=${config.security.pam.makeHomeDir.umask} '' ++ optional cfg.updateWtmp '' - session required ${pkgs.pam}/lib/security/pam_lastlog.so silent + required ${pkgs.pam}/lib/security/pam_lastlog.so silent '' ++ optional config.security.pam.enableEcryptfs '' - session optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so + optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so '' ++ optional config.security.pam.enableFscrypt '' # Work around https://github.com/systemd/systemd/issues/8598 # Skips the pam_fscrypt module for systemd-user sessions which do not have a password # anyways. # See also https://github.com/google/fscrypt/issues/95 - session [success=1 default=ignore] pam_succeed_if.so service = systemd-user + [success=1 default=ignore] pam_succeed_if.so service = systemd-user '' ++ optional config.security.pam.enableFscrypt '' - session optional ${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so + optional ${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so '' ++ optional cfg.zfs '' - session [success=1 default=ignore] pam_succeed_if.so service = systemd-user + [success=1 default=ignore] pam_succeed_if.so service = systemd-user '' ++ optional cfg.zfs '' - session optional ${config.boot.zfs.package}/lib/security/pam_zfs_key.so homes=${config.security.pam.zfs.homes} ${optionalString config.security.pam.zfs.noUnmount "nounmount"} + optional ${config.boot.zfs.package}/lib/security/pam_zfs_key.so homes=${config.security.pam.zfs.homes} ${optionalString config.security.pam.zfs.noUnmount "nounmount"} '' ++ optional cfg.pamMount '' - session optional ${pkgs.pam_mount}/lib/security/pam_mount.so disable_interactive + optional ${pkgs.pam_mount}/lib/security/pam_mount.so disable_interactive '' ++ optional use_ldap '' - session optional ${pam_ldap}/lib/security/pam_ldap.so + optional ${pam_ldap}/lib/security/pam_ldap.so '' ++ optional cfg.mysqlAuth '' - session optional ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf + optional ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf '' ++ optional config.services.kanidm.enablePam '' - session optional ${pkgs.kanidm}/lib/pam_kanidm.so + optional ${pkgs.kanidm}/lib/pam_kanidm.so '' ++ optional config.services.sssd.enable '' - session optional ${pkgs.sssd}/lib/security/pam_sss.so + optional ${pkgs.sssd}/lib/security/pam_sss.so '' ++ optional config.security.pam.krb5.enable '' - session optional ${pam_krb5}/lib/security/pam_krb5.so + optional ${pam_krb5}/lib/security/pam_krb5.so '' ++ optional cfg.otpwAuth '' - session optional ${pkgs.otpw}/lib/security/pam_otpw.so + optional ${pkgs.otpw}/lib/security/pam_otpw.so '' ++ optional cfg.startSession '' - session optional ${config.systemd.package}/lib/security/pam_systemd.so + optional ${config.systemd.package}/lib/security/pam_systemd.so '' ++ optional cfg.forwardXAuth '' - session optional pam_xauth.so xauthpath=${pkgs.xorg.xauth}/bin/xauth systemuser=99 + optional pam_xauth.so xauthpath=${pkgs.xorg.xauth}/bin/xauth systemuser=99 '' ++ optional (cfg.limits != []) '' - session required ${pkgs.pam}/lib/security/pam_limits.so conf=${makeLimitsConf cfg.limits} + required ${pkgs.pam}/lib/security/pam_limits.so conf=${makeLimitsConf cfg.limits} '' ++ optional (cfg.showMotd && (config.users.motd != null || config.users.motdFile != null)) '' - session optional ${pkgs.pam}/lib/security/pam_motd.so motd=${motd} + optional ${pkgs.pam}/lib/security/pam_motd.so motd=${motd} '' ++ optional (cfg.enableAppArmor && config.security.apparmor.enable) '' - session optional ${pkgs.apparmor-pam}/lib/security/pam_apparmor.so order=user,group,default debug + optional ${pkgs.apparmor-pam}/lib/security/pam_apparmor.so order=user,group,default debug '' ++ optional cfg.enableKwallet '' - session optional ${pkgs.plasma5Packages.kwallet-pam}/lib/security/pam_kwallet5.so kwalletd=${pkgs.plasma5Packages.kwallet.bin}/bin/kwalletd5 + optional ${pkgs.plasma5Packages.kwallet-pam}/lib/security/pam_kwallet5.so kwalletd=${pkgs.plasma5Packages.kwallet.bin}/bin/kwalletd5 '' ++ optional cfg.enableGnomeKeyring '' - session optional ${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so auto_start + optional ${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so auto_start '' ++ optional cfg.gnupg.enable '' - session optional ${pkgs.pam_gnupg}/lib/security/pam_gnupg.so ${optionalString cfg.gnupg.noAutostart " no-autostart"} + optional ${pkgs.pam_gnupg}/lib/security/pam_gnupg.so ${optionalString cfg.gnupg.noAutostart " no-autostart"} '' ++ optional config.virtualisation.lxc.lxcfs.enable '' - session optional ${pkgs.lxc}/lib/security/pam_cgfs.so -c all + optional ${pkgs.lxc}/lib/security/pam_cgfs.so -c all ''; }; }; From fbd7427b14dc33eba441fad923c828264251eef0 Mon Sep 17 00:00:00 2001 From: Majiir Paktu Date: Sat, 16 Sep 2023 01:03:41 -0400 Subject: [PATCH 07/82] nixos/pam: define rules as submodules Allows us to decompose rules into multiple fields that we later format as textual rules. Eventually allows users to override individual fields. --- nixos/modules/security/pam.nix | 388 +++++++++++++++++---------------- 1 file changed, 205 insertions(+), 183 deletions(-) diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix index 87b5afcf0bdc..e0c19508b947 100644 --- a/nixos/modules/security/pam.nix +++ b/nixos/modules/security/pam.nix @@ -8,11 +8,27 @@ with lib; let mkRulesTypeOption = type: mkOption { - # This option is experimental and subject to breaking changes without notice. + # These options are experimental and subject to breaking changes without notice. description = lib.mdDoc '' PAM `${type}` rules for this service. ''; - type = types.listOf types.str; + type = types.listOf (types.submodule { + options = { + enable = mkOption { + type = types.bool; + default = true; + description = lib.mdDoc '' + Whether this rule is added to the PAM service config file. + ''; + }; + text = mkOption { + type = types.str; + description = lib.mdDoc '' + Text of the rule (without `service` or `type` fields). + ''; + }; + }; + }); }; parentConfig = config; @@ -503,8 +519,9 @@ let text = let formatRules = type: pipe cfg.rules.${type} [ + (filter (rule: rule.enable)) (map (rule: concatStringsSep " " - [ type (removeSuffix "\n" rule) ] + [ type (removeSuffix "\n" rule.text) ] )) (concatStringsSep "\n") ]; @@ -526,81 +543,83 @@ let # Samba stuff to the Samba module. This requires that the PAM # module provides the right hooks. rules = { - account = - optional use_ldap '' + account = [ + { enable = use_ldap; text = '' sufficient ${pam_ldap}/lib/security/pam_ldap.so - '' ++ - optional cfg.mysqlAuth '' + ''; } + { enable = cfg.mysqlAuth; text = '' sufficient ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf - '' ++ - optional config.services.kanidm.enablePam '' + ''; } + { enable = config.services.kanidm.enablePam; text = '' sufficient ${pkgs.kanidm}/lib/pam_kanidm.so ignore_unknown_user - '' ++ - optional config.services.sssd.enable '' + ''; } + { enable = config.services.sssd.enable; text = '' ${if cfg.sssdStrictAccess then "[default=bad success=ok user_unknown=ignore]" else "sufficient"} ${pkgs.sssd}/lib/security/pam_sss.so - '' ++ - optional config.security.pam.krb5.enable '' + ''; } + { enable = config.security.pam.krb5.enable; text = '' sufficient ${pam_krb5}/lib/security/pam_krb5.so - '' ++ - optional cfg.googleOsLoginAccountVerification '' + ''; } + { enable = cfg.googleOsLoginAccountVerification; text = '' [success=ok ignore=ignore default=die] ${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_login.so - '' ++ - optional cfg.googleOsLoginAccountVerification '' + ''; } + { enable = cfg.googleOsLoginAccountVerification; text = '' [success=ok default=ignore] ${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_admin.so - '' ++ - optional config.services.homed.enable '' + ''; } + { enable = config.services.homed.enable; text = '' sufficient ${config.systemd.package}/lib/security/pam_systemd_home.so - '' ++ + ''; } # The required pam_unix.so module has to come after all the sufficient modules # because otherwise, the account lookup will fail if the user does not exist # locally, for example with MySQL- or LDAP-auth. - singleton '' + { text = '' required pam_unix.so - ''; + ''; } + ]; - auth = - optional cfg.googleOsLoginAuthentication '' + auth = [ + { enable = cfg.googleOsLoginAuthentication; text = '' [success=done perm_denied=die default=ignore] ${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_login.so - '' ++ - optional cfg.rootOK '' + ''; } + { enable = cfg.rootOK; text = '' sufficient pam_rootok.so - '' ++ - optional cfg.requireWheel '' + ''; } + { enable = cfg.requireWheel; text = '' required pam_wheel.so use_uid - '' ++ - optional cfg.logFailures '' + ''; } + { enable = cfg.logFailures; text = '' required pam_faillock.so - '' ++ - optional cfg.mysqlAuth '' + ''; } + { enable = cfg.mysqlAuth; text = '' sufficient ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf - '' ++ - optional (config.security.pam.enableSSHAgentAuth && cfg.sshAgentAuth) '' + ''; } + { enable = config.security.pam.enableSSHAgentAuth && cfg.sshAgentAuth; text = '' sufficient ${pkgs.pam_ssh_agent_auth}/libexec/pam_ssh_agent_auth.so file=${lib.concatStringsSep ":" config.services.openssh.authorizedKeysFiles} - '' ++ - (let p11 = config.security.pam.p11; in optional cfg.p11Auth '' + ''; } + (let p11 = config.security.pam.p11; in { enable = cfg.p11Auth; text = '' ${p11.control} ${pkgs.pam_p11}/lib/security/pam_p11.so ${pkgs.opensc}/lib/opensc-pkcs11.so - '') ++ - (let u2f = config.security.pam.u2f; in optional cfg.u2fAuth '' + ''; }) + (let u2f = config.security.pam.u2f; in { enable = cfg.u2fAuth; text = '' ${u2f.control} ${pkgs.pam_u2f}/lib/security/pam_u2f.so ${optionalString u2f.debug "debug"} ${optionalString (u2f.authFile != null) "authfile=${u2f.authFile}"} ${optionalString u2f.interactive "interactive"} ${optionalString u2f.cue "cue"} ${optionalString (u2f.appId != null) "appid=${u2f.appId}"} ${optionalString (u2f.origin != null) "origin=${u2f.origin}"} - '') ++ - optional cfg.usbAuth '' + ''; }) + { enable = cfg.usbAuth; text = '' sufficient ${pkgs.pam_usb}/lib/security/pam_usb.so - '' ++ - (let ussh = config.security.pam.ussh; in optional (config.security.pam.ussh.enable && cfg.usshAuth) '' + ''; } + (let ussh = config.security.pam.ussh; in { enable = config.security.pam.ussh.enable && cfg.usshAuth; text = '' ${ussh.control} ${pkgs.pam_ussh}/lib/security/pam_ussh.so ${optionalString (ussh.caFile != null) "ca_file=${ussh.caFile}"} ${optionalString (ussh.authorizedPrincipals != null) "authorized_principals=${ussh.authorizedPrincipals}"} ${optionalString (ussh.authorizedPrincipalsFile != null) "authorized_principals_file=${ussh.authorizedPrincipalsFile}"} ${optionalString (ussh.group != null) "group=${ussh.group}"} - '') ++ - (let oath = config.security.pam.oath; in optional cfg.oathAuth '' + ''; }) + (let oath = config.security.pam.oath; in { enable = cfg.oathAuth; text = '' requisite ${pkgs.oath-toolkit}/lib/security/pam_oath.so window=${toString oath.window} usersfile=${toString oath.usersFile} digits=${toString oath.digits} - '') ++ - (let yubi = config.security.pam.yubico; in optional cfg.yubicoAuth '' + ''; }) + (let yubi = config.security.pam.yubico; in { enable = cfg.yubicoAuth; text = '' ${yubi.control} ${pkgs.yubico-pam}/lib/security/pam_yubico.so mode=${toString yubi.mode} ${optionalString (yubi.challengeResponsePath != null) "chalresp_path=${yubi.challengeResponsePath}"} ${optionalString (yubi.mode == "client") "id=${toString yubi.id}"} ${optionalString yubi.debug "debug"} - '') ++ - (let dp9ik = config.security.pam.dp9ik; in optional dp9ik.enable '' + ''; }) + (let dp9ik = config.security.pam.dp9ik; in { enable = dp9ik.enable; text = '' ${dp9ik.control} ${pkgs.pam_dp9ik}/lib/security/pam_p9.so ${dp9ik.authserver} - '') ++ - optional cfg.fprintAuth '' + ''; }) + { enable = cfg.fprintAuth; text = '' sufficient ${pkgs.fprintd}/lib/security/pam_fprintd.so - '' ++ + ''; } + ] ++ # Modules in this block require having the password set in PAM_AUTHTOK. # pam_unix is marked as 'sufficient' on NixOS which means nothing will run # after it succeeds. Certain modules need to run after pam_unix @@ -620,202 +639,205 @@ let || cfg.failDelay.enable || cfg.duoSecurity.enable || cfg.zfs)) - ( - optional config.services.homed.enable '' + [ + { enable = config.services.homed.enable; text = '' optional ${config.systemd.package}/lib/security/pam_systemd_home.so - '' ++ - optional cfg.unixAuth '' + ''; } + { enable = cfg.unixAuth; text = '' optional pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} ${optionalString cfg.nodelay "nodelay"} likeauth - '' ++ - optional config.security.pam.enableEcryptfs '' + ''; } + { enable = config.security.pam.enableEcryptfs; text = '' optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so unwrap - '' ++ - optional config.security.pam.enableFscrypt '' + ''; } + { enable = config.security.pam.enableFscrypt; text = '' optional ${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so - '' ++ - optional cfg.zfs '' + ''; } + { enable = cfg.zfs; text = '' optional ${config.boot.zfs.package}/lib/security/pam_zfs_key.so homes=${config.security.pam.zfs.homes} - '' ++ - optional cfg.pamMount '' + ''; } + { enable = cfg.pamMount; text = '' optional ${pkgs.pam_mount}/lib/security/pam_mount.so disable_interactive - '' ++ - optional cfg.enableKwallet '' + ''; } + { enable = cfg.enableKwallet; text = '' optional ${pkgs.plasma5Packages.kwallet-pam}/lib/security/pam_kwallet5.so kwalletd=${pkgs.plasma5Packages.kwallet.bin}/bin/kwalletd5 - '' ++ - optional cfg.enableGnomeKeyring '' + ''; } + { enable = cfg.enableGnomeKeyring; text = '' optional ${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so - '' ++ - optional cfg.gnupg.enable '' + ''; } + { enable = cfg.gnupg.enable; text = '' optional ${pkgs.pam_gnupg}/lib/security/pam_gnupg.so ${optionalString cfg.gnupg.storeOnly "store-only"} - '' ++ - optional cfg.failDelay.enable '' + ''; } + { enable = cfg.failDelay.enable; text = '' optional ${pkgs.pam}/lib/security/pam_faildelay.so delay=${toString cfg.failDelay.delay} - '' ++ - optional cfg.googleAuthenticator.enable '' + ''; } + { enable = cfg.googleAuthenticator.enable; text = '' required ${pkgs.google-authenticator}/lib/security/pam_google_authenticator.so no_increment_hotp - '' ++ - optional cfg.duoSecurity.enable '' + ''; } + { enable = cfg.duoSecurity.enable; text = '' required ${pkgs.duo-unix}/lib/security/pam_duo.so - '' - )) ++ - optional config.services.homed.enable '' + ''; } + ]) ++ [ + { enable = config.services.homed.enable; text = '' sufficient ${config.systemd.package}/lib/security/pam_systemd_home.so - '' ++ - optional cfg.unixAuth '' + ''; } + { enable = cfg.unixAuth; text = '' sufficient pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} ${optionalString cfg.nodelay "nodelay"} likeauth try_first_pass - '' ++ - optional cfg.otpwAuth '' + ''; } + { enable = cfg.otpwAuth; text = '' sufficient ${pkgs.otpw}/lib/security/pam_otpw.so - '' ++ - optional use_ldap '' + ''; } + { enable = use_ldap; text = '' sufficient ${pam_ldap}/lib/security/pam_ldap.so use_first_pass - '' ++ - optional config.services.kanidm.enablePam '' + ''; } + { enable = config.services.kanidm.enablePam; text = '' sufficient ${pkgs.kanidm}/lib/pam_kanidm.so ignore_unknown_user use_first_pass - '' ++ - optional config.services.sssd.enable '' + ''; } + { enable = config.services.sssd.enable; text = '' sufficient ${pkgs.sssd}/lib/security/pam_sss.so use_first_pass - '' ++ - optional config.security.pam.krb5.enable '' + ''; } + { enable = config.security.pam.krb5.enable; text = '' [default=ignore success=1 service_err=reset] ${pam_krb5}/lib/security/pam_krb5.so use_first_pass - '' ++ - optional config.security.pam.krb5.enable '' + ''; } + { enable = config.security.pam.krb5.enable; text = '' [default=die success=done] ${pam_ccreds}/lib/security/pam_ccreds.so action=validate use_first_pass - '' ++ - optional config.security.pam.krb5.enable '' + ''; } + { enable = config.security.pam.krb5.enable; text = '' sufficient ${pam_ccreds}/lib/security/pam_ccreds.so action=store use_first_pass - '' ++ - singleton '' + ''; } + { text = '' required pam_deny.so - ''; + ''; } + ]; - password = - optional config.services.homed.enable '' + password = [ + { enable = config.services.homed.enable; text = '' sufficient ${config.systemd.package}/lib/security/pam_systemd_home.so - '' ++ - singleton '' + ''; } + { text = '' sufficient pam_unix.so nullok yescrypt - '' ++ - optional config.security.pam.enableEcryptfs '' + ''; } + { enable = config.security.pam.enableEcryptfs; text = '' optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so - '' ++ - optional config.security.pam.enableFscrypt '' + ''; } + { enable = config.security.pam.enableFscrypt; text = '' optional ${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so - '' ++ - optional cfg.zfs '' + ''; } + { enable = cfg.zfs; text = '' optional ${config.boot.zfs.package}/lib/security/pam_zfs_key.so homes=${config.security.pam.zfs.homes} - '' ++ - optional cfg.pamMount '' + ''; } + { enable = cfg.pamMount; text = '' optional ${pkgs.pam_mount}/lib/security/pam_mount.so - '' ++ - optional use_ldap '' + ''; } + { enable = use_ldap; text = '' sufficient ${pam_ldap}/lib/security/pam_ldap.so - '' ++ - optional cfg.mysqlAuth '' + ''; } + { enable = cfg.mysqlAuth; text = '' sufficient ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf - '' ++ - optional config.services.kanidm.enablePam '' + ''; } + { enable = config.services.kanidm.enablePam; text = '' sufficient ${pkgs.kanidm}/lib/pam_kanidm.so - '' ++ - optional config.services.sssd.enable '' + ''; } + { enable = config.services.sssd.enable; text = '' sufficient ${pkgs.sssd}/lib/security/pam_sss.so - '' ++ - optional config.security.pam.krb5.enable '' + ''; } + { enable = config.security.pam.krb5.enable; text = '' sufficient ${pam_krb5}/lib/security/pam_krb5.so use_first_pass - '' ++ - optional cfg.enableGnomeKeyring '' + ''; } + { enable = cfg.enableGnomeKeyring; text = '' optional ${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so use_authtok - ''; + ''; } + ]; - session = - optional cfg.setEnvironment '' + session = [ + { enable = cfg.setEnvironment; text = '' required pam_env.so conffile=/etc/pam/environment readenv=0 - '' ++ - singleton '' + ''; } + { text = '' required pam_unix.so - '' ++ - optional cfg.setLoginUid '' + ''; } + { enable = cfg.setLoginUid; text = '' ${if config.boot.isContainer then "optional" else "required"} pam_loginuid.so - '' ++ - optional cfg.ttyAudit.enable '' + ''; } + { enable = cfg.ttyAudit.enable; text = '' required ${pkgs.pam}/lib/security/pam_tty_audit.so ${optionalString cfg.ttyAudit.openOnly "open_only"} ${optionalString (cfg.ttyAudit.enablePattern != null) "enable=${cfg.ttyAudit.enablePattern}"} ${optionalString (cfg.ttyAudit.disablePattern != null) "disable=${cfg.ttyAudit.disablePattern}"} - '' ++ - optional config.services.homed.enable '' + ''; } + { enable = config.services.homed.enable; text = '' required ${config.systemd.package}/lib/security/pam_systemd_home.so - '' ++ - optional cfg.makeHomeDir '' + ''; } + { enable = cfg.makeHomeDir; text = '' required ${pkgs.pam}/lib/security/pam_mkhomedir.so silent skel=${config.security.pam.makeHomeDir.skelDirectory} umask=${config.security.pam.makeHomeDir.umask} - '' ++ - optional cfg.updateWtmp '' + ''; } + { enable = cfg.updateWtmp; text = '' required ${pkgs.pam}/lib/security/pam_lastlog.so silent - '' ++ - optional config.security.pam.enableEcryptfs '' + ''; } + { enable = config.security.pam.enableEcryptfs; text = '' optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so - '' ++ - optional config.security.pam.enableFscrypt '' - # Work around https://github.com/systemd/systemd/issues/8598 - # Skips the pam_fscrypt module for systemd-user sessions which do not have a password - # anyways. - # See also https://github.com/google/fscrypt/issues/95 + ''; } + # Work around https://github.com/systemd/systemd/issues/8598 + # Skips the pam_fscrypt module for systemd-user sessions which do not have a password + # anyways. + # See also https://github.com/google/fscrypt/issues/95 + { enable = config.security.pam.enableFscrypt; text = '' [success=1 default=ignore] pam_succeed_if.so service = systemd-user - '' ++ - optional config.security.pam.enableFscrypt '' + ''; } + { enable = config.security.pam.enableFscrypt; text = '' optional ${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so - '' ++ - optional cfg.zfs '' + ''; } + { enable = cfg.zfs; text = '' [success=1 default=ignore] pam_succeed_if.so service = systemd-user - '' ++ - optional cfg.zfs '' + ''; } + { enable = cfg.zfs; text = '' optional ${config.boot.zfs.package}/lib/security/pam_zfs_key.so homes=${config.security.pam.zfs.homes} ${optionalString config.security.pam.zfs.noUnmount "nounmount"} - '' ++ - optional cfg.pamMount '' + ''; } + { enable = cfg.pamMount; text = '' optional ${pkgs.pam_mount}/lib/security/pam_mount.so disable_interactive - '' ++ - optional use_ldap '' + ''; } + { enable = use_ldap; text = '' optional ${pam_ldap}/lib/security/pam_ldap.so - '' ++ - optional cfg.mysqlAuth '' + ''; } + { enable = cfg.mysqlAuth; text = '' optional ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf - '' ++ - optional config.services.kanidm.enablePam '' + ''; } + { enable = config.services.kanidm.enablePam; text = '' optional ${pkgs.kanidm}/lib/pam_kanidm.so - '' ++ - optional config.services.sssd.enable '' + ''; } + { enable = config.services.sssd.enable; text = '' optional ${pkgs.sssd}/lib/security/pam_sss.so - '' ++ - optional config.security.pam.krb5.enable '' + ''; } + { enable = config.security.pam.krb5.enable; text = '' optional ${pam_krb5}/lib/security/pam_krb5.so - '' ++ - optional cfg.otpwAuth '' + ''; } + { enable = cfg.otpwAuth; text = '' optional ${pkgs.otpw}/lib/security/pam_otpw.so - '' ++ - optional cfg.startSession '' + ''; } + { enable = cfg.startSession; text = '' optional ${config.systemd.package}/lib/security/pam_systemd.so - '' ++ - optional cfg.forwardXAuth '' + ''; } + { enable = cfg.forwardXAuth; text = '' optional pam_xauth.so xauthpath=${pkgs.xorg.xauth}/bin/xauth systemuser=99 - '' ++ - optional (cfg.limits != []) '' + ''; } + { enable = cfg.limits != []; text = '' required ${pkgs.pam}/lib/security/pam_limits.so conf=${makeLimitsConf cfg.limits} - '' ++ - optional (cfg.showMotd && (config.users.motd != null || config.users.motdFile != null)) '' + ''; } + { enable = cfg.showMotd && (config.users.motd != null || config.users.motdFile != null); text = '' optional ${pkgs.pam}/lib/security/pam_motd.so motd=${motd} - '' ++ - optional (cfg.enableAppArmor && config.security.apparmor.enable) '' + ''; } + { enable = cfg.enableAppArmor && config.security.apparmor.enable; text = '' optional ${pkgs.apparmor-pam}/lib/security/pam_apparmor.so order=user,group,default debug - '' ++ - optional cfg.enableKwallet '' + ''; } + { enable = cfg.enableKwallet; text = '' optional ${pkgs.plasma5Packages.kwallet-pam}/lib/security/pam_kwallet5.so kwalletd=${pkgs.plasma5Packages.kwallet.bin}/bin/kwalletd5 - '' ++ - optional cfg.enableGnomeKeyring '' + ''; } + { enable = cfg.enableGnomeKeyring; text = '' optional ${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so auto_start - '' ++ - optional cfg.gnupg.enable '' + ''; } + { enable = cfg.gnupg.enable; text = '' optional ${pkgs.pam_gnupg}/lib/security/pam_gnupg.so ${optionalString cfg.gnupg.noAutostart " no-autostart"} - '' ++ - optional config.virtualisation.lxc.lxcfs.enable '' + ''; } + { enable = config.virtualisation.lxc.lxcfs.enable; text = '' optional ${pkgs.lxc}/lib/security/pam_cgfs.so -c all - ''; + ''; } + ]; }; }; From 0563e0a379448e9195d5f9f470d3f693b3180ae6 Mon Sep 17 00:00:00 2001 From: Majiir Paktu Date: Sat, 16 Sep 2023 13:00:46 -0400 Subject: [PATCH 08/82] nixos/pam: give each rule a name These names are internal identifiers. They will be used as keys so that users can reconfigure rules by merging a rule config with the same name. The name is arbitrary. The built-in rules are named after the PAM where practical. --- nixos/modules/security/pam.nix | 176 +++++++++++++++++---------------- 1 file changed, 91 insertions(+), 85 deletions(-) diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix index e0c19508b947..569a1deb6b61 100644 --- a/nixos/modules/security/pam.nix +++ b/nixos/modules/security/pam.nix @@ -14,6 +14,12 @@ let ''; type = types.listOf (types.submodule { options = { + name = mkOption { + type = types.str; + description = lib.mdDoc '' + Name of this rule. + ''; + }; enable = mkOption { type = types.bool; default = true; @@ -544,79 +550,79 @@ let # module provides the right hooks. rules = { account = [ - { enable = use_ldap; text = '' + { name = "ldap"; enable = use_ldap; text = '' sufficient ${pam_ldap}/lib/security/pam_ldap.so ''; } - { enable = cfg.mysqlAuth; text = '' + { name = "mysql"; enable = cfg.mysqlAuth; text = '' sufficient ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf ''; } - { enable = config.services.kanidm.enablePam; text = '' + { name = "kanidm"; enable = config.services.kanidm.enablePam; text = '' sufficient ${pkgs.kanidm}/lib/pam_kanidm.so ignore_unknown_user ''; } - { enable = config.services.sssd.enable; text = '' + { name = "sss"; enable = config.services.sssd.enable; text = '' ${if cfg.sssdStrictAccess then "[default=bad success=ok user_unknown=ignore]" else "sufficient"} ${pkgs.sssd}/lib/security/pam_sss.so ''; } - { enable = config.security.pam.krb5.enable; text = '' + { name = "krb5"; enable = config.security.pam.krb5.enable; text = '' sufficient ${pam_krb5}/lib/security/pam_krb5.so ''; } - { enable = cfg.googleOsLoginAccountVerification; text = '' + { name = "oslogin_login"; enable = cfg.googleOsLoginAccountVerification; text = '' [success=ok ignore=ignore default=die] ${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_login.so ''; } - { enable = cfg.googleOsLoginAccountVerification; text = '' + { name = "oslogin_admin"; enable = cfg.googleOsLoginAccountVerification; text = '' [success=ok default=ignore] ${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_admin.so ''; } - { enable = config.services.homed.enable; text = '' + { name = "systemd_home"; enable = config.services.homed.enable; text = '' sufficient ${config.systemd.package}/lib/security/pam_systemd_home.so ''; } # The required pam_unix.so module has to come after all the sufficient modules # because otherwise, the account lookup will fail if the user does not exist # locally, for example with MySQL- or LDAP-auth. - { text = '' + { name = "unix"; text = '' required pam_unix.so ''; } ]; auth = [ - { enable = cfg.googleOsLoginAuthentication; text = '' + { name = "oslogin_login"; enable = cfg.googleOsLoginAuthentication; text = '' [success=done perm_denied=die default=ignore] ${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_login.so ''; } - { enable = cfg.rootOK; text = '' + { name = "rootok"; enable = cfg.rootOK; text = '' sufficient pam_rootok.so ''; } - { enable = cfg.requireWheel; text = '' + { name = "wheel"; enable = cfg.requireWheel; text = '' required pam_wheel.so use_uid ''; } - { enable = cfg.logFailures; text = '' + { name = "faillock"; enable = cfg.logFailures; text = '' required pam_faillock.so ''; } - { enable = cfg.mysqlAuth; text = '' + { name = "mysql"; enable = cfg.mysqlAuth; text = '' sufficient ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf ''; } - { enable = config.security.pam.enableSSHAgentAuth && cfg.sshAgentAuth; text = '' + { name = "ssh_agent_auth"; enable = config.security.pam.enableSSHAgentAuth && cfg.sshAgentAuth; text = '' sufficient ${pkgs.pam_ssh_agent_auth}/libexec/pam_ssh_agent_auth.so file=${lib.concatStringsSep ":" config.services.openssh.authorizedKeysFiles} ''; } - (let p11 = config.security.pam.p11; in { enable = cfg.p11Auth; text = '' + (let p11 = config.security.pam.p11; in { name = "p11"; enable = cfg.p11Auth; text = '' ${p11.control} ${pkgs.pam_p11}/lib/security/pam_p11.so ${pkgs.opensc}/lib/opensc-pkcs11.so ''; }) - (let u2f = config.security.pam.u2f; in { enable = cfg.u2fAuth; text = '' + (let u2f = config.security.pam.u2f; in { name = "u2f"; enable = cfg.u2fAuth; text = '' ${u2f.control} ${pkgs.pam_u2f}/lib/security/pam_u2f.so ${optionalString u2f.debug "debug"} ${optionalString (u2f.authFile != null) "authfile=${u2f.authFile}"} ${optionalString u2f.interactive "interactive"} ${optionalString u2f.cue "cue"} ${optionalString (u2f.appId != null) "appid=${u2f.appId}"} ${optionalString (u2f.origin != null) "origin=${u2f.origin}"} ''; }) - { enable = cfg.usbAuth; text = '' + { name = "usb"; enable = cfg.usbAuth; text = '' sufficient ${pkgs.pam_usb}/lib/security/pam_usb.so ''; } - (let ussh = config.security.pam.ussh; in { enable = config.security.pam.ussh.enable && cfg.usshAuth; text = '' + (let ussh = config.security.pam.ussh; in { name = "ussh"; enable = config.security.pam.ussh.enable && cfg.usshAuth; text = '' ${ussh.control} ${pkgs.pam_ussh}/lib/security/pam_ussh.so ${optionalString (ussh.caFile != null) "ca_file=${ussh.caFile}"} ${optionalString (ussh.authorizedPrincipals != null) "authorized_principals=${ussh.authorizedPrincipals}"} ${optionalString (ussh.authorizedPrincipalsFile != null) "authorized_principals_file=${ussh.authorizedPrincipalsFile}"} ${optionalString (ussh.group != null) "group=${ussh.group}"} ''; }) - (let oath = config.security.pam.oath; in { enable = cfg.oathAuth; text = '' + (let oath = config.security.pam.oath; in { name = "oath"; enable = cfg.oathAuth; text = '' requisite ${pkgs.oath-toolkit}/lib/security/pam_oath.so window=${toString oath.window} usersfile=${toString oath.usersFile} digits=${toString oath.digits} ''; }) - (let yubi = config.security.pam.yubico; in { enable = cfg.yubicoAuth; text = '' + (let yubi = config.security.pam.yubico; in { name = "yubico"; enable = cfg.yubicoAuth; text = '' ${yubi.control} ${pkgs.yubico-pam}/lib/security/pam_yubico.so mode=${toString yubi.mode} ${optionalString (yubi.challengeResponsePath != null) "chalresp_path=${yubi.challengeResponsePath}"} ${optionalString (yubi.mode == "client") "id=${toString yubi.id}"} ${optionalString yubi.debug "debug"} ''; }) - (let dp9ik = config.security.pam.dp9ik; in { enable = dp9ik.enable; text = '' + (let dp9ik = config.security.pam.dp9ik; in { name = "p9"; enable = dp9ik.enable; text = '' ${dp9ik.control} ${pkgs.pam_dp9ik}/lib/security/pam_p9.so ${dp9ik.authserver} ''; }) - { enable = cfg.fprintAuth; text = '' + { name = "fprintd"; enable = cfg.fprintAuth; text = '' sufficient ${pkgs.fprintd}/lib/security/pam_fprintd.so ''; } ] ++ @@ -640,201 +646,201 @@ let || cfg.duoSecurity.enable || cfg.zfs)) [ - { enable = config.services.homed.enable; text = '' + { name = "systemd_home-early"; enable = config.services.homed.enable; text = '' optional ${config.systemd.package}/lib/security/pam_systemd_home.so ''; } - { enable = cfg.unixAuth; text = '' + { name = "unix-early"; enable = cfg.unixAuth; text = '' optional pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} ${optionalString cfg.nodelay "nodelay"} likeauth ''; } - { enable = config.security.pam.enableEcryptfs; text = '' + { name = "ecryptfs"; enable = config.security.pam.enableEcryptfs; text = '' optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so unwrap ''; } - { enable = config.security.pam.enableFscrypt; text = '' + { name = "fscrypt"; enable = config.security.pam.enableFscrypt; text = '' optional ${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so ''; } - { enable = cfg.zfs; text = '' + { name = "zfs_key"; enable = cfg.zfs; text = '' optional ${config.boot.zfs.package}/lib/security/pam_zfs_key.so homes=${config.security.pam.zfs.homes} ''; } - { enable = cfg.pamMount; text = '' + { name = "mount"; enable = cfg.pamMount; text = '' optional ${pkgs.pam_mount}/lib/security/pam_mount.so disable_interactive ''; } - { enable = cfg.enableKwallet; text = '' + { name = "kwallet5"; enable = cfg.enableKwallet; text = '' optional ${pkgs.plasma5Packages.kwallet-pam}/lib/security/pam_kwallet5.so kwalletd=${pkgs.plasma5Packages.kwallet.bin}/bin/kwalletd5 ''; } - { enable = cfg.enableGnomeKeyring; text = '' + { name = "gnome_keyring"; enable = cfg.enableGnomeKeyring; text = '' optional ${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so ''; } - { enable = cfg.gnupg.enable; text = '' + { name = "gnupg"; enable = cfg.gnupg.enable; text = '' optional ${pkgs.pam_gnupg}/lib/security/pam_gnupg.so ${optionalString cfg.gnupg.storeOnly "store-only"} ''; } - { enable = cfg.failDelay.enable; text = '' + { name = "faildelay"; enable = cfg.failDelay.enable; text = '' optional ${pkgs.pam}/lib/security/pam_faildelay.so delay=${toString cfg.failDelay.delay} ''; } - { enable = cfg.googleAuthenticator.enable; text = '' + { name = "google_authenticator"; enable = cfg.googleAuthenticator.enable; text = '' required ${pkgs.google-authenticator}/lib/security/pam_google_authenticator.so no_increment_hotp ''; } - { enable = cfg.duoSecurity.enable; text = '' + { name = "duo"; enable = cfg.duoSecurity.enable; text = '' required ${pkgs.duo-unix}/lib/security/pam_duo.so ''; } ]) ++ [ - { enable = config.services.homed.enable; text = '' + { name = "systemd_home"; enable = config.services.homed.enable; text = '' sufficient ${config.systemd.package}/lib/security/pam_systemd_home.so ''; } - { enable = cfg.unixAuth; text = '' + { name = "unix"; enable = cfg.unixAuth; text = '' sufficient pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} ${optionalString cfg.nodelay "nodelay"} likeauth try_first_pass ''; } - { enable = cfg.otpwAuth; text = '' + { name = "otpw"; enable = cfg.otpwAuth; text = '' sufficient ${pkgs.otpw}/lib/security/pam_otpw.so ''; } - { enable = use_ldap; text = '' + { name = "ldap"; enable = use_ldap; text = '' sufficient ${pam_ldap}/lib/security/pam_ldap.so use_first_pass ''; } - { enable = config.services.kanidm.enablePam; text = '' + { name = "kanidm"; enable = config.services.kanidm.enablePam; text = '' sufficient ${pkgs.kanidm}/lib/pam_kanidm.so ignore_unknown_user use_first_pass ''; } - { enable = config.services.sssd.enable; text = '' + { name = "sss"; enable = config.services.sssd.enable; text = '' sufficient ${pkgs.sssd}/lib/security/pam_sss.so use_first_pass ''; } - { enable = config.security.pam.krb5.enable; text = '' + { name = "krb5"; enable = config.security.pam.krb5.enable; text = '' [default=ignore success=1 service_err=reset] ${pam_krb5}/lib/security/pam_krb5.so use_first_pass ''; } - { enable = config.security.pam.krb5.enable; text = '' + { name = "ccreds-validate"; enable = config.security.pam.krb5.enable; text = '' [default=die success=done] ${pam_ccreds}/lib/security/pam_ccreds.so action=validate use_first_pass ''; } - { enable = config.security.pam.krb5.enable; text = '' + { name = "ccreds-store"; enable = config.security.pam.krb5.enable; text = '' sufficient ${pam_ccreds}/lib/security/pam_ccreds.so action=store use_first_pass ''; } - { text = '' + { name = "deny"; text = '' required pam_deny.so ''; } ]; password = [ - { enable = config.services.homed.enable; text = '' + { name = "systemd_home"; enable = config.services.homed.enable; text = '' sufficient ${config.systemd.package}/lib/security/pam_systemd_home.so ''; } - { text = '' + { name = "unix"; text = '' sufficient pam_unix.so nullok yescrypt ''; } - { enable = config.security.pam.enableEcryptfs; text = '' + { name = "ecryptfs"; enable = config.security.pam.enableEcryptfs; text = '' optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so ''; } - { enable = config.security.pam.enableFscrypt; text = '' + { name = "fscrypt"; enable = config.security.pam.enableFscrypt; text = '' optional ${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so ''; } - { enable = cfg.zfs; text = '' + { name = "zfs_key"; enable = cfg.zfs; text = '' optional ${config.boot.zfs.package}/lib/security/pam_zfs_key.so homes=${config.security.pam.zfs.homes} ''; } - { enable = cfg.pamMount; text = '' + { name = "mount"; enable = cfg.pamMount; text = '' optional ${pkgs.pam_mount}/lib/security/pam_mount.so ''; } - { enable = use_ldap; text = '' + { name = "ldap"; enable = use_ldap; text = '' sufficient ${pam_ldap}/lib/security/pam_ldap.so ''; } - { enable = cfg.mysqlAuth; text = '' + { name = "mysql"; enable = cfg.mysqlAuth; text = '' sufficient ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf ''; } - { enable = config.services.kanidm.enablePam; text = '' + { name = "kanidm"; enable = config.services.kanidm.enablePam; text = '' sufficient ${pkgs.kanidm}/lib/pam_kanidm.so ''; } - { enable = config.services.sssd.enable; text = '' + { name = "sss"; enable = config.services.sssd.enable; text = '' sufficient ${pkgs.sssd}/lib/security/pam_sss.so ''; } - { enable = config.security.pam.krb5.enable; text = '' + { name = "krb5"; enable = config.security.pam.krb5.enable; text = '' sufficient ${pam_krb5}/lib/security/pam_krb5.so use_first_pass ''; } - { enable = cfg.enableGnomeKeyring; text = '' + { name = "gnome_keyring"; enable = cfg.enableGnomeKeyring; text = '' optional ${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so use_authtok ''; } ]; session = [ - { enable = cfg.setEnvironment; text = '' + { name = "env"; enable = cfg.setEnvironment; text = '' required pam_env.so conffile=/etc/pam/environment readenv=0 ''; } - { text = '' + { name = "unix"; text = '' required pam_unix.so ''; } - { enable = cfg.setLoginUid; text = '' + { name = "loginuid"; enable = cfg.setLoginUid; text = '' ${if config.boot.isContainer then "optional" else "required"} pam_loginuid.so ''; } - { enable = cfg.ttyAudit.enable; text = '' + { name = "tty_audit"; enable = cfg.ttyAudit.enable; text = '' required ${pkgs.pam}/lib/security/pam_tty_audit.so ${optionalString cfg.ttyAudit.openOnly "open_only"} ${optionalString (cfg.ttyAudit.enablePattern != null) "enable=${cfg.ttyAudit.enablePattern}"} ${optionalString (cfg.ttyAudit.disablePattern != null) "disable=${cfg.ttyAudit.disablePattern}"} ''; } - { enable = config.services.homed.enable; text = '' + { name = "systemd_home"; enable = config.services.homed.enable; text = '' required ${config.systemd.package}/lib/security/pam_systemd_home.so ''; } - { enable = cfg.makeHomeDir; text = '' + { name = "mkhomedir"; enable = cfg.makeHomeDir; text = '' required ${pkgs.pam}/lib/security/pam_mkhomedir.so silent skel=${config.security.pam.makeHomeDir.skelDirectory} umask=${config.security.pam.makeHomeDir.umask} ''; } - { enable = cfg.updateWtmp; text = '' + { name = "lastlog"; enable = cfg.updateWtmp; text = '' required ${pkgs.pam}/lib/security/pam_lastlog.so silent ''; } - { enable = config.security.pam.enableEcryptfs; text = '' + { name = "ecryptfs"; enable = config.security.pam.enableEcryptfs; text = '' optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so ''; } # Work around https://github.com/systemd/systemd/issues/8598 # Skips the pam_fscrypt module for systemd-user sessions which do not have a password # anyways. # See also https://github.com/google/fscrypt/issues/95 - { enable = config.security.pam.enableFscrypt; text = '' + { name = "fscrypt-skip-systemd"; enable = config.security.pam.enableFscrypt; text = '' [success=1 default=ignore] pam_succeed_if.so service = systemd-user ''; } - { enable = config.security.pam.enableFscrypt; text = '' + { name = "fscrypt"; enable = config.security.pam.enableFscrypt; text = '' optional ${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so ''; } - { enable = cfg.zfs; text = '' + { name = "zfs_key-skip-systemd"; enable = cfg.zfs; text = '' [success=1 default=ignore] pam_succeed_if.so service = systemd-user ''; } - { enable = cfg.zfs; text = '' + { name = "zfs_key"; enable = cfg.zfs; text = '' optional ${config.boot.zfs.package}/lib/security/pam_zfs_key.so homes=${config.security.pam.zfs.homes} ${optionalString config.security.pam.zfs.noUnmount "nounmount"} ''; } - { enable = cfg.pamMount; text = '' + { name = "mount"; enable = cfg.pamMount; text = '' optional ${pkgs.pam_mount}/lib/security/pam_mount.so disable_interactive ''; } - { enable = use_ldap; text = '' + { name = "ldap"; enable = use_ldap; text = '' optional ${pam_ldap}/lib/security/pam_ldap.so ''; } - { enable = cfg.mysqlAuth; text = '' + { name = "mysql"; enable = cfg.mysqlAuth; text = '' optional ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf ''; } - { enable = config.services.kanidm.enablePam; text = '' + { name = "kanidm"; enable = config.services.kanidm.enablePam; text = '' optional ${pkgs.kanidm}/lib/pam_kanidm.so ''; } - { enable = config.services.sssd.enable; text = '' + { name = "sss"; enable = config.services.sssd.enable; text = '' optional ${pkgs.sssd}/lib/security/pam_sss.so ''; } - { enable = config.security.pam.krb5.enable; text = '' + { name = "krb5"; enable = config.security.pam.krb5.enable; text = '' optional ${pam_krb5}/lib/security/pam_krb5.so ''; } - { enable = cfg.otpwAuth; text = '' + { name = "otpw"; enable = cfg.otpwAuth; text = '' optional ${pkgs.otpw}/lib/security/pam_otpw.so ''; } - { enable = cfg.startSession; text = '' + { name = "systemd"; enable = cfg.startSession; text = '' optional ${config.systemd.package}/lib/security/pam_systemd.so ''; } - { enable = cfg.forwardXAuth; text = '' + { name = "xauth"; enable = cfg.forwardXAuth; text = '' optional pam_xauth.so xauthpath=${pkgs.xorg.xauth}/bin/xauth systemuser=99 ''; } - { enable = cfg.limits != []; text = '' + { name = "limits"; enable = cfg.limits != []; text = '' required ${pkgs.pam}/lib/security/pam_limits.so conf=${makeLimitsConf cfg.limits} ''; } - { enable = cfg.showMotd && (config.users.motd != null || config.users.motdFile != null); text = '' + { name = "motd"; enable = cfg.showMotd && (config.users.motd != null || config.users.motdFile != null); text = '' optional ${pkgs.pam}/lib/security/pam_motd.so motd=${motd} ''; } - { enable = cfg.enableAppArmor && config.security.apparmor.enable; text = '' + { name = "apparmor"; enable = cfg.enableAppArmor && config.security.apparmor.enable; text = '' optional ${pkgs.apparmor-pam}/lib/security/pam_apparmor.so order=user,group,default debug ''; } - { enable = cfg.enableKwallet; text = '' + { name = "kwallet5"; enable = cfg.enableKwallet; text = '' optional ${pkgs.plasma5Packages.kwallet-pam}/lib/security/pam_kwallet5.so kwalletd=${pkgs.plasma5Packages.kwallet.bin}/bin/kwalletd5 ''; } - { enable = cfg.enableGnomeKeyring; text = '' + { name = "gnome_keyring"; enable = cfg.enableGnomeKeyring; text = '' optional ${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so auto_start ''; } - { enable = cfg.gnupg.enable; text = '' + { name = "gnupg"; enable = cfg.gnupg.enable; text = '' optional ${pkgs.pam_gnupg}/lib/security/pam_gnupg.so ${optionalString cfg.gnupg.noAutostart " no-autostart"} ''; } - { enable = config.virtualisation.lxc.lxcfs.enable; text = '' + { name = "cgfs"; enable = config.virtualisation.lxc.lxcfs.enable; text = '' optional ${pkgs.lxc}/lib/security/pam_cgfs.so -c all ''; } ]; From 25bc21f19a3f87d7512d7bd450ee7674370f14fb Mon Sep 17 00:00:00 2001 From: Majiir Paktu Date: Sat, 16 Sep 2023 13:32:55 -0400 Subject: [PATCH 09/82] nixos/pam: extract control field --- nixos/modules/security/pam.nix | 350 +++++++++++++++++---------------- 1 file changed, 178 insertions(+), 172 deletions(-) diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix index 569a1deb6b61..12a818a9680b 100644 --- a/nixos/modules/security/pam.nix +++ b/nixos/modules/security/pam.nix @@ -27,10 +27,16 @@ let Whether this rule is added to the PAM service config file. ''; }; + control = mkOption { + type = types.str; + description = lib.mdDoc '' + Indicates the behavior of the PAM-API should the module fail to succeed in its authentication task. See `control` in {manpage}`pam.conf(5)` for details. + ''; + }; text = mkOption { type = types.str; description = lib.mdDoc '' - Text of the rule (without `service` or `type` fields). + Text of the rule (without `service`, `type` or `control` fields). ''; }; }; @@ -527,7 +533,7 @@ let formatRules = type: pipe cfg.rules.${type} [ (filter (rule: rule.enable)) (map (rule: concatStringsSep " " - [ type (removeSuffix "\n" rule.text) ] + [ type rule.control (removeSuffix "\n" rule.text) ] )) (concatStringsSep "\n") ]; @@ -550,80 +556,80 @@ let # module provides the right hooks. rules = { account = [ - { name = "ldap"; enable = use_ldap; text = '' - sufficient ${pam_ldap}/lib/security/pam_ldap.so + { name = "ldap"; enable = use_ldap; control = "sufficient"; text = '' + ${pam_ldap}/lib/security/pam_ldap.so ''; } - { name = "mysql"; enable = cfg.mysqlAuth; text = '' - sufficient ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf + { name = "mysql"; enable = cfg.mysqlAuth; control = "sufficient"; text = '' + ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf ''; } - { name = "kanidm"; enable = config.services.kanidm.enablePam; text = '' - sufficient ${pkgs.kanidm}/lib/pam_kanidm.so ignore_unknown_user + { name = "kanidm"; enable = config.services.kanidm.enablePam; control = "sufficient"; text = '' + ${pkgs.kanidm}/lib/pam_kanidm.so ignore_unknown_user ''; } - { name = "sss"; enable = config.services.sssd.enable; text = '' - ${if cfg.sssdStrictAccess then "[default=bad success=ok user_unknown=ignore]" else "sufficient"} ${pkgs.sssd}/lib/security/pam_sss.so + { name = "sss"; enable = config.services.sssd.enable; control = if cfg.sssdStrictAccess then "[default=bad success=ok user_unknown=ignore]" else "sufficient"; text = '' + ${pkgs.sssd}/lib/security/pam_sss.so ''; } - { name = "krb5"; enable = config.security.pam.krb5.enable; text = '' - sufficient ${pam_krb5}/lib/security/pam_krb5.so + { name = "krb5"; enable = config.security.pam.krb5.enable; control = "sufficient"; text = '' + ${pam_krb5}/lib/security/pam_krb5.so ''; } - { name = "oslogin_login"; enable = cfg.googleOsLoginAccountVerification; text = '' - [success=ok ignore=ignore default=die] ${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_login.so + { name = "oslogin_login"; enable = cfg.googleOsLoginAccountVerification; control = "[success=ok ignore=ignore default=die]"; text = '' + ${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_login.so ''; } - { name = "oslogin_admin"; enable = cfg.googleOsLoginAccountVerification; text = '' - [success=ok default=ignore] ${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_admin.so + { name = "oslogin_admin"; enable = cfg.googleOsLoginAccountVerification; control = "[success=ok default=ignore]"; text = '' + ${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_admin.so ''; } - { name = "systemd_home"; enable = config.services.homed.enable; text = '' - sufficient ${config.systemd.package}/lib/security/pam_systemd_home.so + { name = "systemd_home"; enable = config.services.homed.enable; control = "sufficient"; text = '' + ${config.systemd.package}/lib/security/pam_systemd_home.so ''; } # The required pam_unix.so module has to come after all the sufficient modules # because otherwise, the account lookup will fail if the user does not exist # locally, for example with MySQL- or LDAP-auth. - { name = "unix"; text = '' - required pam_unix.so + { name = "unix"; control = "required"; text = '' + pam_unix.so ''; } ]; auth = [ - { name = "oslogin_login"; enable = cfg.googleOsLoginAuthentication; text = '' - [success=done perm_denied=die default=ignore] ${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_login.so + { name = "oslogin_login"; enable = cfg.googleOsLoginAuthentication; control = "[success=done perm_denied=die default=ignore]"; text = '' + ${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_login.so ''; } - { name = "rootok"; enable = cfg.rootOK; text = '' - sufficient pam_rootok.so + { name = "rootok"; enable = cfg.rootOK; control = "sufficient"; text = '' + pam_rootok.so ''; } - { name = "wheel"; enable = cfg.requireWheel; text = '' - required pam_wheel.so use_uid + { name = "wheel"; enable = cfg.requireWheel; control = "required"; text = '' + pam_wheel.so use_uid ''; } - { name = "faillock"; enable = cfg.logFailures; text = '' - required pam_faillock.so + { name = "faillock"; enable = cfg.logFailures; control = "required"; text = '' + pam_faillock.so ''; } - { name = "mysql"; enable = cfg.mysqlAuth; text = '' - sufficient ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf + { name = "mysql"; enable = cfg.mysqlAuth; control = "sufficient"; text = '' + ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf ''; } - { name = "ssh_agent_auth"; enable = config.security.pam.enableSSHAgentAuth && cfg.sshAgentAuth; text = '' - sufficient ${pkgs.pam_ssh_agent_auth}/libexec/pam_ssh_agent_auth.so file=${lib.concatStringsSep ":" config.services.openssh.authorizedKeysFiles} + { name = "ssh_agent_auth"; enable = config.security.pam.enableSSHAgentAuth && cfg.sshAgentAuth; control = "sufficient"; text = '' + ${pkgs.pam_ssh_agent_auth}/libexec/pam_ssh_agent_auth.so file=${lib.concatStringsSep ":" config.services.openssh.authorizedKeysFiles} ''; } - (let p11 = config.security.pam.p11; in { name = "p11"; enable = cfg.p11Auth; text = '' - ${p11.control} ${pkgs.pam_p11}/lib/security/pam_p11.so ${pkgs.opensc}/lib/opensc-pkcs11.so + (let p11 = config.security.pam.p11; in { name = "p11"; enable = cfg.p11Auth; control = p11.control; text = '' + ${pkgs.pam_p11}/lib/security/pam_p11.so ${pkgs.opensc}/lib/opensc-pkcs11.so ''; }) - (let u2f = config.security.pam.u2f; in { name = "u2f"; enable = cfg.u2fAuth; text = '' - ${u2f.control} ${pkgs.pam_u2f}/lib/security/pam_u2f.so ${optionalString u2f.debug "debug"} ${optionalString (u2f.authFile != null) "authfile=${u2f.authFile}"} ${optionalString u2f.interactive "interactive"} ${optionalString u2f.cue "cue"} ${optionalString (u2f.appId != null) "appid=${u2f.appId}"} ${optionalString (u2f.origin != null) "origin=${u2f.origin}"} + (let u2f = config.security.pam.u2f; in { name = "u2f"; enable = cfg.u2fAuth; control = u2f.control; text = '' + ${pkgs.pam_u2f}/lib/security/pam_u2f.so ${optionalString u2f.debug "debug"} ${optionalString (u2f.authFile != null) "authfile=${u2f.authFile}"} ${optionalString u2f.interactive "interactive"} ${optionalString u2f.cue "cue"} ${optionalString (u2f.appId != null) "appid=${u2f.appId}"} ${optionalString (u2f.origin != null) "origin=${u2f.origin}"} ''; }) - { name = "usb"; enable = cfg.usbAuth; text = '' - sufficient ${pkgs.pam_usb}/lib/security/pam_usb.so + { name = "usb"; enable = cfg.usbAuth; control = "sufficient"; text = '' + ${pkgs.pam_usb}/lib/security/pam_usb.so ''; } - (let ussh = config.security.pam.ussh; in { name = "ussh"; enable = config.security.pam.ussh.enable && cfg.usshAuth; text = '' - ${ussh.control} ${pkgs.pam_ussh}/lib/security/pam_ussh.so ${optionalString (ussh.caFile != null) "ca_file=${ussh.caFile}"} ${optionalString (ussh.authorizedPrincipals != null) "authorized_principals=${ussh.authorizedPrincipals}"} ${optionalString (ussh.authorizedPrincipalsFile != null) "authorized_principals_file=${ussh.authorizedPrincipalsFile}"} ${optionalString (ussh.group != null) "group=${ussh.group}"} + (let ussh = config.security.pam.ussh; in { name = "ussh"; enable = config.security.pam.ussh.enable && cfg.usshAuth; control = ussh.control; text = '' + ${pkgs.pam_ussh}/lib/security/pam_ussh.so ${optionalString (ussh.caFile != null) "ca_file=${ussh.caFile}"} ${optionalString (ussh.authorizedPrincipals != null) "authorized_principals=${ussh.authorizedPrincipals}"} ${optionalString (ussh.authorizedPrincipalsFile != null) "authorized_principals_file=${ussh.authorizedPrincipalsFile}"} ${optionalString (ussh.group != null) "group=${ussh.group}"} ''; }) - (let oath = config.security.pam.oath; in { name = "oath"; enable = cfg.oathAuth; text = '' - requisite ${pkgs.oath-toolkit}/lib/security/pam_oath.so window=${toString oath.window} usersfile=${toString oath.usersFile} digits=${toString oath.digits} + (let oath = config.security.pam.oath; in { name = "oath"; enable = cfg.oathAuth; control = "requisite"; text = '' + ${pkgs.oath-toolkit}/lib/security/pam_oath.so window=${toString oath.window} usersfile=${toString oath.usersFile} digits=${toString oath.digits} ''; }) - (let yubi = config.security.pam.yubico; in { name = "yubico"; enable = cfg.yubicoAuth; text = '' - ${yubi.control} ${pkgs.yubico-pam}/lib/security/pam_yubico.so mode=${toString yubi.mode} ${optionalString (yubi.challengeResponsePath != null) "chalresp_path=${yubi.challengeResponsePath}"} ${optionalString (yubi.mode == "client") "id=${toString yubi.id}"} ${optionalString yubi.debug "debug"} + (let yubi = config.security.pam.yubico; in { name = "yubico"; enable = cfg.yubicoAuth; control = yubi.control; text = '' + ${pkgs.yubico-pam}/lib/security/pam_yubico.so mode=${toString yubi.mode} ${optionalString (yubi.challengeResponsePath != null) "chalresp_path=${yubi.challengeResponsePath}"} ${optionalString (yubi.mode == "client") "id=${toString yubi.id}"} ${optionalString yubi.debug "debug"} ''; }) - (let dp9ik = config.security.pam.dp9ik; in { name = "p9"; enable = dp9ik.enable; text = '' - ${dp9ik.control} ${pkgs.pam_dp9ik}/lib/security/pam_p9.so ${dp9ik.authserver} + (let dp9ik = config.security.pam.dp9ik; in { name = "p9"; enable = dp9ik.enable; control = dp9ik.control; text = '' + ${pkgs.pam_dp9ik}/lib/security/pam_p9.so ${dp9ik.authserver} ''; }) - { name = "fprintd"; enable = cfg.fprintAuth; text = '' - sufficient ${pkgs.fprintd}/lib/security/pam_fprintd.so + { name = "fprintd"; enable = cfg.fprintAuth; control = "sufficient"; text = '' + ${pkgs.fprintd}/lib/security/pam_fprintd.so ''; } ] ++ # Modules in this block require having the password set in PAM_AUTHTOK. @@ -646,202 +652,202 @@ let || cfg.duoSecurity.enable || cfg.zfs)) [ - { name = "systemd_home-early"; enable = config.services.homed.enable; text = '' - optional ${config.systemd.package}/lib/security/pam_systemd_home.so + { name = "systemd_home-early"; enable = config.services.homed.enable; control = "optional"; text = '' + ${config.systemd.package}/lib/security/pam_systemd_home.so ''; } - { name = "unix-early"; enable = cfg.unixAuth; text = '' - optional pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} ${optionalString cfg.nodelay "nodelay"} likeauth + { name = "unix-early"; enable = cfg.unixAuth; control = "optional"; text = '' + pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} ${optionalString cfg.nodelay "nodelay"} likeauth ''; } - { name = "ecryptfs"; enable = config.security.pam.enableEcryptfs; text = '' - optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so unwrap + { name = "ecryptfs"; enable = config.security.pam.enableEcryptfs; control = "optional"; text = '' + ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so unwrap ''; } - { name = "fscrypt"; enable = config.security.pam.enableFscrypt; text = '' - optional ${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so + { name = "fscrypt"; enable = config.security.pam.enableFscrypt; control = "optional"; text = '' + ${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so ''; } - { name = "zfs_key"; enable = cfg.zfs; text = '' - optional ${config.boot.zfs.package}/lib/security/pam_zfs_key.so homes=${config.security.pam.zfs.homes} + { name = "zfs_key"; enable = cfg.zfs; control = "optional"; text = '' + ${config.boot.zfs.package}/lib/security/pam_zfs_key.so homes=${config.security.pam.zfs.homes} ''; } - { name = "mount"; enable = cfg.pamMount; text = '' - optional ${pkgs.pam_mount}/lib/security/pam_mount.so disable_interactive + { name = "mount"; enable = cfg.pamMount; control = "optional"; text = '' + ${pkgs.pam_mount}/lib/security/pam_mount.so disable_interactive ''; } - { name = "kwallet5"; enable = cfg.enableKwallet; text = '' - optional ${pkgs.plasma5Packages.kwallet-pam}/lib/security/pam_kwallet5.so kwalletd=${pkgs.plasma5Packages.kwallet.bin}/bin/kwalletd5 + { name = "kwallet5"; enable = cfg.enableKwallet; control = "optional"; text = '' + ${pkgs.plasma5Packages.kwallet-pam}/lib/security/pam_kwallet5.so kwalletd=${pkgs.plasma5Packages.kwallet.bin}/bin/kwalletd5 ''; } - { name = "gnome_keyring"; enable = cfg.enableGnomeKeyring; text = '' - optional ${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so + { name = "gnome_keyring"; enable = cfg.enableGnomeKeyring; control = "optional"; text = '' + ${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so ''; } - { name = "gnupg"; enable = cfg.gnupg.enable; text = '' - optional ${pkgs.pam_gnupg}/lib/security/pam_gnupg.so ${optionalString cfg.gnupg.storeOnly "store-only"} + { name = "gnupg"; enable = cfg.gnupg.enable; control = "optional"; text = '' + ${pkgs.pam_gnupg}/lib/security/pam_gnupg.so ${optionalString cfg.gnupg.storeOnly "store-only"} ''; } - { name = "faildelay"; enable = cfg.failDelay.enable; text = '' - optional ${pkgs.pam}/lib/security/pam_faildelay.so delay=${toString cfg.failDelay.delay} + { name = "faildelay"; enable = cfg.failDelay.enable; control = "optional"; text = '' + ${pkgs.pam}/lib/security/pam_faildelay.so delay=${toString cfg.failDelay.delay} ''; } - { name = "google_authenticator"; enable = cfg.googleAuthenticator.enable; text = '' - required ${pkgs.google-authenticator}/lib/security/pam_google_authenticator.so no_increment_hotp + { name = "google_authenticator"; enable = cfg.googleAuthenticator.enable; control = "required"; text = '' + ${pkgs.google-authenticator}/lib/security/pam_google_authenticator.so no_increment_hotp ''; } - { name = "duo"; enable = cfg.duoSecurity.enable; text = '' - required ${pkgs.duo-unix}/lib/security/pam_duo.so + { name = "duo"; enable = cfg.duoSecurity.enable; control = "required"; text = '' + ${pkgs.duo-unix}/lib/security/pam_duo.so ''; } ]) ++ [ - { name = "systemd_home"; enable = config.services.homed.enable; text = '' - sufficient ${config.systemd.package}/lib/security/pam_systemd_home.so + { name = "systemd_home"; enable = config.services.homed.enable; control = "sufficient"; text = '' + ${config.systemd.package}/lib/security/pam_systemd_home.so ''; } - { name = "unix"; enable = cfg.unixAuth; text = '' - sufficient pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} ${optionalString cfg.nodelay "nodelay"} likeauth try_first_pass + { name = "unix"; enable = cfg.unixAuth; control = "sufficient"; text = '' + pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} ${optionalString cfg.nodelay "nodelay"} likeauth try_first_pass ''; } - { name = "otpw"; enable = cfg.otpwAuth; text = '' - sufficient ${pkgs.otpw}/lib/security/pam_otpw.so + { name = "otpw"; enable = cfg.otpwAuth; control = "sufficient"; text = '' + ${pkgs.otpw}/lib/security/pam_otpw.so ''; } - { name = "ldap"; enable = use_ldap; text = '' - sufficient ${pam_ldap}/lib/security/pam_ldap.so use_first_pass + { name = "ldap"; enable = use_ldap; control = "sufficient"; text = '' + ${pam_ldap}/lib/security/pam_ldap.so use_first_pass ''; } - { name = "kanidm"; enable = config.services.kanidm.enablePam; text = '' - sufficient ${pkgs.kanidm}/lib/pam_kanidm.so ignore_unknown_user use_first_pass + { name = "kanidm"; enable = config.services.kanidm.enablePam; control = "sufficient"; text = '' + ${pkgs.kanidm}/lib/pam_kanidm.so ignore_unknown_user use_first_pass ''; } - { name = "sss"; enable = config.services.sssd.enable; text = '' - sufficient ${pkgs.sssd}/lib/security/pam_sss.so use_first_pass + { name = "sss"; enable = config.services.sssd.enable; control = "sufficient"; text = '' + ${pkgs.sssd}/lib/security/pam_sss.so use_first_pass ''; } - { name = "krb5"; enable = config.security.pam.krb5.enable; text = '' - [default=ignore success=1 service_err=reset] ${pam_krb5}/lib/security/pam_krb5.so use_first_pass + { name = "krb5"; enable = config.security.pam.krb5.enable; control = "[default=ignore success=1 service_err=reset]"; text = '' + ${pam_krb5}/lib/security/pam_krb5.so use_first_pass ''; } - { name = "ccreds-validate"; enable = config.security.pam.krb5.enable; text = '' - [default=die success=done] ${pam_ccreds}/lib/security/pam_ccreds.so action=validate use_first_pass + { name = "ccreds-validate"; enable = config.security.pam.krb5.enable; control = "[default=die success=done]"; text = '' + ${pam_ccreds}/lib/security/pam_ccreds.so action=validate use_first_pass ''; } - { name = "ccreds-store"; enable = config.security.pam.krb5.enable; text = '' - sufficient ${pam_ccreds}/lib/security/pam_ccreds.so action=store use_first_pass + { name = "ccreds-store"; enable = config.security.pam.krb5.enable; control = "sufficient"; text = '' + ${pam_ccreds}/lib/security/pam_ccreds.so action=store use_first_pass ''; } - { name = "deny"; text = '' - required pam_deny.so + { name = "deny"; control = "required"; text = '' + pam_deny.so ''; } ]; password = [ - { name = "systemd_home"; enable = config.services.homed.enable; text = '' - sufficient ${config.systemd.package}/lib/security/pam_systemd_home.so + { name = "systemd_home"; enable = config.services.homed.enable; control = "sufficient"; text = '' + ${config.systemd.package}/lib/security/pam_systemd_home.so ''; } - { name = "unix"; text = '' - sufficient pam_unix.so nullok yescrypt + { name = "unix"; control = "sufficient"; text = '' + pam_unix.so nullok yescrypt ''; } - { name = "ecryptfs"; enable = config.security.pam.enableEcryptfs; text = '' - optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so + { name = "ecryptfs"; enable = config.security.pam.enableEcryptfs; control = "optional"; text = '' + ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so ''; } - { name = "fscrypt"; enable = config.security.pam.enableFscrypt; text = '' - optional ${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so + { name = "fscrypt"; enable = config.security.pam.enableFscrypt; control = "optional"; text = '' + ${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so ''; } - { name = "zfs_key"; enable = cfg.zfs; text = '' - optional ${config.boot.zfs.package}/lib/security/pam_zfs_key.so homes=${config.security.pam.zfs.homes} + { name = "zfs_key"; enable = cfg.zfs; control = "optional"; text = '' + ${config.boot.zfs.package}/lib/security/pam_zfs_key.so homes=${config.security.pam.zfs.homes} ''; } - { name = "mount"; enable = cfg.pamMount; text = '' - optional ${pkgs.pam_mount}/lib/security/pam_mount.so + { name = "mount"; enable = cfg.pamMount; control = "optional"; text = '' + ${pkgs.pam_mount}/lib/security/pam_mount.so ''; } - { name = "ldap"; enable = use_ldap; text = '' - sufficient ${pam_ldap}/lib/security/pam_ldap.so + { name = "ldap"; enable = use_ldap; control = "sufficient"; text = '' + ${pam_ldap}/lib/security/pam_ldap.so ''; } - { name = "mysql"; enable = cfg.mysqlAuth; text = '' - sufficient ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf + { name = "mysql"; enable = cfg.mysqlAuth; control = "sufficient"; text = '' + ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf ''; } - { name = "kanidm"; enable = config.services.kanidm.enablePam; text = '' - sufficient ${pkgs.kanidm}/lib/pam_kanidm.so + { name = "kanidm"; enable = config.services.kanidm.enablePam; control = "sufficient"; text = '' + ${pkgs.kanidm}/lib/pam_kanidm.so ''; } - { name = "sss"; enable = config.services.sssd.enable; text = '' - sufficient ${pkgs.sssd}/lib/security/pam_sss.so + { name = "sss"; enable = config.services.sssd.enable; control = "sufficient"; text = '' + ${pkgs.sssd}/lib/security/pam_sss.so ''; } - { name = "krb5"; enable = config.security.pam.krb5.enable; text = '' - sufficient ${pam_krb5}/lib/security/pam_krb5.so use_first_pass + { name = "krb5"; enable = config.security.pam.krb5.enable; control = "sufficient"; text = '' + ${pam_krb5}/lib/security/pam_krb5.so use_first_pass ''; } - { name = "gnome_keyring"; enable = cfg.enableGnomeKeyring; text = '' - optional ${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so use_authtok + { name = "gnome_keyring"; enable = cfg.enableGnomeKeyring; control = "optional"; text = '' + ${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so use_authtok ''; } ]; session = [ - { name = "env"; enable = cfg.setEnvironment; text = '' - required pam_env.so conffile=/etc/pam/environment readenv=0 + { name = "env"; enable = cfg.setEnvironment; control = "required"; text = '' + pam_env.so conffile=/etc/pam/environment readenv=0 ''; } - { name = "unix"; text = '' - required pam_unix.so + { name = "unix"; control = "required"; text = '' + pam_unix.so ''; } - { name = "loginuid"; enable = cfg.setLoginUid; text = '' - ${if config.boot.isContainer then "optional" else "required"} pam_loginuid.so + { name = "loginuid"; enable = cfg.setLoginUid; control = if config.boot.isContainer then "optional" else "required"; text = '' + pam_loginuid.so ''; } - { name = "tty_audit"; enable = cfg.ttyAudit.enable; text = '' - required ${pkgs.pam}/lib/security/pam_tty_audit.so ${optionalString cfg.ttyAudit.openOnly "open_only"} ${optionalString (cfg.ttyAudit.enablePattern != null) "enable=${cfg.ttyAudit.enablePattern}"} ${optionalString (cfg.ttyAudit.disablePattern != null) "disable=${cfg.ttyAudit.disablePattern}"} + { name = "tty_audit"; enable = cfg.ttyAudit.enable; control = "required"; text = '' + ${pkgs.pam}/lib/security/pam_tty_audit.so ${optionalString cfg.ttyAudit.openOnly "open_only"} ${optionalString (cfg.ttyAudit.enablePattern != null) "enable=${cfg.ttyAudit.enablePattern}"} ${optionalString (cfg.ttyAudit.disablePattern != null) "disable=${cfg.ttyAudit.disablePattern}"} ''; } - { name = "systemd_home"; enable = config.services.homed.enable; text = '' - required ${config.systemd.package}/lib/security/pam_systemd_home.so + { name = "systemd_home"; enable = config.services.homed.enable; control = "required"; text = '' + ${config.systemd.package}/lib/security/pam_systemd_home.so ''; } - { name = "mkhomedir"; enable = cfg.makeHomeDir; text = '' - required ${pkgs.pam}/lib/security/pam_mkhomedir.so silent skel=${config.security.pam.makeHomeDir.skelDirectory} umask=${config.security.pam.makeHomeDir.umask} + { name = "mkhomedir"; enable = cfg.makeHomeDir; control = "required"; text = '' + ${pkgs.pam}/lib/security/pam_mkhomedir.so silent skel=${config.security.pam.makeHomeDir.skelDirectory} umask=${config.security.pam.makeHomeDir.umask} ''; } - { name = "lastlog"; enable = cfg.updateWtmp; text = '' - required ${pkgs.pam}/lib/security/pam_lastlog.so silent + { name = "lastlog"; enable = cfg.updateWtmp; control = "required"; text = '' + ${pkgs.pam}/lib/security/pam_lastlog.so silent ''; } - { name = "ecryptfs"; enable = config.security.pam.enableEcryptfs; text = '' - optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so + { name = "ecryptfs"; enable = config.security.pam.enableEcryptfs; control = "optional"; text = '' + ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so ''; } # Work around https://github.com/systemd/systemd/issues/8598 # Skips the pam_fscrypt module for systemd-user sessions which do not have a password # anyways. # See also https://github.com/google/fscrypt/issues/95 - { name = "fscrypt-skip-systemd"; enable = config.security.pam.enableFscrypt; text = '' - [success=1 default=ignore] pam_succeed_if.so service = systemd-user + { name = "fscrypt-skip-systemd"; enable = config.security.pam.enableFscrypt; control = "[success=1 default=ignore]"; text = '' + pam_succeed_if.so service = systemd-user ''; } - { name = "fscrypt"; enable = config.security.pam.enableFscrypt; text = '' - optional ${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so + { name = "fscrypt"; enable = config.security.pam.enableFscrypt; control = "optional"; text = '' + ${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so ''; } - { name = "zfs_key-skip-systemd"; enable = cfg.zfs; text = '' - [success=1 default=ignore] pam_succeed_if.so service = systemd-user + { name = "zfs_key-skip-systemd"; enable = cfg.zfs; control = "[success=1 default=ignore]"; text = '' + pam_succeed_if.so service = systemd-user ''; } - { name = "zfs_key"; enable = cfg.zfs; text = '' - optional ${config.boot.zfs.package}/lib/security/pam_zfs_key.so homes=${config.security.pam.zfs.homes} ${optionalString config.security.pam.zfs.noUnmount "nounmount"} + { name = "zfs_key"; enable = cfg.zfs; control = "optional"; text = '' + ${config.boot.zfs.package}/lib/security/pam_zfs_key.so homes=${config.security.pam.zfs.homes} ${optionalString config.security.pam.zfs.noUnmount "nounmount"} ''; } - { name = "mount"; enable = cfg.pamMount; text = '' - optional ${pkgs.pam_mount}/lib/security/pam_mount.so disable_interactive + { name = "mount"; enable = cfg.pamMount; control = "optional"; text = '' + ${pkgs.pam_mount}/lib/security/pam_mount.so disable_interactive ''; } - { name = "ldap"; enable = use_ldap; text = '' - optional ${pam_ldap}/lib/security/pam_ldap.so + { name = "ldap"; enable = use_ldap; control = "optional"; text = '' + ${pam_ldap}/lib/security/pam_ldap.so ''; } - { name = "mysql"; enable = cfg.mysqlAuth; text = '' - optional ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf + { name = "mysql"; enable = cfg.mysqlAuth; control = "optional"; text = '' + ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf ''; } - { name = "kanidm"; enable = config.services.kanidm.enablePam; text = '' - optional ${pkgs.kanidm}/lib/pam_kanidm.so + { name = "kanidm"; enable = config.services.kanidm.enablePam; control = "optional"; text = '' + ${pkgs.kanidm}/lib/pam_kanidm.so ''; } - { name = "sss"; enable = config.services.sssd.enable; text = '' - optional ${pkgs.sssd}/lib/security/pam_sss.so + { name = "sss"; enable = config.services.sssd.enable; control = "optional"; text = '' + ${pkgs.sssd}/lib/security/pam_sss.so ''; } - { name = "krb5"; enable = config.security.pam.krb5.enable; text = '' - optional ${pam_krb5}/lib/security/pam_krb5.so + { name = "krb5"; enable = config.security.pam.krb5.enable; control = "optional"; text = '' + ${pam_krb5}/lib/security/pam_krb5.so ''; } - { name = "otpw"; enable = cfg.otpwAuth; text = '' - optional ${pkgs.otpw}/lib/security/pam_otpw.so + { name = "otpw"; enable = cfg.otpwAuth; control = "optional"; text = '' + ${pkgs.otpw}/lib/security/pam_otpw.so ''; } - { name = "systemd"; enable = cfg.startSession; text = '' - optional ${config.systemd.package}/lib/security/pam_systemd.so + { name = "systemd"; enable = cfg.startSession; control = "optional"; text = '' + ${config.systemd.package}/lib/security/pam_systemd.so ''; } - { name = "xauth"; enable = cfg.forwardXAuth; text = '' - optional pam_xauth.so xauthpath=${pkgs.xorg.xauth}/bin/xauth systemuser=99 + { name = "xauth"; enable = cfg.forwardXAuth; control = "optional"; text = '' + pam_xauth.so xauthpath=${pkgs.xorg.xauth}/bin/xauth systemuser=99 ''; } - { name = "limits"; enable = cfg.limits != []; text = '' - required ${pkgs.pam}/lib/security/pam_limits.so conf=${makeLimitsConf cfg.limits} + { name = "limits"; enable = cfg.limits != []; control = "required"; text = '' + ${pkgs.pam}/lib/security/pam_limits.so conf=${makeLimitsConf cfg.limits} ''; } - { name = "motd"; enable = cfg.showMotd && (config.users.motd != null || config.users.motdFile != null); text = '' - optional ${pkgs.pam}/lib/security/pam_motd.so motd=${motd} + { name = "motd"; enable = cfg.showMotd && (config.users.motd != null || config.users.motdFile != null); control = "optional"; text = '' + ${pkgs.pam}/lib/security/pam_motd.so motd=${motd} ''; } - { name = "apparmor"; enable = cfg.enableAppArmor && config.security.apparmor.enable; text = '' - optional ${pkgs.apparmor-pam}/lib/security/pam_apparmor.so order=user,group,default debug + { name = "apparmor"; enable = cfg.enableAppArmor && config.security.apparmor.enable; control = "optional"; text = '' + ${pkgs.apparmor-pam}/lib/security/pam_apparmor.so order=user,group,default debug ''; } - { name = "kwallet5"; enable = cfg.enableKwallet; text = '' - optional ${pkgs.plasma5Packages.kwallet-pam}/lib/security/pam_kwallet5.so kwalletd=${pkgs.plasma5Packages.kwallet.bin}/bin/kwalletd5 + { name = "kwallet5"; enable = cfg.enableKwallet; control = "optional"; text = '' + ${pkgs.plasma5Packages.kwallet-pam}/lib/security/pam_kwallet5.so kwalletd=${pkgs.plasma5Packages.kwallet.bin}/bin/kwalletd5 ''; } - { name = "gnome_keyring"; enable = cfg.enableGnomeKeyring; text = '' - optional ${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so auto_start + { name = "gnome_keyring"; enable = cfg.enableGnomeKeyring; control = "optional"; text = '' + ${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so auto_start ''; } - { name = "gnupg"; enable = cfg.gnupg.enable; text = '' - optional ${pkgs.pam_gnupg}/lib/security/pam_gnupg.so ${optionalString cfg.gnupg.noAutostart " no-autostart"} + { name = "gnupg"; enable = cfg.gnupg.enable; control = "optional"; text = '' + ${pkgs.pam_gnupg}/lib/security/pam_gnupg.so ${optionalString cfg.gnupg.noAutostart " no-autostart"} ''; } - { name = "cgfs"; enable = config.virtualisation.lxc.lxcfs.enable; text = '' - optional ${pkgs.lxc}/lib/security/pam_cgfs.so -c all + { name = "cgfs"; enable = config.virtualisation.lxc.lxcfs.enable; control = "optional"; text = '' + ${pkgs.lxc}/lib/security/pam_cgfs.so -c all ''; } ]; }; From 12a488e89c32f778b463620b56f92bfc010b0514 Mon Sep 17 00:00:00 2001 From: Majiir Paktu Date: Sat, 16 Sep 2023 13:43:36 -0400 Subject: [PATCH 10/82] nixos/pam: extract modulePath field --- nixos/modules/security/pam.nix | 318 +++++++++++++++------------------ 1 file changed, 144 insertions(+), 174 deletions(-) diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix index 12a818a9680b..012b83c6e1b2 100644 --- a/nixos/modules/security/pam.nix +++ b/nixos/modules/security/pam.nix @@ -33,10 +33,16 @@ let Indicates the behavior of the PAM-API should the module fail to succeed in its authentication task. See `control` in {manpage}`pam.conf(5)` for details. ''; }; + modulePath = mkOption { + type = types.str; + description = lib.mdDoc '' + Either the full filename of the PAM to be used by the application (it begins with a '/'), or a relative pathname from the default module location. See `module-path` in {manpage}`pam.conf(5)` for details. + ''; + }; text = mkOption { type = types.str; description = lib.mdDoc '' - Text of the rule (without `service`, `type` or `control` fields). + Text of the rule (without `service`, `type`, `control` or `module-path` fields). ''; }; }; @@ -532,9 +538,10 @@ let text = let formatRules = type: pipe cfg.rules.${type} [ (filter (rule: rule.enable)) - (map (rule: concatStringsSep " " - [ type rule.control (removeSuffix "\n" rule.text) ] - )) + (map (rule: concatStringsSep " " ( + [ type rule.control rule.modulePath ] + ++ optional (rule.text != "") (removeSuffix "\n" rule.text) + ))) (concatStringsSep "\n") ]; in mkDefault '' @@ -556,80 +563,68 @@ let # module provides the right hooks. rules = { account = [ - { name = "ldap"; enable = use_ldap; control = "sufficient"; text = '' - ${pam_ldap}/lib/security/pam_ldap.so + { name = "ldap"; enable = use_ldap; control = "sufficient"; modulePath = "${pam_ldap}/lib/security/pam_ldap.so"; text = '' ''; } - { name = "mysql"; enable = cfg.mysqlAuth; control = "sufficient"; text = '' - ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf + { name = "mysql"; enable = cfg.mysqlAuth; control = "sufficient"; modulePath = "${pkgs.pam_mysql}/lib/security/pam_mysql.so"; text = '' + config_file=/etc/security/pam_mysql.conf ''; } - { name = "kanidm"; enable = config.services.kanidm.enablePam; control = "sufficient"; text = '' - ${pkgs.kanidm}/lib/pam_kanidm.so ignore_unknown_user + { name = "kanidm"; enable = config.services.kanidm.enablePam; control = "sufficient"; modulePath = "${pkgs.kanidm}/lib/pam_kanidm.so"; text = '' + ignore_unknown_user ''; } - { name = "sss"; enable = config.services.sssd.enable; control = if cfg.sssdStrictAccess then "[default=bad success=ok user_unknown=ignore]" else "sufficient"; text = '' - ${pkgs.sssd}/lib/security/pam_sss.so + { name = "sss"; enable = config.services.sssd.enable; control = if cfg.sssdStrictAccess then "[default=bad success=ok user_unknown=ignore]" else "sufficient"; modulePath = "${pkgs.sssd}/lib/security/pam_sss.so"; text = '' ''; } - { name = "krb5"; enable = config.security.pam.krb5.enable; control = "sufficient"; text = '' - ${pam_krb5}/lib/security/pam_krb5.so + { name = "krb5"; enable = config.security.pam.krb5.enable; control = "sufficient"; modulePath = "${pam_krb5}/lib/security/pam_krb5.so"; text = '' ''; } - { name = "oslogin_login"; enable = cfg.googleOsLoginAccountVerification; control = "[success=ok ignore=ignore default=die]"; text = '' - ${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_login.so + { name = "oslogin_login"; enable = cfg.googleOsLoginAccountVerification; control = "[success=ok ignore=ignore default=die]"; modulePath = "${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_login.so"; text = '' ''; } - { name = "oslogin_admin"; enable = cfg.googleOsLoginAccountVerification; control = "[success=ok default=ignore]"; text = '' - ${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_admin.so + { name = "oslogin_admin"; enable = cfg.googleOsLoginAccountVerification; control = "[success=ok default=ignore]"; modulePath = "${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_admin.so"; text = '' ''; } - { name = "systemd_home"; enable = config.services.homed.enable; control = "sufficient"; text = '' - ${config.systemd.package}/lib/security/pam_systemd_home.so + { name = "systemd_home"; enable = config.services.homed.enable; control = "sufficient"; modulePath = "${config.systemd.package}/lib/security/pam_systemd_home.so"; text = '' ''; } # The required pam_unix.so module has to come after all the sufficient modules # because otherwise, the account lookup will fail if the user does not exist # locally, for example with MySQL- or LDAP-auth. - { name = "unix"; control = "required"; text = '' - pam_unix.so + { name = "unix"; control = "required"; modulePath = "pam_unix.so"; text = '' ''; } ]; auth = [ - { name = "oslogin_login"; enable = cfg.googleOsLoginAuthentication; control = "[success=done perm_denied=die default=ignore]"; text = '' - ${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_login.so + { name = "oslogin_login"; enable = cfg.googleOsLoginAuthentication; control = "[success=done perm_denied=die default=ignore]"; modulePath = "${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_login.so"; text = '' ''; } - { name = "rootok"; enable = cfg.rootOK; control = "sufficient"; text = '' - pam_rootok.so + { name = "rootok"; enable = cfg.rootOK; control = "sufficient"; modulePath = "pam_rootok.so"; text = '' ''; } - { name = "wheel"; enable = cfg.requireWheel; control = "required"; text = '' - pam_wheel.so use_uid + { name = "wheel"; enable = cfg.requireWheel; control = "required"; modulePath = "pam_wheel.so"; text = '' + use_uid ''; } - { name = "faillock"; enable = cfg.logFailures; control = "required"; text = '' - pam_faillock.so + { name = "faillock"; enable = cfg.logFailures; control = "required"; modulePath = "pam_faillock.so"; text = '' ''; } - { name = "mysql"; enable = cfg.mysqlAuth; control = "sufficient"; text = '' - ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf + { name = "mysql"; enable = cfg.mysqlAuth; control = "sufficient"; modulePath = "${pkgs.pam_mysql}/lib/security/pam_mysql.so"; text = '' + config_file=/etc/security/pam_mysql.conf ''; } - { name = "ssh_agent_auth"; enable = config.security.pam.enableSSHAgentAuth && cfg.sshAgentAuth; control = "sufficient"; text = '' - ${pkgs.pam_ssh_agent_auth}/libexec/pam_ssh_agent_auth.so file=${lib.concatStringsSep ":" config.services.openssh.authorizedKeysFiles} + { name = "ssh_agent_auth"; enable = config.security.pam.enableSSHAgentAuth && cfg.sshAgentAuth; control = "sufficient"; modulePath = "${pkgs.pam_ssh_agent_auth}/libexec/pam_ssh_agent_auth.so"; text = '' + file=${lib.concatStringsSep ":" config.services.openssh.authorizedKeysFiles} ''; } - (let p11 = config.security.pam.p11; in { name = "p11"; enable = cfg.p11Auth; control = p11.control; text = '' - ${pkgs.pam_p11}/lib/security/pam_p11.so ${pkgs.opensc}/lib/opensc-pkcs11.so + (let p11 = config.security.pam.p11; in { name = "p11"; enable = cfg.p11Auth; control = p11.control; modulePath = "${pkgs.pam_p11}/lib/security/pam_p11.so"; text = '' + ${pkgs.opensc}/lib/opensc-pkcs11.so ''; }) - (let u2f = config.security.pam.u2f; in { name = "u2f"; enable = cfg.u2fAuth; control = u2f.control; text = '' - ${pkgs.pam_u2f}/lib/security/pam_u2f.so ${optionalString u2f.debug "debug"} ${optionalString (u2f.authFile != null) "authfile=${u2f.authFile}"} ${optionalString u2f.interactive "interactive"} ${optionalString u2f.cue "cue"} ${optionalString (u2f.appId != null) "appid=${u2f.appId}"} ${optionalString (u2f.origin != null) "origin=${u2f.origin}"} + (let u2f = config.security.pam.u2f; in { name = "u2f"; enable = cfg.u2fAuth; control = u2f.control; modulePath = "${pkgs.pam_u2f}/lib/security/pam_u2f.so"; text = '' + ${optionalString u2f.debug "debug"} ${optionalString (u2f.authFile != null) "authfile=${u2f.authFile}"} ${optionalString u2f.interactive "interactive"} ${optionalString u2f.cue "cue"} ${optionalString (u2f.appId != null) "appid=${u2f.appId}"} ${optionalString (u2f.origin != null) "origin=${u2f.origin}"} ''; }) - { name = "usb"; enable = cfg.usbAuth; control = "sufficient"; text = '' - ${pkgs.pam_usb}/lib/security/pam_usb.so + { name = "usb"; enable = cfg.usbAuth; control = "sufficient"; modulePath = "${pkgs.pam_usb}/lib/security/pam_usb.so"; text = '' ''; } - (let ussh = config.security.pam.ussh; in { name = "ussh"; enable = config.security.pam.ussh.enable && cfg.usshAuth; control = ussh.control; text = '' - ${pkgs.pam_ussh}/lib/security/pam_ussh.so ${optionalString (ussh.caFile != null) "ca_file=${ussh.caFile}"} ${optionalString (ussh.authorizedPrincipals != null) "authorized_principals=${ussh.authorizedPrincipals}"} ${optionalString (ussh.authorizedPrincipalsFile != null) "authorized_principals_file=${ussh.authorizedPrincipalsFile}"} ${optionalString (ussh.group != null) "group=${ussh.group}"} + (let ussh = config.security.pam.ussh; in { name = "ussh"; enable = config.security.pam.ussh.enable && cfg.usshAuth; control = ussh.control; modulePath = "${pkgs.pam_ussh}/lib/security/pam_ussh.so"; text = '' + ${optionalString (ussh.caFile != null) "ca_file=${ussh.caFile}"} ${optionalString (ussh.authorizedPrincipals != null) "authorized_principals=${ussh.authorizedPrincipals}"} ${optionalString (ussh.authorizedPrincipalsFile != null) "authorized_principals_file=${ussh.authorizedPrincipalsFile}"} ${optionalString (ussh.group != null) "group=${ussh.group}"} ''; }) - (let oath = config.security.pam.oath; in { name = "oath"; enable = cfg.oathAuth; control = "requisite"; text = '' - ${pkgs.oath-toolkit}/lib/security/pam_oath.so window=${toString oath.window} usersfile=${toString oath.usersFile} digits=${toString oath.digits} + (let oath = config.security.pam.oath; in { name = "oath"; enable = cfg.oathAuth; control = "requisite"; modulePath = "${pkgs.oath-toolkit}/lib/security/pam_oath.so"; text = '' + window=${toString oath.window} usersfile=${toString oath.usersFile} digits=${toString oath.digits} ''; }) - (let yubi = config.security.pam.yubico; in { name = "yubico"; enable = cfg.yubicoAuth; control = yubi.control; text = '' - ${pkgs.yubico-pam}/lib/security/pam_yubico.so mode=${toString yubi.mode} ${optionalString (yubi.challengeResponsePath != null) "chalresp_path=${yubi.challengeResponsePath}"} ${optionalString (yubi.mode == "client") "id=${toString yubi.id}"} ${optionalString yubi.debug "debug"} + (let yubi = config.security.pam.yubico; in { name = "yubico"; enable = cfg.yubicoAuth; control = yubi.control; modulePath = "${pkgs.yubico-pam}/lib/security/pam_yubico.so"; text = '' + mode=${toString yubi.mode} ${optionalString (yubi.challengeResponsePath != null) "chalresp_path=${yubi.challengeResponsePath}"} ${optionalString (yubi.mode == "client") "id=${toString yubi.id}"} ${optionalString yubi.debug "debug"} ''; }) - (let dp9ik = config.security.pam.dp9ik; in { name = "p9"; enable = dp9ik.enable; control = dp9ik.control; text = '' - ${pkgs.pam_dp9ik}/lib/security/pam_p9.so ${dp9ik.authserver} + (let dp9ik = config.security.pam.dp9ik; in { name = "p9"; enable = dp9ik.enable; control = dp9ik.control; modulePath = "${pkgs.pam_dp9ik}/lib/security/pam_p9.so"; text = '' + ${dp9ik.authserver} ''; }) - { name = "fprintd"; enable = cfg.fprintAuth; control = "sufficient"; text = '' - ${pkgs.fprintd}/lib/security/pam_fprintd.so + { name = "fprintd"; enable = cfg.fprintAuth; control = "sufficient"; modulePath = "${pkgs.fprintd}/lib/security/pam_fprintd.so"; text = '' ''; } ] ++ # Modules in this block require having the password set in PAM_AUTHTOK. @@ -652,202 +647,177 @@ let || cfg.duoSecurity.enable || cfg.zfs)) [ - { name = "systemd_home-early"; enable = config.services.homed.enable; control = "optional"; text = '' - ${config.systemd.package}/lib/security/pam_systemd_home.so + { name = "systemd_home-early"; enable = config.services.homed.enable; control = "optional"; modulePath = "${config.systemd.package}/lib/security/pam_systemd_home.so"; text = '' ''; } - { name = "unix-early"; enable = cfg.unixAuth; control = "optional"; text = '' - pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} ${optionalString cfg.nodelay "nodelay"} likeauth + { name = "unix-early"; enable = cfg.unixAuth; control = "optional"; modulePath = "pam_unix.so"; text = '' + ${optionalString cfg.allowNullPassword "nullok"} ${optionalString cfg.nodelay "nodelay"} likeauth ''; } - { name = "ecryptfs"; enable = config.security.pam.enableEcryptfs; control = "optional"; text = '' - ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so unwrap + { name = "ecryptfs"; enable = config.security.pam.enableEcryptfs; control = "optional"; modulePath = "${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so"; text = '' + unwrap ''; } - { name = "fscrypt"; enable = config.security.pam.enableFscrypt; control = "optional"; text = '' - ${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so + { name = "fscrypt"; enable = config.security.pam.enableFscrypt; control = "optional"; modulePath = "${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so"; text = '' ''; } - { name = "zfs_key"; enable = cfg.zfs; control = "optional"; text = '' - ${config.boot.zfs.package}/lib/security/pam_zfs_key.so homes=${config.security.pam.zfs.homes} + { name = "zfs_key"; enable = cfg.zfs; control = "optional"; modulePath = "${config.boot.zfs.package}/lib/security/pam_zfs_key.so"; text = '' + homes=${config.security.pam.zfs.homes} ''; } - { name = "mount"; enable = cfg.pamMount; control = "optional"; text = '' - ${pkgs.pam_mount}/lib/security/pam_mount.so disable_interactive + { name = "mount"; enable = cfg.pamMount; control = "optional"; modulePath = "${pkgs.pam_mount}/lib/security/pam_mount.so"; text = '' + disable_interactive ''; } - { name = "kwallet5"; enable = cfg.enableKwallet; control = "optional"; text = '' - ${pkgs.plasma5Packages.kwallet-pam}/lib/security/pam_kwallet5.so kwalletd=${pkgs.plasma5Packages.kwallet.bin}/bin/kwalletd5 + { name = "kwallet5"; enable = cfg.enableKwallet; control = "optional"; modulePath = "${pkgs.plasma5Packages.kwallet-pam}/lib/security/pam_kwallet5.so"; text = '' + kwalletd=${pkgs.plasma5Packages.kwallet.bin}/bin/kwalletd5 ''; } - { name = "gnome_keyring"; enable = cfg.enableGnomeKeyring; control = "optional"; text = '' - ${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so + { name = "gnome_keyring"; enable = cfg.enableGnomeKeyring; control = "optional"; modulePath = "${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so"; text = '' ''; } - { name = "gnupg"; enable = cfg.gnupg.enable; control = "optional"; text = '' - ${pkgs.pam_gnupg}/lib/security/pam_gnupg.so ${optionalString cfg.gnupg.storeOnly "store-only"} + { name = "gnupg"; enable = cfg.gnupg.enable; control = "optional"; modulePath = "${pkgs.pam_gnupg}/lib/security/pam_gnupg.so"; text = '' + ${optionalString cfg.gnupg.storeOnly "store-only"} ''; } - { name = "faildelay"; enable = cfg.failDelay.enable; control = "optional"; text = '' - ${pkgs.pam}/lib/security/pam_faildelay.so delay=${toString cfg.failDelay.delay} + { name = "faildelay"; enable = cfg.failDelay.enable; control = "optional"; modulePath = "${pkgs.pam}/lib/security/pam_faildelay.so"; text = '' + delay=${toString cfg.failDelay.delay} ''; } - { name = "google_authenticator"; enable = cfg.googleAuthenticator.enable; control = "required"; text = '' - ${pkgs.google-authenticator}/lib/security/pam_google_authenticator.so no_increment_hotp + { name = "google_authenticator"; enable = cfg.googleAuthenticator.enable; control = "required"; modulePath = "${pkgs.google-authenticator}/lib/security/pam_google_authenticator.so"; text = '' + no_increment_hotp ''; } - { name = "duo"; enable = cfg.duoSecurity.enable; control = "required"; text = '' - ${pkgs.duo-unix}/lib/security/pam_duo.so + { name = "duo"; enable = cfg.duoSecurity.enable; control = "required"; modulePath = "${pkgs.duo-unix}/lib/security/pam_duo.so"; text = '' ''; } ]) ++ [ - { name = "systemd_home"; enable = config.services.homed.enable; control = "sufficient"; text = '' - ${config.systemd.package}/lib/security/pam_systemd_home.so + { name = "systemd_home"; enable = config.services.homed.enable; control = "sufficient"; modulePath = "${config.systemd.package}/lib/security/pam_systemd_home.so"; text = '' ''; } - { name = "unix"; enable = cfg.unixAuth; control = "sufficient"; text = '' - pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} ${optionalString cfg.nodelay "nodelay"} likeauth try_first_pass + { name = "unix"; enable = cfg.unixAuth; control = "sufficient"; modulePath = "pam_unix.so"; text = '' + ${optionalString cfg.allowNullPassword "nullok"} ${optionalString cfg.nodelay "nodelay"} likeauth try_first_pass ''; } - { name = "otpw"; enable = cfg.otpwAuth; control = "sufficient"; text = '' - ${pkgs.otpw}/lib/security/pam_otpw.so + { name = "otpw"; enable = cfg.otpwAuth; control = "sufficient"; modulePath = "${pkgs.otpw}/lib/security/pam_otpw.so"; text = '' ''; } - { name = "ldap"; enable = use_ldap; control = "sufficient"; text = '' - ${pam_ldap}/lib/security/pam_ldap.so use_first_pass + { name = "ldap"; enable = use_ldap; control = "sufficient"; modulePath = "${pam_ldap}/lib/security/pam_ldap.so"; text = '' + use_first_pass ''; } - { name = "kanidm"; enable = config.services.kanidm.enablePam; control = "sufficient"; text = '' - ${pkgs.kanidm}/lib/pam_kanidm.so ignore_unknown_user use_first_pass + { name = "kanidm"; enable = config.services.kanidm.enablePam; control = "sufficient"; modulePath = "${pkgs.kanidm}/lib/pam_kanidm.so"; text = '' + ignore_unknown_user use_first_pass ''; } - { name = "sss"; enable = config.services.sssd.enable; control = "sufficient"; text = '' - ${pkgs.sssd}/lib/security/pam_sss.so use_first_pass + { name = "sss"; enable = config.services.sssd.enable; control = "sufficient"; modulePath = "${pkgs.sssd}/lib/security/pam_sss.so"; text = '' + use_first_pass ''; } - { name = "krb5"; enable = config.security.pam.krb5.enable; control = "[default=ignore success=1 service_err=reset]"; text = '' - ${pam_krb5}/lib/security/pam_krb5.so use_first_pass + { name = "krb5"; enable = config.security.pam.krb5.enable; control = "[default=ignore success=1 service_err=reset]"; modulePath = "${pam_krb5}/lib/security/pam_krb5.so"; text = '' + use_first_pass ''; } - { name = "ccreds-validate"; enable = config.security.pam.krb5.enable; control = "[default=die success=done]"; text = '' - ${pam_ccreds}/lib/security/pam_ccreds.so action=validate use_first_pass + { name = "ccreds-validate"; enable = config.security.pam.krb5.enable; control = "[default=die success=done]"; modulePath = "${pam_ccreds}/lib/security/pam_ccreds.so"; text = '' + action=validate use_first_pass ''; } - { name = "ccreds-store"; enable = config.security.pam.krb5.enable; control = "sufficient"; text = '' - ${pam_ccreds}/lib/security/pam_ccreds.so action=store use_first_pass + { name = "ccreds-store"; enable = config.security.pam.krb5.enable; control = "sufficient"; modulePath = "${pam_ccreds}/lib/security/pam_ccreds.so"; text = '' + action=store use_first_pass ''; } - { name = "deny"; control = "required"; text = '' - pam_deny.so + { name = "deny"; control = "required"; modulePath = "pam_deny.so"; text = '' ''; } ]; password = [ - { name = "systemd_home"; enable = config.services.homed.enable; control = "sufficient"; text = '' - ${config.systemd.package}/lib/security/pam_systemd_home.so + { name = "systemd_home"; enable = config.services.homed.enable; control = "sufficient"; modulePath = "${config.systemd.package}/lib/security/pam_systemd_home.so"; text = '' ''; } - { name = "unix"; control = "sufficient"; text = '' - pam_unix.so nullok yescrypt + { name = "unix"; control = "sufficient"; modulePath = "pam_unix.so"; text = '' + nullok yescrypt ''; } - { name = "ecryptfs"; enable = config.security.pam.enableEcryptfs; control = "optional"; text = '' - ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so + { name = "ecryptfs"; enable = config.security.pam.enableEcryptfs; control = "optional"; modulePath = "${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so"; text = '' ''; } - { name = "fscrypt"; enable = config.security.pam.enableFscrypt; control = "optional"; text = '' - ${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so + { name = "fscrypt"; enable = config.security.pam.enableFscrypt; control = "optional"; modulePath = "${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so"; text = '' ''; } - { name = "zfs_key"; enable = cfg.zfs; control = "optional"; text = '' - ${config.boot.zfs.package}/lib/security/pam_zfs_key.so homes=${config.security.pam.zfs.homes} + { name = "zfs_key"; enable = cfg.zfs; control = "optional"; modulePath = "${config.boot.zfs.package}/lib/security/pam_zfs_key.so"; text = '' + homes=${config.security.pam.zfs.homes} ''; } - { name = "mount"; enable = cfg.pamMount; control = "optional"; text = '' - ${pkgs.pam_mount}/lib/security/pam_mount.so + { name = "mount"; enable = cfg.pamMount; control = "optional"; modulePath = "${pkgs.pam_mount}/lib/security/pam_mount.so"; text = '' ''; } - { name = "ldap"; enable = use_ldap; control = "sufficient"; text = '' - ${pam_ldap}/lib/security/pam_ldap.so + { name = "ldap"; enable = use_ldap; control = "sufficient"; modulePath = "${pam_ldap}/lib/security/pam_ldap.so"; text = '' ''; } - { name = "mysql"; enable = cfg.mysqlAuth; control = "sufficient"; text = '' - ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf + { name = "mysql"; enable = cfg.mysqlAuth; control = "sufficient"; modulePath = "${pkgs.pam_mysql}/lib/security/pam_mysql.so"; text = '' + config_file=/etc/security/pam_mysql.conf ''; } - { name = "kanidm"; enable = config.services.kanidm.enablePam; control = "sufficient"; text = '' - ${pkgs.kanidm}/lib/pam_kanidm.so + { name = "kanidm"; enable = config.services.kanidm.enablePam; control = "sufficient"; modulePath = "${pkgs.kanidm}/lib/pam_kanidm.so"; text = '' ''; } - { name = "sss"; enable = config.services.sssd.enable; control = "sufficient"; text = '' - ${pkgs.sssd}/lib/security/pam_sss.so + { name = "sss"; enable = config.services.sssd.enable; control = "sufficient"; modulePath = "${pkgs.sssd}/lib/security/pam_sss.so"; text = '' ''; } - { name = "krb5"; enable = config.security.pam.krb5.enable; control = "sufficient"; text = '' - ${pam_krb5}/lib/security/pam_krb5.so use_first_pass + { name = "krb5"; enable = config.security.pam.krb5.enable; control = "sufficient"; modulePath = "${pam_krb5}/lib/security/pam_krb5.so"; text = '' + use_first_pass ''; } - { name = "gnome_keyring"; enable = cfg.enableGnomeKeyring; control = "optional"; text = '' - ${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so use_authtok + { name = "gnome_keyring"; enable = cfg.enableGnomeKeyring; control = "optional"; modulePath = "${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so"; text = '' + use_authtok ''; } ]; session = [ - { name = "env"; enable = cfg.setEnvironment; control = "required"; text = '' - pam_env.so conffile=/etc/pam/environment readenv=0 + { name = "env"; enable = cfg.setEnvironment; control = "required"; modulePath = "pam_env.so"; text = '' + conffile=/etc/pam/environment readenv=0 ''; } - { name = "unix"; control = "required"; text = '' - pam_unix.so + { name = "unix"; control = "required"; modulePath = "pam_unix.so"; text = '' ''; } - { name = "loginuid"; enable = cfg.setLoginUid; control = if config.boot.isContainer then "optional" else "required"; text = '' - pam_loginuid.so + { name = "loginuid"; enable = cfg.setLoginUid; control = if config.boot.isContainer then "optional" else "required"; modulePath = "pam_loginuid.so"; text = '' ''; } - { name = "tty_audit"; enable = cfg.ttyAudit.enable; control = "required"; text = '' - ${pkgs.pam}/lib/security/pam_tty_audit.so ${optionalString cfg.ttyAudit.openOnly "open_only"} ${optionalString (cfg.ttyAudit.enablePattern != null) "enable=${cfg.ttyAudit.enablePattern}"} ${optionalString (cfg.ttyAudit.disablePattern != null) "disable=${cfg.ttyAudit.disablePattern}"} + { name = "tty_audit"; enable = cfg.ttyAudit.enable; control = "required"; modulePath = "${pkgs.pam}/lib/security/pam_tty_audit.so"; text = '' + ${optionalString cfg.ttyAudit.openOnly "open_only"} ${optionalString (cfg.ttyAudit.enablePattern != null) "enable=${cfg.ttyAudit.enablePattern}"} ${optionalString (cfg.ttyAudit.disablePattern != null) "disable=${cfg.ttyAudit.disablePattern}"} ''; } - { name = "systemd_home"; enable = config.services.homed.enable; control = "required"; text = '' - ${config.systemd.package}/lib/security/pam_systemd_home.so + { name = "systemd_home"; enable = config.services.homed.enable; control = "required"; modulePath = "${config.systemd.package}/lib/security/pam_systemd_home.so"; text = '' ''; } - { name = "mkhomedir"; enable = cfg.makeHomeDir; control = "required"; text = '' - ${pkgs.pam}/lib/security/pam_mkhomedir.so silent skel=${config.security.pam.makeHomeDir.skelDirectory} umask=${config.security.pam.makeHomeDir.umask} + { name = "mkhomedir"; enable = cfg.makeHomeDir; control = "required"; modulePath = "${pkgs.pam}/lib/security/pam_mkhomedir.so"; text = '' + silent skel=${config.security.pam.makeHomeDir.skelDirectory} umask=${config.security.pam.makeHomeDir.umask} ''; } - { name = "lastlog"; enable = cfg.updateWtmp; control = "required"; text = '' - ${pkgs.pam}/lib/security/pam_lastlog.so silent + { name = "lastlog"; enable = cfg.updateWtmp; control = "required"; modulePath = "${pkgs.pam}/lib/security/pam_lastlog.so"; text = '' + silent ''; } - { name = "ecryptfs"; enable = config.security.pam.enableEcryptfs; control = "optional"; text = '' - ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so + { name = "ecryptfs"; enable = config.security.pam.enableEcryptfs; control = "optional"; modulePath = "${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so"; text = '' ''; } # Work around https://github.com/systemd/systemd/issues/8598 # Skips the pam_fscrypt module for systemd-user sessions which do not have a password # anyways. # See also https://github.com/google/fscrypt/issues/95 - { name = "fscrypt-skip-systemd"; enable = config.security.pam.enableFscrypt; control = "[success=1 default=ignore]"; text = '' - pam_succeed_if.so service = systemd-user + { name = "fscrypt-skip-systemd"; enable = config.security.pam.enableFscrypt; control = "[success=1 default=ignore]"; modulePath = "pam_succeed_if.so"; text = '' + service = systemd-user ''; } - { name = "fscrypt"; enable = config.security.pam.enableFscrypt; control = "optional"; text = '' - ${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so + { name = "fscrypt"; enable = config.security.pam.enableFscrypt; control = "optional"; modulePath = "${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so"; text = '' ''; } - { name = "zfs_key-skip-systemd"; enable = cfg.zfs; control = "[success=1 default=ignore]"; text = '' - pam_succeed_if.so service = systemd-user + { name = "zfs_key-skip-systemd"; enable = cfg.zfs; control = "[success=1 default=ignore]"; modulePath = "pam_succeed_if.so"; text = '' + service = systemd-user ''; } - { name = "zfs_key"; enable = cfg.zfs; control = "optional"; text = '' - ${config.boot.zfs.package}/lib/security/pam_zfs_key.so homes=${config.security.pam.zfs.homes} ${optionalString config.security.pam.zfs.noUnmount "nounmount"} + { name = "zfs_key"; enable = cfg.zfs; control = "optional"; modulePath = "${config.boot.zfs.package}/lib/security/pam_zfs_key.so"; text = '' + homes=${config.security.pam.zfs.homes} ${optionalString config.security.pam.zfs.noUnmount "nounmount"} ''; } - { name = "mount"; enable = cfg.pamMount; control = "optional"; text = '' - ${pkgs.pam_mount}/lib/security/pam_mount.so disable_interactive + { name = "mount"; enable = cfg.pamMount; control = "optional"; modulePath = "${pkgs.pam_mount}/lib/security/pam_mount.so"; text = '' + disable_interactive ''; } - { name = "ldap"; enable = use_ldap; control = "optional"; text = '' - ${pam_ldap}/lib/security/pam_ldap.so + { name = "ldap"; enable = use_ldap; control = "optional"; modulePath = "${pam_ldap}/lib/security/pam_ldap.so"; text = '' ''; } - { name = "mysql"; enable = cfg.mysqlAuth; control = "optional"; text = '' - ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf + { name = "mysql"; enable = cfg.mysqlAuth; control = "optional"; modulePath = "${pkgs.pam_mysql}/lib/security/pam_mysql.so"; text = '' + config_file=/etc/security/pam_mysql.conf ''; } - { name = "kanidm"; enable = config.services.kanidm.enablePam; control = "optional"; text = '' - ${pkgs.kanidm}/lib/pam_kanidm.so + { name = "kanidm"; enable = config.services.kanidm.enablePam; control = "optional"; modulePath = "${pkgs.kanidm}/lib/pam_kanidm.so"; text = '' ''; } - { name = "sss"; enable = config.services.sssd.enable; control = "optional"; text = '' - ${pkgs.sssd}/lib/security/pam_sss.so + { name = "sss"; enable = config.services.sssd.enable; control = "optional"; modulePath = "${pkgs.sssd}/lib/security/pam_sss.so"; text = '' ''; } - { name = "krb5"; enable = config.security.pam.krb5.enable; control = "optional"; text = '' - ${pam_krb5}/lib/security/pam_krb5.so + { name = "krb5"; enable = config.security.pam.krb5.enable; control = "optional"; modulePath = "${pam_krb5}/lib/security/pam_krb5.so"; text = '' ''; } - { name = "otpw"; enable = cfg.otpwAuth; control = "optional"; text = '' - ${pkgs.otpw}/lib/security/pam_otpw.so + { name = "otpw"; enable = cfg.otpwAuth; control = "optional"; modulePath = "${pkgs.otpw}/lib/security/pam_otpw.so"; text = '' ''; } - { name = "systemd"; enable = cfg.startSession; control = "optional"; text = '' - ${config.systemd.package}/lib/security/pam_systemd.so + { name = "systemd"; enable = cfg.startSession; control = "optional"; modulePath = "${config.systemd.package}/lib/security/pam_systemd.so"; text = '' ''; } - { name = "xauth"; enable = cfg.forwardXAuth; control = "optional"; text = '' - pam_xauth.so xauthpath=${pkgs.xorg.xauth}/bin/xauth systemuser=99 + { name = "xauth"; enable = cfg.forwardXAuth; control = "optional"; modulePath = "pam_xauth.so"; text = '' + xauthpath=${pkgs.xorg.xauth}/bin/xauth systemuser=99 ''; } - { name = "limits"; enable = cfg.limits != []; control = "required"; text = '' - ${pkgs.pam}/lib/security/pam_limits.so conf=${makeLimitsConf cfg.limits} + { name = "limits"; enable = cfg.limits != []; control = "required"; modulePath = "${pkgs.pam}/lib/security/pam_limits.so"; text = '' + conf=${makeLimitsConf cfg.limits} ''; } - { name = "motd"; enable = cfg.showMotd && (config.users.motd != null || config.users.motdFile != null); control = "optional"; text = '' - ${pkgs.pam}/lib/security/pam_motd.so motd=${motd} + { name = "motd"; enable = cfg.showMotd && (config.users.motd != null || config.users.motdFile != null); control = "optional"; modulePath = "${pkgs.pam}/lib/security/pam_motd.so"; text = '' + motd=${motd} ''; } - { name = "apparmor"; enable = cfg.enableAppArmor && config.security.apparmor.enable; control = "optional"; text = '' - ${pkgs.apparmor-pam}/lib/security/pam_apparmor.so order=user,group,default debug + { name = "apparmor"; enable = cfg.enableAppArmor && config.security.apparmor.enable; control = "optional"; modulePath = "${pkgs.apparmor-pam}/lib/security/pam_apparmor.so"; text = '' + order=user,group,default debug ''; } - { name = "kwallet5"; enable = cfg.enableKwallet; control = "optional"; text = '' - ${pkgs.plasma5Packages.kwallet-pam}/lib/security/pam_kwallet5.so kwalletd=${pkgs.plasma5Packages.kwallet.bin}/bin/kwalletd5 + { name = "kwallet5"; enable = cfg.enableKwallet; control = "optional"; modulePath = "${pkgs.plasma5Packages.kwallet-pam}/lib/security/pam_kwallet5.so"; text = '' + kwalletd=${pkgs.plasma5Packages.kwallet.bin}/bin/kwalletd5 ''; } - { name = "gnome_keyring"; enable = cfg.enableGnomeKeyring; control = "optional"; text = '' - ${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so auto_start + { name = "gnome_keyring"; enable = cfg.enableGnomeKeyring; control = "optional"; modulePath = "${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so"; text = '' + auto_start ''; } - { name = "gnupg"; enable = cfg.gnupg.enable; control = "optional"; text = '' - ${pkgs.pam_gnupg}/lib/security/pam_gnupg.so ${optionalString cfg.gnupg.noAutostart " no-autostart"} + { name = "gnupg"; enable = cfg.gnupg.enable; control = "optional"; modulePath = "${pkgs.pam_gnupg}/lib/security/pam_gnupg.so"; text = '' + ${optionalString cfg.gnupg.noAutostart " no-autostart"} ''; } - { name = "cgfs"; enable = config.virtualisation.lxc.lxcfs.enable; control = "optional"; text = '' - ${pkgs.lxc}/lib/security/pam_cgfs.so -c all + { name = "cgfs"; enable = config.virtualisation.lxc.lxcfs.enable; control = "optional"; modulePath = "${pkgs.lxc}/lib/security/pam_cgfs.so"; text = '' + -c all ''; } ]; }; From 6eea7fb19485f7a6138975c7904e1e77a051e481 Mon Sep 17 00:00:00 2001 From: Majiir Paktu Date: Mon, 18 Sep 2023 18:39:53 -0400 Subject: [PATCH 11/82] nixos/pam: extract args field Module arguments have common escaping rules for all PAMs. --- nixos/modules/security/pam.nix | 287 ++++++++++++++++++++++----------- nixos/tests/pam/test_chfn.py | 2 +- 2 files changed, 191 insertions(+), 98 deletions(-) diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix index 012b83c6e1b2..bcdb69eb06d3 100644 --- a/nixos/modules/security/pam.nix +++ b/nixos/modules/security/pam.nix @@ -39,10 +39,19 @@ let Either the full filename of the PAM to be used by the application (it begins with a '/'), or a relative pathname from the default module location. See `module-path` in {manpage}`pam.conf(5)` for details. ''; }; + args = mkOption { + type = types.listOf types.str; + default = []; + description = lib.mdDoc '' + Tokens that can be used to modify the specific behavior of the given PAM. Such arguments will be documented for each individual module. See `module-arguments` in {manpage}`pam.conf(5)` for details. + + Escaping rules for spaces and square brackets are automatically applied. + ''; + }; text = mkOption { type = types.str; description = lib.mdDoc '' - Text of the rule (without `service`, `type`, `control` or `module-path` fields). + (Obsolete.) ''; }; }; @@ -536,10 +545,16 @@ let limits = mkDefault config.security.pam.loginLimits; text = let + # Formats a string for use in `module-arguments`. See `man pam.conf`. + formatModuleArgument = token: + if hasInfix " " token + then "[${replaceStrings ["]"] ["\\]"] token}]" + else token; formatRules = type: pipe cfg.rules.${type} [ (filter (rule: rule.enable)) (map (rule: concatStringsSep " " ( [ type rule.control rule.modulePath ] + ++ map formatModuleArgument rule.args ++ optional (rule.text != "") (removeSuffix "\n" rule.text) ))) (concatStringsSep "\n") @@ -565,11 +580,13 @@ let account = [ { name = "ldap"; enable = use_ldap; control = "sufficient"; modulePath = "${pam_ldap}/lib/security/pam_ldap.so"; text = '' ''; } - { name = "mysql"; enable = cfg.mysqlAuth; control = "sufficient"; modulePath = "${pkgs.pam_mysql}/lib/security/pam_mysql.so"; text = '' - config_file=/etc/security/pam_mysql.conf + { name = "mysql"; enable = cfg.mysqlAuth; control = "sufficient"; modulePath = "${pkgs.pam_mysql}/lib/security/pam_mysql.so"; args = [ + "config_file=/etc/security/pam_mysql.conf" + ]; text = '' ''; } - { name = "kanidm"; enable = config.services.kanidm.enablePam; control = "sufficient"; modulePath = "${pkgs.kanidm}/lib/pam_kanidm.so"; text = '' - ignore_unknown_user + { name = "kanidm"; enable = config.services.kanidm.enablePam; control = "sufficient"; modulePath = "${pkgs.kanidm}/lib/pam_kanidm.so"; args = [ + "ignore_unknown_user" + ]; text = '' ''; } { name = "sss"; enable = config.services.sssd.enable; control = if cfg.sssdStrictAccess then "[default=bad success=ok user_unknown=ignore]" else "sufficient"; modulePath = "${pkgs.sssd}/lib/security/pam_sss.so"; text = '' ''; } @@ -593,36 +610,58 @@ let ''; } { name = "rootok"; enable = cfg.rootOK; control = "sufficient"; modulePath = "pam_rootok.so"; text = '' ''; } - { name = "wheel"; enable = cfg.requireWheel; control = "required"; modulePath = "pam_wheel.so"; text = '' - use_uid + { name = "wheel"; enable = cfg.requireWheel; control = "required"; modulePath = "pam_wheel.so"; args = [ + "use_uid" + ]; text = '' ''; } { name = "faillock"; enable = cfg.logFailures; control = "required"; modulePath = "pam_faillock.so"; text = '' ''; } - { name = "mysql"; enable = cfg.mysqlAuth; control = "sufficient"; modulePath = "${pkgs.pam_mysql}/lib/security/pam_mysql.so"; text = '' - config_file=/etc/security/pam_mysql.conf + { name = "mysql"; enable = cfg.mysqlAuth; control = "sufficient"; modulePath = "${pkgs.pam_mysql}/lib/security/pam_mysql.so"; args = [ + "config_file=/etc/security/pam_mysql.conf" + ]; text = '' ''; } - { name = "ssh_agent_auth"; enable = config.security.pam.enableSSHAgentAuth && cfg.sshAgentAuth; control = "sufficient"; modulePath = "${pkgs.pam_ssh_agent_auth}/libexec/pam_ssh_agent_auth.so"; text = '' - file=${lib.concatStringsSep ":" config.services.openssh.authorizedKeysFiles} + { name = "ssh_agent_auth"; enable = config.security.pam.enableSSHAgentAuth && cfg.sshAgentAuth; control = "sufficient"; modulePath = "${pkgs.pam_ssh_agent_auth}/libexec/pam_ssh_agent_auth.so"; args = [ + "file=${lib.concatStringsSep ":" config.services.openssh.authorizedKeysFiles}" + ]; text = '' ''; } - (let p11 = config.security.pam.p11; in { name = "p11"; enable = cfg.p11Auth; control = p11.control; modulePath = "${pkgs.pam_p11}/lib/security/pam_p11.so"; text = '' - ${pkgs.opensc}/lib/opensc-pkcs11.so + (let p11 = config.security.pam.p11; in { name = "p11"; enable = cfg.p11Auth; control = p11.control; modulePath = "${pkgs.pam_p11}/lib/security/pam_p11.so"; args = [ + "${pkgs.opensc}/lib/opensc-pkcs11.so" + ]; text = '' ''; }) - (let u2f = config.security.pam.u2f; in { name = "u2f"; enable = cfg.u2fAuth; control = u2f.control; modulePath = "${pkgs.pam_u2f}/lib/security/pam_u2f.so"; text = '' - ${optionalString u2f.debug "debug"} ${optionalString (u2f.authFile != null) "authfile=${u2f.authFile}"} ${optionalString u2f.interactive "interactive"} ${optionalString u2f.cue "cue"} ${optionalString (u2f.appId != null) "appid=${u2f.appId}"} ${optionalString (u2f.origin != null) "origin=${u2f.origin}"} + (let u2f = config.security.pam.u2f; in { name = "u2f"; enable = cfg.u2fAuth; control = u2f.control; modulePath = "${pkgs.pam_u2f}/lib/security/pam_u2f.so"; args = concatLists [ + (optional u2f.debug "debug") + (optional (u2f.authFile != null) "authfile=${u2f.authFile}") + (optional u2f.interactive "interactive") + (optional u2f.cue "cue") + (optional (u2f.appId != null) "appid=${u2f.appId}") + (optional (u2f.origin != null) "origin=${u2f.origin}") + ]; text = '' ''; }) { name = "usb"; enable = cfg.usbAuth; control = "sufficient"; modulePath = "${pkgs.pam_usb}/lib/security/pam_usb.so"; text = '' ''; } - (let ussh = config.security.pam.ussh; in { name = "ussh"; enable = config.security.pam.ussh.enable && cfg.usshAuth; control = ussh.control; modulePath = "${pkgs.pam_ussh}/lib/security/pam_ussh.so"; text = '' - ${optionalString (ussh.caFile != null) "ca_file=${ussh.caFile}"} ${optionalString (ussh.authorizedPrincipals != null) "authorized_principals=${ussh.authorizedPrincipals}"} ${optionalString (ussh.authorizedPrincipalsFile != null) "authorized_principals_file=${ussh.authorizedPrincipalsFile}"} ${optionalString (ussh.group != null) "group=${ussh.group}"} + (let ussh = config.security.pam.ussh; in { name = "ussh"; enable = config.security.pam.ussh.enable && cfg.usshAuth; control = ussh.control; modulePath = "${pkgs.pam_ussh}/lib/security/pam_ussh.so"; args = concatLists [ + (optional (ussh.caFile != null) "ca_file=${ussh.caFile}") + (optional (ussh.authorizedPrincipals != null) "authorized_principals=${ussh.authorizedPrincipals}") + (optional (ussh.authorizedPrincipalsFile != null) "authorized_principals_file=${ussh.authorizedPrincipalsFile}") + (optional (ussh.group != null) "group=${ussh.group}") + ]; text = '' ''; }) - (let oath = config.security.pam.oath; in { name = "oath"; enable = cfg.oathAuth; control = "requisite"; modulePath = "${pkgs.oath-toolkit}/lib/security/pam_oath.so"; text = '' - window=${toString oath.window} usersfile=${toString oath.usersFile} digits=${toString oath.digits} + (let oath = config.security.pam.oath; in { name = "oath"; enable = cfg.oathAuth; control = "requisite"; modulePath = "${pkgs.oath-toolkit}/lib/security/pam_oath.so"; args = [ + "window=${toString oath.window}" + "usersfile=${toString oath.usersFile}" + "digits=${toString oath.digits}" + ]; text = '' ''; }) - (let yubi = config.security.pam.yubico; in { name = "yubico"; enable = cfg.yubicoAuth; control = yubi.control; modulePath = "${pkgs.yubico-pam}/lib/security/pam_yubico.so"; text = '' - mode=${toString yubi.mode} ${optionalString (yubi.challengeResponsePath != null) "chalresp_path=${yubi.challengeResponsePath}"} ${optionalString (yubi.mode == "client") "id=${toString yubi.id}"} ${optionalString yubi.debug "debug"} + (let yubi = config.security.pam.yubico; in { name = "yubico"; enable = cfg.yubicoAuth; control = yubi.control; modulePath = "${pkgs.yubico-pam}/lib/security/pam_yubico.so"; args = concatLists [ + (singleton "mode=${toString yubi.mode}") + (optional (yubi.challengeResponsePath != null) "chalresp_path=${yubi.challengeResponsePath}") + (optional (yubi.mode == "client") "id=${toString yubi.id}") + (optional yubi.debug "debug") + ]; text = '' ''; }) - (let dp9ik = config.security.pam.dp9ik; in { name = "p9"; enable = dp9ik.enable; control = dp9ik.control; modulePath = "${pkgs.pam_dp9ik}/lib/security/pam_p9.so"; text = '' - ${dp9ik.authserver} + (let dp9ik = config.security.pam.dp9ik; in { name = "p9"; enable = dp9ik.enable; control = dp9ik.control; modulePath = "${pkgs.pam_dp9ik}/lib/security/pam_p9.so"; args = [ + dp9ik.authserver + ]; text = '' ''; }) { name = "fprintd"; enable = cfg.fprintAuth; control = "sufficient"; modulePath = "${pkgs.fprintd}/lib/security/pam_fprintd.so"; text = '' ''; } @@ -649,61 +688,84 @@ let [ { name = "systemd_home-early"; enable = config.services.homed.enable; control = "optional"; modulePath = "${config.systemd.package}/lib/security/pam_systemd_home.so"; text = '' ''; } - { name = "unix-early"; enable = cfg.unixAuth; control = "optional"; modulePath = "pam_unix.so"; text = '' - ${optionalString cfg.allowNullPassword "nullok"} ${optionalString cfg.nodelay "nodelay"} likeauth + { name = "unix-early"; enable = cfg.unixAuth; control = "optional"; modulePath = "pam_unix.so"; args = concatLists [ + (optional cfg.allowNullPassword "nullok") + (optional cfg.nodelay "nodelay") + (singleton "likeauth") + ]; text = '' ''; } - { name = "ecryptfs"; enable = config.security.pam.enableEcryptfs; control = "optional"; modulePath = "${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so"; text = '' - unwrap + { name = "ecryptfs"; enable = config.security.pam.enableEcryptfs; control = "optional"; modulePath = "${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so"; args = [ + "unwrap" + ]; text = '' ''; } { name = "fscrypt"; enable = config.security.pam.enableFscrypt; control = "optional"; modulePath = "${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so"; text = '' ''; } - { name = "zfs_key"; enable = cfg.zfs; control = "optional"; modulePath = "${config.boot.zfs.package}/lib/security/pam_zfs_key.so"; text = '' - homes=${config.security.pam.zfs.homes} + { name = "zfs_key"; enable = cfg.zfs; control = "optional"; modulePath = "${config.boot.zfs.package}/lib/security/pam_zfs_key.so"; args = [ + "homes=${config.security.pam.zfs.homes}" + ]; text = '' ''; } - { name = "mount"; enable = cfg.pamMount; control = "optional"; modulePath = "${pkgs.pam_mount}/lib/security/pam_mount.so"; text = '' - disable_interactive + { name = "mount"; enable = cfg.pamMount; control = "optional"; modulePath = "${pkgs.pam_mount}/lib/security/pam_mount.so"; args = [ + "disable_interactive" + ]; text = '' ''; } - { name = "kwallet5"; enable = cfg.enableKwallet; control = "optional"; modulePath = "${pkgs.plasma5Packages.kwallet-pam}/lib/security/pam_kwallet5.so"; text = '' - kwalletd=${pkgs.plasma5Packages.kwallet.bin}/bin/kwalletd5 + { name = "kwallet5"; enable = cfg.enableKwallet; control = "optional"; modulePath = "${pkgs.plasma5Packages.kwallet-pam}/lib/security/pam_kwallet5.so"; args = [ + "kwalletd=${pkgs.plasma5Packages.kwallet.bin}/bin/kwalletd5" + ]; text = '' ''; } { name = "gnome_keyring"; enable = cfg.enableGnomeKeyring; control = "optional"; modulePath = "${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so"; text = '' ''; } - { name = "gnupg"; enable = cfg.gnupg.enable; control = "optional"; modulePath = "${pkgs.pam_gnupg}/lib/security/pam_gnupg.so"; text = '' - ${optionalString cfg.gnupg.storeOnly "store-only"} + { name = "gnupg"; enable = cfg.gnupg.enable; control = "optional"; modulePath = "${pkgs.pam_gnupg}/lib/security/pam_gnupg.so"; args = concatLists [ + (optional cfg.gnupg.storeOnly "store-only") + ]; text = '' ''; } - { name = "faildelay"; enable = cfg.failDelay.enable; control = "optional"; modulePath = "${pkgs.pam}/lib/security/pam_faildelay.so"; text = '' - delay=${toString cfg.failDelay.delay} + { name = "faildelay"; enable = cfg.failDelay.enable; control = "optional"; modulePath = "${pkgs.pam}/lib/security/pam_faildelay.so"; args = [ + "delay=${toString cfg.failDelay.delay}" + ]; text = '' ''; } - { name = "google_authenticator"; enable = cfg.googleAuthenticator.enable; control = "required"; modulePath = "${pkgs.google-authenticator}/lib/security/pam_google_authenticator.so"; text = '' - no_increment_hotp + { name = "google_authenticator"; enable = cfg.googleAuthenticator.enable; control = "required"; modulePath = "${pkgs.google-authenticator}/lib/security/pam_google_authenticator.so"; args = [ + "no_increment_hotp" + ]; text = '' ''; } { name = "duo"; enable = cfg.duoSecurity.enable; control = "required"; modulePath = "${pkgs.duo-unix}/lib/security/pam_duo.so"; text = '' ''; } ]) ++ [ { name = "systemd_home"; enable = config.services.homed.enable; control = "sufficient"; modulePath = "${config.systemd.package}/lib/security/pam_systemd_home.so"; text = '' ''; } - { name = "unix"; enable = cfg.unixAuth; control = "sufficient"; modulePath = "pam_unix.so"; text = '' - ${optionalString cfg.allowNullPassword "nullok"} ${optionalString cfg.nodelay "nodelay"} likeauth try_first_pass + { name = "unix"; enable = cfg.unixAuth; control = "sufficient"; modulePath = "pam_unix.so"; args = concatLists [ + (optional cfg.allowNullPassword "nullok") + (optional cfg.nodelay "nodelay") + (singleton "likeauth") + (singleton "try_first_pass") + ]; text = '' ''; } { name = "otpw"; enable = cfg.otpwAuth; control = "sufficient"; modulePath = "${pkgs.otpw}/lib/security/pam_otpw.so"; text = '' ''; } - { name = "ldap"; enable = use_ldap; control = "sufficient"; modulePath = "${pam_ldap}/lib/security/pam_ldap.so"; text = '' - use_first_pass + { name = "ldap"; enable = use_ldap; control = "sufficient"; modulePath = "${pam_ldap}/lib/security/pam_ldap.so"; args = [ + "use_first_pass" + ]; text = '' ''; } - { name = "kanidm"; enable = config.services.kanidm.enablePam; control = "sufficient"; modulePath = "${pkgs.kanidm}/lib/pam_kanidm.so"; text = '' - ignore_unknown_user use_first_pass + { name = "kanidm"; enable = config.services.kanidm.enablePam; control = "sufficient"; modulePath = "${pkgs.kanidm}/lib/pam_kanidm.so"; args = [ + "ignore_unknown_user" + "use_first_pass" + ]; text = '' ''; } - { name = "sss"; enable = config.services.sssd.enable; control = "sufficient"; modulePath = "${pkgs.sssd}/lib/security/pam_sss.so"; text = '' - use_first_pass + { name = "sss"; enable = config.services.sssd.enable; control = "sufficient"; modulePath = "${pkgs.sssd}/lib/security/pam_sss.so"; args = [ + "use_first_pass" + ]; text = '' ''; } - { name = "krb5"; enable = config.security.pam.krb5.enable; control = "[default=ignore success=1 service_err=reset]"; modulePath = "${pam_krb5}/lib/security/pam_krb5.so"; text = '' - use_first_pass + { name = "krb5"; enable = config.security.pam.krb5.enable; control = "[default=ignore success=1 service_err=reset]"; modulePath = "${pam_krb5}/lib/security/pam_krb5.so"; args = [ + "use_first_pass" + ]; text = '' ''; } - { name = "ccreds-validate"; enable = config.security.pam.krb5.enable; control = "[default=die success=done]"; modulePath = "${pam_ccreds}/lib/security/pam_ccreds.so"; text = '' - action=validate use_first_pass + { name = "ccreds-validate"; enable = config.security.pam.krb5.enable; control = "[default=die success=done]"; modulePath = "${pam_ccreds}/lib/security/pam_ccreds.so"; args = [ + "action=validate" + "use_first_pass" + ]; text = '' ''; } - { name = "ccreds-store"; enable = config.security.pam.krb5.enable; control = "sufficient"; modulePath = "${pam_ccreds}/lib/security/pam_ccreds.so"; text = '' - action=store use_first_pass + { name = "ccreds-store"; enable = config.security.pam.krb5.enable; control = "sufficient"; modulePath = "${pam_ccreds}/lib/security/pam_ccreds.so"; args = [ + "action=store" + "use_first_pass" + ]; text = '' ''; } { name = "deny"; control = "required"; modulePath = "pam_deny.so"; text = '' ''; } @@ -712,53 +774,68 @@ let password = [ { name = "systemd_home"; enable = config.services.homed.enable; control = "sufficient"; modulePath = "${config.systemd.package}/lib/security/pam_systemd_home.so"; text = '' ''; } - { name = "unix"; control = "sufficient"; modulePath = "pam_unix.so"; text = '' - nullok yescrypt + { name = "unix"; control = "sufficient"; modulePath = "pam_unix.so"; args = [ + "nullok" + "yescrypt" + ]; text = '' ''; } { name = "ecryptfs"; enable = config.security.pam.enableEcryptfs; control = "optional"; modulePath = "${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so"; text = '' ''; } { name = "fscrypt"; enable = config.security.pam.enableFscrypt; control = "optional"; modulePath = "${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so"; text = '' ''; } - { name = "zfs_key"; enable = cfg.zfs; control = "optional"; modulePath = "${config.boot.zfs.package}/lib/security/pam_zfs_key.so"; text = '' - homes=${config.security.pam.zfs.homes} + { name = "zfs_key"; enable = cfg.zfs; control = "optional"; modulePath = "${config.boot.zfs.package}/lib/security/pam_zfs_key.so"; args = [ + "homes=${config.security.pam.zfs.homes}" + ]; text = '' ''; } { name = "mount"; enable = cfg.pamMount; control = "optional"; modulePath = "${pkgs.pam_mount}/lib/security/pam_mount.so"; text = '' ''; } { name = "ldap"; enable = use_ldap; control = "sufficient"; modulePath = "${pam_ldap}/lib/security/pam_ldap.so"; text = '' ''; } - { name = "mysql"; enable = cfg.mysqlAuth; control = "sufficient"; modulePath = "${pkgs.pam_mysql}/lib/security/pam_mysql.so"; text = '' - config_file=/etc/security/pam_mysql.conf + { name = "mysql"; enable = cfg.mysqlAuth; control = "sufficient"; modulePath = "${pkgs.pam_mysql}/lib/security/pam_mysql.so"; args = [ + "config_file=/etc/security/pam_mysql.conf" + ]; text = '' ''; } { name = "kanidm"; enable = config.services.kanidm.enablePam; control = "sufficient"; modulePath = "${pkgs.kanidm}/lib/pam_kanidm.so"; text = '' ''; } { name = "sss"; enable = config.services.sssd.enable; control = "sufficient"; modulePath = "${pkgs.sssd}/lib/security/pam_sss.so"; text = '' ''; } - { name = "krb5"; enable = config.security.pam.krb5.enable; control = "sufficient"; modulePath = "${pam_krb5}/lib/security/pam_krb5.so"; text = '' - use_first_pass + { name = "krb5"; enable = config.security.pam.krb5.enable; control = "sufficient"; modulePath = "${pam_krb5}/lib/security/pam_krb5.so"; args = [ + "use_first_pass" + ]; text = '' ''; } - { name = "gnome_keyring"; enable = cfg.enableGnomeKeyring; control = "optional"; modulePath = "${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so"; text = '' - use_authtok + { name = "gnome_keyring"; enable = cfg.enableGnomeKeyring; control = "optional"; modulePath = "${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so"; args = [ + "use_authtok" + ]; text = '' ''; } ]; session = [ - { name = "env"; enable = cfg.setEnvironment; control = "required"; modulePath = "pam_env.so"; text = '' - conffile=/etc/pam/environment readenv=0 + { name = "env"; enable = cfg.setEnvironment; control = "required"; modulePath = "pam_env.so"; args = [ + "conffile=/etc/pam/environment" + "readenv=0" + ]; text = '' ''; } { name = "unix"; control = "required"; modulePath = "pam_unix.so"; text = '' ''; } { name = "loginuid"; enable = cfg.setLoginUid; control = if config.boot.isContainer then "optional" else "required"; modulePath = "pam_loginuid.so"; text = '' ''; } - { name = "tty_audit"; enable = cfg.ttyAudit.enable; control = "required"; modulePath = "${pkgs.pam}/lib/security/pam_tty_audit.so"; text = '' - ${optionalString cfg.ttyAudit.openOnly "open_only"} ${optionalString (cfg.ttyAudit.enablePattern != null) "enable=${cfg.ttyAudit.enablePattern}"} ${optionalString (cfg.ttyAudit.disablePattern != null) "disable=${cfg.ttyAudit.disablePattern}"} + { name = "tty_audit"; enable = cfg.ttyAudit.enable; control = "required"; modulePath = "${pkgs.pam}/lib/security/pam_tty_audit.so"; args = concatLists [ + (optional cfg.ttyAudit.openOnly "open_only") + (optional (cfg.ttyAudit.enablePattern != null) "enable=${cfg.ttyAudit.enablePattern}") + (optional (cfg.ttyAudit.disablePattern != null) "disable=${cfg.ttyAudit.disablePattern}") + ]; text = '' ''; } { name = "systemd_home"; enable = config.services.homed.enable; control = "required"; modulePath = "${config.systemd.package}/lib/security/pam_systemd_home.so"; text = '' ''; } - { name = "mkhomedir"; enable = cfg.makeHomeDir; control = "required"; modulePath = "${pkgs.pam}/lib/security/pam_mkhomedir.so"; text = '' - silent skel=${config.security.pam.makeHomeDir.skelDirectory} umask=${config.security.pam.makeHomeDir.umask} + { name = "mkhomedir"; enable = cfg.makeHomeDir; control = "required"; modulePath = "${pkgs.pam}/lib/security/pam_mkhomedir.so"; args = [ + "silent" + "skel=${config.security.pam.makeHomeDir.skelDirectory}" + "umask=${config.security.pam.makeHomeDir.umask}" + ]; text = '' ''; } - { name = "lastlog"; enable = cfg.updateWtmp; control = "required"; modulePath = "${pkgs.pam}/lib/security/pam_lastlog.so"; text = '' - silent + { name = "lastlog"; enable = cfg.updateWtmp; control = "required"; modulePath = "${pkgs.pam}/lib/security/pam_lastlog.so"; args = [ + "silent" + ]; text = '' ''; } { name = "ecryptfs"; enable = config.security.pam.enableEcryptfs; control = "optional"; modulePath = "${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so"; text = '' ''; } @@ -766,24 +843,30 @@ let # Skips the pam_fscrypt module for systemd-user sessions which do not have a password # anyways. # See also https://github.com/google/fscrypt/issues/95 - { name = "fscrypt-skip-systemd"; enable = config.security.pam.enableFscrypt; control = "[success=1 default=ignore]"; modulePath = "pam_succeed_if.so"; text = '' - service = systemd-user + { name = "fscrypt-skip-systemd"; enable = config.security.pam.enableFscrypt; control = "[success=1 default=ignore]"; modulePath = "pam_succeed_if.so"; args = [ + "service" "=" "systemd-user" + ]; text = '' ''; } { name = "fscrypt"; enable = config.security.pam.enableFscrypt; control = "optional"; modulePath = "${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so"; text = '' ''; } - { name = "zfs_key-skip-systemd"; enable = cfg.zfs; control = "[success=1 default=ignore]"; modulePath = "pam_succeed_if.so"; text = '' - service = systemd-user + { name = "zfs_key-skip-systemd"; enable = cfg.zfs; control = "[success=1 default=ignore]"; modulePath = "pam_succeed_if.so"; args = [ + "service" "=" "systemd-user" + ]; text = '' ''; } - { name = "zfs_key"; enable = cfg.zfs; control = "optional"; modulePath = "${config.boot.zfs.package}/lib/security/pam_zfs_key.so"; text = '' - homes=${config.security.pam.zfs.homes} ${optionalString config.security.pam.zfs.noUnmount "nounmount"} + { name = "zfs_key"; enable = cfg.zfs; control = "optional"; modulePath = "${config.boot.zfs.package}/lib/security/pam_zfs_key.so"; args = concatLists [ + (singleton "homes=${config.security.pam.zfs.homes}") + (optional config.security.pam.zfs.noUnmount "nounmount") + ]; text = '' ''; } - { name = "mount"; enable = cfg.pamMount; control = "optional"; modulePath = "${pkgs.pam_mount}/lib/security/pam_mount.so"; text = '' - disable_interactive + { name = "mount"; enable = cfg.pamMount; control = "optional"; modulePath = "${pkgs.pam_mount}/lib/security/pam_mount.so"; args = [ + "disable_interactive" + ]; text = '' ''; } { name = "ldap"; enable = use_ldap; control = "optional"; modulePath = "${pam_ldap}/lib/security/pam_ldap.so"; text = '' ''; } - { name = "mysql"; enable = cfg.mysqlAuth; control = "optional"; modulePath = "${pkgs.pam_mysql}/lib/security/pam_mysql.so"; text = '' - config_file=/etc/security/pam_mysql.conf + { name = "mysql"; enable = cfg.mysqlAuth; control = "optional"; modulePath = "${pkgs.pam_mysql}/lib/security/pam_mysql.so"; args = [ + "config_file=/etc/security/pam_mysql.conf" + ]; text = '' ''; } { name = "kanidm"; enable = config.services.kanidm.enablePam; control = "optional"; modulePath = "${pkgs.kanidm}/lib/pam_kanidm.so"; text = '' ''; } @@ -795,29 +878,39 @@ let ''; } { name = "systemd"; enable = cfg.startSession; control = "optional"; modulePath = "${config.systemd.package}/lib/security/pam_systemd.so"; text = '' ''; } - { name = "xauth"; enable = cfg.forwardXAuth; control = "optional"; modulePath = "pam_xauth.so"; text = '' - xauthpath=${pkgs.xorg.xauth}/bin/xauth systemuser=99 + { name = "xauth"; enable = cfg.forwardXAuth; control = "optional"; modulePath = "pam_xauth.so"; args = [ + "xauthpath=${pkgs.xorg.xauth}/bin/xauth" + "systemuser=99" + ]; text = '' ''; } - { name = "limits"; enable = cfg.limits != []; control = "required"; modulePath = "${pkgs.pam}/lib/security/pam_limits.so"; text = '' - conf=${makeLimitsConf cfg.limits} + { name = "limits"; enable = cfg.limits != []; control = "required"; modulePath = "${pkgs.pam}/lib/security/pam_limits.so"; args = [ + "conf=${makeLimitsConf cfg.limits}" + ]; text = '' ''; } - { name = "motd"; enable = cfg.showMotd && (config.users.motd != null || config.users.motdFile != null); control = "optional"; modulePath = "${pkgs.pam}/lib/security/pam_motd.so"; text = '' - motd=${motd} + { name = "motd"; enable = cfg.showMotd && (config.users.motd != null || config.users.motdFile != null); control = "optional"; modulePath = "${pkgs.pam}/lib/security/pam_motd.so"; args = [ + "motd=${motd}" + ]; text = '' ''; } - { name = "apparmor"; enable = cfg.enableAppArmor && config.security.apparmor.enable; control = "optional"; modulePath = "${pkgs.apparmor-pam}/lib/security/pam_apparmor.so"; text = '' - order=user,group,default debug + { name = "apparmor"; enable = cfg.enableAppArmor && config.security.apparmor.enable; control = "optional"; modulePath = "${pkgs.apparmor-pam}/lib/security/pam_apparmor.so"; args = [ + "order=user,group,default" + "debug" + ]; text = '' ''; } - { name = "kwallet5"; enable = cfg.enableKwallet; control = "optional"; modulePath = "${pkgs.plasma5Packages.kwallet-pam}/lib/security/pam_kwallet5.so"; text = '' - kwalletd=${pkgs.plasma5Packages.kwallet.bin}/bin/kwalletd5 + { name = "kwallet5"; enable = cfg.enableKwallet; control = "optional"; modulePath = "${pkgs.plasma5Packages.kwallet-pam}/lib/security/pam_kwallet5.so"; args = [ + "kwalletd=${pkgs.plasma5Packages.kwallet.bin}/bin/kwalletd5" + ]; text = '' ''; } - { name = "gnome_keyring"; enable = cfg.enableGnomeKeyring; control = "optional"; modulePath = "${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so"; text = '' - auto_start + { name = "gnome_keyring"; enable = cfg.enableGnomeKeyring; control = "optional"; modulePath = "${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so"; args = [ + "auto_start" + ]; text = '' ''; } - { name = "gnupg"; enable = cfg.gnupg.enable; control = "optional"; modulePath = "${pkgs.pam_gnupg}/lib/security/pam_gnupg.so"; text = '' - ${optionalString cfg.gnupg.noAutostart " no-autostart"} + { name = "gnupg"; enable = cfg.gnupg.enable; control = "optional"; modulePath = "${pkgs.pam_gnupg}/lib/security/pam_gnupg.so"; args = concatLists [ + (optional cfg.gnupg.noAutostart " no-autostart") + ]; text = '' ''; } - { name = "cgfs"; enable = config.virtualisation.lxc.lxcfs.enable; control = "optional"; modulePath = "${pkgs.lxc}/lib/security/pam_cgfs.so"; text = '' - -c all + { name = "cgfs"; enable = config.virtualisation.lxc.lxcfs.enable; control = "optional"; modulePath = "${pkgs.lxc}/lib/security/pam_cgfs.so"; args = [ + "-c" "all" + ]; text = '' ''; } ]; }; diff --git a/nixos/tests/pam/test_chfn.py b/nixos/tests/pam/test_chfn.py index a48438b8d305..4fd33447a543 100644 --- a/nixos/tests/pam/test_chfn.py +++ b/nixos/tests/pam/test_chfn.py @@ -6,7 +6,7 @@ expected_lines = { "auth required pam_deny.so", "auth sufficient @@pam_ccreds@@/lib/security/pam_ccreds.so action=store use_first_pass", "auth sufficient pam_rootok.so", - "auth sufficient pam_unix.so likeauth try_first_pass", + "auth sufficient pam_unix.so likeauth try_first_pass", "password sufficient @@pam_krb5@@/lib/security/pam_krb5.so use_first_pass", "password sufficient pam_unix.so nullok yescrypt", "session optional @@pam_krb5@@/lib/security/pam_krb5.so", From 5b8439f9666d3fc6ef3139ce48f4d9b34e1fd525 Mon Sep 17 00:00:00 2001 From: Majiir Paktu Date: Sun, 24 Sep 2023 19:55:54 -0400 Subject: [PATCH 12/82] nixos/pam: add settings option for common argument styles Adds easily overrideable settings for the most common PAM argument styles. These are: - Flag (e.g. "use_first_pass"): rendered for true boolean values. false values are ignored. - Key-value (e.g. "action=validate"): rendered for non-null, non-boolean values. Most PAM arguments can be configured this way. Others can still be configured with the 'args' option. --- nixos/modules/security/pam.nix | 339 +++++++++++++++++---------------- nixos/tests/pam/pam-u2f.nix | 2 +- 2 files changed, 177 insertions(+), 164 deletions(-) diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix index bcdb69eb06d3..2d79c9142121 100644 --- a/nixos/modules/security/pam.nix +++ b/nixos/modules/security/pam.nix @@ -12,7 +12,7 @@ let description = lib.mdDoc '' PAM `${type}` rules for this service. ''; - type = types.listOf (types.submodule { + type = types.listOf (types.submodule ({ config, ... }: { options = { name = mkOption { type = types.str; @@ -41,11 +41,21 @@ let }; args = mkOption { type = types.listOf types.str; - default = []; description = lib.mdDoc '' Tokens that can be used to modify the specific behavior of the given PAM. Such arguments will be documented for each individual module. See `module-arguments` in {manpage}`pam.conf(5)` for details. Escaping rules for spaces and square brackets are automatically applied. + + {option}`settings` are automatically added as {option}`args`. It's recommended to use the {option}`settings` option whenever possible so that arguments can be overridden. + ''; + }; + settings = mkOption { + type = with types; attrsOf (nullOr (oneOf [ bool str int pathInStore ])); + default = {}; + description = lib.mdDoc '' + Settings to add as `module-arguments`. + + Boolean values render just the key if true, and nothing if false. Null values are ignored. All other values are rendered as key-value pairs. ''; }; text = mkOption { @@ -55,7 +65,15 @@ let ''; }; }; - }); + config = { + # Formats an attrset of settings as args for use as `module-arguments`. + args = concatLists (flip mapAttrsToList config.settings (name: value: + if isBool value + then optional value name + else optional (value != null) "${name}=${toString value}" + )); + }; + })); }; parentConfig = config; @@ -580,13 +598,13 @@ let account = [ { name = "ldap"; enable = use_ldap; control = "sufficient"; modulePath = "${pam_ldap}/lib/security/pam_ldap.so"; text = '' ''; } - { name = "mysql"; enable = cfg.mysqlAuth; control = "sufficient"; modulePath = "${pkgs.pam_mysql}/lib/security/pam_mysql.so"; args = [ - "config_file=/etc/security/pam_mysql.conf" - ]; text = '' + { name = "mysql"; enable = cfg.mysqlAuth; control = "sufficient"; modulePath = "${pkgs.pam_mysql}/lib/security/pam_mysql.so"; settings = { + config_file = "/etc/security/pam_mysql.conf"; + }; text = '' ''; } - { name = "kanidm"; enable = config.services.kanidm.enablePam; control = "sufficient"; modulePath = "${pkgs.kanidm}/lib/pam_kanidm.so"; args = [ - "ignore_unknown_user" - ]; text = '' + { name = "kanidm"; enable = config.services.kanidm.enablePam; control = "sufficient"; modulePath = "${pkgs.kanidm}/lib/pam_kanidm.so"; settings = { + ignore_unknown_user = true; + }; text = '' ''; } { name = "sss"; enable = config.services.sssd.enable; control = if cfg.sssdStrictAccess then "[default=bad success=ok user_unknown=ignore]" else "sufficient"; modulePath = "${pkgs.sssd}/lib/security/pam_sss.so"; text = '' ''; } @@ -610,54 +628,49 @@ let ''; } { name = "rootok"; enable = cfg.rootOK; control = "sufficient"; modulePath = "pam_rootok.so"; text = '' ''; } - { name = "wheel"; enable = cfg.requireWheel; control = "required"; modulePath = "pam_wheel.so"; args = [ - "use_uid" - ]; text = '' + { name = "wheel"; enable = cfg.requireWheel; control = "required"; modulePath = "pam_wheel.so"; settings = { + use_uid = true; + }; text = '' ''; } { name = "faillock"; enable = cfg.logFailures; control = "required"; modulePath = "pam_faillock.so"; text = '' ''; } - { name = "mysql"; enable = cfg.mysqlAuth; control = "sufficient"; modulePath = "${pkgs.pam_mysql}/lib/security/pam_mysql.so"; args = [ - "config_file=/etc/security/pam_mysql.conf" - ]; text = '' + { name = "mysql"; enable = cfg.mysqlAuth; control = "sufficient"; modulePath = "${pkgs.pam_mysql}/lib/security/pam_mysql.so"; settings = { + config_file = "/etc/security/pam_mysql.conf"; + }; text = '' ''; } - { name = "ssh_agent_auth"; enable = config.security.pam.enableSSHAgentAuth && cfg.sshAgentAuth; control = "sufficient"; modulePath = "${pkgs.pam_ssh_agent_auth}/libexec/pam_ssh_agent_auth.so"; args = [ - "file=${lib.concatStringsSep ":" config.services.openssh.authorizedKeysFiles}" - ]; text = '' + { name = "ssh_agent_auth"; enable = config.security.pam.enableSSHAgentAuth && cfg.sshAgentAuth; control = "sufficient"; modulePath = "${pkgs.pam_ssh_agent_auth}/libexec/pam_ssh_agent_auth.so"; settings = { + file = lib.concatStringsSep ":" config.services.openssh.authorizedKeysFiles; + }; text = '' ''; } (let p11 = config.security.pam.p11; in { name = "p11"; enable = cfg.p11Auth; control = p11.control; modulePath = "${pkgs.pam_p11}/lib/security/pam_p11.so"; args = [ "${pkgs.opensc}/lib/opensc-pkcs11.so" ]; text = '' ''; }) - (let u2f = config.security.pam.u2f; in { name = "u2f"; enable = cfg.u2fAuth; control = u2f.control; modulePath = "${pkgs.pam_u2f}/lib/security/pam_u2f.so"; args = concatLists [ - (optional u2f.debug "debug") - (optional (u2f.authFile != null) "authfile=${u2f.authFile}") - (optional u2f.interactive "interactive") - (optional u2f.cue "cue") - (optional (u2f.appId != null) "appid=${u2f.appId}") - (optional (u2f.origin != null) "origin=${u2f.origin}") - ]; text = '' - ''; }) + (let u2f = config.security.pam.u2f; in { name = "u2f"; enable = cfg.u2fAuth; control = u2f.control; modulePath = "${pkgs.pam_u2f}/lib/security/pam_u2f.so"; settings = { + inherit (u2f) debug interactive cue origin; + authfile = u2f.authFile; + appid = u2f.appId; + }; text = ('' + ''); }) { name = "usb"; enable = cfg.usbAuth; control = "sufficient"; modulePath = "${pkgs.pam_usb}/lib/security/pam_usb.so"; text = '' ''; } - (let ussh = config.security.pam.ussh; in { name = "ussh"; enable = config.security.pam.ussh.enable && cfg.usshAuth; control = ussh.control; modulePath = "${pkgs.pam_ussh}/lib/security/pam_ussh.so"; args = concatLists [ - (optional (ussh.caFile != null) "ca_file=${ussh.caFile}") - (optional (ussh.authorizedPrincipals != null) "authorized_principals=${ussh.authorizedPrincipals}") - (optional (ussh.authorizedPrincipalsFile != null) "authorized_principals_file=${ussh.authorizedPrincipalsFile}") - (optional (ussh.group != null) "group=${ussh.group}") - ]; text = '' + (let ussh = config.security.pam.ussh; in { name = "ussh"; enable = config.security.pam.ussh.enable && cfg.usshAuth; control = ussh.control; modulePath = "${pkgs.pam_ussh}/lib/security/pam_ussh.so"; settings = { + ca_file = ussh.caFile; + authorized_principals = ussh.authorizedPrincipals; + authorized_principals_file = ussh.authorizedPrincipalsFile; + inherit (ussh) group; + }; text = '' ''; }) - (let oath = config.security.pam.oath; in { name = "oath"; enable = cfg.oathAuth; control = "requisite"; modulePath = "${pkgs.oath-toolkit}/lib/security/pam_oath.so"; args = [ - "window=${toString oath.window}" - "usersfile=${toString oath.usersFile}" - "digits=${toString oath.digits}" - ]; text = '' + (let oath = config.security.pam.oath; in { name = "oath"; enable = cfg.oathAuth; control = "requisite"; modulePath = "${pkgs.oath-toolkit}/lib/security/pam_oath.so"; settings = { + inherit (oath) window digits; + usersfile = oath.usersFile; + }; text = '' ''; }) - (let yubi = config.security.pam.yubico; in { name = "yubico"; enable = cfg.yubicoAuth; control = yubi.control; modulePath = "${pkgs.yubico-pam}/lib/security/pam_yubico.so"; args = concatLists [ - (singleton "mode=${toString yubi.mode}") - (optional (yubi.challengeResponsePath != null) "chalresp_path=${yubi.challengeResponsePath}") - (optional (yubi.mode == "client") "id=${toString yubi.id}") - (optional yubi.debug "debug") - ]; text = '' + (let yubi = config.security.pam.yubico; in { name = "yubico"; enable = cfg.yubicoAuth; control = yubi.control; modulePath = "${pkgs.yubico-pam}/lib/security/pam_yubico.so"; settings = { + inherit (yubi) mode debug; + chalresp_path = yubi.challengeResponsePath; + id = mkIf (yubi.mode == "client") yubi.id; + }; text = '' ''; }) (let dp9ik = config.security.pam.dp9ik; in { name = "p9"; enable = dp9ik.enable; control = dp9ik.control; modulePath = "${pkgs.pam_dp9ik}/lib/security/pam_p9.so"; args = [ dp9ik.authserver @@ -688,84 +701,84 @@ let [ { name = "systemd_home-early"; enable = config.services.homed.enable; control = "optional"; modulePath = "${config.systemd.package}/lib/security/pam_systemd_home.so"; text = '' ''; } - { name = "unix-early"; enable = cfg.unixAuth; control = "optional"; modulePath = "pam_unix.so"; args = concatLists [ - (optional cfg.allowNullPassword "nullok") - (optional cfg.nodelay "nodelay") - (singleton "likeauth") - ]; text = '' + { name = "unix-early"; enable = cfg.unixAuth; control = "optional"; modulePath = "pam_unix.so"; settings = { + nullok = cfg.allowNullPassword; + inherit (cfg) nodelay; + likeauth = true; + }; text = '' ''; } - { name = "ecryptfs"; enable = config.security.pam.enableEcryptfs; control = "optional"; modulePath = "${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so"; args = [ - "unwrap" - ]; text = '' + { name = "ecryptfs"; enable = config.security.pam.enableEcryptfs; control = "optional"; modulePath = "${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so"; settings = { + unwrap = true; + }; text = '' ''; } { name = "fscrypt"; enable = config.security.pam.enableFscrypt; control = "optional"; modulePath = "${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so"; text = '' ''; } - { name = "zfs_key"; enable = cfg.zfs; control = "optional"; modulePath = "${config.boot.zfs.package}/lib/security/pam_zfs_key.so"; args = [ - "homes=${config.security.pam.zfs.homes}" - ]; text = '' + { name = "zfs_key"; enable = cfg.zfs; control = "optional"; modulePath = "${config.boot.zfs.package}/lib/security/pam_zfs_key.so"; settings = { + inherit (config.security.pam.zfs) homes; + }; text = '' ''; } - { name = "mount"; enable = cfg.pamMount; control = "optional"; modulePath = "${pkgs.pam_mount}/lib/security/pam_mount.so"; args = [ - "disable_interactive" - ]; text = '' + { name = "mount"; enable = cfg.pamMount; control = "optional"; modulePath = "${pkgs.pam_mount}/lib/security/pam_mount.so"; settings = { + disable_interactive = true; + }; text = '' ''; } - { name = "kwallet5"; enable = cfg.enableKwallet; control = "optional"; modulePath = "${pkgs.plasma5Packages.kwallet-pam}/lib/security/pam_kwallet5.so"; args = [ - "kwalletd=${pkgs.plasma5Packages.kwallet.bin}/bin/kwalletd5" - ]; text = '' + { name = "kwallet5"; enable = cfg.enableKwallet; control = "optional"; modulePath = "${pkgs.plasma5Packages.kwallet-pam}/lib/security/pam_kwallet5.so"; settings = { + kwalletd = "${pkgs.plasma5Packages.kwallet.bin}/bin/kwalletd5"; + }; text = '' ''; } { name = "gnome_keyring"; enable = cfg.enableGnomeKeyring; control = "optional"; modulePath = "${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so"; text = '' ''; } - { name = "gnupg"; enable = cfg.gnupg.enable; control = "optional"; modulePath = "${pkgs.pam_gnupg}/lib/security/pam_gnupg.so"; args = concatLists [ - (optional cfg.gnupg.storeOnly "store-only") - ]; text = '' + { name = "gnupg"; enable = cfg.gnupg.enable; control = "optional"; modulePath = "${pkgs.pam_gnupg}/lib/security/pam_gnupg.so"; settings = { + store-only = cfg.gnupg.storeOnly; + }; text = '' ''; } - { name = "faildelay"; enable = cfg.failDelay.enable; control = "optional"; modulePath = "${pkgs.pam}/lib/security/pam_faildelay.so"; args = [ - "delay=${toString cfg.failDelay.delay}" - ]; text = '' + { name = "faildelay"; enable = cfg.failDelay.enable; control = "optional"; modulePath = "${pkgs.pam}/lib/security/pam_faildelay.so"; settings = { + inherit (cfg.failDelay) delay; + }; text = '' ''; } - { name = "google_authenticator"; enable = cfg.googleAuthenticator.enable; control = "required"; modulePath = "${pkgs.google-authenticator}/lib/security/pam_google_authenticator.so"; args = [ - "no_increment_hotp" - ]; text = '' + { name = "google_authenticator"; enable = cfg.googleAuthenticator.enable; control = "required"; modulePath = "${pkgs.google-authenticator}/lib/security/pam_google_authenticator.so"; settings = { + no_increment_hotp = true; + }; text = '' ''; } { name = "duo"; enable = cfg.duoSecurity.enable; control = "required"; modulePath = "${pkgs.duo-unix}/lib/security/pam_duo.so"; text = '' ''; } ]) ++ [ { name = "systemd_home"; enable = config.services.homed.enable; control = "sufficient"; modulePath = "${config.systemd.package}/lib/security/pam_systemd_home.so"; text = '' ''; } - { name = "unix"; enable = cfg.unixAuth; control = "sufficient"; modulePath = "pam_unix.so"; args = concatLists [ - (optional cfg.allowNullPassword "nullok") - (optional cfg.nodelay "nodelay") - (singleton "likeauth") - (singleton "try_first_pass") - ]; text = '' + { name = "unix"; enable = cfg.unixAuth; control = "sufficient"; modulePath = "pam_unix.so"; settings = { + nullok = cfg.allowNullPassword; + inherit (cfg) nodelay; + likeauth = true; + try_first_pass = true; + }; text = '' ''; } { name = "otpw"; enable = cfg.otpwAuth; control = "sufficient"; modulePath = "${pkgs.otpw}/lib/security/pam_otpw.so"; text = '' ''; } - { name = "ldap"; enable = use_ldap; control = "sufficient"; modulePath = "${pam_ldap}/lib/security/pam_ldap.so"; args = [ - "use_first_pass" - ]; text = '' + { name = "ldap"; enable = use_ldap; control = "sufficient"; modulePath = "${pam_ldap}/lib/security/pam_ldap.so"; settings = { + use_first_pass = true; + }; text = '' ''; } - { name = "kanidm"; enable = config.services.kanidm.enablePam; control = "sufficient"; modulePath = "${pkgs.kanidm}/lib/pam_kanidm.so"; args = [ - "ignore_unknown_user" - "use_first_pass" - ]; text = '' + { name = "kanidm"; enable = config.services.kanidm.enablePam; control = "sufficient"; modulePath = "${pkgs.kanidm}/lib/pam_kanidm.so"; settings = { + ignore_unknown_user = true; + use_first_pass = true; + }; text = '' ''; } - { name = "sss"; enable = config.services.sssd.enable; control = "sufficient"; modulePath = "${pkgs.sssd}/lib/security/pam_sss.so"; args = [ - "use_first_pass" - ]; text = '' + { name = "sss"; enable = config.services.sssd.enable; control = "sufficient"; modulePath = "${pkgs.sssd}/lib/security/pam_sss.so"; settings = { + use_first_pass = true; + }; text = '' ''; } - { name = "krb5"; enable = config.security.pam.krb5.enable; control = "[default=ignore success=1 service_err=reset]"; modulePath = "${pam_krb5}/lib/security/pam_krb5.so"; args = [ - "use_first_pass" - ]; text = '' + { name = "krb5"; enable = config.security.pam.krb5.enable; control = "[default=ignore success=1 service_err=reset]"; modulePath = "${pam_krb5}/lib/security/pam_krb5.so"; settings = { + use_first_pass = true; + }; text = '' ''; } - { name = "ccreds-validate"; enable = config.security.pam.krb5.enable; control = "[default=die success=done]"; modulePath = "${pam_ccreds}/lib/security/pam_ccreds.so"; args = [ - "action=validate" - "use_first_pass" - ]; text = '' + { name = "ccreds-validate"; enable = config.security.pam.krb5.enable; control = "[default=die success=done]"; modulePath = "${pam_ccreds}/lib/security/pam_ccreds.so"; settings = { + action = "validate"; + use_first_pass = true; + }; text = '' ''; } - { name = "ccreds-store"; enable = config.security.pam.krb5.enable; control = "sufficient"; modulePath = "${pam_ccreds}/lib/security/pam_ccreds.so"; args = [ - "action=store" - "use_first_pass" - ]; text = '' + { name = "ccreds-store"; enable = config.security.pam.krb5.enable; control = "sufficient"; modulePath = "${pam_ccreds}/lib/security/pam_ccreds.so"; settings = { + action = "store"; + use_first_pass = true; + }; text = '' ''; } { name = "deny"; control = "required"; modulePath = "pam_deny.so"; text = '' ''; } @@ -774,68 +787,68 @@ let password = [ { name = "systemd_home"; enable = config.services.homed.enable; control = "sufficient"; modulePath = "${config.systemd.package}/lib/security/pam_systemd_home.so"; text = '' ''; } - { name = "unix"; control = "sufficient"; modulePath = "pam_unix.so"; args = [ - "nullok" - "yescrypt" - ]; text = '' + { name = "unix"; control = "sufficient"; modulePath = "pam_unix.so"; settings = { + nullok = true; + yescrypt = true; + }; text = '' ''; } { name = "ecryptfs"; enable = config.security.pam.enableEcryptfs; control = "optional"; modulePath = "${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so"; text = '' ''; } { name = "fscrypt"; enable = config.security.pam.enableFscrypt; control = "optional"; modulePath = "${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so"; text = '' ''; } - { name = "zfs_key"; enable = cfg.zfs; control = "optional"; modulePath = "${config.boot.zfs.package}/lib/security/pam_zfs_key.so"; args = [ - "homes=${config.security.pam.zfs.homes}" - ]; text = '' + { name = "zfs_key"; enable = cfg.zfs; control = "optional"; modulePath = "${config.boot.zfs.package}/lib/security/pam_zfs_key.so"; settings = { + inherit (config.security.pam.zfs) homes; + }; text = '' ''; } { name = "mount"; enable = cfg.pamMount; control = "optional"; modulePath = "${pkgs.pam_mount}/lib/security/pam_mount.so"; text = '' ''; } { name = "ldap"; enable = use_ldap; control = "sufficient"; modulePath = "${pam_ldap}/lib/security/pam_ldap.so"; text = '' ''; } - { name = "mysql"; enable = cfg.mysqlAuth; control = "sufficient"; modulePath = "${pkgs.pam_mysql}/lib/security/pam_mysql.so"; args = [ - "config_file=/etc/security/pam_mysql.conf" - ]; text = '' + { name = "mysql"; enable = cfg.mysqlAuth; control = "sufficient"; modulePath = "${pkgs.pam_mysql}/lib/security/pam_mysql.so"; settings = { + config_file = "/etc/security/pam_mysql.conf"; + }; text = '' ''; } { name = "kanidm"; enable = config.services.kanidm.enablePam; control = "sufficient"; modulePath = "${pkgs.kanidm}/lib/pam_kanidm.so"; text = '' ''; } { name = "sss"; enable = config.services.sssd.enable; control = "sufficient"; modulePath = "${pkgs.sssd}/lib/security/pam_sss.so"; text = '' ''; } - { name = "krb5"; enable = config.security.pam.krb5.enable; control = "sufficient"; modulePath = "${pam_krb5}/lib/security/pam_krb5.so"; args = [ - "use_first_pass" - ]; text = '' + { name = "krb5"; enable = config.security.pam.krb5.enable; control = "sufficient"; modulePath = "${pam_krb5}/lib/security/pam_krb5.so"; settings = { + use_first_pass = true; + }; text = '' ''; } - { name = "gnome_keyring"; enable = cfg.enableGnomeKeyring; control = "optional"; modulePath = "${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so"; args = [ - "use_authtok" - ]; text = '' + { name = "gnome_keyring"; enable = cfg.enableGnomeKeyring; control = "optional"; modulePath = "${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so"; settings = { + use_authtok = true; + }; text = '' ''; } ]; session = [ - { name = "env"; enable = cfg.setEnvironment; control = "required"; modulePath = "pam_env.so"; args = [ - "conffile=/etc/pam/environment" - "readenv=0" - ]; text = '' + { name = "env"; enable = cfg.setEnvironment; control = "required"; modulePath = "pam_env.so"; settings = { + conffile = "/etc/pam/environment"; + readenv = 0; + }; text = '' ''; } { name = "unix"; control = "required"; modulePath = "pam_unix.so"; text = '' ''; } { name = "loginuid"; enable = cfg.setLoginUid; control = if config.boot.isContainer then "optional" else "required"; modulePath = "pam_loginuid.so"; text = '' ''; } - { name = "tty_audit"; enable = cfg.ttyAudit.enable; control = "required"; modulePath = "${pkgs.pam}/lib/security/pam_tty_audit.so"; args = concatLists [ - (optional cfg.ttyAudit.openOnly "open_only") - (optional (cfg.ttyAudit.enablePattern != null) "enable=${cfg.ttyAudit.enablePattern}") - (optional (cfg.ttyAudit.disablePattern != null) "disable=${cfg.ttyAudit.disablePattern}") - ]; text = '' + { name = "tty_audit"; enable = cfg.ttyAudit.enable; control = "required"; modulePath = "${pkgs.pam}/lib/security/pam_tty_audit.so"; settings = { + open_only = cfg.ttyAudit.openOnly; + enable = cfg.ttyAudit.enablePattern; + disable = cfg.ttyAudit.disablePattern; + }; text = '' ''; } { name = "systemd_home"; enable = config.services.homed.enable; control = "required"; modulePath = "${config.systemd.package}/lib/security/pam_systemd_home.so"; text = '' ''; } - { name = "mkhomedir"; enable = cfg.makeHomeDir; control = "required"; modulePath = "${pkgs.pam}/lib/security/pam_mkhomedir.so"; args = [ - "silent" - "skel=${config.security.pam.makeHomeDir.skelDirectory}" - "umask=${config.security.pam.makeHomeDir.umask}" - ]; text = '' + { name = "mkhomedir"; enable = cfg.makeHomeDir; control = "required"; modulePath = "${pkgs.pam}/lib/security/pam_mkhomedir.so"; settings = { + silent = true; + skel = config.security.pam.makeHomeDir.skelDirectory; + inherit (config.security.pam.makeHomeDir) umask; + }; text = '' ''; } - { name = "lastlog"; enable = cfg.updateWtmp; control = "required"; modulePath = "${pkgs.pam}/lib/security/pam_lastlog.so"; args = [ - "silent" - ]; text = '' + { name = "lastlog"; enable = cfg.updateWtmp; control = "required"; modulePath = "${pkgs.pam}/lib/security/pam_lastlog.so"; settings = { + silent = true; + }; text = '' ''; } { name = "ecryptfs"; enable = config.security.pam.enableEcryptfs; control = "optional"; modulePath = "${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so"; text = '' ''; } @@ -853,20 +866,20 @@ let "service" "=" "systemd-user" ]; text = '' ''; } - { name = "zfs_key"; enable = cfg.zfs; control = "optional"; modulePath = "${config.boot.zfs.package}/lib/security/pam_zfs_key.so"; args = concatLists [ - (singleton "homes=${config.security.pam.zfs.homes}") - (optional config.security.pam.zfs.noUnmount "nounmount") - ]; text = '' + { name = "zfs_key"; enable = cfg.zfs; control = "optional"; modulePath = "${config.boot.zfs.package}/lib/security/pam_zfs_key.so"; settings = { + inherit (config.security.pam.zfs) homes; + nounmount = config.security.pam.zfs.noUnmount; + }; text = '' ''; } - { name = "mount"; enable = cfg.pamMount; control = "optional"; modulePath = "${pkgs.pam_mount}/lib/security/pam_mount.so"; args = [ - "disable_interactive" - ]; text = '' + { name = "mount"; enable = cfg.pamMount; control = "optional"; modulePath = "${pkgs.pam_mount}/lib/security/pam_mount.so"; settings = { + disable_interactive = true; + }; text = '' ''; } { name = "ldap"; enable = use_ldap; control = "optional"; modulePath = "${pam_ldap}/lib/security/pam_ldap.so"; text = '' ''; } - { name = "mysql"; enable = cfg.mysqlAuth; control = "optional"; modulePath = "${pkgs.pam_mysql}/lib/security/pam_mysql.so"; args = [ - "config_file=/etc/security/pam_mysql.conf" - ]; text = '' + { name = "mysql"; enable = cfg.mysqlAuth; control = "optional"; modulePath = "${pkgs.pam_mysql}/lib/security/pam_mysql.so"; settings = { + config_file = "/etc/security/pam_mysql.conf"; + }; text = '' ''; } { name = "kanidm"; enable = config.services.kanidm.enablePam; control = "optional"; modulePath = "${pkgs.kanidm}/lib/pam_kanidm.so"; text = '' ''; } @@ -878,35 +891,35 @@ let ''; } { name = "systemd"; enable = cfg.startSession; control = "optional"; modulePath = "${config.systemd.package}/lib/security/pam_systemd.so"; text = '' ''; } - { name = "xauth"; enable = cfg.forwardXAuth; control = "optional"; modulePath = "pam_xauth.so"; args = [ - "xauthpath=${pkgs.xorg.xauth}/bin/xauth" - "systemuser=99" - ]; text = '' + { name = "xauth"; enable = cfg.forwardXAuth; control = "optional"; modulePath = "pam_xauth.so"; settings = { + xauthpath = "${pkgs.xorg.xauth}/bin/xauth"; + systemuser = 99; + }; text = '' ''; } - { name = "limits"; enable = cfg.limits != []; control = "required"; modulePath = "${pkgs.pam}/lib/security/pam_limits.so"; args = [ - "conf=${makeLimitsConf cfg.limits}" - ]; text = '' + { name = "limits"; enable = cfg.limits != []; control = "required"; modulePath = "${pkgs.pam}/lib/security/pam_limits.so"; settings = { + conf = "${makeLimitsConf cfg.limits}"; + }; text = '' ''; } - { name = "motd"; enable = cfg.showMotd && (config.users.motd != null || config.users.motdFile != null); control = "optional"; modulePath = "${pkgs.pam}/lib/security/pam_motd.so"; args = [ - "motd=${motd}" - ]; text = '' + { name = "motd"; enable = cfg.showMotd && (config.users.motd != null || config.users.motdFile != null); control = "optional"; modulePath = "${pkgs.pam}/lib/security/pam_motd.so"; settings = { + inherit motd; + }; text = '' ''; } - { name = "apparmor"; enable = cfg.enableAppArmor && config.security.apparmor.enable; control = "optional"; modulePath = "${pkgs.apparmor-pam}/lib/security/pam_apparmor.so"; args = [ - "order=user,group,default" - "debug" - ]; text = '' + { name = "apparmor"; enable = cfg.enableAppArmor && config.security.apparmor.enable; control = "optional"; modulePath = "${pkgs.apparmor-pam}/lib/security/pam_apparmor.so"; settings = { + order = "user,group,default"; + debug = true; + }; text = '' ''; } - { name = "kwallet5"; enable = cfg.enableKwallet; control = "optional"; modulePath = "${pkgs.plasma5Packages.kwallet-pam}/lib/security/pam_kwallet5.so"; args = [ - "kwalletd=${pkgs.plasma5Packages.kwallet.bin}/bin/kwalletd5" - ]; text = '' + { name = "kwallet5"; enable = cfg.enableKwallet; control = "optional"; modulePath = "${pkgs.plasma5Packages.kwallet-pam}/lib/security/pam_kwallet5.so"; settings = { + kwalletd = "${pkgs.plasma5Packages.kwallet.bin}/bin/kwalletd5"; + }; text = '' ''; } - { name = "gnome_keyring"; enable = cfg.enableGnomeKeyring; control = "optional"; modulePath = "${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so"; args = [ - "auto_start" - ]; text = '' + { name = "gnome_keyring"; enable = cfg.enableGnomeKeyring; control = "optional"; modulePath = "${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so"; settings = { + auto_start = true; + }; text = '' ''; } - { name = "gnupg"; enable = cfg.gnupg.enable; control = "optional"; modulePath = "${pkgs.pam_gnupg}/lib/security/pam_gnupg.so"; args = concatLists [ - (optional cfg.gnupg.noAutostart " no-autostart") - ]; text = '' + { name = "gnupg"; enable = cfg.gnupg.enable; control = "optional"; modulePath = "${pkgs.pam_gnupg}/lib/security/pam_gnupg.so"; settings = { + no-autostart = cfg.gnupg.noAutostart; + }; text = '' ''; } { name = "cgfs"; enable = config.virtualisation.lxc.lxcfs.enable; control = "optional"; modulePath = "${pkgs.lxc}/lib/security/pam_cgfs.so"; args = [ "-c" "all" diff --git a/nixos/tests/pam/pam-u2f.nix b/nixos/tests/pam/pam-u2f.nix index 07408dea797e..46e307a3f125 100644 --- a/nixos/tests/pam/pam-u2f.nix +++ b/nixos/tests/pam/pam-u2f.nix @@ -20,7 +20,7 @@ import ../make-test-python.nix ({ ... }: '' machine.wait_for_unit("multi-user.target") machine.succeed( - 'egrep "auth required .*/lib/security/pam_u2f.so.*debug.*interactive.*cue.*origin=nixos-test" /etc/pam.d/ -R' + 'egrep "auth required .*/lib/security/pam_u2f.so.*cue.*debug.*interactive.*origin=nixos-test" /etc/pam.d/ -R' ) ''; }) From e86487e579271dc5f0d7627a8f7f5a496d133d59 Mon Sep 17 00:00:00 2001 From: Majiir Paktu Date: Sat, 16 Sep 2023 14:33:39 -0400 Subject: [PATCH 13/82] nixos/pam: remove empty text fields --- nixos/modules/security/pam.nix | 262 +++++++++++---------------------- 1 file changed, 85 insertions(+), 177 deletions(-) diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix index 2d79c9142121..8c9e17bd9cf2 100644 --- a/nixos/modules/security/pam.nix +++ b/nixos/modules/security/pam.nix @@ -58,12 +58,6 @@ let Boolean values render just the key if true, and nothing if false. Null values are ignored. All other values are rendered as key-value pairs. ''; }; - text = mkOption { - type = types.str; - description = lib.mdDoc '' - (Obsolete.) - ''; - }; }; config = { # Formats an attrset of settings as args for use as `module-arguments`. @@ -573,7 +567,6 @@ let (map (rule: concatStringsSep " " ( [ type rule.control rule.modulePath ] ++ map formatModuleArgument rule.args - ++ optional (rule.text != "") (removeSuffix "\n" rule.text) ))) (concatStringsSep "\n") ]; @@ -596,88 +589,65 @@ let # module provides the right hooks. rules = { account = [ - { name = "ldap"; enable = use_ldap; control = "sufficient"; modulePath = "${pam_ldap}/lib/security/pam_ldap.so"; text = '' - ''; } + { name = "ldap"; enable = use_ldap; control = "sufficient"; modulePath = "${pam_ldap}/lib/security/pam_ldap.so"; } { name = "mysql"; enable = cfg.mysqlAuth; control = "sufficient"; modulePath = "${pkgs.pam_mysql}/lib/security/pam_mysql.so"; settings = { config_file = "/etc/security/pam_mysql.conf"; - }; text = '' - ''; } + }; } { name = "kanidm"; enable = config.services.kanidm.enablePam; control = "sufficient"; modulePath = "${pkgs.kanidm}/lib/pam_kanidm.so"; settings = { ignore_unknown_user = true; - }; text = '' - ''; } - { name = "sss"; enable = config.services.sssd.enable; control = if cfg.sssdStrictAccess then "[default=bad success=ok user_unknown=ignore]" else "sufficient"; modulePath = "${pkgs.sssd}/lib/security/pam_sss.so"; text = '' - ''; } - { name = "krb5"; enable = config.security.pam.krb5.enable; control = "sufficient"; modulePath = "${pam_krb5}/lib/security/pam_krb5.so"; text = '' - ''; } - { name = "oslogin_login"; enable = cfg.googleOsLoginAccountVerification; control = "[success=ok ignore=ignore default=die]"; modulePath = "${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_login.so"; text = '' - ''; } - { name = "oslogin_admin"; enable = cfg.googleOsLoginAccountVerification; control = "[success=ok default=ignore]"; modulePath = "${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_admin.so"; text = '' - ''; } - { name = "systemd_home"; enable = config.services.homed.enable; control = "sufficient"; modulePath = "${config.systemd.package}/lib/security/pam_systemd_home.so"; text = '' - ''; } + }; } + { name = "sss"; enable = config.services.sssd.enable; control = if cfg.sssdStrictAccess then "[default=bad success=ok user_unknown=ignore]" else "sufficient"; modulePath = "${pkgs.sssd}/lib/security/pam_sss.so"; } + { name = "krb5"; enable = config.security.pam.krb5.enable; control = "sufficient"; modulePath = "${pam_krb5}/lib/security/pam_krb5.so"; } + { name = "oslogin_login"; enable = cfg.googleOsLoginAccountVerification; control = "[success=ok ignore=ignore default=die]"; modulePath = "${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_login.so"; } + { name = "oslogin_admin"; enable = cfg.googleOsLoginAccountVerification; control = "[success=ok default=ignore]"; modulePath = "${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_admin.so"; } + { name = "systemd_home"; enable = config.services.homed.enable; control = "sufficient"; modulePath = "${config.systemd.package}/lib/security/pam_systemd_home.so"; } # The required pam_unix.so module has to come after all the sufficient modules # because otherwise, the account lookup will fail if the user does not exist # locally, for example with MySQL- or LDAP-auth. - { name = "unix"; control = "required"; modulePath = "pam_unix.so"; text = '' - ''; } + { name = "unix"; control = "required"; modulePath = "pam_unix.so"; } ]; auth = [ - { name = "oslogin_login"; enable = cfg.googleOsLoginAuthentication; control = "[success=done perm_denied=die default=ignore]"; modulePath = "${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_login.so"; text = '' - ''; } - { name = "rootok"; enable = cfg.rootOK; control = "sufficient"; modulePath = "pam_rootok.so"; text = '' - ''; } + { name = "oslogin_login"; enable = cfg.googleOsLoginAuthentication; control = "[success=done perm_denied=die default=ignore]"; modulePath = "${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_login.so"; } + { name = "rootok"; enable = cfg.rootOK; control = "sufficient"; modulePath = "pam_rootok.so"; } { name = "wheel"; enable = cfg.requireWheel; control = "required"; modulePath = "pam_wheel.so"; settings = { use_uid = true; - }; text = '' - ''; } - { name = "faillock"; enable = cfg.logFailures; control = "required"; modulePath = "pam_faillock.so"; text = '' - ''; } + }; } + { name = "faillock"; enable = cfg.logFailures; control = "required"; modulePath = "pam_faillock.so"; } { name = "mysql"; enable = cfg.mysqlAuth; control = "sufficient"; modulePath = "${pkgs.pam_mysql}/lib/security/pam_mysql.so"; settings = { config_file = "/etc/security/pam_mysql.conf"; - }; text = '' - ''; } + }; } { name = "ssh_agent_auth"; enable = config.security.pam.enableSSHAgentAuth && cfg.sshAgentAuth; control = "sufficient"; modulePath = "${pkgs.pam_ssh_agent_auth}/libexec/pam_ssh_agent_auth.so"; settings = { file = lib.concatStringsSep ":" config.services.openssh.authorizedKeysFiles; - }; text = '' - ''; } + }; } (let p11 = config.security.pam.p11; in { name = "p11"; enable = cfg.p11Auth; control = p11.control; modulePath = "${pkgs.pam_p11}/lib/security/pam_p11.so"; args = [ "${pkgs.opensc}/lib/opensc-pkcs11.so" - ]; text = '' - ''; }) + ]; }) (let u2f = config.security.pam.u2f; in { name = "u2f"; enable = cfg.u2fAuth; control = u2f.control; modulePath = "${pkgs.pam_u2f}/lib/security/pam_u2f.so"; settings = { inherit (u2f) debug interactive cue origin; authfile = u2f.authFile; appid = u2f.appId; - }; text = ('' - ''); }) - { name = "usb"; enable = cfg.usbAuth; control = "sufficient"; modulePath = "${pkgs.pam_usb}/lib/security/pam_usb.so"; text = '' - ''; } + }; }) + { name = "usb"; enable = cfg.usbAuth; control = "sufficient"; modulePath = "${pkgs.pam_usb}/lib/security/pam_usb.so"; } (let ussh = config.security.pam.ussh; in { name = "ussh"; enable = config.security.pam.ussh.enable && cfg.usshAuth; control = ussh.control; modulePath = "${pkgs.pam_ussh}/lib/security/pam_ussh.so"; settings = { ca_file = ussh.caFile; authorized_principals = ussh.authorizedPrincipals; authorized_principals_file = ussh.authorizedPrincipalsFile; inherit (ussh) group; - }; text = '' - ''; }) + }; }) (let oath = config.security.pam.oath; in { name = "oath"; enable = cfg.oathAuth; control = "requisite"; modulePath = "${pkgs.oath-toolkit}/lib/security/pam_oath.so"; settings = { inherit (oath) window digits; usersfile = oath.usersFile; - }; text = '' - ''; }) + }; }) (let yubi = config.security.pam.yubico; in { name = "yubico"; enable = cfg.yubicoAuth; control = yubi.control; modulePath = "${pkgs.yubico-pam}/lib/security/pam_yubico.so"; settings = { inherit (yubi) mode debug; chalresp_path = yubi.challengeResponsePath; id = mkIf (yubi.mode == "client") yubi.id; - }; text = '' - ''; }) + }; }) (let dp9ik = config.security.pam.dp9ik; in { name = "p9"; enable = dp9ik.enable; control = dp9ik.control; modulePath = "${pkgs.pam_dp9ik}/lib/security/pam_p9.so"; args = [ dp9ik.authserver - ]; text = '' - ''; }) - { name = "fprintd"; enable = cfg.fprintAuth; control = "sufficient"; modulePath = "${pkgs.fprintd}/lib/security/pam_fprintd.so"; text = '' - ''; } + ]; }) + { name = "fprintd"; enable = cfg.fprintAuth; control = "sufficient"; modulePath = "${pkgs.fprintd}/lib/security/pam_fprintd.so"; } ] ++ # Modules in this block require having the password set in PAM_AUTHTOK. # pam_unix is marked as 'sufficient' on NixOS which means nothing will run @@ -699,232 +669,170 @@ let || cfg.duoSecurity.enable || cfg.zfs)) [ - { name = "systemd_home-early"; enable = config.services.homed.enable; control = "optional"; modulePath = "${config.systemd.package}/lib/security/pam_systemd_home.so"; text = '' - ''; } + { name = "systemd_home-early"; enable = config.services.homed.enable; control = "optional"; modulePath = "${config.systemd.package}/lib/security/pam_systemd_home.so"; } { name = "unix-early"; enable = cfg.unixAuth; control = "optional"; modulePath = "pam_unix.so"; settings = { nullok = cfg.allowNullPassword; inherit (cfg) nodelay; likeauth = true; - }; text = '' - ''; } + }; } { name = "ecryptfs"; enable = config.security.pam.enableEcryptfs; control = "optional"; modulePath = "${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so"; settings = { unwrap = true; - }; text = '' - ''; } - { name = "fscrypt"; enable = config.security.pam.enableFscrypt; control = "optional"; modulePath = "${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so"; text = '' - ''; } + }; } + { name = "fscrypt"; enable = config.security.pam.enableFscrypt; control = "optional"; modulePath = "${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so"; } { name = "zfs_key"; enable = cfg.zfs; control = "optional"; modulePath = "${config.boot.zfs.package}/lib/security/pam_zfs_key.so"; settings = { inherit (config.security.pam.zfs) homes; - }; text = '' - ''; } + }; } { name = "mount"; enable = cfg.pamMount; control = "optional"; modulePath = "${pkgs.pam_mount}/lib/security/pam_mount.so"; settings = { disable_interactive = true; - }; text = '' - ''; } + }; } { name = "kwallet5"; enable = cfg.enableKwallet; control = "optional"; modulePath = "${pkgs.plasma5Packages.kwallet-pam}/lib/security/pam_kwallet5.so"; settings = { kwalletd = "${pkgs.plasma5Packages.kwallet.bin}/bin/kwalletd5"; - }; text = '' - ''; } - { name = "gnome_keyring"; enable = cfg.enableGnomeKeyring; control = "optional"; modulePath = "${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so"; text = '' - ''; } + }; } + { name = "gnome_keyring"; enable = cfg.enableGnomeKeyring; control = "optional"; modulePath = "${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so"; } { name = "gnupg"; enable = cfg.gnupg.enable; control = "optional"; modulePath = "${pkgs.pam_gnupg}/lib/security/pam_gnupg.so"; settings = { store-only = cfg.gnupg.storeOnly; - }; text = '' - ''; } + }; } { name = "faildelay"; enable = cfg.failDelay.enable; control = "optional"; modulePath = "${pkgs.pam}/lib/security/pam_faildelay.so"; settings = { inherit (cfg.failDelay) delay; - }; text = '' - ''; } + }; } { name = "google_authenticator"; enable = cfg.googleAuthenticator.enable; control = "required"; modulePath = "${pkgs.google-authenticator}/lib/security/pam_google_authenticator.so"; settings = { no_increment_hotp = true; - }; text = '' - ''; } - { name = "duo"; enable = cfg.duoSecurity.enable; control = "required"; modulePath = "${pkgs.duo-unix}/lib/security/pam_duo.so"; text = '' - ''; } + }; } + { name = "duo"; enable = cfg.duoSecurity.enable; control = "required"; modulePath = "${pkgs.duo-unix}/lib/security/pam_duo.so"; } ]) ++ [ - { name = "systemd_home"; enable = config.services.homed.enable; control = "sufficient"; modulePath = "${config.systemd.package}/lib/security/pam_systemd_home.so"; text = '' - ''; } + { name = "systemd_home"; enable = config.services.homed.enable; control = "sufficient"; modulePath = "${config.systemd.package}/lib/security/pam_systemd_home.so"; } { name = "unix"; enable = cfg.unixAuth; control = "sufficient"; modulePath = "pam_unix.so"; settings = { nullok = cfg.allowNullPassword; inherit (cfg) nodelay; likeauth = true; try_first_pass = true; - }; text = '' - ''; } - { name = "otpw"; enable = cfg.otpwAuth; control = "sufficient"; modulePath = "${pkgs.otpw}/lib/security/pam_otpw.so"; text = '' - ''; } + }; } + { name = "otpw"; enable = cfg.otpwAuth; control = "sufficient"; modulePath = "${pkgs.otpw}/lib/security/pam_otpw.so"; } { name = "ldap"; enable = use_ldap; control = "sufficient"; modulePath = "${pam_ldap}/lib/security/pam_ldap.so"; settings = { use_first_pass = true; - }; text = '' - ''; } + }; } { name = "kanidm"; enable = config.services.kanidm.enablePam; control = "sufficient"; modulePath = "${pkgs.kanidm}/lib/pam_kanidm.so"; settings = { ignore_unknown_user = true; use_first_pass = true; - }; text = '' - ''; } + }; } { name = "sss"; enable = config.services.sssd.enable; control = "sufficient"; modulePath = "${pkgs.sssd}/lib/security/pam_sss.so"; settings = { use_first_pass = true; - }; text = '' - ''; } + }; } { name = "krb5"; enable = config.security.pam.krb5.enable; control = "[default=ignore success=1 service_err=reset]"; modulePath = "${pam_krb5}/lib/security/pam_krb5.so"; settings = { use_first_pass = true; - }; text = '' - ''; } + }; } { name = "ccreds-validate"; enable = config.security.pam.krb5.enable; control = "[default=die success=done]"; modulePath = "${pam_ccreds}/lib/security/pam_ccreds.so"; settings = { action = "validate"; use_first_pass = true; - }; text = '' - ''; } + }; } { name = "ccreds-store"; enable = config.security.pam.krb5.enable; control = "sufficient"; modulePath = "${pam_ccreds}/lib/security/pam_ccreds.so"; settings = { action = "store"; use_first_pass = true; - }; text = '' - ''; } - { name = "deny"; control = "required"; modulePath = "pam_deny.so"; text = '' - ''; } + }; } + { name = "deny"; control = "required"; modulePath = "pam_deny.so"; } ]; password = [ - { name = "systemd_home"; enable = config.services.homed.enable; control = "sufficient"; modulePath = "${config.systemd.package}/lib/security/pam_systemd_home.so"; text = '' - ''; } + { name = "systemd_home"; enable = config.services.homed.enable; control = "sufficient"; modulePath = "${config.systemd.package}/lib/security/pam_systemd_home.so"; } { name = "unix"; control = "sufficient"; modulePath = "pam_unix.so"; settings = { nullok = true; yescrypt = true; - }; text = '' - ''; } - { name = "ecryptfs"; enable = config.security.pam.enableEcryptfs; control = "optional"; modulePath = "${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so"; text = '' - ''; } - { name = "fscrypt"; enable = config.security.pam.enableFscrypt; control = "optional"; modulePath = "${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so"; text = '' - ''; } + }; } + { name = "ecryptfs"; enable = config.security.pam.enableEcryptfs; control = "optional"; modulePath = "${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so"; } + { name = "fscrypt"; enable = config.security.pam.enableFscrypt; control = "optional"; modulePath = "${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so"; } { name = "zfs_key"; enable = cfg.zfs; control = "optional"; modulePath = "${config.boot.zfs.package}/lib/security/pam_zfs_key.so"; settings = { inherit (config.security.pam.zfs) homes; - }; text = '' - ''; } - { name = "mount"; enable = cfg.pamMount; control = "optional"; modulePath = "${pkgs.pam_mount}/lib/security/pam_mount.so"; text = '' - ''; } - { name = "ldap"; enable = use_ldap; control = "sufficient"; modulePath = "${pam_ldap}/lib/security/pam_ldap.so"; text = '' - ''; } + }; } + { name = "mount"; enable = cfg.pamMount; control = "optional"; modulePath = "${pkgs.pam_mount}/lib/security/pam_mount.so"; } + { name = "ldap"; enable = use_ldap; control = "sufficient"; modulePath = "${pam_ldap}/lib/security/pam_ldap.so"; } { name = "mysql"; enable = cfg.mysqlAuth; control = "sufficient"; modulePath = "${pkgs.pam_mysql}/lib/security/pam_mysql.so"; settings = { config_file = "/etc/security/pam_mysql.conf"; - }; text = '' - ''; } - { name = "kanidm"; enable = config.services.kanidm.enablePam; control = "sufficient"; modulePath = "${pkgs.kanidm}/lib/pam_kanidm.so"; text = '' - ''; } - { name = "sss"; enable = config.services.sssd.enable; control = "sufficient"; modulePath = "${pkgs.sssd}/lib/security/pam_sss.so"; text = '' - ''; } + }; } + { name = "kanidm"; enable = config.services.kanidm.enablePam; control = "sufficient"; modulePath = "${pkgs.kanidm}/lib/pam_kanidm.so"; } + { name = "sss"; enable = config.services.sssd.enable; control = "sufficient"; modulePath = "${pkgs.sssd}/lib/security/pam_sss.so"; } { name = "krb5"; enable = config.security.pam.krb5.enable; control = "sufficient"; modulePath = "${pam_krb5}/lib/security/pam_krb5.so"; settings = { use_first_pass = true; - }; text = '' - ''; } + }; } { name = "gnome_keyring"; enable = cfg.enableGnomeKeyring; control = "optional"; modulePath = "${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so"; settings = { use_authtok = true; - }; text = '' - ''; } + }; } ]; session = [ { name = "env"; enable = cfg.setEnvironment; control = "required"; modulePath = "pam_env.so"; settings = { conffile = "/etc/pam/environment"; readenv = 0; - }; text = '' - ''; } - { name = "unix"; control = "required"; modulePath = "pam_unix.so"; text = '' - ''; } - { name = "loginuid"; enable = cfg.setLoginUid; control = if config.boot.isContainer then "optional" else "required"; modulePath = "pam_loginuid.so"; text = '' - ''; } + }; } + { name = "unix"; control = "required"; modulePath = "pam_unix.so"; } + { name = "loginuid"; enable = cfg.setLoginUid; control = if config.boot.isContainer then "optional" else "required"; modulePath = "pam_loginuid.so"; } { name = "tty_audit"; enable = cfg.ttyAudit.enable; control = "required"; modulePath = "${pkgs.pam}/lib/security/pam_tty_audit.so"; settings = { open_only = cfg.ttyAudit.openOnly; enable = cfg.ttyAudit.enablePattern; disable = cfg.ttyAudit.disablePattern; - }; text = '' - ''; } - { name = "systemd_home"; enable = config.services.homed.enable; control = "required"; modulePath = "${config.systemd.package}/lib/security/pam_systemd_home.so"; text = '' - ''; } + }; } + { name = "systemd_home"; enable = config.services.homed.enable; control = "required"; modulePath = "${config.systemd.package}/lib/security/pam_systemd_home.so"; } { name = "mkhomedir"; enable = cfg.makeHomeDir; control = "required"; modulePath = "${pkgs.pam}/lib/security/pam_mkhomedir.so"; settings = { silent = true; skel = config.security.pam.makeHomeDir.skelDirectory; inherit (config.security.pam.makeHomeDir) umask; - }; text = '' - ''; } + }; } { name = "lastlog"; enable = cfg.updateWtmp; control = "required"; modulePath = "${pkgs.pam}/lib/security/pam_lastlog.so"; settings = { silent = true; - }; text = '' - ''; } - { name = "ecryptfs"; enable = config.security.pam.enableEcryptfs; control = "optional"; modulePath = "${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so"; text = '' - ''; } + }; } + { name = "ecryptfs"; enable = config.security.pam.enableEcryptfs; control = "optional"; modulePath = "${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so"; } # Work around https://github.com/systemd/systemd/issues/8598 # Skips the pam_fscrypt module for systemd-user sessions which do not have a password # anyways. # See also https://github.com/google/fscrypt/issues/95 { name = "fscrypt-skip-systemd"; enable = config.security.pam.enableFscrypt; control = "[success=1 default=ignore]"; modulePath = "pam_succeed_if.so"; args = [ "service" "=" "systemd-user" - ]; text = '' - ''; } - { name = "fscrypt"; enable = config.security.pam.enableFscrypt; control = "optional"; modulePath = "${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so"; text = '' - ''; } + ]; } + { name = "fscrypt"; enable = config.security.pam.enableFscrypt; control = "optional"; modulePath = "${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so"; } { name = "zfs_key-skip-systemd"; enable = cfg.zfs; control = "[success=1 default=ignore]"; modulePath = "pam_succeed_if.so"; args = [ "service" "=" "systemd-user" - ]; text = '' - ''; } + ]; } { name = "zfs_key"; enable = cfg.zfs; control = "optional"; modulePath = "${config.boot.zfs.package}/lib/security/pam_zfs_key.so"; settings = { inherit (config.security.pam.zfs) homes; nounmount = config.security.pam.zfs.noUnmount; - }; text = '' - ''; } + }; } { name = "mount"; enable = cfg.pamMount; control = "optional"; modulePath = "${pkgs.pam_mount}/lib/security/pam_mount.so"; settings = { disable_interactive = true; - }; text = '' - ''; } - { name = "ldap"; enable = use_ldap; control = "optional"; modulePath = "${pam_ldap}/lib/security/pam_ldap.so"; text = '' - ''; } + }; } + { name = "ldap"; enable = use_ldap; control = "optional"; modulePath = "${pam_ldap}/lib/security/pam_ldap.so"; } { name = "mysql"; enable = cfg.mysqlAuth; control = "optional"; modulePath = "${pkgs.pam_mysql}/lib/security/pam_mysql.so"; settings = { config_file = "/etc/security/pam_mysql.conf"; - }; text = '' - ''; } - { name = "kanidm"; enable = config.services.kanidm.enablePam; control = "optional"; modulePath = "${pkgs.kanidm}/lib/pam_kanidm.so"; text = '' - ''; } - { name = "sss"; enable = config.services.sssd.enable; control = "optional"; modulePath = "${pkgs.sssd}/lib/security/pam_sss.so"; text = '' - ''; } - { name = "krb5"; enable = config.security.pam.krb5.enable; control = "optional"; modulePath = "${pam_krb5}/lib/security/pam_krb5.so"; text = '' - ''; } - { name = "otpw"; enable = cfg.otpwAuth; control = "optional"; modulePath = "${pkgs.otpw}/lib/security/pam_otpw.so"; text = '' - ''; } - { name = "systemd"; enable = cfg.startSession; control = "optional"; modulePath = "${config.systemd.package}/lib/security/pam_systemd.so"; text = '' - ''; } + }; } + { name = "kanidm"; enable = config.services.kanidm.enablePam; control = "optional"; modulePath = "${pkgs.kanidm}/lib/pam_kanidm.so"; } + { name = "sss"; enable = config.services.sssd.enable; control = "optional"; modulePath = "${pkgs.sssd}/lib/security/pam_sss.so"; } + { name = "krb5"; enable = config.security.pam.krb5.enable; control = "optional"; modulePath = "${pam_krb5}/lib/security/pam_krb5.so"; } + { name = "otpw"; enable = cfg.otpwAuth; control = "optional"; modulePath = "${pkgs.otpw}/lib/security/pam_otpw.so"; } + { name = "systemd"; enable = cfg.startSession; control = "optional"; modulePath = "${config.systemd.package}/lib/security/pam_systemd.so"; } { name = "xauth"; enable = cfg.forwardXAuth; control = "optional"; modulePath = "pam_xauth.so"; settings = { xauthpath = "${pkgs.xorg.xauth}/bin/xauth"; systemuser = 99; - }; text = '' - ''; } + }; } { name = "limits"; enable = cfg.limits != []; control = "required"; modulePath = "${pkgs.pam}/lib/security/pam_limits.so"; settings = { conf = "${makeLimitsConf cfg.limits}"; - }; text = '' - ''; } + }; } { name = "motd"; enable = cfg.showMotd && (config.users.motd != null || config.users.motdFile != null); control = "optional"; modulePath = "${pkgs.pam}/lib/security/pam_motd.so"; settings = { inherit motd; - }; text = '' - ''; } + }; } { name = "apparmor"; enable = cfg.enableAppArmor && config.security.apparmor.enable; control = "optional"; modulePath = "${pkgs.apparmor-pam}/lib/security/pam_apparmor.so"; settings = { order = "user,group,default"; debug = true; - }; text = '' - ''; } + }; } { name = "kwallet5"; enable = cfg.enableKwallet; control = "optional"; modulePath = "${pkgs.plasma5Packages.kwallet-pam}/lib/security/pam_kwallet5.so"; settings = { kwalletd = "${pkgs.plasma5Packages.kwallet.bin}/bin/kwalletd5"; - }; text = '' - ''; } + }; } { name = "gnome_keyring"; enable = cfg.enableGnomeKeyring; control = "optional"; modulePath = "${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so"; settings = { auto_start = true; - }; text = '' - ''; } + }; } { name = "gnupg"; enable = cfg.gnupg.enable; control = "optional"; modulePath = "${pkgs.pam_gnupg}/lib/security/pam_gnupg.so"; settings = { no-autostart = cfg.gnupg.noAutostart; - }; text = '' - ''; } + }; } { name = "cgfs"; enable = config.virtualisation.lxc.lxcfs.enable; control = "optional"; modulePath = "${pkgs.lxc}/lib/security/pam_cgfs.so"; args = [ "-c" "all" - ]; text = '' - ''; } + ]; } ]; }; }; From 077cdcc7e9a9ed406860e97ce3590fba15aed18b Mon Sep 17 00:00:00 2001 From: Majiir Paktu Date: Sat, 16 Sep 2023 15:29:11 -0400 Subject: [PATCH 14/82] nixos/pam: convert rules to attrs, add order field Makes it possible to override properties of a rule by name. Introduces an 'order' field that can be overridden to change the sequence of rules. For now, the order value for each built-in rule is derived from its place in the hardcoded list of rules. --- nixos/modules/security/pam.nix | 50 +++++++++++++++++++++++++++++----- 1 file changed, 43 insertions(+), 7 deletions(-) diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix index 8c9e17bd9cf2..b7a5d7131b57 100644 --- a/nixos/modules/security/pam.nix +++ b/nixos/modules/security/pam.nix @@ -11,14 +11,18 @@ let # These options are experimental and subject to breaking changes without notice. description = lib.mdDoc '' PAM `${type}` rules for this service. + + Attribute keys are the name of each rule. ''; - type = types.listOf (types.submodule ({ config, ... }: { + type = types.attrsOf (types.submodule ({ name, config, ... }: { options = { name = mkOption { type = types.str; description = lib.mdDoc '' Name of this rule. ''; + internal = true; + readOnly = true; }; enable = mkOption { type = types.bool; @@ -27,6 +31,23 @@ let Whether this rule is added to the PAM service config file. ''; }; + order = mkOption { + type = types.int; + description = lib.mdDoc '' + Order of this rule in the service file. Rules are arranged in ascending order of this value. + + ::: {.warning} + The `order` values for the built-in rules are subject to change. If you assign a constant value to this option, a system update could silently reorder your rule. You could be locked out of your system, or your system could be left wide open. When using this option, set it to a relative offset from another rule's `order` value: + + ```nix + { + security.pam.services.login.rules.auth.foo.order = + config.security.pam.services.login.rules.auth.unix.order + 10; + } + ``` + ::: + ''; + }; control = mkOption { type = types.str; description = lib.mdDoc '' @@ -60,6 +81,7 @@ let }; }; config = { + inherit name; # Formats an attrset of settings as args for use as `module-arguments`. args = concatLists (flip mapAttrsToList config.settings (name: value: if isBool value @@ -557,13 +579,21 @@ let limits = mkDefault config.security.pam.loginLimits; text = let + ensureUniqueOrder = type: rules: + let + checkPair = a: b: assert assertMsg (a.order != b.order) "security.pam.services.${name}.rules.${type}: rules '${a.name}' and '${b.name}' cannot have the same order value (${toString a.order})"; b; + checked = zipListsWith checkPair rules (drop 1 rules); + in take 1 rules ++ checked; # Formats a string for use in `module-arguments`. See `man pam.conf`. formatModuleArgument = token: if hasInfix " " token then "[${replaceStrings ["]"] ["\\]"] token}]" else token; formatRules = type: pipe cfg.rules.${type} [ + attrValues (filter (rule: rule.enable)) + (sort (a: b: a.order < b.order)) + (ensureUniqueOrder type) (map (rule: concatStringsSep " " ( [ type rule.control rule.modulePath ] ++ map formatModuleArgument rule.args @@ -587,8 +617,14 @@ let # !!! TODO: move the LDAP stuff to the LDAP module, and the # Samba stuff to the Samba module. This requires that the PAM # module provides the right hooks. - rules = { - account = [ + rules = let + autoOrderRules = flip pipe [ + (imap1 (index: rule: rule // { order = mkDefault (10000 + index * 100); } )) + (map (rule: nameValuePair rule.name (removeAttrs rule [ "name" ]))) + listToAttrs + ]; + in { + account = autoOrderRules [ { name = "ldap"; enable = use_ldap; control = "sufficient"; modulePath = "${pam_ldap}/lib/security/pam_ldap.so"; } { name = "mysql"; enable = cfg.mysqlAuth; control = "sufficient"; modulePath = "${pkgs.pam_mysql}/lib/security/pam_mysql.so"; settings = { config_file = "/etc/security/pam_mysql.conf"; @@ -607,7 +643,7 @@ let { name = "unix"; control = "required"; modulePath = "pam_unix.so"; } ]; - auth = [ + auth = autoOrderRules ([ { name = "oslogin_login"; enable = cfg.googleOsLoginAuthentication; control = "[success=done perm_denied=die default=ignore]"; modulePath = "${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_login.so"; } { name = "rootok"; enable = cfg.rootOK; control = "sufficient"; modulePath = "pam_rootok.so"; } { name = "wheel"; enable = cfg.requireWheel; control = "required"; modulePath = "pam_wheel.so"; settings = { @@ -730,9 +766,9 @@ let use_first_pass = true; }; } { name = "deny"; control = "required"; modulePath = "pam_deny.so"; } - ]; + ]); - password = [ + password = autoOrderRules [ { name = "systemd_home"; enable = config.services.homed.enable; control = "sufficient"; modulePath = "${config.systemd.package}/lib/security/pam_systemd_home.so"; } { name = "unix"; control = "sufficient"; modulePath = "pam_unix.so"; settings = { nullok = true; @@ -758,7 +794,7 @@ let }; } ]; - session = [ + session = autoOrderRules [ { name = "env"; enable = cfg.setEnvironment; control = "required"; modulePath = "pam_env.so"; settings = { conffile = "/etc/pam/environment"; readenv = 0; From 43f7cb4a95436d58a0fe40ff501d42085d676691 Mon Sep 17 00:00:00 2001 From: Majiir Paktu Date: Mon, 9 Oct 2023 22:54:22 -0400 Subject: [PATCH 15/82] nixos/pam: add order comment to each rule line --- nixos/modules/security/pam.nix | 1 + nixos/tests/pam/test_chfn.py | 7 ++++--- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix index b7a5d7131b57..242ce52bfb5b 100644 --- a/nixos/modules/security/pam.nix +++ b/nixos/modules/security/pam.nix @@ -597,6 +597,7 @@ let (map (rule: concatStringsSep " " ( [ type rule.control rule.modulePath ] ++ map formatModuleArgument rule.args + ++ [ "# ${rule.name} (order ${toString rule.order})" ] ))) (concatStringsSep "\n") ]; diff --git a/nixos/tests/pam/test_chfn.py b/nixos/tests/pam/test_chfn.py index 4fd33447a543..3cfbb3908e9d 100644 --- a/nixos/tests/pam/test_chfn.py +++ b/nixos/tests/pam/test_chfn.py @@ -15,9 +15,10 @@ expected_lines = { } actual_lines = set(machine.succeed("cat /etc/pam.d/chfn").splitlines()) -missing_lines = expected_lines - actual_lines -extra_lines = actual_lines - expected_lines -non_functional_lines = set([line for line in extra_lines if (line == "" or line.startswith("#"))]) +stripped_lines = set([line.split("#")[0].rstrip() for line in actual_lines]) +missing_lines = expected_lines - stripped_lines +extra_lines = stripped_lines - expected_lines +non_functional_lines = set([line for line in extra_lines if line == ""]) unexpected_functional_lines = extra_lines - non_functional_lines with subtest("All expected lines are in the file"): From e712b6e81d2e07ca33dce83d6270b3ab3cba0f90 Mon Sep 17 00:00:00 2001 From: Majiir Paktu Date: Wed, 20 Sep 2023 23:44:56 -0400 Subject: [PATCH 16/82] nixos/pam: generate apparmor includes from rules Removes redundant config from the module. Fixes a bug where some modules (e.g. ussh) were added to apparmor even though they had no rules enabled. --- nixos/modules/security/pam.nix | 98 +++++----------------------------- 1 file changed, 13 insertions(+), 85 deletions(-) diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix index 242ce52bfb5b..bd6ab5856fcf 100644 --- a/nixos/modules/security/pam.nix +++ b/nixos/modules/security/pam.nix @@ -1508,9 +1508,7 @@ in fscrypt = {}; }; - security.apparmor.includes."abstractions/pam" = let - isEnabled = test: fold or false (map test (attrValues config.security.pam.services)); - in + security.apparmor.includes."abstractions/pam" = lib.concatMapStrings (name: "r ${config.environment.etc."pam.d/${name}".source},\n") (attrNames config.security.pam.services) + @@ -1519,88 +1517,18 @@ in mr ${getLib pkgs.pam}/lib/security/pam_*.so, r ${getLib pkgs.pam}/lib/security/, '' + - optionalString use_ldap '' - mr ${pam_ldap}/lib/security/pam_ldap.so, - '' + - optionalString config.services.kanidm.enablePam '' - mr ${pkgs.kanidm}/lib/pam_kanidm.so, - '' + - optionalString config.services.sssd.enable '' - mr ${pkgs.sssd}/lib/security/pam_sss.so, - '' + - optionalString config.security.pam.krb5.enable '' - mr ${pam_krb5}/lib/security/pam_krb5.so, - mr ${pam_ccreds}/lib/security/pam_ccreds.so, - '' + - optionalString (isEnabled (cfg: cfg.googleOsLoginAccountVerification)) '' - mr ${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_login.so, - mr ${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_admin.so, - '' + - optionalString (isEnabled (cfg: cfg.googleOsLoginAuthentication)) '' - mr ${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_login.so, - '' + - optionalString (config.security.pam.enableSSHAgentAuth - && isEnabled (cfg: cfg.sshAgentAuth)) '' - mr ${pkgs.pam_ssh_agent_auth}/libexec/pam_ssh_agent_auth.so, - '' + - optionalString (isEnabled (cfg: cfg.fprintAuth)) '' - mr ${pkgs.fprintd}/lib/security/pam_fprintd.so, - '' + - optionalString (isEnabled (cfg: cfg.u2fAuth)) '' - mr ${pkgs.pam_u2f}/lib/security/pam_u2f.so, - '' + - optionalString (isEnabled (cfg: cfg.usbAuth)) '' - mr ${pkgs.pam_usb}/lib/security/pam_usb.so, - '' + - optionalString (isEnabled (cfg: cfg.usshAuth)) '' - mr ${pkgs.pam_ussh}/lib/security/pam_ussh.so, - '' + - optionalString (isEnabled (cfg: cfg.oathAuth)) '' - "mr ${pkgs.oath-toolkit}/lib/security/pam_oath.so, - '' + - optionalString (isEnabled (cfg: cfg.mysqlAuth)) '' - mr ${pkgs.pam_mysql}/lib/security/pam_mysql.so, - '' + - optionalString (isEnabled (cfg: cfg.yubicoAuth)) '' - mr ${pkgs.yubico-pam}/lib/security/pam_yubico.so, - '' + - optionalString (isEnabled (cfg: cfg.duoSecurity.enable)) '' - mr ${pkgs.duo-unix}/lib/security/pam_duo.so, - '' + - optionalString (isEnabled (cfg: cfg.otpwAuth)) '' - mr ${pkgs.otpw}/lib/security/pam_otpw.so, - '' + - optionalString config.security.pam.enableEcryptfs '' - mr ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so, - '' + - optionalString config.security.pam.enableFscrypt '' - mr ${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so, - '' + - optionalString (isEnabled (cfg: cfg.pamMount)) '' - mr ${pkgs.pam_mount}/lib/security/pam_mount.so, - '' + - optionalString (isEnabled (cfg: cfg.enableGnomeKeyring)) '' - mr ${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so, - '' + - optionalString (isEnabled (cfg: cfg.startSession)) '' - mr ${config.systemd.package}/lib/security/pam_systemd.so, - '' + - optionalString (isEnabled (cfg: cfg.enableAppArmor) - && config.security.apparmor.enable) '' - mr ${pkgs.apparmor-pam}/lib/security/pam_apparmor.so, - '' + - optionalString (isEnabled (cfg: cfg.enableKwallet)) '' - mr ${pkgs.plasma5Packages.kwallet-pam}/lib/security/pam_kwallet5.so, - '' + - optionalString config.virtualisation.lxc.lxcfs.enable '' - mr ${pkgs.lxc}/lib/security/pam_cgfs.so, - '' + - optionalString (isEnabled (cfg: cfg.zfs)) '' - mr ${config.boot.zfs.package}/lib/security/pam_zfs_key.so, - '' + - optionalString config.services.homed.enable '' - mr ${config.systemd.package}/lib/security/pam_systemd_home.so - ''; + (with lib; pipe config.security.pam.services [ + attrValues + (catAttrs "rules") + (concatMap attrValues) + (concatMap attrValues) + (filter (rule: rule.enable)) + (catAttrs "modulePath") + (filter (hasPrefix "/")) + unique + (map (module: "mr ${module},")) + concatLines + ]); }; } From 9d6e6e18bccb8e4dbcc5d68263cdcac16ce51973 Mon Sep 17 00:00:00 2001 From: Majiir Paktu Date: Sun, 24 Sep 2023 21:50:20 -0400 Subject: [PATCH 17/82] nixos/pam: add maintainer --- nixos/modules/security/pam.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix index bd6ab5856fcf..709bb8b94a65 100644 --- a/nixos/modules/security/pam.nix +++ b/nixos/modules/security/pam.nix @@ -947,6 +947,8 @@ in { + meta.maintainers = [ maintainers.majiir ]; + imports = [ (mkRenamedOptionModule [ "security" "pam" "enableU2F" ] [ "security" "pam" "u2f" "enable" ]) ]; From fd7daf9fc47e21bc5eaa7793fb23e0b647558e45 Mon Sep 17 00:00:00 2001 From: Donovan Glover Date: Thu, 3 Aug 2023 12:27:59 -0400 Subject: [PATCH 18/82] nixos/nixos-containers: add restartIfChanged option This commit makes auto-restarting declarative containers optional. This is useful when you don't want changes to your config to automatically restart the container and thus stop any applications running inside it. --- nixos/modules/virtualisation/nixos-containers.nix | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/nixos/modules/virtualisation/nixos-containers.nix b/nixos/modules/virtualisation/nixos-containers.nix index 5df9942dbc04..aa85665af695 100644 --- a/nixos/modules/virtualisation/nixos-containers.nix +++ b/nixos/modules/virtualisation/nixos-containers.nix @@ -649,6 +649,15 @@ in ''; }; + restartIfChanged = mkOption { + type = types.bool; + default = true; + description = lib.mdDoc '' + Whether the container should be restarted during a NixOS + configuration switch if its definition has changed. + ''; + }; + timeoutStartSec = mkOption { type = types.str; default = "1min"; @@ -826,7 +835,7 @@ in containerConfig.path config.environment.etc."${configurationDirectoryName}/${name}.conf".source ]; - restartIfChanged = true; + restartIfChanged = containerConfig.restartIfChanged; } ) )) config.containers) From 190ea7b09e4f24af8b8105cdf3a8e67d5b6828c0 Mon Sep 17 00:00:00 2001 From: chayleaf Date: Fri, 13 Oct 2023 04:24:16 +0700 Subject: [PATCH 19/82] keepassxc: add firefox native messaging host file When using a Firefox fork, upstream package relies on you entering the browser user config path manually and writes the native messaging host file to that path. It should be much more convenient to manage it in Nix. --- pkgs/applications/misc/keepassxc/default.nix | 6 ++++++ .../misc/keepassxc/firefox-native-messaging-host.json | 9 +++++++++ .../applications/networking/browsers/firefox/wrapper.nix | 2 ++ 3 files changed, 17 insertions(+) create mode 100644 pkgs/applications/misc/keepassxc/firefox-native-messaging-host.json diff --git a/pkgs/applications/misc/keepassxc/default.nix b/pkgs/applications/misc/keepassxc/default.nix index 762434ef12c1..49406fc0114b 100644 --- a/pkgs/applications/misc/keepassxc/default.nix +++ b/pkgs/applications/misc/keepassxc/default.nix @@ -97,6 +97,12 @@ stdenv.mkDerivation rec { wrapQtApp "$out/Applications/KeePassXC.app/Contents/MacOS/KeePassXC" ''; + # See https://github.com/keepassxreboot/keepassxc/blob/cd7a53abbbb81e468efb33eb56eefc12739969b8/src/browser/NativeMessageInstaller.cpp#L317 + postInstall = lib.optionalString withKeePassBrowser '' + mkdir -p "$out/lib/mozilla/native-messaging-hosts" + substituteAll "${./firefox-native-messaging-host.json}" "$out/lib/mozilla/native-messaging-hosts/org.keepassxc.keepassxc_browser.json" + ''; + buildInputs = [ curl botan2 diff --git a/pkgs/applications/misc/keepassxc/firefox-native-messaging-host.json b/pkgs/applications/misc/keepassxc/firefox-native-messaging-host.json new file mode 100644 index 000000000000..70f1b26041f3 --- /dev/null +++ b/pkgs/applications/misc/keepassxc/firefox-native-messaging-host.json @@ -0,0 +1,9 @@ +{ + "name": "org.keepassxc.keepassxc_browser", + "description": "KeePassXC integration with native messaging support", + "path": "@out@/bin/keepassxc-proxy", + "type": "stdio", + "allowed_extensions": [ + "keepassxc-browser@keepassxc.org" + ] +} diff --git a/pkgs/applications/networking/browsers/firefox/wrapper.nix b/pkgs/applications/networking/browsers/firefox/wrapper.nix index 6561e51d7d95..28e97bcaa41e 100644 --- a/pkgs/applications/networking/browsers/firefox/wrapper.nix +++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix @@ -8,6 +8,7 @@ , browserpass, gnome-browser-connector, uget-integrator, plasma5Packages, bukubrow, pipewire , tridactyl-native , fx-cast-bridge +, keepassxc , udev , libkrb5 , libva @@ -70,6 +71,7 @@ let ++ lib.optional (cfg.enableUgetIntegrator or false) uget-integrator ++ lib.optional (cfg.enablePlasmaBrowserIntegration or false) plasma5Packages.plasma-browser-integration ++ lib.optional (cfg.enableFXCastBridge or false) fx-cast-bridge + ++ lib.optional (cfg.enableKeePassXC or false) keepassxc ++ extraNativeMessagingHosts ; libs = lib.optionals stdenv.isLinux [ udev libva mesa libnotify xorg.libXScrnSaver cups pciutils ] From 498ce1646cfefb8143221399d1f0e686cc43d256 Mon Sep 17 00:00:00 2001 From: Mario Rodas Date: Sun, 15 Oct 2023 04:20:00 +0000 Subject: [PATCH 20/82] ytarchive: unstable-2023-02-21 -> 0.4.0 --- pkgs/tools/misc/ytarchive/default.nix | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/tools/misc/ytarchive/default.nix b/pkgs/tools/misc/ytarchive/default.nix index 67698c4fdc6b..8cd082746447 100644 --- a/pkgs/tools/misc/ytarchive/default.nix +++ b/pkgs/tools/misc/ytarchive/default.nix @@ -1,14 +1,14 @@ -{ lib, buildGoModule, fetchFromGitHub, makeBinaryWrapper, ffmpeg }: +{ lib, buildGoModule, fetchFromGitHub, makeBinaryWrapper, ffmpeg-headless }: buildGoModule rec { pname = "ytarchive"; - version = "unstable-2023-02-21"; + version = "0.4.0"; src = fetchFromGitHub { owner = "Kethsar"; repo = "ytarchive"; - rev = "90aaf17b5e86eec52a95752e3c2dba4f54ee1068"; - hash = "sha256-JRjQRbMqtd04/aO6NkInoDqfOrHnDrXj4C4/URiU6yo="; + rev = "v${version}"; + hash = "sha256-mQgpwuTIEHeDv/PzBHpK1sraxFj8Ef3y8vN5bLw5E94="; }; vendorHash = "sha256-sjwQ/zEYJRkeWUDB7TzV8z+kET8lVRnQkXYbZbcUeHY="; @@ -18,7 +18,7 @@ buildGoModule rec { ldflags = [ "-s" "-w" "-X main.Commit=-${src.rev}" ]; postInstall = '' - wrapProgram $out/bin/ytarchive --prefix PATH : ${lib.makeBinPath [ ffmpeg ]} + wrapProgram $out/bin/ytarchive --prefix PATH : ${lib.makeBinPath [ ffmpeg-headless ]} ''; meta = with lib; { From 0cc1e61d8736c508bf24ef4eb44c33d566b7d1ea Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 15 Oct 2023 16:07:09 +0000 Subject: [PATCH 21/82] python310Packages.pytensor: 2.17.1 -> 2.17.2 --- pkgs/development/python-modules/pytensor/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/pytensor/default.nix b/pkgs/development/python-modules/pytensor/default.nix index b3472f306ebb..dcb41604102f 100644 --- a/pkgs/development/python-modules/pytensor/default.nix +++ b/pkgs/development/python-modules/pytensor/default.nix @@ -26,7 +26,7 @@ buildPythonPackage rec { pname = "pytensor"; - version = "2.17.1"; + version = "2.17.2"; pyproject = true; disabled = pythonOlder "3.9"; @@ -35,7 +35,7 @@ buildPythonPackage rec { owner = "pymc-devs"; repo = "pytensor"; rev = "refs/tags/rel-${version}"; - hash = "sha256-xXS0uNR5rlmUjt9/TW/X/pQc5MS/MwHSQGCp7BkAVYg="; + hash = "sha256-u1CbOjU3rQ6G3SSwYR3UlebymkupGMJWID4RH4v9PIk="; }; postPatch = '' From e510b3b282439baced07e84614d9fca9a120f66a Mon Sep 17 00:00:00 2001 From: Tobias Mayer Date: Sun, 8 Oct 2023 15:06:12 +0200 Subject: [PATCH 22/82] lynx: 2.8.9 -> 2.9.0dev.12 --- .../networking/browsers/lynx/default.nix | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-) diff --git a/pkgs/applications/networking/browsers/lynx/default.nix b/pkgs/applications/networking/browsers/lynx/default.nix index 0a41ad0feb26..a31dc94117ff 100644 --- a/pkgs/applications/networking/browsers/lynx/default.nix +++ b/pkgs/applications/networking/browsers/lynx/default.nix @@ -13,28 +13,20 @@ stdenv.mkDerivation rec { pname = "lynx"; - version = "2.8.9rel.1"; + version = "2.9.0dev.12"; src = fetchurl { urls = [ "ftp://ftp.invisible-island.net/lynx/tarballs/lynx${version}.tar.bz2" "https://invisible-mirror.net/archives/lynx/tarballs/lynx${version}.tar.bz2" ]; - sha256 = "15cmyyma2kz1hfaa6mwjgli8zwdzq3jv0q2cl6nwzycjfwyijzrq"; + hash = "sha256-pkVbFZ0Ad22OwQUShcly3B8MVS0FcaDP8Coj7BRu6OU="; }; enableParallelBuilding = true; hardeningEnable = [ "pie" ]; - patches = [ - (fetchpatch { - name = "CVE-2021-38165.patch"; - url = "https://git.alpinelinux.org/aports/plain/main/lynx/CVE-2021-38165.patch?id=3400945dbbb8a87065360963e4caa0e17d3dcc61"; - sha256 = "1aykb9y2g2vdpbbpvjlm4r40x7py2yv6jbywwcqcxrlciqcw4x57"; - }) - ]; - configureFlags = [ "--enable-default-colors" "--enable-widec" From ecf9c3837043c69d718b0e263b3ed1fcfb5cd897 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= Date: Sun, 15 Oct 2023 13:19:14 -0700 Subject: [PATCH 23/82] python310Packages.igraph: 0.10.8 -> 0.11.2 Diff: https://github.com/igraph/python-igraph/compare/refs/tags/0.10.8...0.11.2 Changelog: https://github.com/igraph/python-igraph/blob/refs/tags/0.11.2/CHANGELOG.md --- pkgs/development/python-modules/igraph/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/development/python-modules/igraph/default.nix b/pkgs/development/python-modules/igraph/default.nix index f73b77699c91..e85f78d4ca5a 100644 --- a/pkgs/development/python-modules/igraph/default.nix +++ b/pkgs/development/python-modules/igraph/default.nix @@ -10,9 +10,9 @@ buildPythonPackage rec { pname = "igraph"; - version = "0.10.8"; + version = "0.11.2"; - disabled = pythonOlder "3.7"; + disabled = pythonOlder "3.8"; format = "setuptools"; @@ -20,7 +20,7 @@ buildPythonPackage rec { owner = "igraph"; repo = "python-igraph"; rev = "refs/tags/${version}"; - hash = "sha256-EpWkFKN8fhKkzR2g9Uv0/LxSwi4TkraH5rjde7yR+C8="; + hash = "sha256-evYnUv2PWO+LbVBBQPa708dQb8Wq8SQ92bJ6clQNV/g="; }; postPatch = '' From d65f164a4a3a10a8aff870e7a1611de093c70d4a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= Date: Sun, 15 Oct 2023 13:25:17 -0700 Subject: [PATCH 24/82] rymdport: 3.5.0 -> 3.5.1 Diff: https://github.com/Jacalz/rymdport/compare/v3.5.0...v3.5.1 Changelog: https://github.com/Jacalz/rymdport/blob/v3.5.1/CHANGELOG.md --- pkgs/applications/networking/rymdport/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/applications/networking/rymdport/default.nix b/pkgs/applications/networking/rymdport/default.nix index 232b6460ec6f..b9f4838f58bf 100644 --- a/pkgs/applications/networking/rymdport/default.nix +++ b/pkgs/applications/networking/rymdport/default.nix @@ -11,16 +11,16 @@ buildGoModule rec { pname = "rymdport"; - version = "3.5.0"; + version = "3.5.1"; src = fetchFromGitHub { owner = "Jacalz"; repo = "rymdport"; rev = "v${version}"; - hash = "sha256-aNLAj8rQSRp6fsEu052uc2gJE55A996YJY7tDApjHxA="; + hash = "sha256-wsFZN2qDp0XScqBdwLYZdRsS30g+ex+sYjw2GkBwwI4="; }; - vendorHash = "sha256-8TxuExcxiBTHVA9DTLfElKOq45a2EVLxqmByDyKJQ4c="; + vendorHash = "sha256-SDNCVROfwCTfoQpUyChxtX3rTf0OPFOTzH5PeH4ahUI="; nativeBuildInputs = [ pkg-config From 974ebc742b69bbeb1be60456c4f15d353f07bd7b Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 15 Oct 2023 20:50:00 +0000 Subject: [PATCH 25/82] python310Packages.python-lsp-ruff: 1.5.1 -> 1.5.2 --- pkgs/development/python-modules/python-lsp-ruff/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/python-lsp-ruff/default.nix b/pkgs/development/python-modules/python-lsp-ruff/default.nix index 88610f19307e..07a389268e77 100644 --- a/pkgs/development/python-modules/python-lsp-ruff/default.nix +++ b/pkgs/development/python-modules/python-lsp-ruff/default.nix @@ -10,14 +10,14 @@ buildPythonPackage rec { pname = "python-lsp-ruff"; - version = "1.5.1"; + version = "1.5.2"; format = "pyproject"; disabled = pythonOlder "3.7"; src = fetchPypi { inherit version; pname = "python-lsp-ruff"; - sha256 = "sha256-yvG4Qn9aym0rTDALURxHrWtDhO7g2VYsI+zLgb8z+gE="; + sha256 = "sha256-7vilIo1PHgHZ6yaRxTVt/bPwGt9g7rGvrq84eyIDIBw="; }; postPatch = '' From 861a83465bb442d4431115256bf93d16e064f65a Mon Sep 17 00:00:00 2001 From: ajs124 Date: Sun, 15 Oct 2023 23:05:20 +0200 Subject: [PATCH 26/82] exim: 4.96.1 -> 4.96.2 https://seclists.org/oss-sec/2023/q4/107 Fixes CVE-2023-42117, CVE-2023-42119 --- pkgs/servers/mail/exim/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/servers/mail/exim/default.nix b/pkgs/servers/mail/exim/default.nix index 698a82a6297f..dc8d0dd648a1 100644 --- a/pkgs/servers/mail/exim/default.nix +++ b/pkgs/servers/mail/exim/default.nix @@ -11,11 +11,11 @@ stdenv.mkDerivation rec { pname = "exim"; - version = "4.96.1"; + version = "4.96.2"; src = fetchurl { url = "https://ftp.exim.org/pub/exim/exim4/${pname}-${version}.tar.xz"; - hash = "sha256-k6wHVcMX4f276ozLcKhoh2vfMUhpKJHHKtD+gWdnAz0="; + hash = "sha256-A44yfo0ek9AFusm7Bv0irsRNUCiTDW2+iBetRLv8HeY="; }; enableParallelBuilding = true; From cba56553798b7f65e92f5811880c8fd8ac16625f Mon Sep 17 00:00:00 2001 From: ProminentRetail Date: Mon, 16 Oct 2023 12:27:11 +1100 Subject: [PATCH 27/82] monero-gui: fix desktop icon --- pkgs/applications/blockchains/monero-gui/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/blockchains/monero-gui/default.nix b/pkgs/applications/blockchains/monero-gui/default.nix index 1b2e073fca14..c78fa74fb68e 100644 --- a/pkgs/applications/blockchains/monero-gui/default.nix +++ b/pkgs/applications/blockchains/monero-gui/default.nix @@ -88,8 +88,8 @@ stdenv.mkDerivation rec { for n in 16 24 32 48 64 96 128 256; do size=$n"x"$n install -Dm644 \ - -t $out/share/icons/hicolor/$size/apps/monero.png \ - $src/images/appicons/$size.png + $src/images/appicons/$size.png \ + $out/share/icons/hicolor/$size/apps/monero.png done; ''; From e81e8bdd723a083371743a1438f4bc13a8e6dcc6 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 16 Oct 2023 02:47:57 +0000 Subject: [PATCH 28/82] python310Packages.sabctools: 7.1.2 -> 8.0.0 --- pkgs/development/python-modules/sabctools/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/sabctools/default.nix b/pkgs/development/python-modules/sabctools/default.nix index d20ea7318620..406d46590a7e 100644 --- a/pkgs/development/python-modules/sabctools/default.nix +++ b/pkgs/development/python-modules/sabctools/default.nix @@ -6,12 +6,12 @@ }: buildPythonPackage rec { pname = "sabctools"; - version = "7.1.2"; # needs to match version sabnzbd expects, e.g. https://github.com/sabnzbd/sabnzbd/blob/4.0.x/requirements.txt#L3 + version = "8.0.0"; # needs to match version sabnzbd expects, e.g. https://github.com/sabnzbd/sabnzbd/blob/4.0.x/requirements.txt#L3 format = "setuptools"; src = fetchPypi { inherit pname version; - hash = "sha256-wDgFXuxclmqMlRXyr9qpruJJcOXfOiOWTZXX53uYEB8="; + hash = "sha256-hrRpEVhmnm4ABSqN/F3MllCgoJCg1PdM+oVrQR+uZbk="; }; pythonImportsCheck = ["sabctools"]; From be1280f8e871dd74790e8af2a42dbd1dfad84116 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 16 Oct 2023 02:54:10 +0000 Subject: [PATCH 29/82] python310Packages.sagemaker: 2.188.0 -> 2.192.1 --- pkgs/development/python-modules/sagemaker/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/sagemaker/default.nix b/pkgs/development/python-modules/sagemaker/default.nix index d32ee63d36f2..7e682a30a930 100644 --- a/pkgs/development/python-modules/sagemaker/default.nix +++ b/pkgs/development/python-modules/sagemaker/default.nix @@ -26,7 +26,7 @@ buildPythonPackage rec { pname = "sagemaker"; - version = "2.188.0"; + version = "2.192.1"; format = "setuptools"; disabled = pythonOlder "3.8"; @@ -35,7 +35,7 @@ buildPythonPackage rec { owner = "aws"; repo = "sagemaker-python-sdk"; rev = "refs/tags/v${version}"; - hash = "sha256-iWNAsqDGTkELQn5K45AYpdzexE3DimI5xYWt3Udd4EI="; + hash = "sha256-+1wb7O+fHhRE8aKlgAB/NRgx2J+LBkR7xuqfWnVYSKc="; }; nativeBuildInputs = [ From dbd9263221a7f0601a4465852c3a9a87144d704d Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 16 Oct 2023 03:22:59 +0000 Subject: [PATCH 30/82] python310Packages.scikit-hep-testdata: 0.4.31 -> 0.4.33 --- .../python-modules/scikit-hep-testdata/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/scikit-hep-testdata/default.nix b/pkgs/development/python-modules/scikit-hep-testdata/default.nix index 0cddf6eee2fe..96542b15f67c 100644 --- a/pkgs/development/python-modules/scikit-hep-testdata/default.nix +++ b/pkgs/development/python-modules/scikit-hep-testdata/default.nix @@ -11,7 +11,7 @@ buildPythonPackage rec { pname = "scikit-hep-testdata"; - version = "0.4.31"; + version = "0.4.33"; format = "pyproject"; disabled = pythonOlder "3.6"; @@ -20,7 +20,7 @@ buildPythonPackage rec { owner = "scikit-hep"; repo = pname; rev = "refs/tags/v${version}"; - hash = "sha256-/CUBRRezm84yAqnEVAC89vKIpALnvSkoSKBCmX84S0w="; + hash = "sha256-IAi1LS6LqcvMR3dqNcppuyoMNM/hRT1eH+LZbczWW/M="; }; SETUPTOOLS_SCM_PRETEND_VERSION = version; From bb47d9f01b4f939c8c3b664fff6424fa97a1ffb6 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 16 Oct 2023 04:51:20 +0000 Subject: [PATCH 31/82] python310Packages.siuba: 0.4.2 -> 0.4.4 --- pkgs/development/python-modules/siuba/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/siuba/default.nix b/pkgs/development/python-modules/siuba/default.nix index a77e737075b7..0974f3bbfe83 100644 --- a/pkgs/development/python-modules/siuba/default.nix +++ b/pkgs/development/python-modules/siuba/default.nix @@ -17,7 +17,7 @@ buildPythonPackage rec { pname = "siuba"; - version = "0.4.2"; + version = "0.4.4"; disabled = pythonOlder "3.7"; format = "setuptools"; @@ -26,7 +26,7 @@ buildPythonPackage rec { owner = "machow"; repo = "siuba"; rev = "refs/tags/v${version}"; - hash = "sha256-Q2nkK51bmIO2OcBuWu+u7yB8UmaqiZJXpuxXcytTlUY="; + hash = "sha256-rd/yQH3sbZqQAQ1AN44vChe30GMJuIlZj3Ccfv1m3lU="; }; propagatedBuildInputs = [ From 5ac79d7119579403f1d88d8721039d38f9318567 Mon Sep 17 00:00:00 2001 From: datafoo <34766150+datafoo@users.noreply.github.com> Date: Mon, 16 Oct 2023 08:28:18 +0200 Subject: [PATCH 32/82] vscode-extensions.elixir-lsp.vscode-elixir-ls: 0.17.0 -> 0.17.1 --- pkgs/applications/editors/vscode/extensions/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix index c78623f009e1..bdc1115e0052 100644 --- a/pkgs/applications/editors/vscode/extensions/default.nix +++ b/pkgs/applications/editors/vscode/extensions/default.nix @@ -1229,8 +1229,8 @@ let mktplcRef = { name = "elixir-ls"; publisher = "JakeBecker"; - version = "0.17.0"; - sha256 = "sha256-jb9WHX5jCdi4vzIRvh7i6ncicuISsEBBmlIHvqquqcA="; + version = "0.17.1"; + sha256 = "sha256-WBtIdz+8zsyTl43ovU3Dz+8p154ZGvHp6BA3AQtXN/U="; }; meta = { changelog = "https://marketplace.visualstudio.com/items/JakeBecker.elixir-ls/changelog"; From 547eac7ba8c0555d4a596d383880bb2622d14b18 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 16 Oct 2023 06:30:57 +0000 Subject: [PATCH 33/82] python310Packages.stanza: 1.6.0 -> 1.6.1 --- pkgs/development/python-modules/stanza/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/stanza/default.nix b/pkgs/development/python-modules/stanza/default.nix index d7c9972f049e..51f2152c8689 100644 --- a/pkgs/development/python-modules/stanza/default.nix +++ b/pkgs/development/python-modules/stanza/default.nix @@ -14,7 +14,7 @@ buildPythonPackage rec { pname = "stanza"; - version = "1.6.0"; + version = "1.6.1"; format = "setuptools"; disabled = pythonOlder "3.6"; @@ -23,7 +23,7 @@ buildPythonPackage rec { owner = "stanfordnlp"; repo = pname; rev = "refs/tags/v${version}"; - hash = "sha256-AyO/BC5JpkxaXXjj8pAVa4WGnK/GTw4xrmUvGLbLt3U="; + hash = "sha256-8WH83K/1SbzjlAmjKVh3gT9KVvQ6BMRmg3Z0SSeL1j8="; }; propagatedBuildInputs = [ From ff3bba57deb548cb2972a06ab1750f8c0c033ec3 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 16 Oct 2023 06:56:23 +0000 Subject: [PATCH 34/82] python310Packages.structlog: 23.1.0 -> 23.2.0 --- pkgs/development/python-modules/structlog/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/structlog/default.nix b/pkgs/development/python-modules/structlog/default.nix index c21785f430b6..4f0e7a50bd9c 100644 --- a/pkgs/development/python-modules/structlog/default.nix +++ b/pkgs/development/python-modules/structlog/default.nix @@ -16,7 +16,7 @@ buildPythonPackage rec { pname = "structlog"; - version = "23.1.0"; + version = "23.2.0"; format = "pyproject"; disabled = pythonOlder "3.7"; @@ -25,7 +25,7 @@ buildPythonPackage rec { owner = "hynek"; repo = "structlog"; rev = "refs/tags/${version}"; - hash = "sha256-0zHvBMiZB4cGntdYXA7C9V9+FfnDB6sHGuFRYAo/LJw="; + hash = "sha256-KSHKgkv+kObKCdWZDg5o6QYe0AMND9VLdEuseY/GyDY="; }; SETUPTOOLS_SCM_PRETEND_VERSION = version; From 17e14cfb931b10e097e33563190305961c736d4d Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 16 Oct 2023 07:10:40 +0000 Subject: [PATCH 35/82] python310Packages.sumo: 2.3.6 -> 2.3.7 --- pkgs/development/python-modules/sumo/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/sumo/default.nix b/pkgs/development/python-modules/sumo/default.nix index 909abc3949bf..5fccc8fe62a4 100644 --- a/pkgs/development/python-modules/sumo/default.nix +++ b/pkgs/development/python-modules/sumo/default.nix @@ -18,7 +18,7 @@ buildPythonPackage rec { pname = "sumo"; - version = "2.3.6"; + version = "2.3.7"; format = "setuptools"; disabled = pythonOlder "3.6"; @@ -27,7 +27,7 @@ buildPythonPackage rec { owner = "SMTG-UCL"; repo = "sumo"; rev = "refs/tags/v${version}"; - hash = "sha256-HQIs2G2hdKQkQOBs2lijmx/0cI4o/FFJU866PjtrBAE="; + hash = "sha256-9NHz8SPymD9zANWMeajjavpjw68X4abqhrLl0dn92l0="; }; nativeBuildInputs = [ From e08e9c6057bcd6503cacfcb8d513d5c44bf100fa Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 16 Oct 2023 07:30:17 +0000 Subject: [PATCH 36/82] python310Packages.tag-expressions: 1.1.0 -> 2.0.0 --- pkgs/development/python-modules/tag-expressions/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/tag-expressions/default.nix b/pkgs/development/python-modules/tag-expressions/default.nix index d992b4250891..d6f67d1f62e2 100644 --- a/pkgs/development/python-modules/tag-expressions/default.nix +++ b/pkgs/development/python-modules/tag-expressions/default.nix @@ -6,11 +6,11 @@ buildPythonPackage rec { pname = "tag-expressions"; - version = "1.1.0"; + version = "2.0.0"; src = fetchPypi { inherit pname version; - sha256 = "1c0a49c3c0357976822b03c43db8d4a1c5548e16fb07ac939c10bbd5183f529d"; + sha256 = "sha256-/6Ym72jlgVdpel4V2W2aCKNtISDT9y5qz7+gTllUuPg="; }; nativeCheckInputs = [ pytestCheckHook ]; From f5d3def05504f0587b84d55a1c9a58ba78769d60 Mon Sep 17 00:00:00 2001 From: David Flatz Date: Mon, 16 Oct 2023 09:15:40 +0200 Subject: [PATCH 37/82] element-{web,desktop}: 1.11.45 -> 1.11.46 ChangeLog: https://github.com/vector-im/element-web/releases/tag/v1.11.46 --- .../networking/instant-messengers/element/pin.nix | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/applications/networking/instant-messengers/element/pin.nix b/pkgs/applications/networking/instant-messengers/element/pin.nix index 5f0506b0220c..da07eb134918 100644 --- a/pkgs/applications/networking/instant-messengers/element/pin.nix +++ b/pkgs/applications/networking/instant-messengers/element/pin.nix @@ -1,9 +1,9 @@ { - "version" = "1.11.45"; + "version" = "1.11.46"; "hashes" = { - "desktopSrcHash" = "sha256-SxpnvIctV738mMRmMiuLgr1InMrlWH39/6lTO0wu+vQ="; - "desktopYarnHash" = "09a2swngqjz4hahzvczhw0lh38y39glc1dkkhjkp4jqvmds9ni7n"; - "webSrcHash" = "sha256-hImwZ7vzpupRulk9g5jhfv0sgZqmPXnggJjUUwZ+UCE="; - "webYarnHash" = "0r2xzq9630vky32hqp3h1skdgv3jiiffi8553yzzk4zr45nlvf9d"; + "desktopSrcHash" = "sha256-sgdvdTi3fi/vZohh/JPW3I24cQS0i84eM1dUgmEafWs="; + "desktopYarnHash" = "1nssv92yk1a53v7mvijkrb3gzif5xrz2j6lxvg7p340z42rm7f9v"; + "webSrcHash" = "sha256-3ucitVtYnOc5UUn4y3u+L0sKWJLt+NNrd5T6mn0wNBg="; + "webYarnHash" = "19396p654zzzh6d18rpyckjd67lncch3r9a0zmjb7znsi7d78k63"; }; } From b877bddacc00a2a2c80fb6239406927255e8d654 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 16 Oct 2023 08:01:10 +0000 Subject: [PATCH 38/82] python310Packages.tesserocr: 2.6.1 -> 2.6.2 --- pkgs/development/python-modules/tesserocr/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/tesserocr/default.nix b/pkgs/development/python-modules/tesserocr/default.nix index 268ee9978536..4b7a89ea7b73 100644 --- a/pkgs/development/python-modules/tesserocr/default.nix +++ b/pkgs/development/python-modules/tesserocr/default.nix @@ -17,11 +17,11 @@ buildPythonPackage rec { pname = "tesserocr"; - version = "2.6.1"; + version = "2.6.2"; src = fetchPypi { inherit pname version; - sha256 = "sha256-pz82cutgQ9ifMS6+40mcBiOsXIqeEquYdBWT+npZNPY="; + sha256 = "sha256-RVJfocGjVvnRVanekbN1nKRECEr9hTVE9aKaqFizA5A="; }; # https://github.com/sirfz/tesserocr/issues/314 From 3090fd1fe2607559e27776824d03d0e4d14be2b1 Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Mon, 16 Oct 2023 10:07:14 +0200 Subject: [PATCH 39/82] python311Packages.aiovlc: 0.3.0 -> 0.3.2 Diff: https://github.com/MartinHjelmare/aiovlc/compare/refs/tags/v0.3.0...v0.3.2 Changelog: https://github.com/MartinHjelmare/aiovlc/blob/v0.3.2/CHANGELOG.md --- pkgs/development/python-modules/aiovlc/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/aiovlc/default.nix b/pkgs/development/python-modules/aiovlc/default.nix index 64ece4bed85b..39607c9fdde5 100644 --- a/pkgs/development/python-modules/aiovlc/default.nix +++ b/pkgs/development/python-modules/aiovlc/default.nix @@ -10,7 +10,7 @@ buildPythonPackage rec { pname = "aiovlc"; - version = "0.3.0"; + version = "0.3.2"; format = "setuptools"; disabled = pythonOlder "3.9"; @@ -19,7 +19,7 @@ buildPythonPackage rec { owner = "MartinHjelmare"; repo = pname; rev = "refs/tags/v${version}"; - hash = "sha256-ZFLNgPxR5N+hI988POCYJD9QGivs1fYysyFtmxsJQaA="; + hash = "sha256-+IpWX661Axl2Ke1NGN6W9CMMQMEu7EQ/2PeRkkByAxI="; }; postPatch = '' From c3fc019082a5001a66befb6fbfaa059b98215609 Mon Sep 17 00:00:00 2001 From: Sergei Trofimovich Date: Mon, 16 Oct 2023 08:36:34 +0100 Subject: [PATCH 40/82] updfparser: unstable 2023-01-23 -> 2023-08-08 Without the change build fails against gcc-13 as: $ nix build --impure --expr 'with import ./. {}; updfparser.override { stdenv = gcc13Stdenv; }' error: builder for '/nix/store/8p5hwa50rild5yaijxg9iavr3lyvi3w2-updfparser.drv' failed with exit code 2; last 10 log lines: > building > build flags: SHELL=/nix/store/xdqlrixlspkks50m9b0mpvag65m3pf2w-bash-5.2-p15/bin/bash BUILD_STATIC=1 BUILD_SHARED=1 > mkdir obj > g++ -Wall -fPIC -I./include -O2 -c src/uPDFParser.cpp -o obj/uPDFParser.o > In file included from ./include/uPDFParser.h:34, > from src/uPDFParser.cpp:26: > ./include/uPDFObject.h:49:52: error: 'uint64_t' has not been declared > 49 | Object(int objectId, int generationNumber, uint64_t offset, bool isNew=false, > | ^~~~~~~~ --- pkgs/development/libraries/updfparser/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/development/libraries/updfparser/default.nix b/pkgs/development/libraries/updfparser/default.nix index 1eae1782b77c..aa25f9f2dffd 100644 --- a/pkgs/development/libraries/updfparser/default.nix +++ b/pkgs/development/libraries/updfparser/default.nix @@ -2,12 +2,12 @@ stdenv.mkDerivation rec { name = "updfparser"; - version = "unstable-2023-01-10"; - rev = "a421098092ba600fb1686a7df8fc58cd67429f59"; + version = "unstable-2023-08-08"; + rev = "c5ce75b9eea8ebb2746b13eeb0f335813c615115"; src = fetchzip { url = "https://indefero.soutade.fr/p/updfparser/source/download/${rev}/"; - sha256 = "sha256-Kt1QDj7E0GaT615kJW2MQKF9BeU5U7/95TQKODpxgNI="; + hash = "sha256-RT7mvu43Izp0rHhKq4wR4kt0TDfzHvB2NGMR+fxO5UM="; extension = "zip"; }; From 70ad949e696c32340b516654d42ffd28f578f152 Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Mon, 16 Oct 2023 10:16:48 +0200 Subject: [PATCH 41/82] python311Packages.sumo: add changelog to meta --- pkgs/development/python-modules/sumo/default.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/pkgs/development/python-modules/sumo/default.nix b/pkgs/development/python-modules/sumo/default.nix index 5fccc8fe62a4..d13fde389350 100644 --- a/pkgs/development/python-modules/sumo/default.nix +++ b/pkgs/development/python-modules/sumo/default.nix @@ -58,6 +58,7 @@ buildPythonPackage rec { meta = with lib; { description = "Toolkit for plotting and analysis of ab initio solid-state calculation data"; homepage = "https://github.com/SMTG-UCL/sumo"; + changelog = "https://github.com/SMTG-Bham/sumo/releases/tag/v${version}"; license = licenses.mit; maintainers = with maintainers; [ psyanticy ]; }; From 58c57992e37f00d338d3f6725afaf620873b79bb Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Mon, 16 Oct 2023 10:17:40 +0200 Subject: [PATCH 42/82] python311Packages.sumo: update disabled --- pkgs/development/python-modules/sumo/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/development/python-modules/sumo/default.nix b/pkgs/development/python-modules/sumo/default.nix index d13fde389350..da7641c9d056 100644 --- a/pkgs/development/python-modules/sumo/default.nix +++ b/pkgs/development/python-modules/sumo/default.nix @@ -21,7 +21,7 @@ buildPythonPackage rec { version = "2.3.7"; format = "setuptools"; - disabled = pythonOlder "3.6"; + disabled = pythonOlder "3.8"; src = fetchFromGitHub { owner = "SMTG-UCL"; From ff876e7f2514308566f9c2d87dd34d352b58ff4f Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Mon, 16 Oct 2023 10:20:08 +0200 Subject: [PATCH 43/82] python311Packages.tag-expressions: add format - disable on unsupported Python releases --- .../python-modules/tag-expressions/default.nix | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/tag-expressions/default.nix b/pkgs/development/python-modules/tag-expressions/default.nix index d6f67d1f62e2..9c56ab999629 100644 --- a/pkgs/development/python-modules/tag-expressions/default.nix +++ b/pkgs/development/python-modules/tag-expressions/default.nix @@ -2,18 +2,24 @@ , buildPythonPackage , fetchPypi , pytestCheckHook +, pythonOlder }: buildPythonPackage rec { pname = "tag-expressions"; version = "2.0.0"; + format = "setuptools"; + + disabled = pythonOlder "3.7"; src = fetchPypi { inherit pname version; - sha256 = "sha256-/6Ym72jlgVdpel4V2W2aCKNtISDT9y5qz7+gTllUuPg="; + hash = "sha256-/6Ym72jlgVdpel4V2W2aCKNtISDT9y5qz7+gTllUuPg="; }; - nativeCheckInputs = [ pytestCheckHook ]; + nativeCheckInputs = [ + pytestCheckHook + ]; meta = with lib; { description = "Package to parse logical tag expressions"; From 1d8a2fa167bb37f8aa7875e48719aad22482300d Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Mon, 16 Oct 2023 10:21:26 +0200 Subject: [PATCH 44/82] python311Packages.tag-expressions: add pythonImportsCheck --- pkgs/development/python-modules/tag-expressions/default.nix | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/pkgs/development/python-modules/tag-expressions/default.nix b/pkgs/development/python-modules/tag-expressions/default.nix index 9c56ab999629..e87c489dae4a 100644 --- a/pkgs/development/python-modules/tag-expressions/default.nix +++ b/pkgs/development/python-modules/tag-expressions/default.nix @@ -21,6 +21,10 @@ buildPythonPackage rec { pytestCheckHook ]; + pythonImportsCheck = [ + "tagexpressions" + ]; + meta = with lib; { description = "Package to parse logical tag expressions"; homepage = "https://github.com/timofurrer/tag-expressions"; From 91a9ddf5d3029bbee860901356ce7d9ac6a46ee1 Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Mon, 16 Oct 2023 10:24:43 +0200 Subject: [PATCH 45/82] python311Packages.structlog: update disabled --- pkgs/development/python-modules/structlog/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/development/python-modules/structlog/default.nix b/pkgs/development/python-modules/structlog/default.nix index 4f0e7a50bd9c..20d1ba2c0a56 100644 --- a/pkgs/development/python-modules/structlog/default.nix +++ b/pkgs/development/python-modules/structlog/default.nix @@ -19,7 +19,7 @@ buildPythonPackage rec { version = "23.2.0"; format = "pyproject"; - disabled = pythonOlder "3.7"; + disabled = pythonOlder "3.8"; src = fetchFromGitHub { owner = "hynek"; From 81cf23cdcd3eeb2c816f7f698e28638e122f3f1b Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 16 Oct 2023 08:30:42 +0000 Subject: [PATCH 46/82] python310Packages.textual-universal-directorytree: 1.0.1 -> 1.0.2 --- .../textual-universal-directorytree/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/development/python-modules/textual-universal-directorytree/default.nix b/pkgs/development/python-modules/textual-universal-directorytree/default.nix index 9224f06511b9..5f14accbaca7 100644 --- a/pkgs/development/python-modules/textual-universal-directorytree/default.nix +++ b/pkgs/development/python-modules/textual-universal-directorytree/default.nix @@ -14,14 +14,14 @@ buildPythonPackage rec { pname = "textual-universal-directorytree"; - version = "1.0.1"; + version = "1.0.2"; format = "pyproject"; src = fetchFromGitHub { owner = "juftin"; repo = "textual-universal-directorytree"; - rev = "v${version}"; - hash = "sha256-a7alxVmHTKJnJiU7X6UlUD2y7MY4O5TMR+02KcyPwEs="; + rev = "refs/tags/v${version}"; + hash = "sha256-FL2bwPGqBmDn33Rhj7+VEpuqB4znEAw+GGAODTs25oo="; }; nativeBuildInputs = [ From 2bf8e468f9159cabed243dea0d04a0c843cb5001 Mon Sep 17 00:00:00 2001 From: Alex Martens Date: Mon, 16 Oct 2023 17:59:20 +0900 Subject: [PATCH 47/82] svdtools: 0.3.3 -> 0.3.4 --- pkgs/development/embedded/svdtools/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/development/embedded/svdtools/default.nix b/pkgs/development/embedded/svdtools/default.nix index 199845598acb..4ff90b4f85a6 100644 --- a/pkgs/development/embedded/svdtools/default.nix +++ b/pkgs/development/embedded/svdtools/default.nix @@ -5,14 +5,14 @@ rustPlatform.buildRustPackage rec { pname = "svdtools"; - version = "0.3.3"; + version = "0.3.4"; src = fetchCrate { inherit version pname; - hash = "sha256-pZufVz7m91MiD1TfzTzS6mL0eBxawcr43GAfvDJVqfU="; + hash = "sha256-rdBUEOyE4bHqPXZs3MxT/oivagKmJIVE/hI9mp0RY0k="; }; - cargoHash = "sha256-FAJZ/3eNhxPvIKXnE9lpejQuMi+yeBaA5ra9Peb2yIM="; + cargoHash = "sha256-mPz8m/9VGKSqXan/R1k1JTZ9a44CwCL6JefVyeeREeE="; meta = with lib; { description = "Tools to handle vendor-supplied, often buggy SVD files"; From f5d3cc41d306a7b1a17c6b3ddeb934f8e5750e2e Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Mon, 16 Oct 2023 11:08:38 +0200 Subject: [PATCH 48/82] python311Packages.siuba: add changelog to meta --- pkgs/development/python-modules/siuba/default.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/pkgs/development/python-modules/siuba/default.nix b/pkgs/development/python-modules/siuba/default.nix index 0974f3bbfe83..10670c2c00a5 100644 --- a/pkgs/development/python-modules/siuba/default.nix +++ b/pkgs/development/python-modules/siuba/default.nix @@ -56,6 +56,7 @@ buildPythonPackage rec { meta = with lib; { description = "Use dplyr-like syntax with pandas and SQL"; homepage = "https://siuba.org"; + changelog = "https://github.com/machow/siuba/releases/tag/v${version}"; license = licenses.mit; maintainers = with maintainers; [ bcdarwin ]; }; From 3184812b0d20feb549c4f465c490c6ba4aaa262c Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Mon, 16 Oct 2023 11:10:15 +0200 Subject: [PATCH 49/82] python311Packages.siuba: update ordering --- pkgs/development/python-modules/siuba/default.nix | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/pkgs/development/python-modules/siuba/default.nix b/pkgs/development/python-modules/siuba/default.nix index 10670c2c00a5..dbaab8c6df6b 100644 --- a/pkgs/development/python-modules/siuba/default.nix +++ b/pkgs/development/python-modules/siuba/default.nix @@ -18,10 +18,10 @@ buildPythonPackage rec { pname = "siuba"; version = "0.4.4"; - disabled = pythonOlder "3.7"; - format = "setuptools"; + disabled = pythonOlder "3.7"; + src = fetchFromGitHub { owner = "machow"; repo = "siuba"; @@ -45,8 +45,9 @@ buildPythonPackage rec { hypothesis pytestCheckHook ]; - doCheck = false; + # requires running mysql and postgres instances; see docker-compose.yml + doCheck = false; pythonImportsCheck = [ "siuba" From c0e9c755cda7811e708fd668aef0b30da2bf9080 Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Mon, 16 Oct 2023 11:25:37 +0200 Subject: [PATCH 50/82] python311Packages.celery-types: 0.19.0 -> 0.20.0 --- .../python-modules/celery-types/default.nix | 15 ++------------- 1 file changed, 2 insertions(+), 13 deletions(-) diff --git a/pkgs/development/python-modules/celery-types/default.nix b/pkgs/development/python-modules/celery-types/default.nix index 6379d041f160..cc77baff0444 100644 --- a/pkgs/development/python-modules/celery-types/default.nix +++ b/pkgs/development/python-modules/celery-types/default.nix @@ -1,6 +1,5 @@ { lib , buildPythonPackage -, fetchpatch , fetchPypi , poetry-core , pythonOlder @@ -9,26 +8,16 @@ buildPythonPackage rec { pname = "celery-types"; - version = "0.19.0"; + version = "0.20.0"; format = "pyproject"; disabled = pythonOlder "3.10"; src = fetchPypi { inherit pname version; - hash = "sha256-1OLUJxsuxG/sCKDxKiU4i7o5HyaJdIW8rPo8UofMI28="; + hash = "sha256-5cdiVVYF7QWSuu2dUZIwBGzo56EcZ6ghVVwIt87OGWA="; }; - patches = [ - # remove extraneous build dependencies: - # https://github.com/sbdchd/celery-types/pull/138 - (fetchpatch { - name = "clean-up-build-dependencies.patch"; - url = "https://github.com/sbdchd/celery-types/commit/ff83f06a0302084e1a690e2a5a8b25f2c0dfc6e7.patch"; - hash = "sha256-c68SMugg6Qk88FC842/czoxLpk0uVAVSlWsvo4NI9uo="; - }) - ]; - propagatedBuildInputs = [ typing-extensions ]; From 7344f8d5e8856fe9b1c222be8320f0fe7a1a5c3b Mon Sep 17 00:00:00 2001 From: "Travis A. Everett" Date: Sun, 15 Oct 2023 15:27:15 -0500 Subject: [PATCH 51/82] pcaudiolib, espeak-ng: fix darwin builds --- pkgs/applications/audio/espeak-ng/default.nix | 18 ++++++++++++++++-- .../libraries/pcaudiolib/default.nix | 7 +++++-- pkgs/top-level/all-packages.nix | 4 +++- 3 files changed, 24 insertions(+), 5 deletions(-) diff --git a/pkgs/applications/audio/espeak-ng/default.nix b/pkgs/applications/audio/espeak-ng/default.nix index 5e62399c8a48..a773bbfa1c54 100644 --- a/pkgs/applications/audio/espeak-ng/default.nix +++ b/pkgs/applications/audio/espeak-ng/default.nix @@ -15,6 +15,9 @@ , pcaudiolib , sonicSupport ? true , sonic +, CoreAudio +, AudioToolbox +, AudioUnit , alsa-plugins , makeWrapper }: @@ -42,9 +45,20 @@ stdenv.mkDerivation rec { buildInputs = lib.optional mbrolaSupport mbrola ++ lib.optional pcaudiolibSupport pcaudiolib - ++ lib.optional sonicSupport sonic; + ++ lib.optional sonicSupport sonic + ++ lib.optionals stdenv.isDarwin [ + CoreAudio + AudioToolbox + AudioUnit + ]; - preConfigure = "./autogen.sh"; + # touch ChangeLog to avoid below error on darwin: + # Makefile.am: error: required file './ChangeLog.md' not found + preConfigure = lib.optionalString stdenv.isDarwin '' + touch ChangeLog + '' + '' + ./autogen.sh + ''; configureFlags = [ "--with-mbrola=${if mbrolaSupport then "yes" else "no"}" diff --git a/pkgs/development/libraries/pcaudiolib/default.nix b/pkgs/development/libraries/pcaudiolib/default.nix index 7730b30b3967..c6e67d39c195 100644 --- a/pkgs/development/libraries/pcaudiolib/default.nix +++ b/pkgs/development/libraries/pcaudiolib/default.nix @@ -38,7 +38,11 @@ stdenv.mkDerivation (finalAttrs: { ++ lib.optional stdenv.isLinux alsa-lib ++ lib.optional pulseaudioSupport libpulseaudio; - preConfigure = '' + # touch ChangeLog to avoid below error on darwin: + # Makefile.am: error: required file './ChangeLog.md' not found + preConfigure = lib.optionalString stdenv.isDarwin '' + touch ChangeLog + '' + '' ./autogen.sh ''; @@ -48,6 +52,5 @@ stdenv.mkDerivation (finalAttrs: { license = licenses.gpl3Plus; maintainers = with maintainers; [ aske ]; platforms = platforms.unix; - badPlatforms = platforms.darwin; }; }) diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 3061da81de31..51223c68fdbd 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -31369,7 +31369,9 @@ with pkgs; espeak-classic = callPackage ../applications/audio/espeak { }; - espeak-ng = callPackage ../applications/audio/espeak-ng { }; + espeak-ng = callPackage ../applications/audio/espeak-ng { + inherit (darwin.apple_sdk.frameworks) AudioToolbox AudioUnit CoreAudio; + }; espeak = res.espeak-ng; espeakedit = callPackage ../applications/audio/espeak/edit.nix { }; From 30afcc11bceb795c236b2c435c216bcf32d6182d Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Mon, 16 Oct 2023 11:32:42 +0200 Subject: [PATCH 52/82] python311Packages.hahomematic: 2023.10.11 -> 2023.10.12 Diff: https://github.com/danielperna84/hahomematic/compare/refs/tags/2023.10.11...2023.10.12 Changelog: https://github.com/danielperna84/hahomematic/releases/tag/2023.10.12 --- pkgs/development/python-modules/hahomematic/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/hahomematic/default.nix b/pkgs/development/python-modules/hahomematic/default.nix index df69f03510d8..97a7a55b26a4 100644 --- a/pkgs/development/python-modules/hahomematic/default.nix +++ b/pkgs/development/python-modules/hahomematic/default.nix @@ -18,7 +18,7 @@ buildPythonPackage rec { pname = "hahomematic"; - version = "2023.10.11"; + version = "2023.10.12"; format = "pyproject"; disabled = pythonOlder "3.11"; @@ -27,7 +27,7 @@ buildPythonPackage rec { owner = "danielperna84"; repo = pname; rev = "refs/tags/${version}"; - hash = "sha256-9vKXIvCLmdKS+DIR6OY7/gnDdqWZfmi9FOGpbqCMCqA="; + hash = "sha256-mlZlaUcpVflz1mTiI0rIAOnJD5+NqXjsb1xp+wvoQvs="; }; postPatch = '' From 1bff2a6e24a9b85b2d5fddf3ca3f4e794b21d9e2 Mon Sep 17 00:00:00 2001 From: Izorkin Date: Mon, 16 Oct 2023 12:51:50 +0300 Subject: [PATCH 53/82] nghttp3: 0.15.0 -> 1.0.0 --- pkgs/development/libraries/nghttp3/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/nghttp3/default.nix b/pkgs/development/libraries/nghttp3/default.nix index 4aaaefe1eb79..21e0cff3b87a 100644 --- a/pkgs/development/libraries/nghttp3/default.nix +++ b/pkgs/development/libraries/nghttp3/default.nix @@ -6,13 +6,13 @@ stdenv.mkDerivation rec { pname = "nghttp3"; - version = "0.15.0"; + version = "1.0.0"; src = fetchFromGitHub { owner = "ngtcp2"; repo = pname; rev = "v${version}"; - hash = "sha256-ZnfwPgjBAI2elHrx7uzc3JX2MdeX/hsrFKj4TfMK2tI="; + hash = "sha256-mw0zI7528lvEZlv+/KuST7PWjuu37p/+EGGsjIEto2Q="; }; outputs = [ "out" "dev" "doc" ]; From 94dfee4e18a095d5fa7038eadba886f8dffb4871 Mon Sep 17 00:00:00 2001 From: Izorkin Date: Mon, 16 Oct 2023 12:55:10 +0300 Subject: [PATCH 54/82] ngtcp2: 0.19.1 -> 1.0.0 --- pkgs/development/libraries/ngtcp2/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/ngtcp2/default.nix b/pkgs/development/libraries/ngtcp2/default.nix index d276311a243f..1d716704c104 100644 --- a/pkgs/development/libraries/ngtcp2/default.nix +++ b/pkgs/development/libraries/ngtcp2/default.nix @@ -8,13 +8,13 @@ stdenv.mkDerivation rec { pname = "ngtcp2"; - version = "0.19.1"; + version = "1.0.0"; src = fetchFromGitHub { owner = "ngtcp2"; repo = pname; rev = "v${version}"; - hash = "sha256-agiQRy/e5VS+ANxajXYi5huRjQQ2M8eddH/AzmwnHdQ=="; + hash = "sha256-dnYIRcNGTIzETu2OjTJa0IWB1+xttdGFKRBmMkTwrXk="; }; outputs = [ "out" "dev" "doc" ]; From 0da19309cc0b2a4325650aed454428a4b7bb6b16 Mon Sep 17 00:00:00 2001 From: spacefault <74156492+spacefault@users.noreply.github.com> Date: Mon, 16 Oct 2023 04:02:02 -0600 Subject: [PATCH 55/82] maintainers: add spacefault --- maintainers/maintainer-list.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix index 61cffc8c8d93..655fbd744c1d 100644 --- a/maintainers/maintainer-list.nix +++ b/maintainers/maintainer-list.nix @@ -16429,6 +16429,11 @@ fingerprint = "75F0 AB7C FE01 D077 AEE6 CAFD 353E 4A18 EE0F AB72"; }]; }; + spacefault = { + github = "spacefault"; + githubId = 74156492; + name = "spacefault"; + }; spacefrogg = { email = "spacefrogg-nixos@meterriblecrew.net"; github = "spacefrogg"; From 011def61064c3055e2fc2a72e37bc9b0f518e8d3 Mon Sep 17 00:00:00 2001 From: spacefault <74156492+spacefault@users.noreply.github.com> Date: Mon, 16 Oct 2023 04:04:15 -0600 Subject: [PATCH 56/82] osu-lazer-bin: add maintainer This commit does not bring a package update, however, it adds me as a maintainer for the osu-lazer-bin package. --- pkgs/games/osu-lazer/bin.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/games/osu-lazer/bin.nix b/pkgs/games/osu-lazer/bin.nix index e0198efa5b9c..683288260d90 100644 --- a/pkgs/games/osu-lazer/bin.nix +++ b/pkgs/games/osu-lazer/bin.nix @@ -70,7 +70,7 @@ let unfreeRedistributable # osu-framework contains libbass.so in repository ]; sourceProvenance = with sourceTypes; [ binaryNativeCode ]; - maintainers = with maintainers; [ delan stepbrobd ]; + maintainers = with maintainers; [ delan stepbrobd spacefault ]; mainProgram = "osu!"; platforms = [ "aarch64-darwin" "x86_64-darwin" "x86_64-linux" ]; }; From 46132b33b548acab81dc4db634ef471ee96633b2 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 16 Oct 2023 10:36:53 +0000 Subject: [PATCH 57/82] python310Packages.tubeup: 2023.8.19 -> 2023.9.19 --- pkgs/development/python-modules/tubeup/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/tubeup/default.nix b/pkgs/development/python-modules/tubeup/default.nix index a264c4b2f93a..df06e4bd0263 100644 --- a/pkgs/development/python-modules/tubeup/default.nix +++ b/pkgs/development/python-modules/tubeup/default.nix @@ -10,14 +10,14 @@ buildPythonPackage rec { pname = "tubeup"; - version = "2023.8.19"; + version = "2023.9.19"; format = "setuptools"; disabled = pythonOlder "3.7"; src = fetchPypi { inherit pname version; - sha256 = "sha256-0atpOUJIfXgw/5fi5w2ciAFDMgWmVH4U8d84zwLCRXk="; + sha256 = "sha256-Pp4h0MBoYhczmxPq21cLiYpLUeFP+2JoACcFpBl3b0E="; }; nativeBuildInputs = [ From 1e2581e39fdaa4fabfb78414def26441b1d94e92 Mon Sep 17 00:00:00 2001 From: Michael Adler Date: Mon, 16 Oct 2023 12:48:31 +0200 Subject: [PATCH 58/82] vscodium: 1.82.2.23257 -> 1.83.1.23285 --- pkgs/applications/editors/vscode/vscodium.nix | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/pkgs/applications/editors/vscode/vscodium.nix b/pkgs/applications/editors/vscode/vscodium.nix index f7527096f17a..c34629a3cf67 100644 --- a/pkgs/applications/editors/vscode/vscodium.nix +++ b/pkgs/applications/editors/vscode/vscodium.nix @@ -15,11 +15,11 @@ let archive_fmt = if stdenv.isDarwin then "zip" else "tar.gz"; sha256 = { - x86_64-linux = "1xzmfvkzqfxblahi2pc54fr7i6rynqm76p4wpbfzxrrh5a3xjwn3"; - x86_64-darwin = "0lp6yqwqwfngl98nba8f77yypb44cfn7kcjhbc93s8kqd57m97zj"; - aarch64-linux = "1hpwjdbfc8l4a7ln50s6h68abcb6djcc5y0h686s9k5v2axm7f3v"; - aarch64-darwin = "0cbms9p8g2gjx9wmm78fzlscw62qasjv30al8v39bda3k694wnh5"; - armv7l-linux = "0hvaray6b36j8s0fvffnkbsw7kf2rn2z4y8q4wlnqx3hfyalcvcn"; + x86_64-linux = "0cqkxd4pywkrvg3b96f1dyain6vlrb3di8a0yskmq3h58qd6k8rc"; + x86_64-darwin = "09y3whpp2z8fgb42pb9lw0b4wn0np3rdjkn5l1kldjljfrcwcn9g"; + aarch64-linux = "1kh8qylj77km8jhmx9a2bck7y4bb0fjx46sll7swagxz27b8ahi0"; + aarch64-darwin = "14g60sx3c5m02ly880sxwhmzvpxqw4pfij2ibgyprzdlpap0r2b0"; + armv7l-linux = "1s4rpd5p4kwmi89cml1106l9dccdwnqq3lyr8ym781pj9p75i8wp"; }.${system} or throwSystem; sourceRoot = lib.optionalString (!stdenv.isDarwin) "."; @@ -29,7 +29,7 @@ in # Please backport all compatible updates to the stable release. # This is important for the extension ecosystem. - version = "1.82.2.23257"; + version = "1.83.1.23285"; pname = "vscodium"; executableName = "codium"; From 72b2a076d923fa48a45977f714a221c0d1046252 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 16 Oct 2023 11:27:30 +0000 Subject: [PATCH 59/82] freedv: 1.9.2 -> 1.9.3 --- pkgs/applications/radio/freedv/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/radio/freedv/default.nix b/pkgs/applications/radio/freedv/default.nix index cd4e69529eb2..1a4f1c5aa2c2 100644 --- a/pkgs/applications/radio/freedv/default.nix +++ b/pkgs/applications/radio/freedv/default.nix @@ -25,13 +25,13 @@ stdenv.mkDerivation rec { pname = "freedv"; - version = "1.9.2"; + version = "1.9.3"; src = fetchFromGitHub { owner = "drowe67"; repo = "freedv-gui"; rev = "v${version}"; - hash = "sha256-SBWwAmIsa9HfaZpH8TioMm9IaoZ+x4HNHaOBps0vA0A="; + hash = "sha256-tlkD8Kem4HPwrk3E98UKcPoBNoFucqarEBo+oihnQSU="; }; postPatch = lib.optionalString stdenv.isDarwin '' From c3c44e0512d7d9e9c9e0b6bd49c15798f693503f Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 16 Oct 2023 11:54:30 +0000 Subject: [PATCH 60/82] moq: 0.3.2 -> 0.3.3 --- pkgs/development/tools/moq/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/tools/moq/default.nix b/pkgs/development/tools/moq/default.nix index 6707cf7300d6..f057a92de3c4 100644 --- a/pkgs/development/tools/moq/default.nix +++ b/pkgs/development/tools/moq/default.nix @@ -2,13 +2,13 @@ buildGoModule rec { pname = "moq"; - version = "0.3.2"; + version = "0.3.3"; src = fetchFromGitHub { owner = "matryer"; repo = "moq"; rev = "v${version}"; - sha256 = "sha256-T+vBzhc9XafCeXsW4/24vOn4U7N1t0S8DXkPNav7I94="; + sha256 = "sha256-TOFWaPJ+XfgiQCVRXze29TG7Zfur0SV4mQNdgVIGj5o="; }; vendorHash = "sha256-lfs61YK5HmUd3/qA4o9MiWeTFhu4MTAkNH+f0iGlRe0="; From 0787cfa1f11202c9e84617ea8447267a9786801b Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 16 Oct 2023 12:28:34 +0000 Subject: [PATCH 61/82] pipes-rs: 1.6.1 -> 1.6.2 --- pkgs/misc/screensavers/pipes-rs/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/misc/screensavers/pipes-rs/default.nix b/pkgs/misc/screensavers/pipes-rs/default.nix index 01346b9ccc6e..612f7b925001 100644 --- a/pkgs/misc/screensavers/pipes-rs/default.nix +++ b/pkgs/misc/screensavers/pipes-rs/default.nix @@ -2,16 +2,16 @@ rustPlatform.buildRustPackage rec { pname = "pipes-rs"; - version = "1.6.1"; + version = "1.6.2"; src = fetchFromGitHub { owner = "lhvy"; repo = pname; rev = "v${version}"; - sha256 = "sha256-0i5jAqOGq+N5bUM103Gk1Wzgwe7wUQRjJ+T4XqUkuZw="; + sha256 = "sha256-PUCbirnOPYIqt56IF6UQ7Jd0bJLsVY2pGIn/C95HTrQ="; }; - cargoHash = "sha256-LOU1BCFeX+F2dJdajgLDAtgyyrn6KkvLx3KtF9NkKcY="; + cargoHash = "sha256-6OTiciRqZyuX4FaDg131DEaVssUT2OYXdw/cxxJmLso="; doInstallCheck = true; From 3c54f29ccae456d08f75ae1c494dbca27272fdad Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jean-Fran=C3=A7ois=20Roche?= Date: Mon, 16 Oct 2023 12:12:00 +0200 Subject: [PATCH 62/82] dagger: remove It violates the dagger trademark policy to use `dagger` name and compile from source. closes #260848 --- .../manual/release-notes/rl-2311.section.md | 2 + .../continuous-integration/dagger/default.nix | 44 ------------------- pkgs/top-level/aliases.nix | 1 + pkgs/top-level/all-packages.nix | 2 - 4 files changed, 3 insertions(+), 46 deletions(-) delete mode 100644 pkgs/development/tools/continuous-integration/dagger/default.nix diff --git a/nixos/doc/manual/release-notes/rl-2311.section.md b/nixos/doc/manual/release-notes/rl-2311.section.md index 34ea5cdbd65f..04b3373c32ff 100644 --- a/nixos/doc/manual/release-notes/rl-2311.section.md +++ b/nixos/doc/manual/release-notes/rl-2311.section.md @@ -297,6 +297,8 @@ - `service.borgmatic.settings.location` and `services.borgmatic.configurations..location` are deprecated, please move your options out of sections to the global scope. +- `dagger` was removed because using a package called `dagger` and packaging it from source violates their trademark policy. + ## Other Notable Changes {#sec-release-23.11-notable-changes} - The Cinnamon module now enables XDG desktop integration by default. If you are experiencing collisions related to xdg-desktop-portal-gtk you can safely remove `xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-gtk ];` from your NixOS configuration. diff --git a/pkgs/development/tools/continuous-integration/dagger/default.nix b/pkgs/development/tools/continuous-integration/dagger/default.nix deleted file mode 100644 index 2b35ac4837ec..000000000000 --- a/pkgs/development/tools/continuous-integration/dagger/default.nix +++ /dev/null @@ -1,44 +0,0 @@ -{ lib, stdenv, buildGoModule, fetchFromGitHub, installShellFiles, testers, dagger }: - -buildGoModule rec { - pname = "dagger"; - version = "0.8.8"; - - src = fetchFromGitHub { - owner = "dagger"; - repo = "dagger"; - rev = "v${version}"; - hash = "sha256-EHAQRmBgQEM0ypfUwuaoPnoKsQb1S+tarO1nHdmY5RI="; - }; - - vendorHash = "sha256-fUNet9P6twEJP4eYooiHZ6qaJ3jEkJUwQ2zPzk3+eIs="; - proxyVendor = true; - - subPackages = [ - "cmd/dagger" - ]; - - ldflags = [ "-s" "-w" "-X github.com/dagger/dagger/engine.Version=${version}" ]; - - nativeBuildInputs = [ installShellFiles ]; - - postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) '' - installShellCompletion --cmd dagger \ - --bash <($out/bin/dagger completion bash) \ - --fish <($out/bin/dagger completion fish) \ - --zsh <($out/bin/dagger completion zsh) - ''; - - passthru.tests.version = testers.testVersion { - package = dagger; - command = "dagger version"; - version = "v${version}"; - }; - - meta = with lib; { - description = "A portable devkit for CICD pipelines"; - homepage = "https://dagger.io"; - license = licenses.asl20; - maintainers = with maintainers; [ jfroche sagikazarmark ]; - }; -} diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix index 1d7edca089f6..94253d366d98 100644 --- a/pkgs/top-level/aliases.nix +++ b/pkgs/top-level/aliases.nix @@ -166,6 +166,7 @@ mapAliases ({ ### D ### + dagger = throw "'dagger' has been removed from nixpkgs, as the trademark policy of the upstream project is incompatible"; # Added 2023-10-16 dart_stable = dart; # Added 2020-01-15 dat = nodePackages.dat; deadpixi-sam = deadpixi-sam-unstable; diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 53465f6dfed0..ee73c3b9c5f3 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -4954,8 +4954,6 @@ with pkgs; daemontools = callPackage ../tools/admin/daemontools { }; - dagger = callPackage ../development/tools/continuous-integration/dagger { }; - dale = callPackage ../development/compilers/dale { }; damon = callPackage ../tools/admin/damon { }; From ce498282e672b28ff2733269fc646adb3a10b255 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 16 Oct 2023 12:46:12 +0000 Subject: [PATCH 63/82] prometheus-nextcloud-exporter: 0.6.1 -> 0.6.2 --- pkgs/servers/monitoring/prometheus/nextcloud-exporter.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/servers/monitoring/prometheus/nextcloud-exporter.nix b/pkgs/servers/monitoring/prometheus/nextcloud-exporter.nix index a0984b510260..2ca413c20af8 100644 --- a/pkgs/servers/monitoring/prometheus/nextcloud-exporter.nix +++ b/pkgs/servers/monitoring/prometheus/nextcloud-exporter.nix @@ -2,16 +2,16 @@ buildGoModule rec { pname = "prometheus-nextcloud-exporter"; - version = "0.6.1"; + version = "0.6.2"; src = fetchFromGitHub { owner = "xperimental"; repo = "nextcloud-exporter"; rev = "v${version}"; - sha256 = "sha256-8Pz1Xa8P0T+5P4qCoyRyRqPtAaSiZw4BV+rSZf4exC0="; + sha256 = "sha256-OiuhxawEpD29EhbzA9DYeJ1J1/uMQGgBTZR9m/5egHI="; }; - vendorHash = "sha256-NIJH5Ya+fZ+37y+Lim/WizNCOYk1lpPRf6u70IoiFZk="; + vendorHash = "sha256-QlMj4ATpJATlQAsrxIHG/1vrD5E/4brsda3BoGGzDgk="; passthru.tests = { inherit (nixosTests.prometheus-exporters) nextcloud; }; From ab710f653dc9083a7e82e38cb9d90d24e32c7158 Mon Sep 17 00:00:00 2001 From: Yureka Date: Mon, 16 Oct 2023 14:55:44 +0200 Subject: [PATCH 64/82] python3.pkgs.django-filter: 23.2 -> 23.3 (#257310) And enable tests --- .../python-modules/django-filter/default.nix | 29 ++++++++++--------- 1 file changed, 15 insertions(+), 14 deletions(-) diff --git a/pkgs/development/python-modules/django-filter/default.nix b/pkgs/development/python-modules/django-filter/default.nix index 80714b28cf72..dcbcede30563 100644 --- a/pkgs/development/python-modules/django-filter/default.nix +++ b/pkgs/development/python-modules/django-filter/default.nix @@ -1,43 +1,44 @@ { lib , buildPythonPackage , fetchPypi +, flit-core , django -, djangorestframework, python, mock +, djangorestframework +, pytestCheckHook +, pytest-django +, python }: buildPythonPackage rec { pname = "django-filter"; - version = "23.2"; + version = "23.3"; + format = "pyproject"; src = fetchPypi { inherit pname version; - hash = "sha256-L+FfeBCEde2lJWkoEyBfpvnowcrxrmXapYYtQDxtvwA="; + hash = "sha256-AV/hVVguGAW0Bik0Tkps88xARQgn0pTQQLS4wXSan6Y="; }; + nativeBuildInputs = [ flit-core ]; + propagatedBuildInputs = [ django ]; pythonImportsCheck = [ "django_filters" ]; - # Tests fail (needs the 'crispy_forms' module not packaged on nixos) - doCheck = false; - nativeCheckInputs = [ djangorestframework - django - mock + pytestCheckHook + pytest-django ]; - checkPhase = '' - runHook preCheck - ${python.interpreter} runtests.py tests - runHook postCheck - ''; + env.DJANGO_SETTINGS_MODULE = "tests.settings"; meta = with lib; { description = "Reusable Django application for allowing users to filter querysets dynamically"; - homepage = "https://pypi.org/project/django-filter/"; + homepage = "https://github.com/carltongibson/django-filter"; + changelog = "https://github.com/carltongibson/django-filter/blob/v${version}/CHANGES.rst"; license = licenses.bsd3; maintainers = with maintainers; [ mmai ]; }; From 9783947f42ed2212a4558872e1dd0fe65d330738 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 16 Oct 2023 13:17:58 +0000 Subject: [PATCH 65/82] python310Packages.typepy: 1.3.1 -> 1.3.2 --- pkgs/development/python-modules/typepy/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/typepy/default.nix b/pkgs/development/python-modules/typepy/default.nix index c5c393b29c01..ae97d857da8d 100644 --- a/pkgs/development/python-modules/typepy/default.nix +++ b/pkgs/development/python-modules/typepy/default.nix @@ -12,7 +12,7 @@ buildPythonPackage rec { pname = "typepy"; - version = "1.3.1"; + version = "1.3.2"; format = "setuptools"; disabled = pythonOlder "3.7"; @@ -21,7 +21,7 @@ buildPythonPackage rec { owner = "thombashi"; repo = pname; rev = "refs/tags/v${version}"; - hash = "sha256-cgy1+6RZ1DUyH45bAKpGPOOZCwhCUghummw2fnfJGww="; + hash = "sha256-oIDVjJwapHun0Rk04zOZ4IjAh7qZ2k0BXK6zqFmtVds="; }; propagatedBuildInputs = [ From df77975e68088a9ae43e5e6604a7a6c2173c3672 Mon Sep 17 00:00:00 2001 From: Jennifer Graul Date: Mon, 16 Oct 2023 14:02:21 +0200 Subject: [PATCH 66/82] prometheus-junos-czerwonk-exporter: change maintainters to wdz team --- pkgs/servers/monitoring/prometheus/junos-czerwonk-exporter.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/servers/monitoring/prometheus/junos-czerwonk-exporter.nix b/pkgs/servers/monitoring/prometheus/junos-czerwonk-exporter.nix index 7a72ab9cb903..b5c8d994bd0f 100644 --- a/pkgs/servers/monitoring/prometheus/junos-czerwonk-exporter.nix +++ b/pkgs/servers/monitoring/prometheus/junos-czerwonk-exporter.nix @@ -17,6 +17,6 @@ buildGoModule rec { description = "Exporter for metrics from devices running JunOS"; homepage = "https://github.com/czerwonk/junos_exporter"; license = licenses.mit; - maintainers = with maintainers; [ netali ]; + maintainers = teams.wdz.members; }; } From f96942e68bef55a89123b92a6a14dc2fa6bfdebc Mon Sep 17 00:00:00 2001 From: Jennifer Graul Date: Mon, 16 Oct 2023 14:04:05 +0200 Subject: [PATCH 67/82] oui: change maintainters to wdz team --- pkgs/tools/networking/oui/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/tools/networking/oui/default.nix b/pkgs/tools/networking/oui/default.nix index af9f564bf0f4..517eb06507b4 100644 --- a/pkgs/tools/networking/oui/default.nix +++ b/pkgs/tools/networking/oui/default.nix @@ -17,6 +17,6 @@ buildGoModule rec { description = "MAC Address CLI Toolkit"; homepage = "https://github.com/thatmattlove/oui"; license = with licenses; [ bsd3 ]; - maintainers = [ maintainers.netali ]; + maintainers = teams.wdz.members; }; } From 218bef911668c53d550a216faff29c037f316b77 Mon Sep 17 00:00:00 2001 From: lelgenio Date: Mon, 16 Oct 2023 10:33:45 -0300 Subject: [PATCH 68/82] nixos/writefreely: fix admin user creation on sqlite --- nixos/modules/services/web-apps/writefreely.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/services/web-apps/writefreely.nix b/nixos/modules/services/web-apps/writefreely.nix index a7671aa717f4..f92afa9276e3 100644 --- a/nixos/modules/services/web-apps/writefreely.nix +++ b/nixos/modules/services/web-apps/writefreely.nix @@ -120,7 +120,7 @@ let withConfigFile '' query () { local result=$(${sqlite}/bin/sqlite3 \ - '${cfg.stateDir}/${settings.database.filename}' + '${cfg.stateDir}/${settings.database.filename}' \ "$1" \ ) From 7247ec07ba5d78f7ce93b89461a1503a9a1b021f Mon Sep 17 00:00:00 2001 From: Silvan Mosberger Date: Mon, 16 Oct 2023 15:49:53 +0200 Subject: [PATCH 69/82] lib.fileset: Improved error for unsupported coercion values --- lib/fileset/internal.nix | 4 ++-- lib/fileset/tests.sh | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/lib/fileset/internal.nix b/lib/fileset/internal.nix index 546b93f158a1..9892172955c3 100644 --- a/lib/fileset/internal.nix +++ b/lib/fileset/internal.nix @@ -172,11 +172,11 @@ rec { else if ! isPath value then if isStringLike value then throw '' - ${context} ("${toString value}") is a string-like value, but it should be a path instead. + ${context} ("${toString value}") is a string-like value, but it should be a file set or a path instead. Paths represented as strings are not supported by `lib.fileset`, use `lib.sources` or derivations instead.'' else throw '' - ${context} is of type ${typeOf value}, but it should be a path instead.'' + ${context} is of type ${typeOf value}, but it should be a file set or a path instead.'' else if ! pathExists value then throw '' ${context} (${toString value}) does not exist.'' diff --git a/lib/fileset/tests.sh b/lib/fileset/tests.sh index 7a104654983f..529f23ae8871 100755 --- a/lib/fileset/tests.sh +++ b/lib/fileset/tests.sh @@ -355,8 +355,8 @@ expectFailure 'toSource { root = ./a; fileset = ./.; }' 'lib.fileset.toSource: ` rm -rf * # Path coercion only works for paths -expectFailure 'toSource { root = ./.; fileset = 10; }' 'lib.fileset.toSource: `fileset` is of type int, but it should be a path instead.' -expectFailure 'toSource { root = ./.; fileset = "/some/path"; }' 'lib.fileset.toSource: `fileset` \("/some/path"\) is a string-like value, but it should be a path instead. +expectFailure 'toSource { root = ./.; fileset = 10; }' 'lib.fileset.toSource: `fileset` is of type int, but it should be a file set or a path instead.' +expectFailure 'toSource { root = ./.; fileset = "/some/path"; }' 'lib.fileset.toSource: `fileset` \("/some/path"\) is a string-like value, but it should be a file set or a path instead. \s*Paths represented as strings are not supported by `lib.fileset`, use `lib.sources` or derivations instead.' # Path coercion errors for non-existent paths From 22f3d6b190a49614a23479a05a905ef35e8092ed Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= Date: Mon, 16 Oct 2023 16:03:15 +0200 Subject: [PATCH 70/82] bandwhich: 0.21.0 -> 0.21.1 Diff: https://github.com/imsnif/bandwhich/compare/v0.21.0...v0.21.1 --- pkgs/tools/networking/bandwhich/Cargo.lock | 471 +++++++++++++------- pkgs/tools/networking/bandwhich/default.nix | 4 +- 2 files changed, 324 insertions(+), 151 deletions(-) diff --git a/pkgs/tools/networking/bandwhich/Cargo.lock b/pkgs/tools/networking/bandwhich/Cargo.lock index 5d28b7691ca6..f0388a58d2bb 100644 --- a/pkgs/tools/networking/bandwhich/Cargo.lock +++ b/pkgs/tools/networking/bandwhich/Cargo.lock @@ -30,9 +30,9 @@ dependencies = [ [[package]] name = "aho-corasick" -version = "1.1.0" +version = "1.1.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0f2135563fb5c609d2b2b87c1e8ce7bc41b0b45430fa9661f457981503dd5bf0" +checksum = "b2969dcb958b36655471fc61f7e416fa76033bdd4bfed0678d8fee1e2d07a1f0" dependencies = [ "memchr", ] @@ -54,9 +54,9 @@ dependencies = [ [[package]] name = "anstream" -version = "0.5.0" +version = "0.6.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b1f58811cfac344940f1a400b6e6231ce35171f614f26439e80f8c1465c5cc0c" +checksum = "2ab91ebe16eb252986481c5b62f6098f3b698a45e34b5b98200cf20dd2484a44" dependencies = [ "anstyle", "anstyle-parse", @@ -68,15 +68,15 @@ dependencies = [ [[package]] name = "anstyle" -version = "1.0.3" +version = "1.0.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b84bf0a05bbb2a83e5eb6fa36bb6e87baa08193c35ff52bbf6b38d8af2890e46" +checksum = "7079075b41f533b8c61d2a4d073c4676e1f8b249ff94a393b0595db304e0dd87" [[package]] name = "anstyle-parse" -version = "0.2.1" +version = "0.2.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "938874ff5980b03a87c5524b3ae5b59cf99b1d6bc836848df7bc5ada9643c333" +checksum = "317b9a89c1868f5ea6ff1d9539a69f45dffc21ce321ac1fd1160dfa48c8e2140" dependencies = [ "utf8parse", ] @@ -92,9 +92,9 @@ dependencies = [ [[package]] name = "anstyle-wincon" -version = "2.1.0" +version = "3.0.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "58f54d10c6dfa51283a066ceab3ec1ab78d13fae00aa49243a45e4571fb79dfd" +checksum = "f0699d10d2f4d628a98ee7b57b289abbc98ff3bad977cb3152709d4bf2330628" dependencies = [ "anstyle", "windows-sys 0.48.0", @@ -111,13 +111,13 @@ dependencies = [ [[package]] name = "async-trait" -version = "0.1.73" +version = "0.1.74" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "bc00ceb34980c03614e35a3a4e218276a0a824e911d07651cd0d858a51e8c0f0" +checksum = "a66537f1bb974b254c98ed142ff995236e81b9d0fe4db0575f46612cb15eb0f9" dependencies = [ "proc-macro2", "quote", - "syn 2.0.37", + "syn 2.0.38", ] [[package]] @@ -143,16 +143,19 @@ dependencies = [ [[package]] name = "bandwhich" -version = "0.21.0" +version = "0.21.1" dependencies = [ "anyhow", "async-trait", "chrono", "clap", + "clap-verbosity-flag", "crossterm", + "derivative", "http_req", "insta", "ipnetwork", + "log", "netstat2", "packet-builder", "pnet", @@ -162,6 +165,8 @@ dependencies = [ "ratatui", "regex", "resolv-conf", + "rstest", + "simplelog", "sysinfo", "thiserror", "tokio", @@ -184,9 +189,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a" [[package]] name = "bitflags" -version = "2.4.0" +version = "2.4.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b4682ae6287fcf752ecaabbfcc7b6f9b72aa33933dc23a554d853aea8eea8635" +checksum = "327762f6e5a765692301e5bb513e0d9fef63be86bbc14528052b1cd3e6f03e07" [[package]] name = "block-buffer" @@ -205,9 +210,9 @@ checksum = "7f30e7476521f6f8af1a1c4c0b8cc94f0bee37d91763d0ca2665f299b6cd8aec" [[package]] name = "byteorder" -version = "1.4.3" +version = "1.5.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "14c189c53d098945499cdfa7ecc63567cf3886b3332b312a5b4585d8d3a6a610" +checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b" [[package]] name = "bytes" @@ -284,19 +289,29 @@ dependencies = [ [[package]] name = "clap" -version = "4.4.4" +version = "4.4.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b1d7b8d5ec32af0fadc644bf1fd509a688c2103b185644bb1e29d164e0703136" +checksum = "d04704f56c2cde07f43e8e2c154b43f216dc5c92fc98ada720177362f953b956" dependencies = [ "clap_builder", "clap_derive", ] [[package]] -name = "clap_builder" -version = "4.4.4" +name = "clap-verbosity-flag" +version = "2.0.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5179bb514e4d7c2051749d8fcefa2ed6d06a9f4e6d69faf3805f5d80b8cf8d56" +checksum = "1eef05769009513df2eb1c3b4613e7fad873a14c600ff025b08f250f59fee7de" +dependencies = [ + "clap", + "log", +] + +[[package]] +name = "clap_builder" +version = "4.4.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0e231faeaca65ebd1ea3c737966bf858971cd38c3849107aa3ea7de90a804e45" dependencies = [ "anstream", "anstyle", @@ -313,7 +328,7 @@ dependencies = [ "heck", "proc-macro2", "quote", - "syn 2.0.37", + "syn 2.0.38", ] [[package]] @@ -380,16 +395,6 @@ dependencies = [ "cfg-if", ] -[[package]] -name = "crossbeam-channel" -version = "0.5.8" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a33c2bf77f2df06183c3aa30d1e96c0695a313d4f9c453cc3762a6db39f99200" -dependencies = [ - "cfg-if", - "crossbeam-utils", -] - [[package]] name = "crossbeam-deque" version = "0.8.3" @@ -429,7 +434,7 @@ version = "0.27.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "f476fe445d41c9e991fd07515a6f463074b782242ccf4a5b7b1d1012e70824df" dependencies = [ - "bitflags 2.4.0", + "bitflags 2.4.1", "crossterm_winapi", "libc", "mio", @@ -466,9 +471,23 @@ checksum = "c2e66c9d817f1720209181c316d28635c050fa304f9c79e47a520882661b7308" [[package]] name = "deranged" -version = "0.3.8" +version = "0.3.9" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f2696e8a945f658fd14dc3b87242e6b80cd0f36ff04ea560fa39082368847946" +checksum = "0f32d04922c60427da6f9fef14d042d9edddef64cb9d4ce0d64d0685fbeb1fd3" +dependencies = [ + "powerfmt", +] + +[[package]] +name = "derivative" +version = "2.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "fcc3dd5e9e9c0b295d6e1e4d811fb6f157d5ffd784b8d202fc62eac8035a770b" +dependencies = [ + "proc-macro2", + "quote", + "syn 1.0.109", +] [[package]] name = "derive-new" @@ -513,41 +532,30 @@ dependencies = [ "heck", "proc-macro2", "quote", - "syn 2.0.37", + "syn 2.0.38", ] [[package]] name = "errno" -version = "0.3.3" +version = "0.3.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "136526188508e25c6fef639d7927dfb3e0e3084488bf202267829cf7fc23dbdd" +checksum = "ac3e13f66a2f95e32a39eaa81f6b95d42878ca0e1db0c7543723dfe12557e860" dependencies = [ - "errno-dragonfly", "libc", "windows-sys 0.48.0", ] -[[package]] -name = "errno-dragonfly" -version = "0.1.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "aa68f1b12764fab894d2755d2518754e71b4fd80ecfb822714a1206c2aab39bf" -dependencies = [ - "cc", - "libc", -] - [[package]] name = "fastrand" -version = "2.0.0" +version = "2.0.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6999dc1837253364c2ebb0704ba97994bd874e8f195d665c50b7548f6ea92764" +checksum = "25cbce373ec4653f1a01a31e8a5e5ec0c622dc27ff9c4e6606eefef5cbbed4a5" [[package]] name = "flate2" -version = "1.0.27" +version = "1.0.28" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c6c98ee8095e9d1dcbf2fcc6d95acccb90d1c81db1e44725c6a984b1dbdfb010" +checksum = "46303f565772937ffe1d394a4fac6f411c6013172fadde9dcdb1e147a086940e" dependencies = [ "crc32fast", "miniz_oxide", @@ -577,6 +585,21 @@ dependencies = [ "percent-encoding", ] +[[package]] +name = "futures" +version = "0.3.28" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "23342abe12aba583913b2e62f22225ff9c950774065e4bfb61a19cd9770fec40" +dependencies = [ + "futures-channel", + "futures-core", + "futures-executor", + "futures-io", + "futures-sink", + "futures-task", + "futures-util", +] + [[package]] name = "futures-channel" version = "0.3.28" @@ -584,6 +607,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "955518d47e09b25bbebc7a18df10b81f0c766eaf4c4f1cccef2fca5f2a4fb5f2" dependencies = [ "futures-core", + "futures-sink", ] [[package]] @@ -592,26 +616,65 @@ version = "0.3.28" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "4bca583b7e26f571124fe5b7561d49cb2868d79116cfa0eefce955557c6fee8c" +[[package]] +name = "futures-executor" +version = "0.3.28" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ccecee823288125bd88b4d7f565c9e58e41858e47ab72e8ea2d64e93624386e0" +dependencies = [ + "futures-core", + "futures-task", + "futures-util", +] + [[package]] name = "futures-io" version = "0.3.28" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "4fff74096e71ed47f8e023204cfd0aa1289cd54ae5430a9523be060cdb849964" +[[package]] +name = "futures-macro" +version = "0.3.28" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "89ca545a94061b6365f2c7355b4b32bd20df3ff95f02da9329b34ccc3bd6ee72" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.38", +] + +[[package]] +name = "futures-sink" +version = "0.3.28" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f43be4fe21a13b9781a69afa4985b0f6ee0e1afab2c6f454a8cf30e2b2237b6e" + [[package]] name = "futures-task" version = "0.3.28" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "76d3d132be6c0e6aa1534069c705a74a5997a356c0dc2f86a47765e5617c5b65" +[[package]] +name = "futures-timer" +version = "3.0.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e64b03909df88034c26dc1547e8970b91f98bdb65165d6a4e9110d94263dbb2c" + [[package]] name = "futures-util" version = "0.3.28" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "26b01e40b772d54cf6c6d721c1d1abd0647a0106a12ecaa1c186273392a69533" dependencies = [ + "futures-channel", "futures-core", + "futures-io", + "futures-macro", + "futures-sink", "futures-task", + "memchr", "pin-project-lite", "pin-utils", "slab", @@ -658,9 +721,9 @@ checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8" [[package]] name = "hermit-abi" -version = "0.3.2" +version = "0.3.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "443144c8cdadd93ebf52ddb4056d257f5b52c04d3c804e657d19eb73fc33668b" +checksum = "d77f7ec81a6d05a3abb01ab6eb7590f6083d08449fe5a1c8b1e620283546ccb7" [[package]] name = "hex" @@ -690,9 +753,9 @@ dependencies = [ [[package]] name = "http_req" -version = "0.9.3" +version = "0.10.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "42ce34c74ec562d68f2c23a532c62c1332ff1d1b6147fd118bd1938e090137d0" +checksum = "158d4edacc70c9bdb0464314063b8d9d60fa776442dc13b00a13581b88b0a0a0" dependencies = [ "native-tls", "unicase", @@ -748,9 +811,9 @@ dependencies = [ [[package]] name = "insta" -version = "1.31.0" +version = "1.34.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a0770b0a3d4c70567f0d58331f3088b0e4c4f56c9b8d764efe654b4a5d46de3a" +checksum = "5d64600be34b2fcfc267740a243fa7744441bb4947a619ac4e5bb6507f35fbfc" dependencies = [ "console", "lazy_static", @@ -807,10 +870,16 @@ dependencies = [ ] [[package]] -name = "jobserver" -version = "0.1.26" +name = "itoa" +version = "1.0.9" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "936cfd212a0155903bcbc060e316fb6cc7cbf2e1907329391ebadc1fe0ce77c2" +checksum = "af150ab688ff2122fcef229be89cb50dd66af9e01a4ff320cc137eecc9bacc38" + +[[package]] +name = "jobserver" +version = "0.1.27" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8c37f63953c4c63420ed5fd3d6d398c719489b9f872b9fa683262f8edd363c7d" dependencies = [ "libc", ] @@ -832,9 +901,9 @@ checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646" [[package]] name = "libc" -version = "0.2.148" +version = "0.2.149" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9cdc71e17332e86d2e1d38c1f99edcb6288ee11b815fb1a4b049eaa2114d369b" +checksum = "a08173bc88b7955d1b3145aa561539096c421ac8debde8cbc3612ec635fee29b" [[package]] name = "linked-hash-map" @@ -850,9 +919,9 @@ checksum = "f051f77a7c8e6957c0696eac88f26b0117e54f52d3fc682ab19397a8812846a4" [[package]] name = "linux-raw-sys" -version = "0.4.7" +version = "0.4.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1a9bad9f94746442c783ca431b22403b519cd7fbeed0533fdd6328b2f2212128" +checksum = "da2479e8c062e40bf0066ffa0bc823de0a9368974af99c9f6df941d2c231e03f" [[package]] name = "lock_api" @@ -887,9 +956,9 @@ checksum = "ffbee8634e0d45d258acb448e7eaab3fce7a0a467395d4d9f228e3c1f01fb2e4" [[package]] name = "memchr" -version = "2.6.3" +version = "2.6.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8f232d6ef707e1956a43342693d2a31e72989554d58299d7a88738cc95b0d35c" +checksum = "f665ee40bc4a3c5590afb1e9677db74a508659dfd71e126420da8274909a0167" [[package]] name = "memoffset" @@ -981,9 +1050,9 @@ dependencies = [ [[package]] name = "num-traits" -version = "0.2.16" +version = "0.2.17" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f30b0abd723be7e2ffca1272140fac1a2f084c77ec3e123c192b66af1ee9e6c2" +checksum = "39e3200413f237f41ab11ad6d161bc7239c84dcb631773ccd7de3dfe4b5c267c" dependencies = [ "autocfg", ] @@ -998,6 +1067,15 @@ dependencies = [ "libc", ] +[[package]] +name = "num_threads" +version = "0.1.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2819ce041d2ee131036f4fc9d6ae7ae125a3a40e97ba64d04fe799ad9dabbb44" +dependencies = [ + "libc", +] + [[package]] name = "object" version = "0.32.1" @@ -1019,7 +1097,7 @@ version = "0.10.57" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "bac25ee399abb46215765b1cb35bc0212377e58a061560d8b29b024fd0430e7c" dependencies = [ - "bitflags 2.4.0", + "bitflags 2.4.1", "cfg-if", "foreign-types", "libc", @@ -1036,7 +1114,7 @@ checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c" dependencies = [ "proc-macro2", "quote", - "syn 2.0.37", + "syn 2.0.38", ] [[package]] @@ -1189,7 +1267,7 @@ dependencies = [ "proc-macro2", "quote", "regex", - "syn 2.0.37", + "syn 2.0.38", ] [[package]] @@ -1235,6 +1313,12 @@ dependencies = [ "pnet_sys", ] +[[package]] +name = "powerfmt" +version = "0.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391" + [[package]] name = "ppv-lite86" version = "0.2.17" @@ -1243,9 +1327,9 @@ checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de" [[package]] name = "proc-macro2" -version = "1.0.67" +version = "1.0.69" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3d433d9f1a3e8c1263d9456598b16fec66f4acc9a74dacffd35c7bb09b3a1328" +checksum = "134c189feb4956b20f6f547d2cf727d4c0fe06722b20a0eec87ed445a97f92da" dependencies = [ "unicode-ident", ] @@ -1262,7 +1346,7 @@ dependencies = [ "flate2", "hex", "lazy_static", - "rustix 0.36.15", + "rustix 0.36.16", ] [[package]] @@ -1316,7 +1400,7 @@ version = "0.23.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "2e2e4cd95294a85c3b4446e63ef054eea43e0205b1fd60120c16b74ff7ff96ad" dependencies = [ - "bitflags 2.4.0", + "bitflags 2.4.1", "cassowary", "crossterm", "indoc", @@ -1329,9 +1413,9 @@ dependencies = [ [[package]] name = "rayon" -version = "1.7.0" +version = "1.8.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1d2df5196e37bcc87abebc0053e20787d73847bb33134a69841207dd0a47f03b" +checksum = "9c27db03db7734835b3f53954b534c91069375ce6ccaa2e065441e07d9b6cdb1" dependencies = [ "either", "rayon-core", @@ -1339,14 +1423,12 @@ dependencies = [ [[package]] name = "rayon-core" -version = "1.11.0" +version = "1.12.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4b8f95bd6966f5c87776639160a66bd8ab9895d9d4ab01ddba9fc60661aebe8d" +checksum = "5ce3fb6ad83f861aac485e76e1985cd109d9a3713802152be56c3b1f0e0658ed" dependencies = [ - "crossbeam-channel", "crossbeam-deque", "crossbeam-utils", - "num_cpus", ] [[package]] @@ -1360,9 +1442,9 @@ dependencies = [ [[package]] name = "regex" -version = "1.9.5" +version = "1.10.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "697061221ea1b4a94a624f67d0ae2bfe4e22b8a17b6a192afb11046542cc8c47" +checksum = "aaac441002f822bc9705a681810a4dd2963094b9ca0ddc41cb963a4c189189ea" dependencies = [ "aho-corasick", "memchr", @@ -1372,9 +1454,9 @@ dependencies = [ [[package]] name = "regex-automata" -version = "0.3.8" +version = "0.4.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c2f401f4955220693b56f8ec66ee9c78abffd8d1c4f23dc41a23839eb88f0795" +checksum = "5011c7e263a695dc8ca064cddb722af1be54e517a280b12a5356f98366899e5d" dependencies = [ "aho-corasick", "memchr", @@ -1383,9 +1465,15 @@ dependencies = [ [[package]] name = "regex-syntax" -version = "0.7.5" +version = "0.8.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dbb5fb1acd8a1a18b3dd5be62d25485eb770e05afb408a9627d14d451bae12da" +checksum = "c08c74e62047bb2de4ff487b251e4a92e24f48745648451635cec7d591162d9f" + +[[package]] +name = "relative-path" +version = "1.9.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c707298afce11da2efef2f600116fa93ffa7a032b5d7b628aa17711ec81383ca" [[package]] name = "resolv-conf" @@ -1397,6 +1485,35 @@ dependencies = [ "quick-error", ] +[[package]] +name = "rstest" +version = "0.18.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "97eeab2f3c0a199bc4be135c36c924b6590b88c377d416494288c14f2db30199" +dependencies = [ + "futures", + "futures-timer", + "rstest_macros", + "rustc_version", +] + +[[package]] +name = "rstest_macros" +version = "0.18.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d428f8247852f894ee1be110b375111b586d4fa431f6c46e64ba5a0dcccbe605" +dependencies = [ + "cfg-if", + "glob", + "proc-macro2", + "quote", + "regex", + "relative-path", + "rustc_version", + "syn 2.0.38", + "unicode-ident", +] + [[package]] name = "rustc-demangle" version = "0.1.23" @@ -1404,10 +1521,19 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d626bb9dae77e28219937af045c257c28bfd3f69333c512553507f5f9798cb76" [[package]] -name = "rustix" -version = "0.36.15" +name = "rustc_version" +version = "0.4.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c37f1bd5ef1b5422177b7646cba67430579cfe2ace80f284fee876bca52ad941" +checksum = "bfa0f585226d2e68097d4f95d113b15b83a82e819ab25717ec0590d9584ef366" +dependencies = [ + "semver", +] + +[[package]] +name = "rustix" +version = "0.36.16" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6da3636faa25820d8648e0e31c5d519bbb01f72fdf57131f0f5f7da5fed36eab" dependencies = [ "bitflags 1.3.2", "errno", @@ -1419,14 +1545,14 @@ dependencies = [ [[package]] name = "rustix" -version = "0.38.13" +version = "0.38.19" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d7db8590df6dfcd144d22afd1b83b36c21a18d7cbc1dc4bb5295a8712e9eb662" +checksum = "745ecfa778e66b2b63c88a61cb36e0eea109e803b0b86bf9879fbc77c70e86ed" dependencies = [ - "bitflags 2.4.0", + "bitflags 2.4.1", "errno", "libc", - "linux-raw-sys 0.4.7", + "linux-raw-sys 0.4.10", "windows-sys 0.48.0", ] @@ -1475,30 +1601,36 @@ dependencies = [ ] [[package]] -name = "serde" -version = "1.0.188" +name = "semver" +version = "1.0.20" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cf9e0fcba69a370eed61bcf2b728575f726b50b55cba78064753d708ddc7549e" +checksum = "836fa6a3e1e547f9a2c4040802ec865b5d85f4014efe00555d7090a3dcaa1090" + +[[package]] +name = "serde" +version = "1.0.189" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8e422a44e74ad4001bdc8eede9a4570ab52f71190e9c076d14369f38b9200537" dependencies = [ "serde_derive", ] [[package]] name = "serde_derive" -version = "1.0.188" +version = "1.0.189" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4eca7ac642d82aa35b60049a6eccb4be6be75e599bd2e9adb5f875a737654af2" +checksum = "1e48d1f918009ce3145511378cf68d613e3b3d9137d67272562080d68a2b32d5" dependencies = [ "proc-macro2", "quote", - "syn 2.0.37", + "syn 2.0.38", ] [[package]] name = "sha1" -version = "0.10.5" +version = "0.10.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f04293dc80c3993519f2d7f6f511707ee7094fe0c6d3406feb330cdb3540eba3" +checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba" dependencies = [ "cfg-if", "cpufeatures", @@ -1507,9 +1639,9 @@ dependencies = [ [[package]] name = "sha2" -version = "0.10.7" +version = "0.10.8" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "479fb9d862239e610720565ca91403019f2f00410f1864c5aa7479b950a76ed8" +checksum = "793db75ad2bcafc3ffa7c68b215fee268f537982cd901d132f89c6343f3a3dc8" dependencies = [ "cfg-if", "cpufeatures", @@ -1548,9 +1680,20 @@ dependencies = [ [[package]] name = "similar" -version = "2.2.1" +version = "2.3.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "420acb44afdae038210c99e69aae24109f32f15500aa708e81d46c9f29d55fcf" +checksum = "2aeaf503862c419d66959f5d7ca015337d864e9c49485d771b732e2a20453597" + +[[package]] +name = "simplelog" +version = "0.12.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "acee08041c5de3d5048c8b3f6f13fafb3026b24ba43c6a695a0c76179b844369" +dependencies = [ + "log", + "termcolor", + "time", +] [[package]] name = "slab" @@ -1563,9 +1706,9 @@ dependencies = [ [[package]] name = "smallvec" -version = "1.11.0" +version = "1.11.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "62bb4feee49fdd9f707ef802e22365a35de4b7b299de4763d44bfea899442ff9" +checksum = "942b4a808e05215192e39f4ab80813e599068285906cc91aa64f923db842bd5a" [[package]] name = "socket2" @@ -1594,15 +1737,15 @@ dependencies = [ [[package]] name = "strum_macros" -version = "0.25.2" +version = "0.25.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ad8d03b598d3d0fff69bf533ee3ef19b8eeb342729596df84bcc7e1f96ec4059" +checksum = "23dc1fa9ac9c169a78ba62f0b841814b7abae11bdd047b9c58f893439e309ea0" dependencies = [ "heck", "proc-macro2", "quote", "rustversion", - "syn 2.0.37", + "syn 2.0.38", ] [[package]] @@ -1624,9 +1767,9 @@ dependencies = [ [[package]] name = "syn" -version = "2.0.37" +version = "2.0.38" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7303ef2c05cd654186cb250d29049a24840ca25d2747c25c0381c8d9e2f582e8" +checksum = "e96b79aaa137db8f61e26363a0c9b47d8b4ec75da28b7d1d614c2303e232408b" dependencies = [ "proc-macro2", "quote", @@ -1657,46 +1800,69 @@ dependencies = [ "cfg-if", "fastrand", "redox_syscall", - "rustix 0.38.13", + "rustix 0.38.19", "windows-sys 0.48.0", ] [[package]] -name = "thiserror" -version = "1.0.48" +name = "termcolor" +version = "1.1.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9d6d7a740b8a666a7e828dd00da9c0dc290dff53154ea77ac109281de90589b7" +checksum = "bab24d30b911b2376f3a13cc2cd443142f0c81dda04c118693e35b3835757755" +dependencies = [ + "winapi-util", +] + +[[package]] +name = "thiserror" +version = "1.0.49" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1177e8c6d7ede7afde3585fd2513e611227efd6481bd78d2e82ba1ce16557ed4" dependencies = [ "thiserror-impl", ] [[package]] name = "thiserror-impl" -version = "1.0.48" +version = "1.0.49" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "49922ecae66cc8a249b77e68d1d0623c1b2c514f0060c27cdc68bd62a1219d35" +checksum = "10712f02019e9288794769fba95cd6847df9874d49d871d062172f9dd41bc4cc" dependencies = [ "proc-macro2", "quote", - "syn 2.0.37", + "syn 2.0.38", ] [[package]] name = "time" -version = "0.3.28" +version = "0.3.30" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "17f6bb557fd245c28e6411aa56b6403c689ad95061f50e4be16c274e70a17e48" +checksum = "c4a34ab300f2dee6e562c10a046fc05e358b29f9bf92277f30c3c8d82275f6f5" dependencies = [ "deranged", + "itoa", + "libc", + "num_threads", + "powerfmt", "serde", "time-core", + "time-macros", ] [[package]] name = "time-core" -version = "0.1.1" +version = "0.1.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7300fbefb4dadc1af235a9cef3737cea692a9d97e1b9cbcd4ebdae6f8868e6fb" +checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3" + +[[package]] +name = "time-macros" +version = "0.2.15" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4ad70d68dba9e1f8aceda7aa6711965dfec1cac869f311a51bd08b3a2ccbce20" +dependencies = [ + "time-core", +] [[package]] name = "tinyvec" @@ -1715,9 +1881,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20" [[package]] name = "tokio" -version = "1.32.0" +version = "1.33.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "17ed6077ed6cd6c74735e21f37eb16dc3935f96878b1fe961074089cc80893f9" +checksum = "4f38200e3ef7995e5ef13baec2f432a6da0aa9ac495b2c0e8f3b7eec2c92d653" dependencies = [ "backtrace", "bytes", @@ -1731,11 +1897,10 @@ dependencies = [ [[package]] name = "tracing" -version = "0.1.37" +version = "0.1.39" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8ce8c33a8d48bd45d624a6e523445fd21ec13d3653cd51f681abf67418f54eb8" +checksum = "ee2ef2af84856a50c1d430afce2fdded0a4ec7eda868db86409b4543df0797f9" dependencies = [ - "cfg-if", "pin-project-lite", "tracing-attributes", "tracing-core", @@ -1743,29 +1908,29 @@ dependencies = [ [[package]] name = "tracing-attributes" -version = "0.1.26" +version = "0.1.27" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5f4f31f56159e98206da9efd823404b79b6ef3143b4a7ab76e67b1751b25a4ab" +checksum = "34704c8d6ebcbc939824180af020566b01a7c01f80641264eba0999f6c2b6be7" dependencies = [ "proc-macro2", "quote", - "syn 2.0.37", + "syn 2.0.38", ] [[package]] name = "tracing-core" -version = "0.1.31" +version = "0.1.32" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0955b8137a1df6f1a2e9a37d8a6656291ff0297c1a97c24e0d8425fe2312f79a" +checksum = "c06d3da6113f116aaee68e4d601191614c9053067f9ab7f6edbcb161237daa54" dependencies = [ "once_cell", ] [[package]] name = "trust-dns-proto" -version = "0.23.0" +version = "0.23.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0dc775440033cb114085f6f2437682b194fa7546466024b1037e82a48a052a69" +checksum = "559ac980345f7f5020883dd3bcacf176355225e01916f8c2efecad7534f682c6" dependencies = [ "async-trait", "cfg-if", @@ -1788,9 +1953,9 @@ dependencies = [ [[package]] name = "trust-dns-resolver" -version = "0.23.0" +version = "0.23.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2dff7aed33ef3e8bf2c9966fccdfed93f93d46f432282ea875cd66faabc6ef2f" +checksum = "c723b0e608b24ad04c73b2607e0241b2c98fd79795a95e98b068b6966138a29d" dependencies = [ "cfg-if", "futures-util", @@ -1851,9 +2016,9 @@ checksum = "1dd624098567895118886609431a7c3b8f516e41d30e0643f03d94592a147e36" [[package]] name = "unicode-width" -version = "0.1.10" +version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c0edd1e5b14653f783770bce4a4dabb4a5108a5370a5f5d8cfe8710c361f6c8b" +checksum = "e51733f11c9c4f72aa0c160008246859e340b00807569a0da0e7a1079b27ba85" [[package]] name = "url" @@ -1911,7 +2076,7 @@ dependencies = [ "once_cell", "proc-macro2", "quote", - "syn 2.0.37", + "syn 2.0.38", "wasm-bindgen-shared", ] @@ -1933,7 +2098,7 @@ checksum = "54681b18a46765f095758388f2d0cf16eb8d4169b639ab575a8f5693af210c7b" dependencies = [ "proc-macro2", "quote", - "syn 2.0.37", + "syn 2.0.38", "wasm-bindgen-backend", "wasm-bindgen-shared", ] @@ -1966,6 +2131,15 @@ version = "0.4.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6" +[[package]] +name = "winapi-util" +version = "0.1.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f29e6f9198ba0d26b4c9f07dbe6f9ed633e1f3d5b8b414090084349e46a52596" +dependencies = [ + "winapi", +] + [[package]] name = "winapi-x86_64-pc-windows-gnu" version = "0.4.0" @@ -2173,11 +2347,10 @@ dependencies = [ [[package]] name = "zstd-sys" -version = "2.0.8+zstd.1.5.5" +version = "2.0.9+zstd.1.5.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5556e6ee25d32df2586c098bbfa278803692a20d0ab9565e049480d52707ec8c" +checksum = "9e16efa8a874a0481a574084d34cc26fdb3b99627480f785888deb6386506656" dependencies = [ "cc", - "libc", "pkg-config", ] diff --git a/pkgs/tools/networking/bandwhich/default.nix b/pkgs/tools/networking/bandwhich/default.nix index 78b8f7ddf1b5..c0fe0fbb8741 100644 --- a/pkgs/tools/networking/bandwhich/default.nix +++ b/pkgs/tools/networking/bandwhich/default.nix @@ -2,13 +2,13 @@ rustPlatform.buildRustPackage rec { pname = "bandwhich"; - version = "0.21.0"; + version = "0.21.1"; src = fetchFromGitHub { owner = "imsnif"; repo = pname; rev = "v${version}"; - hash = "sha256-FquV+V5BTIX0HB6lLqPMUTvnPn7Y8/jhl93qvrSkYLY="; + hash = "sha256-9+7ol2QSIXLkkRt/YlAobZHb3Tm+SmnjW/JufwimMTE="; }; cargoLock = { From 5e499eef287c3b5d36057a9bf7b9e7b47012b193 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 16 Oct 2023 14:06:24 +0000 Subject: [PATCH 71/82] python310Packages.unearth: 0.11.0 -> 0.11.1 --- pkgs/development/python-modules/unearth/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/unearth/default.nix b/pkgs/development/python-modules/unearth/default.nix index 4602a30fde98..cd11bf45df8d 100644 --- a/pkgs/development/python-modules/unearth/default.nix +++ b/pkgs/development/python-modules/unearth/default.nix @@ -15,14 +15,14 @@ buildPythonPackage rec { pname = "unearth"; - version = "0.11.0"; + version = "0.11.1"; format = "pyproject"; disabled = pythonOlder "3.7"; src = fetchPypi { inherit pname version; - hash = "sha256-ryBymzmNLzuDklHXReT0DyPLCb1reX4Kb/bu1GynBCI="; + hash = "sha256-abnU2GFz9vvoz2hcgpwxpg0MguG81sW1mvj9Vkvw3Bo="; }; nativeBuildInputs = [ From be4d94890e639be870e525c2158308b9bd39278b Mon Sep 17 00:00:00 2001 From: Gaetan Lepage Date: Mon, 16 Oct 2023 13:32:33 +0200 Subject: [PATCH 72/82] vimPluginsUpdater: fix nvim-treesitter grammars update --- .../editors/vim/plugins/nvim-treesitter/update.py | 9 +++++---- pkgs/applications/editors/vim/plugins/update.py | 10 +++++++--- 2 files changed, 12 insertions(+), 7 deletions(-) diff --git a/pkgs/applications/editors/vim/plugins/nvim-treesitter/update.py b/pkgs/applications/editors/vim/plugins/nvim-treesitter/update.py index 6d9fd4de0984..4b70d8555dd2 100755 --- a/pkgs/applications/editors/vim/plugins/nvim-treesitter/update.py +++ b/pkgs/applications/editors/vim/plugins/nvim-treesitter/update.py @@ -63,14 +63,14 @@ def update_grammars(nvim_treesitter_dir: str): generated_file = """# generated by pkgs/applications/editors/vim/plugins/nvim-treesitter/update.py - { buildGrammar, """ +{ buildGrammar, """ generated_file += subprocess.check_output(["nurl", "-Ls", ", "], text=True) generated_file += """ }: - { - """ +{ +""" lockfile_path = os.path.join(nvim_treesitter_dir, "lockfile.json") log.debug("Opening %s", lockfile_path) @@ -88,7 +88,8 @@ def update_grammars(nvim_treesitter_dir: str): _generate_grammar, lockfile.items() ): generated_file += generated - generated_file += "}\n" + + generated_file += "}\n" return generated_file diff --git a/pkgs/applications/editors/vim/plugins/update.py b/pkgs/applications/editors/vim/plugins/update.py index b658ca7e2bd9..e7e50c21d475 100755 --- a/pkgs/applications/editors/vim/plugins/update.py +++ b/pkgs/applications/editors/vim/plugins/update.py @@ -138,15 +138,19 @@ class VimEditor(pluginupdate.Editor): nvim_treesitter_dir = subprocess.check_output(cmd, text=True, timeout=90).strip() generated = treesitter.update_grammars(nvim_treesitter_dir) - open(os.path.join(args.nixpkgs, "generated.nix"), "w").write(generated) + treesitter_generated_nix_path = os.path.join( + NIXPKGS_NVIMTREESITTER_FOLDER, + "generated.nix" + ) + open(os.path.join(args.nixpkgs, treesitter_generated_nix_path), "w").write(generated) if self.nixpkgs_repo: index = self.nixpkgs_repo.index for diff in index.diff(None): - if diff.a_path == f"{NIXPKGS_NVIMTREESITTER_FOLDER}/generated.nix": + if diff.a_path == treesitter_generated_nix_path: msg = "vimPlugins.nvim-treesitter: update grammars" print(f"committing to nixpkgs: {msg}") - index.add([str(nvim_treesitter_dir.joinpath("generated.nix"))]) + index.add([treesitter_generated_nix_path]) index.commit(msg) return print("no updates to nvim-treesitter grammars") From 35824864ee737433e6a9901393d498d410278927 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 16 Oct 2023 14:34:34 +0000 Subject: [PATCH 73/82] python310Packages.uptime-kuma-api: 1.2.0 -> 1.2.1 --- pkgs/development/python-modules/uptime-kuma-api/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/uptime-kuma-api/default.nix b/pkgs/development/python-modules/uptime-kuma-api/default.nix index 2912c44fcf06..1d7db943ad81 100644 --- a/pkgs/development/python-modules/uptime-kuma-api/default.nix +++ b/pkgs/development/python-modules/uptime-kuma-api/default.nix @@ -7,7 +7,7 @@ buildPythonPackage rec { pname = "uptime-kuma-api"; - version = "1.2.0"; + version = "1.2.1"; format = "setuptools"; disabled = pythonOlder "3.7"; @@ -15,7 +15,7 @@ buildPythonPackage rec { src = fetchPypi { pname = "uptime_kuma_api"; inherit version; - hash = "sha256-owRLc6823jJbEEzdJ3ORCkQfaEvxxs0uwYLzzCa17zI="; + hash = "sha256-tZ5ln3sy6W5RLcwjzLbhobCNLbHXIhXIzrcOVCG+Z+E="; }; propagatedBuildInputs = [ From dc41a2fc0c24ed4ff85d745a4826e6e6b06f966a Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Mon, 16 Oct 2023 16:56:55 +0200 Subject: [PATCH 74/82] python311Packages.pylutron-caseta: 0.18.2 -> 0.18.3 https://github.com/gurumitts/pylutron-caseta/blob/v0.18.3/CHANGELOG.md --- .../python-modules/pylutron-caseta/default.nix | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/pkgs/development/python-modules/pylutron-caseta/default.nix b/pkgs/development/python-modules/pylutron-caseta/default.nix index fd9ca66daebe..e069e902687f 100644 --- a/pkgs/development/python-modules/pylutron-caseta/default.nix +++ b/pkgs/development/python-modules/pylutron-caseta/default.nix @@ -1,9 +1,9 @@ { lib +, async-timeout , buildPythonPackage , cryptography , fetchFromGitHub , pytest-asyncio -, pytest-sugar , pytest-timeout , pytestCheckHook , pythonOlder @@ -12,7 +12,7 @@ buildPythonPackage rec { pname = "pylutron-caseta"; - version = "0.18.2"; + version = "0.18.3"; format = "pyproject"; disabled = pythonOlder "3.8"; @@ -21,7 +21,7 @@ buildPythonPackage rec { owner = "gurumitts"; repo = pname; rev = "refs/tags/v${version}"; - hash = "sha256-GyYJZIjvy4JYNCUUJpQxt32U8lMS/iQoz4llbCmJQhU="; + hash = "sha256-tjmMu7LUne+hLLTXGqHhci9/PZiuQ10mQaARvL2sdIM="; }; nativeBuildInputs = [ @@ -34,9 +34,10 @@ buildPythonPackage rec { nativeCheckInputs = [ pytest-asyncio - pytest-sugar pytest-timeout pytestCheckHook + ] ++ lib.optionals (pythonOlder "3.11") [ + async-timeout ]; pytestFlagsArray = [ From d3b60a85dff1e6754d1a41864f833f2e09d73cf2 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Mon, 16 Oct 2023 17:01:24 +0200 Subject: [PATCH 75/82] home-assistant: 2023.10.1 -> 2023.10.3 https://github.com/home-assistant/core/releases/tag/2023.10.2 https://github.com/home-assistant/core/releases/tag/2023.10.3 --- pkgs/servers/home-assistant/component-packages.nix | 3 +-- pkgs/servers/home-assistant/default.nix | 6 +++--- 2 files changed, 4 insertions(+), 5 deletions(-) diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix index 0d608126f8ab..128f20777fe2 100644 --- a/pkgs/servers/home-assistant/component-packages.nix +++ b/pkgs/servers/home-assistant/component-packages.nix @@ -2,7 +2,7 @@ # Do not edit! { - version = "2023.10.1"; + version = "2023.10.3"; components = { "3_day_blinds" = ps: with ps; [ ]; @@ -2485,7 +2485,6 @@ maxcube-api ]; "mazda" = ps: with ps; [ - pymazda ]; "meater" = ps: with ps; [ meater-python diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix index 3a520a379044..9bc35bd882c9 100644 --- a/pkgs/servers/home-assistant/default.nix +++ b/pkgs/servers/home-assistant/default.nix @@ -296,7 +296,7 @@ let extraBuildInputs = extraPackages python.pkgs; # Don't forget to run parse-requirements.py after updating - hassVersion = "2023.10.1"; + hassVersion = "2023.10.3"; in python.pkgs.buildPythonApplication rec { pname = "homeassistant"; @@ -312,7 +312,7 @@ in python.pkgs.buildPythonApplication rec { # Primary source is the pypi sdist, because it contains translations src = fetchPypi { inherit pname version; - hash = "sha256-3VkV5DirOzLO9Qbo4s5of5Aie7JvSAN7hgHBTA8koAE="; + hash = "sha256-7Eg6Ik8eiPPUTXyRedQLixaCnHDg9Dmikmhcq55+458="; }; # Secondary source is git for tests @@ -320,7 +320,7 @@ in python.pkgs.buildPythonApplication rec { owner = "home-assistant"; repo = "core"; rev = "refs/tags/${version}"; - hash = "sha256-mzj4JJ81Wr5FO1lVVwHlgnS3olxzXzMw0lFYPbTf634="; + hash = "sha256-4J1BBC6PvfbN4fKD+zUpW19sMvoKALilitNJlwB0ZTk="; }; nativeBuildInputs = with python.pkgs; [ From 391e4ef53490575c11250a5efda97c0aca07cf5e Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Mon, 16 Oct 2023 17:03:26 +0200 Subject: [PATCH 76/82] python311Packages.pymazda: remove The upstream repo is gone, because of a DCMA claim by Mazda. --- .../python-modules/pymazda/default.nix | 45 ------------------- pkgs/top-level/python-aliases.nix | 1 + pkgs/top-level/python-packages.nix | 2 - 3 files changed, 1 insertion(+), 47 deletions(-) delete mode 100644 pkgs/development/python-modules/pymazda/default.nix diff --git a/pkgs/development/python-modules/pymazda/default.nix b/pkgs/development/python-modules/pymazda/default.nix deleted file mode 100644 index b0b83ca84038..000000000000 --- a/pkgs/development/python-modules/pymazda/default.nix +++ /dev/null @@ -1,45 +0,0 @@ -{ lib -, aiohttp -, buildPythonPackage -, cryptography -, fetchPypi -, poetry-core -, pythonOlder -}: - -buildPythonPackage rec { - pname = "pymazda"; - version = "0.3.11"; - format = "pyproject"; - - disabled = pythonOlder "3.8"; - - src = fetchPypi { - inherit pname version; - hash = "sha256-DiXLY4mfgRbE0Y1tOJnkMSQQj1vcySLVDBthOWe7/dM="; - }; - - nativeBuildInputs = [ - poetry-core - ]; - - propagatedBuildInputs = [ - aiohttp - cryptography - ]; - - # Project has no tests - doCheck = false; - - pythonImportsCheck = [ - "pymazda" - ]; - - meta = with lib; { - description = "Python client for interacting with the MyMazda API"; - homepage = "https://github.com/bdr99/pymazda"; - changelog = "https://github.com/bdr99/pymazda/releases/tag/${version}"; - license = licenses.mit; - maintainers = with maintainers; [ fab ]; - }; -} diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix index 9d39469d2dc7..6d28fd6dc2f1 100644 --- a/pkgs/top-level/python-aliases.nix +++ b/pkgs/top-level/python-aliases.nix @@ -285,6 +285,7 @@ mapAliases ({ pylibgen = throw "pylibgen is unmaintained upstreamed, and removed from nixpkgs"; # added 2020-06-20 PyLD = pyld; # added 2022-06-22 pymatgen-lammps = throw "pymatgen-lammps has been removed because it is unmaintained and broken"; # added 2023-06-20 + pymazda = throw "pymazda has been removed, because the upstream repo has been affected by a DCMA claim."; # added 2023-10-16 pymc3 = pymc; # added 2022-06-05, module was rename starting with 4.0.0 pymssql = throw "pymssql has been abandoned upstream."; # added 2020-05-04 PyMVGLive = pymvglive; # added 2023-02-19 diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index 2b7d70991bfc..7351988a0fcb 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -10352,8 +10352,6 @@ self: super: with self; { pymavlink = callPackage ../development/python-modules/pymavlink { }; - pymazda = callPackage ../development/python-modules/pymazda { }; - pymbolic = callPackage ../development/python-modules/pymbolic { }; pymc = callPackage ../development/python-modules/pymc { }; From 19bc53adab95c341d34ccc8f01498e79ee43c024 Mon Sep 17 00:00:00 2001 From: Austin Seipp Date: Sun, 15 Oct 2023 14:23:36 +0000 Subject: [PATCH 77/82] buck2: unstable-2023-10-01 -> unstable-2023-10-15 --- .../development/tools/build-managers/buck2/default.nix | 4 ++-- .../development/tools/build-managers/buck2/hashes.json | 10 +++++----- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/pkgs/development/tools/build-managers/buck2/default.nix b/pkgs/development/tools/build-managers/buck2/default.nix index 7fa99a962264..5ae28b1512c2 100644 --- a/pkgs/development/tools/build-managers/buck2/default.nix +++ b/pkgs/development/tools/build-managers/buck2/default.nix @@ -38,7 +38,7 @@ let buildHashes = builtins.fromJSON (builtins.readFile ./hashes.json); # our version of buck2; this should be a git tag - version = "2023-10-01"; + version = "2023-10-15"; # the platform-specific, statically linked binary — which is also # zstd-compressed @@ -63,7 +63,7 @@ let # tooling prelude-src = let - prelude-hash = "75aa81a92edd2bf477538f9a3f0fe6a47e811842"; + prelude-hash = "880be565178cf1e08ce9badef52b215f91e48479"; name = "buck2-prelude-${version}.tar.gz"; hash = buildHashes."_prelude"; url = "https://github.com/facebook/buck2-prelude/archive/${prelude-hash}.tar.gz"; diff --git a/pkgs/development/tools/build-managers/buck2/hashes.json b/pkgs/development/tools/build-managers/buck2/hashes.json index 53df40eb622e..b444cfeeae04 100644 --- a/pkgs/development/tools/build-managers/buck2/hashes.json +++ b/pkgs/development/tools/build-managers/buck2/hashes.json @@ -1,7 +1,7 @@ { "_comment": "@generated by pkgs/development/tools/build-managers/buck2/update.sh" -, "_prelude": "sha256-SshYnziEP/2jdoeLZYkQOvH56VBOJZaf0TUt++tLO1U=" -, "x86_64-linux": "sha256-eztjSDjgtXZWeDSPsKNSUGlIR+g8DsByIjDpcGNXB2s=" -, "x86_64-darwin": "sha256-buC0mShgDPU1+oeuNdjP6hNq1MoJDIPaEHCGL+Rcsr8=" -, "aarch64-linux": "sha256-52Ld12TzC51OutjZY+idpd7GhFr2tPksz1pda4F9Zag=" -, "aarch64-darwin": "sha256-b9peYBF9FZbSdMiwC8E/+y15pWlFe37/Euj5v8q3v1E=" +, "_prelude": "sha256-mm9jU74rsLpiMzuDmSih6tzY4+NOiR15j+W96BVe/OI=" +, "x86_64-linux": "sha256-qxymUjsSwCf6ev5TwlkWVGtMc9tj6Vt4yMIPaLHFAMM=" +, "x86_64-darwin": "sha256-DGfpByvL4gmP+CR7VLCZS8IGSJ3esHhuKxHUfXJb/6k=" +, "aarch64-linux": "sha256-zc9LEYmpVJttCTI6Qxm25KZRX8CJVJzVtSbouw0LB6g=" +, "aarch64-darwin": "sha256-HUzpKJQN/22IQYmHLhW0fVQs0f86rREMTlp+yOfK0+Y=" } From f66ea232509331f6d23a1fe670359dd4ef8ceca7 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 16 Oct 2023 15:14:46 +0000 Subject: [PATCH 78/82] python310Packages.vispy: 0.14.0 -> 0.14.1 --- pkgs/development/python-modules/vispy/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/vispy/default.nix b/pkgs/development/python-modules/vispy/default.nix index 67c34776ff1a..ae52494d78cd 100644 --- a/pkgs/development/python-modules/vispy/default.nix +++ b/pkgs/development/python-modules/vispy/default.nix @@ -17,14 +17,14 @@ buildPythonPackage rec { pname = "vispy"; - version = "0.14.0"; + version = "0.14.1"; format = "setuptools"; disabled = pythonOlder "3.7"; src = fetchPypi { inherit pname version; - hash = "sha256-3vcn528rZd7YhmSoPaUN2peWOWHBbxOk2FCr3UWTD5Q="; + hash = "sha256-JJpQl5/ACotlEJKDNU3PEs9BXBpdz5gh4RP25ZC5uTw="; }; patches = [ From d3ae415ae2b2837f8d81297a1e9915da6614eb06 Mon Sep 17 00:00:00 2001 From: Henner Zeller Date: Sun, 15 Oct 2023 08:14:19 -0700 Subject: [PATCH 79/82] yosys-synlig: init at 2023.10.12 --- .../plugins/synlig-makefile-for-nix.patch | 66 +++++++++++++++++ .../compilers/yosys/plugins/synlig.nix | 73 +++++++++++++++++++ pkgs/top-level/all-packages.nix | 1 + 3 files changed, 140 insertions(+) create mode 100644 pkgs/development/compilers/yosys/plugins/synlig-makefile-for-nix.patch create mode 100644 pkgs/development/compilers/yosys/plugins/synlig.nix diff --git a/pkgs/development/compilers/yosys/plugins/synlig-makefile-for-nix.patch b/pkgs/development/compilers/yosys/plugins/synlig-makefile-for-nix.patch new file mode 100644 index 000000000000..7d1f407d6fdc --- /dev/null +++ b/pkgs/development/compilers/yosys/plugins/synlig-makefile-for-nix.patch @@ -0,0 +1,66 @@ +diff --git a/Makefile b/Makefile +index 4c96ae7..9e1a2e3 100755 +--- a/Makefile ++++ b/Makefile +@@ -3,7 +3,7 @@ + # Setup make itself. + + .ONESHELL: +-override SHELL := /bin/bash ++SHELL := bash + override .SHELLFLAGS := -e -u -o pipefail -O nullglob -O extglob -O globstar -c + + # Unset all default build- and recipe-related variables. +@@ -315,7 +315,6 @@ endif + GetTargetStructName = target[${1}] + + makefiles_to_include := \ +- third_party/Build.*.mk \ + frontends/*/Build.mk \ + tests/*/Build.mk \ + lib/*/Build.mk +diff --git a/frontends/systemverilog/Build.mk b/frontends/systemverilog/Build.mk +index acd9cb6..c039994 100644 +--- a/frontends/systemverilog/Build.mk ++++ b/frontends/systemverilog/Build.mk +@@ -1,6 +1,7 @@ + t := systemverilog-plugin + ts := $(call GetTargetStructName,${t}) + out_dir := $(call GetTargetBuildDir,${t}) ++mod_dir := third_party/yosys_mod + + cxx_is_clang := $(findstring clang,$(notdir ${CXX})) + +@@ -13,9 +14,9 @@ ${ts}.sources := \ + ${${ts}.src_dir}uhdm_ast_frontend.cc \ + ${${ts}.src_dir}uhdm_common_frontend.cc \ + ${${ts}.src_dir}uhdm_surelog_ast_frontend.cc \ +- ${$(call GetTargetStructName,yosys).mod_dir}const2ast.cc \ +- ${$(call GetTargetStructName,yosys).mod_dir}edif.cc \ +- ${$(call GetTargetStructName,yosys).mod_dir}simplify.cc ++ $(mod_dir)/const2ast.cc \ ++ $(mod_dir)/edif.cc \ ++ $(mod_dir)/simplify.cc + + define ${ts}.env = + export PKG_CONFIG_PATH=$(call ShQuote,${$(call GetTargetStructName,surelog).output_vars.PKG_CONFIG_PATH}$(if ${PKG_CONFIG_PATH},:${PKG_CONFIG_PATH})) +@@ -35,8 +36,8 @@ endif + endif + + ${ts}.cxxflags = \ +- -I${$(call GetTargetStructName,yosys).src_dir} \ +- -I${$(call GetTargetStructName,yosys).mod_dir} \ ++ -I$(shell yosys-config --cxxflags) \ ++ -I$(mod_dir) \ + -D_YOSYS_ \ + -DYOSYS_ENABLE_PLUGINS \ + $(shell ${${ts}.env}; pkg-config --cflags Surelog) \ +@@ -55,7 +56,7 @@ ${ts}.ldflags = \ + $(shell ${${ts}.env}; pkg-config --libs-only-L Surelog) \ + ${build_type_ldflags} \ + ${LDFLAGS} \ +- -Wl,--export-dynamic ++ $(shell yosys-config --ldflags --ldlibs) + + ${ts}.ldlibs = \ + $(shell ${${ts}.env}; pkg-config --libs-only-l --libs-only-other Surelog) \ diff --git a/pkgs/development/compilers/yosys/plugins/synlig.nix b/pkgs/development/compilers/yosys/plugins/synlig.nix new file mode 100644 index 000000000000..ccbf88159313 --- /dev/null +++ b/pkgs/development/compilers/yosys/plugins/synlig.nix @@ -0,0 +1,73 @@ +{ stdenv +, lib +, fetchFromGitHub +, pkg-config +, antlr4 +, capnproto +, readline +, surelog +, uhdm +, yosys +}: + +stdenv.mkDerivation (finalAttrs: { + pname = "yosys-synlig"; + version = "2023.10.12"; # Currently no tagged versions upstream + plugin = "synlig"; + + src = fetchFromGitHub { + owner = "chipsalliance"; + repo = "synlig"; + rev = "c5bd73595151212c61709d69a382917e96877a14"; + sha256 = "sha256-WJhf5gdZTCs3EeNocP9aZAh6EZquHgYOG/xiTo8l0ao="; + fetchSubmodules = false; # we use all dependencies from nix + }; + + patches = [ + ./synlig-makefile-for-nix.patch # Remove assumption submodules available. + ]; + + nativeBuildInputs = [ + pkg-config + ]; + + buildInputs = [ + antlr4.runtime.cpp + capnproto + readline + surelog + uhdm + yosys + ]; + + buildPhase = '' + runHook preBuild + make -j $NIX_BUILD_CORES build@systemverilog-plugin + runHook postBuild + ''; + + # Very simple litmus test that the plugin can be loaded successfully. + doCheck = true; + checkPhase = '' + runHook preCheck + yosys -p "plugin -i build/release/systemverilog-plugin/systemverilog.so;\ + help read_systemverilog" | grep "Read SystemVerilog files using" + runHook postCheck + ''; + + installPhase = '' + runHook preInstall + mkdir -p $out/share/yosys/plugins + cp ./build/release/systemverilog-plugin/systemverilog.so \ + $out/share/yosys/plugins/systemverilog.so + runHook postInstall + ''; + + meta = with lib; { + description = "SystemVerilog support plugin for Yosys"; + homepage = "https://github.com/chipsalliance/synlig"; + license = licenses.asl20; + maintainers = with maintainers; [ hzeller ]; + platforms = platforms.all; + }; +}) diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 9ff1a5da6938..80a8b1f295a5 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -17484,6 +17484,7 @@ with pkgs; yosys = callPackage ../development/compilers/yosys { }; yosys-bluespec = callPackage ../development/compilers/yosys/plugins/bluespec.nix { }; yosys-ghdl = callPackage ../development/compilers/yosys/plugins/ghdl.nix { }; + yosys-synlig = callPackage ../development/compilers/yosys/plugins/synlig.nix { }; yosys-symbiflow = callPackage ../development/compilers/yosys/plugins/symbiflow.nix { }; z88dk = callPackage ../development/compilers/z88dk { }; From ea61b75a4b6c851828ff7a7c92c8b598706b612a Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 16 Oct 2023 12:57:00 +0000 Subject: [PATCH 80/82] python310Packages.txtai: 6.0.0 -> 6.1.0 --- pkgs/development/python-modules/txtai/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/txtai/default.nix b/pkgs/development/python-modules/txtai/default.nix index 1d4413a6dce9..c4214fdc3c61 100644 --- a/pkgs/development/python-modules/txtai/default.nix +++ b/pkgs/development/python-modules/txtai/default.nix @@ -52,7 +52,7 @@ , unittestCheckHook }: let - version = "6.0.0"; + version = "6.1.0"; api = [ aiohttp fastapi uvicorn ]; # cloud = [ apache-libcloud ]; console = [ rich ]; @@ -105,7 +105,7 @@ buildPythonPackage { owner = "neuml"; repo = "txtai"; rev = "refs/tags/v${version}"; - hash = "sha256-lGRdSUSQGdxe+I4WrUkE4hIyyJ1HcFn3cXO3zd27fsM="; + hash = "sha256-ZUMfDyebroa9r01bOUFYDyVjuNUqlPU88HBocp3YQJ4="; }; nativeBuildInputs = [ From add41fac3caa00d0f737f0c46c77b9e79fd15358 Mon Sep 17 00:00:00 2001 From: Nick Cao Date: Mon, 16 Oct 2023 12:40:21 -0400 Subject: [PATCH 81/82] Revert "python310Packages.sabctools: 7.1.2 -> 8.0.0" --- pkgs/development/python-modules/sabctools/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/sabctools/default.nix b/pkgs/development/python-modules/sabctools/default.nix index 406d46590a7e..d20ea7318620 100644 --- a/pkgs/development/python-modules/sabctools/default.nix +++ b/pkgs/development/python-modules/sabctools/default.nix @@ -6,12 +6,12 @@ }: buildPythonPackage rec { pname = "sabctools"; - version = "8.0.0"; # needs to match version sabnzbd expects, e.g. https://github.com/sabnzbd/sabnzbd/blob/4.0.x/requirements.txt#L3 + version = "7.1.2"; # needs to match version sabnzbd expects, e.g. https://github.com/sabnzbd/sabnzbd/blob/4.0.x/requirements.txt#L3 format = "setuptools"; src = fetchPypi { inherit pname version; - hash = "sha256-hrRpEVhmnm4ABSqN/F3MllCgoJCg1PdM+oVrQR+uZbk="; + hash = "sha256-wDgFXuxclmqMlRXyr9qpruJJcOXfOiOWTZXX53uYEB8="; }; pythonImportsCheck = ["sabctools"]; From e8b4e945ddfdbe221242131475711e487e1b2eb6 Mon Sep 17 00:00:00 2001 From: nikstur Date: Mon, 16 Oct 2023 19:03:57 +0200 Subject: [PATCH 82/82] nixos/systemd-repart: remove superfluous gpt manipulation --- nixos/tests/systemd-repart.nix | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/nixos/tests/systemd-repart.nix b/nixos/tests/systemd-repart.nix index 22ea8fbd2271..3914d5b32397 100644 --- a/nixos/tests/systemd-repart.nix +++ b/nixos/tests/systemd-repart.nix @@ -29,16 +29,6 @@ let "+32M", ]) - # Fix the GPT table by moving the backup table to the end of the enlarged - # disk image. This is necessary because we increased the size of the disk - # before. The disk needs to be a raw disk because sgdisk can only run on - # raw images. - subprocess.run([ - "${pkgs.gptfdisk}/bin/sgdisk", - "--move-second-header", - tmp_disk_image.name, - ]) - # Set NIX_DISK_IMAGE so that the qemu script finds the right disk image. os.environ['NIX_DISK_IMAGE'] = tmp_disk_image.name '';