From 55b5f298205f6c37db43edb1f79fe6f10151500f Mon Sep 17 00:00:00 2001 From: rnhmjoj Date: Wed, 9 Oct 2024 20:56:45 +0200 Subject: [PATCH 1/2] dhcpcd: bring back enablePrivSep option --- pkgs/tools/networking/dhcpcd/default.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/pkgs/tools/networking/dhcpcd/default.nix b/pkgs/tools/networking/dhcpcd/default.nix index e5affd02a554..5d5e4a0b32e2 100644 --- a/pkgs/tools/networking/dhcpcd/default.nix +++ b/pkgs/tools/networking/dhcpcd/default.nix @@ -7,6 +7,7 @@ , runtimeShellPackage , runtimeShell , nixosTests +, enablePrivSep ? false }: stdenv.mkDerivation rec { @@ -39,7 +40,8 @@ stdenv.mkDerivation rec { "--localstatedir=/var" "--disable-privsep" "--dbdir=/var/lib/dhcpcd" - ]; + (lib.enableFeature enablePrivSep "privsep") + ] ++ lib.optional enablePrivSep "--privsepuser=dhcpcd"; makeFlags = [ "PREFIX=${placeholder "out"}" ]; From fb28bba040d49219153cfeab588f0ab1a9f25aaf Mon Sep 17 00:00:00 2001 From: rnhmjoj Date: Wed, 9 Oct 2024 20:57:17 +0200 Subject: [PATCH 2/2] nixos/release-notes: remove duplicate note Fix up the merge of the two dhcpcd hardening PRs (#336988 and #208780) --- nixos/doc/manual/release-notes/rl-2411.section.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md index c885be49b745..bb5164ab57fc 100644 --- a/nixos/doc/manual/release-notes/rl-2411.section.md +++ b/nixos/doc/manual/release-notes/rl-2411.section.md @@ -600,8 +600,6 @@ - `nixosTests` now provide a working IPv6 setup for VLAN 1 by default. -- `services.dhcpcd` is now started with additional systemd sandbox/hardening options for better security. When using `networking.dhcpcd.runHook` these settings are not applied. - - Kanidm can now be provisioned using the new [`services.kanidm.provision`] option, but requires using a patched version available via `pkgs.kanidm.withSecretProvisioning`. - Kanidm previously had an incorrect systemd service type, causing dependent units with an `after` and `requires` directive to start before `kanidm*` finished startup. The module has now been updated in line with upstream recommendations.