gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ecryptfs: drop (#479934)

Browse Source
This commit is contained in:
Doron Behar
2026-01-14 15:41:32 +00:00
committed by GitHub
parent c2fbbe230e a939c13d89
commit 3632d76437
11 changed files with 11 additions and 288 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nixos/doc/manual/release-notes/rl-2605.section.md
+2
View File
@@ -71,6 +71,8 @@ of pulling the upstream container image from Docker Hub. If you want the old beh
- Support for `reiserfs` in nixpkgs has been removed, following the removal in Linux 6.13.
- support for `ecryptfs` in nixpkgs has been removed.
- The `networking.wireless` module has been security hardened: the `wpa_supplicant` daemon now runs under an unprivileged user with restricted access to the system.
As part of these changes, `/etc/wpa_supplicant.conf` has been deprecated: the NixOS-generated configuration file is now linked to `/etc/wpa_supplicant/nixos.conf` and `/etc/wpa_supplicant/imperative.conf` has been added for imperatively configuring `wpa_supplicant` or when using [allowAuxiliaryImperativeNetworks](#opt-networking.wireless.allowAuxiliaryImperativeNetworks).
nixos/modules/misc/locate.nix
-1
View File
@@ -89,7 +89,6 @@ in
"devfs"
"devpts"
"devtmpfs"
"ecryptfs"
"eventpollfs"
"exofs"
"futexfs"
nixos/modules/module-list.nix
-2
View File
@@ -202,7 +202,6 @@
./programs/droidcam.nix
./programs/dsearch.nix
./programs/dublin-traceroute.nix
./programs/ecryptfs.nix
./programs/ente-auth.nix
./programs/environment.nix
./programs/envision.nix
@@ -1918,7 +1917,6 @@
./tasks/filesystems/bindfs.nix
./tasks/filesystems/btrfs.nix
./tasks/filesystems/cifs.nix
./tasks/filesystems/ecryptfs.nix
./tasks/filesystems/envfs.nix
./tasks/filesystems/erofs.nix
./tasks/filesystems/exfat.nix
nixos/modules/programs/ecryptfs.nix
-35
View File
@@ -1,35 +0,0 @@
{
config,
lib,
pkgs,
...
}:
let
cfg = config.programs.ecryptfs;
in
{
options.programs.ecryptfs = {
enable = lib.mkEnableOption "ecryptfs setuid mount wrappers";
};
config = lib.mkIf cfg.enable {
security.wrappers = {
"mount.ecryptfs_private" = {
setuid = true;
owner = "root";
group = "root";
source = "${lib.getBin pkgs.ecryptfs}/bin/mount.ecryptfs_private";
};
"umount.ecryptfs_private" = {
setuid = true;
owner = "root";
group = "root";
source = "${lib.getBin pkgs.ecryptfs}/bin/umount.ecryptfs_private";
};
};
};
}
nixos/modules/rename.nix
+7
View File
@@ -74,6 +74,10 @@ in
"programs"
"cardboard"
] "The corresponding package was removed from nixpkgs.")
(mkRemovedOptionModule [
"programs"
"ecryptfs"
] "The corresponding package was removed from nixpkgs.")
(mkRemovedOptionModule [
"programs"
"gnome-documents"
@@ -452,6 +456,9 @@ in
(mkRemovedOptionModule [ "services" "simplesamlphp" ] ''
services.simplesamlphp has been vulnerable and unmaintained in nixpkgs.
'')
(mkRemovedOptionModule [ "security" "pam" "enableEcryptfs" ] ''
security.pam.enableFscrypt was removed since it was unmaintained in nixpkgs.
'')
(mkRemovedOptionModule [ "security" "rngd" ] ''
rngd is not necessary for any device that the kernel recognises
as an hardware RNG, as it will automatically run the krngd task
nixos/modules/security/pam.nix
+1 -26
View File
@@ -965,8 +965,7 @@ let
(
(cfg.unixAuth || config.services.homed.enable)
&& (
config.security.pam.enableEcryptfs
|| config.security.pam.enableFscrypt
config.security.pam.enableFscrypt
|| cfg.pamMount
|| cfg.kwallet.enable
|| cfg.enableGnomeKeyring
@@ -996,15 +995,6 @@ let
likeauth = true;
};
}
{
name = "ecryptfs";
enable = config.security.pam.enableEcryptfs;
control = "optional";
modulePath = "${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so";
settings = {
unwrap = true;
};
}
{
name = "fscrypt";
enable = config.security.pam.enableFscrypt;
@@ -1191,12 +1181,6 @@ let
yescrypt = true;
};
}
{
name = "ecryptfs";
enable = config.security.pam.enableEcryptfs;
control = "optional";
modulePath = "${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so";
}
{
name = "fscrypt";
enable = config.security.pam.enableFscrypt;
@@ -1331,12 +1315,6 @@ let
silent = true;
};
}
{
name = "ecryptfs";
enable = config.security.pam.enableEcryptfs;
control = "optional";
modulePath = "${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so";
}
# Work around https://github.com/systemd/systemd/issues/8598
# Skips the pam_fscrypt module for systemd-user sessions which do not have a password
# anyways.
@@ -2223,7 +2201,6 @@ in
security.pam.enableUMask = lib.mkEnableOption "umask PAM module";
security.pam.enableEcryptfs = lib.mkEnableOption "eCryptfs PAM module (mounting ecryptfs home directory on login)";
security.pam.enableFscrypt = lib.mkEnableOption ''
fscrypt, to automatically unlock directories with the user's login password.
@@ -2324,8 +2301,6 @@ in
++ lib.optionals config.security.pam.enableFscrypt [ pkgs.fscrypt-experimental ]
++ lib.optionals config.security.pam.u2f.enable [ pkgs.pam_u2f ];
boot.supportedFilesystems = lib.mkIf config.security.pam.enableEcryptfs [ "ecryptfs" ];
security.wrappers = {
unix_chkpwd = {
setuid = true;
nixos/modules/tasks/filesystems/ecryptfs.nix
-29
View File
@@ -1,29 +0,0 @@
{
config,
lib,
pkgs,
...
}:
# TODO: make ecryptfs work in initramfs?
with lib;
{
config = mkIf (config.boot.supportedFilesystems.ecryptfs or false) {
system.fsPackages = [ pkgs.ecryptfs ];
security.wrappers = {
"mount.ecryptfs_private" = {
setuid = true;
owner = "root";
group = "root";
source = "${pkgs.ecryptfs.out}/bin/mount.ecryptfs_private";
};
"umount.ecryptfs_private" = {
setuid = true;
owner = "root";
group = "root";
source = "${pkgs.ecryptfs.out}/bin/umount.ecryptfs_private";
};
};
};
}
nixos/tests/all-tests.nix
-1
View File
@@ -502,7 +502,6 @@ in
ec2-image = runTest ./ec2-image.nix;
ec2-nixops = (handleTestOn [ "x86_64-linux" ] ./ec2.nix { }).boot-ec2-nixops or { };
echoip = runTest ./echoip.nix;
ecryptfs = runTest ./ecryptfs.nix;
ejabberd = runTest ./xmpp/ejabberd.nix;
elk = handleTestOn [ "x86_64-linux" ] ./elk.nix { };
emacs-daemon = runTest ./emacs-daemon.nix;
nixos/tests/ecryptfs.nix
-87
View File
@@ -1,87 +0,0 @@
{ ... }:
{
name = "ecryptfs";
nodes.machine =
{ pkgs, ... }:
{
imports = [ ./common/user-account.nix ];
boot.kernelModules = [ "ecryptfs" ];
security.pam.enableEcryptfs = true;
environment.systemPackages = with pkgs; [ keyutils ];
};
testScript = ''
def login_as_alice():
machine.wait_until_tty_matches("1", "login: ")
machine.send_chars("alice\n")
machine.wait_until_tty_matches("1", "Password: ")
machine.send_chars("foobar\n")
machine.wait_until_tty_matches("1", "alice\@machine")
def logout():
machine.send_chars("logout\n")
machine.wait_until_tty_matches("1", "login: ")
machine.wait_for_unit("default.target")
with subtest("Set alice up with a password and a home"):
machine.succeed("(echo foobar; echo foobar) | passwd alice")
machine.succeed("chown -R alice.users ~alice")
with subtest("Migrate alice's home"):
out = machine.succeed("echo foobar | ecryptfs-migrate-home -u alice")
machine.log(f"ecryptfs-migrate-home said: {out}")
with subtest("Log alice in (ecryptfs passwhrase is wrapped during first login)"):
login_as_alice()
machine.send_chars("logout\n")
machine.wait_until_tty_matches("1", "login: ")
# Why do I need to do this??
machine.succeed("su alice -c ecryptfs-umount-private || true")
machine.sleep(1)
with subtest("check that encrypted home is not mounted"):
machine.fail("mount | grep ecryptfs")
with subtest("Show contents of the user keyring"):
out = machine.succeed("su - alice -c 'keyctl list \@u'")
machine.log(f"keyctl unlink said: {out}")
with subtest("Log alice again"):
login_as_alice()
with subtest("Create some files in encrypted home"):
machine.succeed("su alice -c 'touch ~alice/a'")
machine.succeed("su alice -c 'echo c > ~alice/b'")
with subtest("Logout"):
logout()
# Why do I need to do this??
machine.succeed("su alice -c ecryptfs-umount-private || true")
machine.sleep(1)
with subtest("Check that the filesystem is not accessible"):
machine.fail("mount | grep ecryptfs")
machine.succeed("su alice -c 'test \! -f ~alice/a'")
machine.succeed("su alice -c 'test \! -f ~alice/b'")
with subtest("Log alice once more"):
login_as_alice()
with subtest("Check that the files are there"):
machine.sleep(1)
machine.succeed("su alice -c 'test -f ~alice/a'")
machine.succeed("su alice -c 'test -f ~alice/b'")
machine.succeed('test "$(cat ~alice/b)" = "c"')
with subtest("Catch https://github.com/NixOS/nixpkgs/issues/16766"):
machine.succeed("su alice -c 'ls -lh ~alice/'")
logout()
'';
}
pkgs/by-name/ec/ecryptfs/package.nix
-107
View File
@@ -1,107 +0,0 @@
{
lib,
stdenv,
fetchurl,
pkg-config,
perl,
util-linux,
keyutils,
nss,
nspr,
python2,
pam,
enablePython ? false,
intltool,
makeWrapper,
coreutils,
bash,
gettext,
cryptsetup,
lvm2,
rsync,
which,
lsof,
nixosTests,
}:
stdenv.mkDerivation rec {
pname = "ecryptfs";
version = "111";
src = fetchurl {
url = "https://launchpad.net/ecryptfs/trunk/${version}/+download/ecryptfs-utils_${version}.orig.tar.gz";
sha256 = "0zwq19siiwf09h7lwa7n7mgmrr8cxifp45lmwgcfr8c1gviv6b0i";
};
# TODO: replace wrapperDir below with from <nixos> config.security.wrapperDir;
wrapperDir = "/run/wrappers/bin";
postPatch = ''
FILES="$(grep -r '/bin/sh' src/utils -l; find src -name \*.c)"
for file in $FILES; do
substituteInPlace "$file" \
--replace /bin/mount ${util-linux}/bin/mount \
--replace /bin/umount ${util-linux}/bin/umount \
--replace /sbin/mount.ecryptfs_private ${wrapperDir}/mount.ecryptfs_private \
--replace /sbin/umount.ecryptfs_private ${wrapperDir}/umount.ecryptfs_private \
--replace /sbin/mount.ecryptfs $out/sbin/mount.ecryptfs \
--replace /sbin/umount.ecryptfs $out/sbin/umount.ecryptfs \
--replace /usr/bin/ecryptfs-rewrite-file $out/bin/ecryptfs-rewrite-file \
--replace /usr/bin/ecryptfs-mount-private $out/bin/ecryptfs-mount-private \
--replace /usr/bin/ecryptfs-setup-private $out/bin/ecryptfs-setup-private \
--replace /sbin/cryptsetup ${cryptsetup}/sbin/cryptsetup \
--replace /sbin/dmsetup ${lvm2}/sbin/dmsetup \
--replace /sbin/unix_chkpwd ${wrapperDir}/unix_chkpwd \
--replace /bin/bash ${bash}/bin/bash
done
'';
configureFlags = [ " --disable-openssl" ] ++ lib.optionals (!enablePython) [ "--disable-pywrap" ];
nativeBuildInputs = [
pkg-config
makeWrapper
intltool
]
# if python2 support is requested, it is needed at builtime as well as runtime.
++ lib.optionals enablePython [ python2 ];
buildInputs = [
perl
nss
nspr
pam
]
++ lib.optionals enablePython [ python2 ];
propagatedBuildInputs = [
coreutils
gettext
cryptsetup
lvm2
rsync
keyutils
which
];
postInstall = ''
FILES="$(grep -r '/bin/sh' $out/bin -l)"
for file in $FILES; do
wrapProgram $file \
--prefix PATH ":" "${coreutils}/bin" \
--prefix PATH ":" "${gettext}/bin" \
--prefix PATH ":" "${rsync}/bin" \
--prefix PATH ":" "${keyutils}/bin" \
--prefix PATH ":" "${which}/bin" \
--prefix PATH ":" "${lsof}/bin" \
--prefix PATH ":" "$out/bin"
done
'';
passthru.tests = { inherit (nixosTests) ecryptfs; };
meta = {
description = "Enterprise-class stacked cryptographic filesystem";
license = lib.licenses.gpl2Plus;
maintainers = with lib.maintainers; [ obadz ];
platforms = lib.platforms.linux;
};
}
pkgs/top-level/aliases.nix
+1
View File
@@ -566,6 +566,7 @@ mapAliases {
easyloggingpp = throw "easyloggingpp has been removed, as it is deprecated upstream and does not build with CMake 4"; # Added 2025-09-17
EBTKS = throw "'EBTKS' has been renamed to/replaced by 'ebtks'"; # Converted to throw 2025-10-27
ec2-utils = throw "'ec2-utils' has been renamed to/replaced by 'amazon-ec2-utils'"; # Converted to throw 2025-10-27
ecryptfs = throw "'ecryptfs' has been removed due to lack of maintenance. Consider using 'fscrypt', 'gocryptfs' or 'cryfs' instead."; # Added 2026-01-14
edid-decode = v4l-utils; # Added 2025-06-20
eidolon = throw "eidolon was removed as it is unmaintained upstream."; # Added 2025-05-28
eintopf = throw "'eintopf' has been renamed to/replaced by 'lauti'"; # Converted to throw 2025-10-27