From a939c13d898c5b2fae1f2ca88de3a22f176e82a1 Mon Sep 17 00:00:00 2001 From: Sigmanificient Date: Wed, 14 Jan 2026 06:14:21 +0100 Subject: [PATCH] ecryptfs: drop --- .../manual/release-notes/rl-2605.section.md | 2 + nixos/modules/misc/locate.nix | 1 - nixos/modules/module-list.nix | 2 - nixos/modules/programs/ecryptfs.nix | 35 ------ nixos/modules/rename.nix | 7 ++ nixos/modules/security/pam.nix | 27 +---- nixos/modules/tasks/filesystems/ecryptfs.nix | 29 ----- nixos/tests/all-tests.nix | 1 - nixos/tests/ecryptfs.nix | 87 -------------- pkgs/by-name/ec/ecryptfs/package.nix | 107 ------------------ pkgs/top-level/aliases.nix | 1 + 11 files changed, 11 insertions(+), 288 deletions(-) delete mode 100644 nixos/modules/programs/ecryptfs.nix delete mode 100644 nixos/modules/tasks/filesystems/ecryptfs.nix delete mode 100644 nixos/tests/ecryptfs.nix delete mode 100644 pkgs/by-name/ec/ecryptfs/package.nix diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md index 16a6dd7103ef..2da0f71b3063 100644 --- a/nixos/doc/manual/release-notes/rl-2605.section.md +++ b/nixos/doc/manual/release-notes/rl-2605.section.md @@ -71,6 +71,8 @@ of pulling the upstream container image from Docker Hub. If you want the old beh - Support for `reiserfs` in nixpkgs has been removed, following the removal in Linux 6.13. +- support for `ecryptfs` in nixpkgs has been removed. + - The `networking.wireless` module has been security hardened: the `wpa_supplicant` daemon now runs under an unprivileged user with restricted access to the system. As part of these changes, `/etc/wpa_supplicant.conf` has been deprecated: the NixOS-generated configuration file is now linked to `/etc/wpa_supplicant/nixos.conf` and `/etc/wpa_supplicant/imperative.conf` has been added for imperatively configuring `wpa_supplicant` or when using [allowAuxiliaryImperativeNetworks](#opt-networking.wireless.allowAuxiliaryImperativeNetworks). diff --git a/nixos/modules/misc/locate.nix b/nixos/modules/misc/locate.nix index 0980e6f385a2..1affb234e418 100644 --- a/nixos/modules/misc/locate.nix +++ b/nixos/modules/misc/locate.nix @@ -89,7 +89,6 @@ in "devfs" "devpts" "devtmpfs" - "ecryptfs" "eventpollfs" "exofs" "futexfs" diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index 3046b73f731b..f9adc3f3230f 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -202,7 +202,6 @@ ./programs/droidcam.nix ./programs/dsearch.nix ./programs/dublin-traceroute.nix - ./programs/ecryptfs.nix ./programs/ente-auth.nix ./programs/environment.nix ./programs/envision.nix @@ -1918,7 +1917,6 @@ ./tasks/filesystems/bindfs.nix ./tasks/filesystems/btrfs.nix ./tasks/filesystems/cifs.nix - ./tasks/filesystems/ecryptfs.nix ./tasks/filesystems/envfs.nix ./tasks/filesystems/erofs.nix ./tasks/filesystems/exfat.nix diff --git a/nixos/modules/programs/ecryptfs.nix b/nixos/modules/programs/ecryptfs.nix deleted file mode 100644 index 37b3699c20a8..000000000000 --- a/nixos/modules/programs/ecryptfs.nix +++ /dev/null @@ -1,35 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: - -let - cfg = config.programs.ecryptfs; - -in -{ - options.programs.ecryptfs = { - enable = lib.mkEnableOption "ecryptfs setuid mount wrappers"; - }; - - config = lib.mkIf cfg.enable { - security.wrappers = { - - "mount.ecryptfs_private" = { - setuid = true; - owner = "root"; - group = "root"; - source = "${lib.getBin pkgs.ecryptfs}/bin/mount.ecryptfs_private"; - }; - "umount.ecryptfs_private" = { - setuid = true; - owner = "root"; - group = "root"; - source = "${lib.getBin pkgs.ecryptfs}/bin/umount.ecryptfs_private"; - }; - - }; - }; -} diff --git a/nixos/modules/rename.nix b/nixos/modules/rename.nix index d2152082a042..f3fcf6055946 100644 --- a/nixos/modules/rename.nix +++ b/nixos/modules/rename.nix @@ -74,6 +74,10 @@ in "programs" "cardboard" ] "The corresponding package was removed from nixpkgs.") + (mkRemovedOptionModule [ + "programs" + "ecryptfs" + ] "The corresponding package was removed from nixpkgs.") (mkRemovedOptionModule [ "programs" "gnome-documents" @@ -452,6 +456,9 @@ in (mkRemovedOptionModule [ "services" "simplesamlphp" ] '' services.simplesamlphp has been vulnerable and unmaintained in nixpkgs. '') + (mkRemovedOptionModule [ "security" "pam" "enableEcryptfs" ] '' + security.pam.enableFscrypt was removed since it was unmaintained in nixpkgs. + '') (mkRemovedOptionModule [ "security" "rngd" ] '' rngd is not necessary for any device that the kernel recognises as an hardware RNG, as it will automatically run the krngd task diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix index 3bcac1371081..12fdf781e9ec 100644 --- a/nixos/modules/security/pam.nix +++ b/nixos/modules/security/pam.nix @@ -965,8 +965,7 @@ let ( (cfg.unixAuth || config.services.homed.enable) && ( - config.security.pam.enableEcryptfs - || config.security.pam.enableFscrypt + config.security.pam.enableFscrypt || cfg.pamMount || cfg.kwallet.enable || cfg.enableGnomeKeyring @@ -996,15 +995,6 @@ let likeauth = true; }; } - { - name = "ecryptfs"; - enable = config.security.pam.enableEcryptfs; - control = "optional"; - modulePath = "${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so"; - settings = { - unwrap = true; - }; - } { name = "fscrypt"; enable = config.security.pam.enableFscrypt; @@ -1191,12 +1181,6 @@ let yescrypt = true; }; } - { - name = "ecryptfs"; - enable = config.security.pam.enableEcryptfs; - control = "optional"; - modulePath = "${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so"; - } { name = "fscrypt"; enable = config.security.pam.enableFscrypt; @@ -1331,12 +1315,6 @@ let silent = true; }; } - { - name = "ecryptfs"; - enable = config.security.pam.enableEcryptfs; - control = "optional"; - modulePath = "${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so"; - } # Work around https://github.com/systemd/systemd/issues/8598 # Skips the pam_fscrypt module for systemd-user sessions which do not have a password # anyways. @@ -2223,7 +2201,6 @@ in security.pam.enableUMask = lib.mkEnableOption "umask PAM module"; - security.pam.enableEcryptfs = lib.mkEnableOption "eCryptfs PAM module (mounting ecryptfs home directory on login)"; security.pam.enableFscrypt = lib.mkEnableOption '' fscrypt, to automatically unlock directories with the user's login password. @@ -2324,8 +2301,6 @@ in ++ lib.optionals config.security.pam.enableFscrypt [ pkgs.fscrypt-experimental ] ++ lib.optionals config.security.pam.u2f.enable [ pkgs.pam_u2f ]; - boot.supportedFilesystems = lib.mkIf config.security.pam.enableEcryptfs [ "ecryptfs" ]; - security.wrappers = { unix_chkpwd = { setuid = true; diff --git a/nixos/modules/tasks/filesystems/ecryptfs.nix b/nixos/modules/tasks/filesystems/ecryptfs.nix deleted file mode 100644 index 8b489d65d843..000000000000 --- a/nixos/modules/tasks/filesystems/ecryptfs.nix +++ /dev/null @@ -1,29 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: -# TODO: make ecryptfs work in initramfs? - -with lib; - -{ - config = mkIf (config.boot.supportedFilesystems.ecryptfs or false) { - system.fsPackages = [ pkgs.ecryptfs ]; - security.wrappers = { - "mount.ecryptfs_private" = { - setuid = true; - owner = "root"; - group = "root"; - source = "${pkgs.ecryptfs.out}/bin/mount.ecryptfs_private"; - }; - "umount.ecryptfs_private" = { - setuid = true; - owner = "root"; - group = "root"; - source = "${pkgs.ecryptfs.out}/bin/umount.ecryptfs_private"; - }; - }; - }; -} diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index ddd09ceb28d2..957882749b9a 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -502,7 +502,6 @@ in ec2-image = runTest ./ec2-image.nix; ec2-nixops = (handleTestOn [ "x86_64-linux" ] ./ec2.nix { }).boot-ec2-nixops or { }; echoip = runTest ./echoip.nix; - ecryptfs = runTest ./ecryptfs.nix; ejabberd = runTest ./xmpp/ejabberd.nix; elk = handleTestOn [ "x86_64-linux" ] ./elk.nix { }; emacs-daemon = runTest ./emacs-daemon.nix; diff --git a/nixos/tests/ecryptfs.nix b/nixos/tests/ecryptfs.nix deleted file mode 100644 index e0deaa7e5013..000000000000 --- a/nixos/tests/ecryptfs.nix +++ /dev/null @@ -1,87 +0,0 @@ -{ ... }: -{ - name = "ecryptfs"; - - nodes.machine = - { pkgs, ... }: - { - imports = [ ./common/user-account.nix ]; - boot.kernelModules = [ "ecryptfs" ]; - security.pam.enableEcryptfs = true; - environment.systemPackages = with pkgs; [ keyutils ]; - }; - - testScript = '' - def login_as_alice(): - machine.wait_until_tty_matches("1", "login: ") - machine.send_chars("alice\n") - machine.wait_until_tty_matches("1", "Password: ") - machine.send_chars("foobar\n") - machine.wait_until_tty_matches("1", "alice\@machine") - - - def logout(): - machine.send_chars("logout\n") - machine.wait_until_tty_matches("1", "login: ") - - - machine.wait_for_unit("default.target") - - with subtest("Set alice up with a password and a home"): - machine.succeed("(echo foobar; echo foobar) | passwd alice") - machine.succeed("chown -R alice.users ~alice") - - with subtest("Migrate alice's home"): - out = machine.succeed("echo foobar | ecryptfs-migrate-home -u alice") - machine.log(f"ecryptfs-migrate-home said: {out}") - - with subtest("Log alice in (ecryptfs passwhrase is wrapped during first login)"): - login_as_alice() - machine.send_chars("logout\n") - machine.wait_until_tty_matches("1", "login: ") - - # Why do I need to do this?? - machine.succeed("su alice -c ecryptfs-umount-private || true") - machine.sleep(1) - - with subtest("check that encrypted home is not mounted"): - machine.fail("mount | grep ecryptfs") - - with subtest("Show contents of the user keyring"): - out = machine.succeed("su - alice -c 'keyctl list \@u'") - machine.log(f"keyctl unlink said: {out}") - - with subtest("Log alice again"): - login_as_alice() - - with subtest("Create some files in encrypted home"): - machine.succeed("su alice -c 'touch ~alice/a'") - machine.succeed("su alice -c 'echo c > ~alice/b'") - - with subtest("Logout"): - logout() - - # Why do I need to do this?? - machine.succeed("su alice -c ecryptfs-umount-private || true") - machine.sleep(1) - - with subtest("Check that the filesystem is not accessible"): - machine.fail("mount | grep ecryptfs") - machine.succeed("su alice -c 'test \! -f ~alice/a'") - machine.succeed("su alice -c 'test \! -f ~alice/b'") - - with subtest("Log alice once more"): - login_as_alice() - - with subtest("Check that the files are there"): - machine.sleep(1) - machine.succeed("su alice -c 'test -f ~alice/a'") - machine.succeed("su alice -c 'test -f ~alice/b'") - machine.succeed('test "$(cat ~alice/b)" = "c"') - - with subtest("Catch https://github.com/NixOS/nixpkgs/issues/16766"): - machine.succeed("su alice -c 'ls -lh ~alice/'") - - logout() - ''; -} diff --git a/pkgs/by-name/ec/ecryptfs/package.nix b/pkgs/by-name/ec/ecryptfs/package.nix deleted file mode 100644 index e2ca444fcead..000000000000 --- a/pkgs/by-name/ec/ecryptfs/package.nix +++ /dev/null @@ -1,107 +0,0 @@ -{ - lib, - stdenv, - fetchurl, - pkg-config, - perl, - util-linux, - keyutils, - nss, - nspr, - python2, - pam, - enablePython ? false, - intltool, - makeWrapper, - coreutils, - bash, - gettext, - cryptsetup, - lvm2, - rsync, - which, - lsof, - nixosTests, -}: - -stdenv.mkDerivation rec { - pname = "ecryptfs"; - version = "111"; - - src = fetchurl { - url = "https://launchpad.net/ecryptfs/trunk/${version}/+download/ecryptfs-utils_${version}.orig.tar.gz"; - sha256 = "0zwq19siiwf09h7lwa7n7mgmrr8cxifp45lmwgcfr8c1gviv6b0i"; - }; - - # TODO: replace wrapperDir below with from config.security.wrapperDir; - wrapperDir = "/run/wrappers/bin"; - - postPatch = '' - FILES="$(grep -r '/bin/sh' src/utils -l; find src -name \*.c)" - for file in $FILES; do - substituteInPlace "$file" \ - --replace /bin/mount ${util-linux}/bin/mount \ - --replace /bin/umount ${util-linux}/bin/umount \ - --replace /sbin/mount.ecryptfs_private ${wrapperDir}/mount.ecryptfs_private \ - --replace /sbin/umount.ecryptfs_private ${wrapperDir}/umount.ecryptfs_private \ - --replace /sbin/mount.ecryptfs $out/sbin/mount.ecryptfs \ - --replace /sbin/umount.ecryptfs $out/sbin/umount.ecryptfs \ - --replace /usr/bin/ecryptfs-rewrite-file $out/bin/ecryptfs-rewrite-file \ - --replace /usr/bin/ecryptfs-mount-private $out/bin/ecryptfs-mount-private \ - --replace /usr/bin/ecryptfs-setup-private $out/bin/ecryptfs-setup-private \ - --replace /sbin/cryptsetup ${cryptsetup}/sbin/cryptsetup \ - --replace /sbin/dmsetup ${lvm2}/sbin/dmsetup \ - --replace /sbin/unix_chkpwd ${wrapperDir}/unix_chkpwd \ - --replace /bin/bash ${bash}/bin/bash - done - ''; - - configureFlags = [ " --disable-openssl" ] ++ lib.optionals (!enablePython) [ "--disable-pywrap" ]; - - nativeBuildInputs = [ - pkg-config - makeWrapper - intltool - ] - # if python2 support is requested, it is needed at builtime as well as runtime. - ++ lib.optionals enablePython [ python2 ]; - buildInputs = [ - perl - nss - nspr - pam - ] - ++ lib.optionals enablePython [ python2 ]; - propagatedBuildInputs = [ - coreutils - gettext - cryptsetup - lvm2 - rsync - keyutils - which - ]; - - postInstall = '' - FILES="$(grep -r '/bin/sh' $out/bin -l)" - for file in $FILES; do - wrapProgram $file \ - --prefix PATH ":" "${coreutils}/bin" \ - --prefix PATH ":" "${gettext}/bin" \ - --prefix PATH ":" "${rsync}/bin" \ - --prefix PATH ":" "${keyutils}/bin" \ - --prefix PATH ":" "${which}/bin" \ - --prefix PATH ":" "${lsof}/bin" \ - --prefix PATH ":" "$out/bin" - done - ''; - - passthru.tests = { inherit (nixosTests) ecryptfs; }; - - meta = { - description = "Enterprise-class stacked cryptographic filesystem"; - license = lib.licenses.gpl2Plus; - maintainers = with lib.maintainers; [ obadz ]; - platforms = lib.platforms.linux; - }; -} diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix index f74111e1ecec..e2e2d54edcce 100644 --- a/pkgs/top-level/aliases.nix +++ b/pkgs/top-level/aliases.nix @@ -566,6 +566,7 @@ mapAliases { easyloggingpp = throw "easyloggingpp has been removed, as it is deprecated upstream and does not build with CMake 4"; # Added 2025-09-17 EBTKS = throw "'EBTKS' has been renamed to/replaced by 'ebtks'"; # Converted to throw 2025-10-27 ec2-utils = throw "'ec2-utils' has been renamed to/replaced by 'amazon-ec2-utils'"; # Converted to throw 2025-10-27 + ecryptfs = throw "'ecryptfs' has been removed due to lack of maintenance. Consider using 'fscrypt', 'gocryptfs' or 'cryfs' instead."; # Added 2026-01-14 edid-decode = v4l-utils; # Added 2025-06-20 eidolon = throw "eidolon was removed as it is unmaintained upstream."; # Added 2025-05-28 eintopf = throw "'eintopf' has been renamed to/replaced by 'lauti'"; # Converted to throw 2025-10-27