From 00a8c125b00ce8164b3993be636d4c59fc073597 Mon Sep 17 00:00:00 2001
From: Nessdoor <entropy.overseer@entropic.network>
Date: Sun, 25 Aug 2024 18:46:26 +0200
Subject: [PATCH 1/2] nixos/kerberos_server: add the "get-keys" ACL permission

---
 nixos/modules/security/krb5/krb5-conf-format.nix | 11 ++++++++++-
 nixos/modules/services/system/kerberos/mit.nix   |  3 ++-
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/security/krb5/krb5-conf-format.nix b/nixos/modules/security/krb5/krb5-conf-format.nix
index 274e1024209d..a17edf1e2e2d 100644
--- a/nixos/modules/security/krb5/krb5-conf-format.nix
+++ b/nixos/modules/security/krb5/krb5-conf-format.nix
@@ -62,15 +62,24 @@ rec {
           };
           access = mkOption {
             type = either (listOf (enum [
+              "all"
               "add"
               "cpw"
               "delete"
+              "get-keys"
               "get"
               "list"
               "modify"
             ])) (enum [ "all" ]);
             default = "all";
-            description = "The changes the principal is allowed to make.";
+            description = ''
+              The changes the principal is allowed to make.
+
+              :::{.important}
+              The "all" permission does not imply the "get-keys" permission. This
+              is consistent with the behavior of both MIT Kerberos and Heimdal.
+              :::
+            '';
           };
           target = mkOption {
             type = str;
diff --git a/nixos/modules/services/system/kerberos/mit.nix b/nixos/modules/services/system/kerberos/mit.nix
index c698468dddee..f1caa92c04df 100644
--- a/nixos/modules/services/system/kerberos/mit.nix
+++ b/nixos/modules/services/system/kerberos/mit.nix
@@ -19,10 +19,11 @@ let
     add = "a";
     cpw = "c";
     delete = "d";
+    get-keys = "e";
     get = "i";
     list = "l";
     modify = "m";
-    all = "*";
+    all = "x";
   };
 
   aclConfigs = lib.pipe cfg.settings.realms [

From f500ae084a09cfcb276d2861d06945988572cef3 Mon Sep 17 00:00:00 2001
From: Nessdoor <entropy.overseer@entropic.network>
Date: Fri, 14 Feb 2025 19:45:27 +0100
Subject: [PATCH 2/2] nixos/kerberos_server: disallow combining "all" with
 policies != "get-keys"

---
 .../security/krb5/krb5-conf-format.nix        | 28 ++++++++++++-------
 .../services/system/kerberos/default.nix      | 11 ++++++++
 2 files changed, 29 insertions(+), 10 deletions(-)

diff --git a/nixos/modules/security/krb5/krb5-conf-format.nix b/nixos/modules/security/krb5/krb5-conf-format.nix
index a17edf1e2e2d..c6af150186b5 100644
--- a/nixos/modules/security/krb5/krb5-conf-format.nix
+++ b/nixos/modules/security/krb5/krb5-conf-format.nix
@@ -61,16 +61,18 @@ rec {
             description = "Which principal the rule applies to";
           };
           access = mkOption {
-            type = either (listOf (enum [
-              "all"
-              "add"
-              "cpw"
-              "delete"
-              "get-keys"
-              "get"
-              "list"
-              "modify"
-            ])) (enum [ "all" ]);
+            type = coercedTo str singleton (
+              listOf (enum [
+                "all"
+                "add"
+                "cpw"
+                "delete"
+                "get-keys"
+                "get"
+                "list"
+                "modify"
+              ])
+            );
             default = "all";
             description = ''
               The changes the principal is allowed to make.
@@ -79,6 +81,12 @@ rec {
               The "all" permission does not imply the "get-keys" permission. This
               is consistent with the behavior of both MIT Kerberos and Heimdal.
               :::
+
+              :::{.warning}
+              Value "all" is allowed as a list member only if it appears alone
+              or accompanied by "get-keys". Any other combination involving
+              "all" will raise an exception.
+              :::
             '';
           };
           target = mkOption {
diff --git a/nixos/modules/services/system/kerberos/default.nix b/nixos/modules/services/system/kerberos/default.nix
index 90baae98624f..5e7210ca7629 100644
--- a/nixos/modules/services/system/kerberos/default.nix
+++ b/nixos/modules/services/system/kerberos/default.nix
@@ -55,6 +55,17 @@ in
         assertion = lib.length (lib.attrNames cfg.settings.realms) <= 1;
         message = "Only one realm per server is currently supported.";
       }
+      {
+        assertion =
+          let
+            inherit (builtins) attrValues elem length;
+            realms = attrValues cfg.settings.realms;
+            accesses = lib.concatMap (r: map (a: a.access) r.acl) realms;
+            property = a: !elem "all" a || (length a <= 1) || (length a <= 2 && elem "get-keys" a);
+          in
+          builtins.all property accesses;
+        message = "Cannot specify \"all\" in a list with additional permissions other than \"get-keys\"";
+      }
     ];
 
     systemd.slices.system-kerberos-server = { };