From 4177ddcfd6284e18067dade38f0a438c60890fce Mon Sep 17 00:00:00 2001 From: Savyasachee Jha Date: Fri, 17 Mar 2023 16:16:47 +0530 Subject: [PATCH] doas: refactor config generation According to Ted Unangst, since doas evaluates rules in a last matched manner, it is prudent to have the "permit root to do everything without a password at the end of the file. Source: https://flak.tedunangst.com/post/doas-mastery --- nixos/modules/security/doas.nix | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/nixos/modules/security/doas.nix b/nixos/modules/security/doas.nix index be30a6b92e26..115ca33efb5c 100644 --- a/nixos/modules/security/doas.nix +++ b/nixos/modules/security/doas.nix @@ -75,7 +75,9 @@ in {file}`/etc/doas.conf` file. More specific rules should come after more general ones in order to yield the expected behavior. You can use `mkBefore` and/or `mkAfter` to ensure - this is the case when configuration options are merged. + this is the case when configuration options are merged. Be aware that + this option cannot be used to override the behaviour allowing + passwordless operation for root. ''; example = literalExpression '' [ @@ -224,7 +226,9 @@ in type = with types; lines; default = ""; description = lib.mdDoc '' - Extra configuration text appended to {file}`doas.conf`. + Extra configuration text appended to {file}`doas.conf`. Be aware that + this option cannot be used to override the behaviour allowing + passwordless operation for root. ''; }; }; @@ -266,14 +270,14 @@ in # completely replace the contents of this file, use # `environment.etc."doas.conf"`. - # "root" is allowed to do anything. - permit nopass keepenv root - # extraRules ${concatStringsSep "\n" (lists.flatten (map mkRule cfg.extraRules))} # extraConfig ${cfg.extraConfig} + + # "root" is allowed to do anything. + permit nopass keepenv root ''; preferLocalBuild = true; }