From 430f4e9c5e5662a5c540fe1f1d8373f76fa1c5ff Mon Sep 17 00:00:00 2001 From: Felix Buehler Date: Sun, 8 Dec 2024 13:18:22 +0100 Subject: [PATCH] nixos/security.pam: remove `with lib;` --- nixos/modules/security/pam_mount.nix | 77 +++++++++++++--------------- 1 file changed, 37 insertions(+), 40 deletions(-) diff --git a/nixos/modules/security/pam_mount.nix b/nixos/modules/security/pam_mount.nix index bc0c5c5fbfbc..2915118eb7b4 100644 --- a/nixos/modules/security/pam_mount.nix +++ b/nixos/modules/security/pam_mount.nix @@ -1,7 +1,4 @@ { config, lib, pkgs, ... }: - -with lib; - let cfg = config.security.pam.mount; @@ -13,23 +10,23 @@ let ${pkgs.lsof}/bin/lsof | ${pkgs.gnugrep}/bin/grep $MNTPT | ${pkgs.gawk}/bin/awk '{print $2}' | ${pkgs.findutils}/bin/xargs ${pkgs.util-linux}/bin/kill -$SIGNAL ''; - anyPamMount = any (attrByPath ["pamMount"] false) (attrValues config.security.pam.services); + anyPamMount = lib.any (lib.attrByPath ["pamMount"] false) (lib.attrValues config.security.pam.services); in { options = { security.pam.mount = { - enable = mkOption { - type = types.bool; + enable = lib.mkOption { + type = lib.types.bool; default = false; description = '' Enable PAM mount system to mount filesystems on user login. ''; }; - extraVolumes = mkOption { - type = types.listOf types.str; + extraVolumes = lib.mkOption { + type = lib.types.listOf lib.types.str; default = []; description = '' List of volume definitions for pam_mount. @@ -37,20 +34,20 @@ in ''; }; - additionalSearchPaths = mkOption { - type = types.listOf types.package; + additionalSearchPaths = lib.mkOption { + type = lib.types.listOf lib.types.package; default = []; - example = literalExpression "[ pkgs.bindfs ]"; + example = lib.literalExpression "[ pkgs.bindfs ]"; description = '' Additional programs to include in the search path of pam_mount. Useful for example if you want to use some FUSE filesystems like bindfs. ''; }; - cryptMountOptions = mkOption { - type = types.listOf types.str; + cryptMountOptions = lib.mkOption { + type = lib.types.listOf lib.types.str; default = []; - example = literalExpression '' + example = lib.literalExpression '' [ "allow_discard" ] ''; description = '' @@ -59,10 +56,10 @@ in ''; }; - fuseMountOptions = mkOption { - type = types.listOf types.str; + fuseMountOptions = lib.mkOption { + type = lib.types.listOf lib.types.str; default = []; - example = literalExpression '' + example = lib.literalExpression '' [ "nodev" "nosuid" "force-user=%(USER)" "gid=%(USERGID)" "perms=0700" "chmod-deny" "chown-deny" "chgrp-deny" ] ''; description = '' @@ -71,8 +68,8 @@ in ''; }; - debugLevel = mkOption { - type = types.int; + debugLevel = lib.mkOption { + type = lib.types.int; default = 0; example = 1; description = '' @@ -82,8 +79,8 @@ in ''; }; - logoutWait = mkOption { - type = types.int; + logoutWait = lib.mkOption { + type = lib.types.int; default = 0; description = '' Amount of microseconds to wait until killing remaining processes after @@ -92,40 +89,40 @@ in ''; }; - logoutHup = mkOption { - type = types.bool; + logoutHup = lib.mkOption { + type = lib.types.bool; default = false; description = '' Kill remaining processes after logout by sending a SIGHUP. ''; }; - logoutTerm = mkOption { - type = types.bool; + logoutTerm = lib.mkOption { + type = lib.types.bool; default = false; description = '' Kill remaining processes after logout by sending a SIGTERM. ''; }; - logoutKill = mkOption { - type = types.bool; + logoutKill = lib.mkOption { + type = lib.types.bool; default = false; description = '' Kill remaining processes after logout by sending a SIGKILL. ''; }; - createMountPoints = mkOption { - type = types.bool; + createMountPoints = lib.mkOption { + type = lib.types.bool; default = true; description = '' Create mountpoints for volumes if they do not exist. ''; }; - removeCreatedMountPoints = mkOption { - type = types.bool; + removeCreatedMountPoints = lib.mkOption { + type = lib.types.bool; default = true; description = '' Remove mountpoints created by pam_mount after logout. This @@ -137,13 +134,13 @@ in }; - config = mkIf (cfg.enable || anyPamMount) { + config = lib.mkIf (cfg.enable || anyPamMount) { environment.systemPackages = [ pkgs.pam_mount ]; environment.etc."security/pam_mount.conf.xml" = { source = let - extraUserVolumes = filterAttrs (n: u: u.cryptHomeLuks != null || u.pamMount != {}) config.users.users; + extraUserVolumes = lib.filterAttrs (n: u: u.cryptHomeLuks != null || u.pamMount != {}) config.users.users; mkAttr = k: v: ''${k}="${v}"''; userVolumeEntry = user: let attrs = { @@ -152,7 +149,7 @@ in mountpoint = user.home; } // user.pamMount; in - "\n"; + "\n"; in pkgs.writeText "pam_mount.conf.xml" '' @@ -163,20 +160,20 @@ in - ${makeBinPath ([ pkgs.util-linux ] ++ cfg.additionalSearchPaths)} + ${lib.makeBinPath ([ pkgs.util-linux ] ++ cfg.additionalSearchPaths)} - ${pkgs.fuse}/bin/mount.fuse %(VOLUME) %(MNTPT) -o ,${concatStringsSep "," (cfg.fuseMountOptions ++ [ "%(OPTIONS)" ])}' + ${pkgs.fuse}/bin/mount.fuse %(VOLUME) %(MNTPT) -o ,${lib.concatStringsSep "," (cfg.fuseMountOptions ++ [ "%(OPTIONS)" ])}' ${pkgs.fuse}/bin/fusermount -u %(MNTPT) - ${pkgs.pam_mount}/bin/mount.crypt -o ,${concatStringsSep "," (cfg.cryptMountOptions ++ [ "%(OPTIONS)" ])} %(VOLUME) %(MNTPT) + ${pkgs.pam_mount}/bin/mount.crypt -o ,${lib.concatStringsSep "," (cfg.cryptMountOptions ++ [ "%(OPTIONS)" ])} %(VOLUME) %(MNTPT) ${pkgs.pam_mount}/bin/umount.crypt %(MNTPT) ${pkgs.pam_mount}/bin/pmvarrun -u %(USER) -o %(OPERATION) - ${optionalString oflRequired "${fake_ofl}/bin/fake_ofl %(SIGNAL) %(MNTPT)"} - ${concatStrings (map userVolumeEntry (attrValues extraUserVolumes))} - ${concatStringsSep "\n" cfg.extraVolumes} + ${lib.optionalString oflRequired "${fake_ofl}/bin/fake_ofl %(SIGNAL) %(MNTPT)"} + ${lib.concatStrings (map userVolumeEntry (lib.attrValues extraUserVolumes))} + ${lib.concatStringsSep "\n" cfg.extraVolumes} ''; };