gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/run0: add options for persistent authentication

Browse Source 
Co-authored-by: Grimmauld <soeren@benjos.de>
Assisted-by: languagetool 6.6
This commit is contained in:
zimward
2026-06-18 14:24:32 +02:00
parent 746b8efb34
commit 498aab6ea8
2 changed files with 27 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nixos/doc/manual/release-notes/rl-2611.section.md
+2
View File
@@ -50,6 +50,8 @@
- `security.run0.enableSudoAlias` now uses the `run0-sudo-shim` instead of a shell-script to improve compatibility.
- `security.run0.persistentAuth` options have been added to support persistent Authentication of session. Timeout configurable via `security.polkit.settings.Polkitd.ExpirationSeconds`.
- `boot.loader.systemd-boot` gained support for [Automatic Boot Assessment](https://systemd.io/AUTOMATIC_BOOT_ASSESSMENT/) via the new [`boot.loader.systemd-boot.bootCounting`](#opt-boot.loader.systemd-boot.bootCounting.enable) options, allowing automatic detection of and recovery from bad NixOS generations. As part of this change, boot loader entries on the ESP/XBOOTLDR partition are now named `nixos-<content-hash>.conf` instead of `nixos-generation-<n>.conf`; existing entries are migrated automatically on the next `nixos-rebuild boot`/`switch`.
- The `newuidmap` and `newgidmap` security wrappers are now installed with `cap_setuid`/`cap_setgid` file capabilities instead of the setuid-root bit, matching shadow's `--with-fcaps` install mode and other major distributions. Rootless containers (podman, docker-rootless, unprivileged user namespaces) are unaffected. The only behavioural change is that mapping host uid 0 via `/etc/subuid` (which NixOS never configures by default) additionally requires `cap_setfcap`; users who explicitly grant uid 0 in a subuid range can restore the previous behaviour with `security.wrappers.newuidmap.capabilities = lib.mkForce "cap_setuid,cap_setfcap+ep";`.
nixos/modules/security/run0.nix
+25 -7
View File
@@ -13,6 +13,7 @@ let
mkOption
mkPackageOption
mkAliasOptionModule
optionalString
;
cfg = config.security.run0;
@@ -21,6 +22,12 @@ in
options.security.run0 = {
enable = mkEnableOption "support for run0";
persistentAuth.enable = mkEnableOption ''
persistent authentication for sessions.
Timeout configurable via {option}`security.polkit.settings.Polkitd.ExpirationSeconds`
'';
persistentAuth.enableRemote = mkEnableOption "persistent authentication for remote sessions";
wheelNeedsPassword = mkOption {
type = lib.types.bool;
default = true;
@@ -67,13 +74,24 @@ in
security.polkit = {
enable = true;
extraConfig = mkIf (!cfg.wheelNeedsPassword) ''
polkit.addRule(function(action, subject) {
if (action.id == "org.freedesktop.systemd1.manage-units" && subject.isInGroup("wheel")) {
return polkit.Result.YES;
}
});
'';
extraConfig = lib.concatLines [
(optionalString (!cfg.wheelNeedsPassword) ''
polkit.addRule(function(action, subject) {
if (action.id == "org.freedesktop.systemd1.manage-units" && subject.isInGroup("wheel")) {
return polkit.Result.YES;
}
});
'')
(optionalString cfg.persistentAuth.enable ''
polkit.addRule(function(action, subject) {
if (action.id == "org.freedesktop.systemd1.manage-units" && subject.active ${
optionalString (!cfg.persistentAuth.enableRemote) "&& subject.local"
}) {
return polkit.Result.AUTH_ADMIN_KEEP;
}
});
'')
];
};
environment.systemPackages = lib.optional cfg.sudo-shim.enable cfg.sudo-shim.package;