From 66db09eb6225dbc3b013a70513ce8ae82d32edf6 Mon Sep 17 00:00:00 2001
From: rnhmjoj <rnhmjoj@inventati.org>
Date: Wed, 26 Feb 2025 19:33:54 +0100
Subject: [PATCH] nixos/dhcpcd: add option to allow setuid binaries

The promise in the networking.dhcpcd.runHook description was broken by
further restrictions added in 21bb7ea9.
---
 nixos/modules/services/networking/dhcpcd.nix | 36 +++++++++++++-------
 1 file changed, 24 insertions(+), 12 deletions(-)

diff --git a/nixos/modules/services/networking/dhcpcd.nix b/nixos/modules/services/networking/dhcpcd.nix
index 32ddc2757bff..6aecbec7bd4a 100644
--- a/nixos/modules/services/networking/dhcpcd.nix
+++ b/nixos/modules/services/networking/dhcpcd.nix
@@ -202,6 +202,15 @@ in
       '';
     };
 
+    networking.dhcpcd.allowSetuid = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Whether to relax the security sandbox to allow running setuid
+        binaries (e.g. `sudo`) in the dhcpcd hooks.
+      '';
+    };
+
     networking.dhcpcd.runHook = lib.mkOption {
       type = lib.types.lines;
       default = "";
@@ -213,7 +222,7 @@ in
         ::: {.note}
         To use sudo or similar tools in your script you may have to set:
 
-            systemd.services.dhcpcd.serviceConfig.NoNewPrivileges = false;
+            networking.dhcpcd.allowSetuid = true;
 
         In addition, as most of the filesystem is inaccessible to dhcpcd
         by default, you may want to define some exceptions, e.g.
@@ -321,7 +330,7 @@ in
             "CAP_NET_RAW"
             "CAP_NET_BIND_SERVICE"
           ];
-          CapabilityBoundingSet = [
+          CapabilityBoundingSet = lib.optionals (!cfg.allowSetuid) [
             "CAP_NET_ADMIN"
             "CAP_NET_RAW"
             "CAP_NET_BIND_SERVICE"
@@ -335,7 +344,7 @@ in
           DeviceAllow = "";
           LockPersonality = true;
           MemoryDenyWriteExecute = true;
-          NoNewPrivileges = lib.mkDefault true; # may be disabled for sudo in runHook
+          NoNewPrivileges = lib.mkDefault (!cfg.allowSetuid); # may be disabled for sudo in runHook
           PrivateDevices = true;
           PrivateMounts = true;
           PrivateTmp = true;
@@ -360,15 +369,18 @@ in
           RestrictNamespaces = true;
           RestrictRealtime = true;
           RestrictSUIDSGID = true;
-          SystemCallFilter = [
-            "@system-service"
-            "~@aio"
-            "~@keyring"
-            "~@memlock"
-            "~@mount"
-            "~@privileged"
-            "~@resources"
-          ];
+          SystemCallFilter =
+            [
+              "@system-service"
+              "~@aio"
+              "~@keyring"
+              "~@memlock"
+              "~@mount"
+            ]
+            ++ lib.optionals (!cfg.allowSetuid) [
+              "~@privileged"
+              "~@resources"
+            ];
           SystemCallArchitectures = "native";
           UMask = "0027";
         };