gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/pam: add u2f.control option (#495378)

Browse Source
This commit is contained in:
Pol Dellaiera
2026-04-12 08:08:59 +00:00
committed by GitHub
parent b047a82548 2fb68fdb50
commit 75b1dc85ed
2 changed files with 38 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nixos/modules/programs/i3lock.nix
+2 -2
View File
@@ -32,7 +32,7 @@ in
description = ''
Whether to enable U2F support in the i3lock program.
U2F enables authentication using a hardware device, such as a security key.
When U2F support is enabled, the i3lock program will set the setuid bit on the i3lock binary and enable the pam u2fAuth service,
When U2F support is enabled, the i3lock program will set the setuid bit on the i3lock binary and enable the pam u2f service,
'';
};
};
@@ -51,7 +51,7 @@ in
source = "${cfg.package.out}/bin/i3lock";
};
security.pam.services.i3lock.u2fAuth = cfg.u2fSupport;
security.pam.services.i3lock.u2f.enable = cfg.u2fSupport;
};
nixos/modules/security/pam.nix
+36 -13
View File
@@ -135,6 +135,7 @@ let
imports = [
(lib.mkRenamedOptionModule [ "enableKwallet" ] [ "kwallet" "enable" ])
(lib.mkRenamedOptionModule [ "u2fAuth" ] [ "u2f" "enable" ])
];
options = {
@@ -202,17 +203,39 @@ let
'';
};
u2fAuth = lib.mkOption {
default = config.security.pam.u2f.enable;
defaultText = lib.literalExpression "config.security.pam.u2f.enable";
type = lib.types.bool;
description = ''
If set, users listed in
{file}`$XDG_CONFIG_HOME/Yubico/u2f_keys` (or
{file}`$HOME/.config/Yubico/u2f_keys` if XDG variable is
not set) are able to log in with the associated U2F key. Path can be
changed using {option}`security.pam.u2f.authFile` option.
'';
u2f = {
enable = lib.mkOption {
default = config.security.pam.u2f.enable;
defaultText = lib.literalExpression "config.security.pam.u2f.enable";
type = lib.types.bool;
description = ''
If set, users listed in
{file}`$XDG_CONFIG_HOME/Yubico/u2f_keys` (or
{file}`$HOME/.config/Yubico/u2f_keys` if XDG variable is
not set) are able to log in with the associated U2F key. Path can be
changed using {option}`security.pam.u2f.authFile` option.
'';
};
control = lib.mkOption {
default = config.security.pam.u2f.control;
defaultText = lib.literalExpression "config.security.pam.u2f.control";
type = lib.types.enum [
"required"
"requisite"
"sufficient"
"optional"
];
description = ''
This option sets pam "control".
If you want to have multi factor authentication, use "required".
If you want to use U2F device instead of regular password, use "sufficient".
Read
{manpage}`pam.conf(5)`
for better understanding of this option.
'';
};
};
usshAuth = lib.mkOption {
@@ -1045,8 +1068,8 @@ let
in
{
name = "u2f";
enable = cfg.u2fAuth;
control = u2f.control;
enable = cfg.u2f.enable;
control = cfg.u2f.control;
modulePath = "${pkgs.pam_u2f}/lib/security/pam_u2f.so";
inherit (u2f) settings;
}