From 8072ee22f2c8bbe7c2120ab9bd605de4560cf905 Mon Sep 17 00:00:00 2001
From: pennae <github@quasiparticle.net>
Date: Fri, 26 Nov 2021 18:44:50 +0100
Subject: [PATCH] dhcpcd, nixos/dhcpcd: enable privsep

dhdpcd 9 support privilege separation with a dedicated user and seccomp
filtering. this has been enabled for a while in other distributions as
well.

if the dhcpcd module is not used and the _dhcpcd user/group isn't
definied otherwise dhcpcd will fall back to not using privsep.
---
 nixos/modules/services/networking/dhcpcd.nix | 6 ++++++
 pkgs/tools/networking/dhcpcd/default.nix     | 7 +++++++
 2 files changed, 13 insertions(+)

diff --git a/nixos/modules/services/networking/dhcpcd.nix b/nixos/modules/services/networking/dhcpcd.nix
index 7d50c9477bd5..0c69caa64bba 100644
--- a/nixos/modules/services/networking/dhcpcd.nix
+++ b/nixos/modules/services/networking/dhcpcd.nix
@@ -214,6 +214,12 @@ in
           };
       };
 
+    users.users._dhcpcd = {
+      isSystemUser = true;
+      group = "_dhcpcd";
+    };
+    users.groups._dhcpcd = {};
+
     environment.systemPackages = [ dhcpcd ];
 
     environment.etc."dhcpcd.exit-hook".source = exitHook;
diff --git a/pkgs/tools/networking/dhcpcd/default.nix b/pkgs/tools/networking/dhcpcd/default.nix
index 8927e8e76aa0..2f27956a7973 100644
--- a/pkgs/tools/networking/dhcpcd/default.nix
+++ b/pkgs/tools/networking/dhcpcd/default.nix
@@ -6,6 +6,7 @@
 , runtimeShellPackage
 , runtimeShell
 , nixosTests
+, enablePrivSep ? true
 }:
 
 stdenv.mkDerivation rec {
@@ -32,6 +33,12 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--sysconfdir=/etc"
     "--localstatedir=/var"
+  ]
+  ++ lib.optionals enablePrivSep [
+    "--enable-privsep"
+    # dhcpcd disables privsep if it can't find the default user,
+    # so we explicitly specify the default.
+    "--privsepuser=_dhcpcd"
   ];
 
   makeFlags = [ "PREFIX=${placeholder "out"}" ];