gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

security: Updating the machinery for creating the wrapper programs dir in var and updating ping and ping6 for changed config interface.

Browse Source
This commit is contained in:
Parnell Springmeyer
2016-07-15 18:15:08 -05:00
parent 79e81aa31b
commit 81b33eb466
3 changed files with 19 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
nixos/modules/tasks/network-interfaces.nix
View File

@@ -891,7 +891,7 @@ in
# Capabilities won't work unless we have at-least a 4.3 Linux
# kernel because we need the ambient capability
security.setcapCapabilities = mkIf (versionAtLeast (getVersion config.boot.kernelPackages.kernel) "4.3") (
security.permissionsWrappers.setcap = mkIf (versionAtLeast (getVersion config.boot.kernelPackages.kernel) "4.3") (
[
{ program = "ping";
source = "${pkgs.iputils.out}/bin/ping";
@@ -908,8 +908,22 @@ in
);
# If our linux kernel IS older than 4.3, let's setuid ping and ping6
security.setuidPrograms = mkIf (versionOlder (getVersion config.boot.kernelPackages.kernel) "4.3") (
[ "ping" "ping6" ]
security.permissionsWrappers.setuid = mkIf (versionOlder (getVersion config.boot.kernelPackages.kernel) "4.3") (
[
{ program = "ping";
source = "${pkgs.iputils.out}/bin/ping";
owner = "root";
group = "root";
setuid = true;
}
{ program = "ping6";
source = "${pkgs.iputils.out}/bin/ping6";
owner = "root";
group = "root";
setuid = true;
}
]
);
# Set the host and domain names in the activation script. Don't