gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/run0: add options for persistent authentication (#533341)

Browse Source
This commit is contained in:
Grimmauld
2026-06-23 09:22:31 +00:00
committed by GitHub
parent b4c420174b 498aab6ea8
commit 854a752851
2 changed files with 27 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nixos/doc/manual/release-notes/rl-2611.section.md
+2
View File
@@ -58,6 +58,8 @@
- `security.run0.enableSudoAlias` now uses the `run0-sudo-shim` instead of a shell-script to improve compatibility.
- `security.run0.persistentAuth` options have been added to support persistent Authentication of session. Timeout configurable via `security.polkit.settings.Polkitd.ExpirationSeconds`.
- `boot.loader.systemd-boot` gained support for [Automatic Boot Assessment](https://systemd.io/AUTOMATIC_BOOT_ASSESSMENT/) via the new [`boot.loader.systemd-boot.bootCounting`](#opt-boot.loader.systemd-boot.bootCounting.enable) options, allowing automatic detection of and recovery from bad NixOS generations. As part of this change, boot loader entries on the ESP/XBOOTLDR partition are now named `nixos-<content-hash>.conf` instead of `nixos-generation-<n>.conf`; existing entries are migrated automatically on the next `nixos-rebuild boot`/`switch`.
- `security.polkit.settings` added for RFC42 style configuration of the polkitd daemon.
nixos/modules/security/run0.nix
+25 -7
View File
@@ -13,6 +13,7 @@ let
mkOption
mkPackageOption
mkAliasOptionModule
optionalString
;
cfg = config.security.run0;
@@ -21,6 +22,12 @@ in
options.security.run0 = {
enable = mkEnableOption "support for run0";
persistentAuth.enable = mkEnableOption ''
persistent authentication for sessions.
Timeout configurable via {option}`security.polkit.settings.Polkitd.ExpirationSeconds`
'';
persistentAuth.enableRemote = mkEnableOption "persistent authentication for remote sessions";
wheelNeedsPassword = mkOption {
type = lib.types.bool;
default = true;
@@ -67,13 +74,24 @@ in
security.polkit = {
enable = true;
extraConfig = mkIf (!cfg.wheelNeedsPassword) ''
polkit.addRule(function(action, subject) {
if (action.id == "org.freedesktop.systemd1.manage-units" && subject.isInGroup("wheel")) {
return polkit.Result.YES;
}
});
'';
extraConfig = lib.concatLines [
(optionalString (!cfg.wheelNeedsPassword) ''
polkit.addRule(function(action, subject) {
if (action.id == "org.freedesktop.systemd1.manage-units" && subject.isInGroup("wheel")) {
return polkit.Result.YES;
}
});
'')
(optionalString cfg.persistentAuth.enable ''
polkit.addRule(function(action, subject) {
if (action.id == "org.freedesktop.systemd1.manage-units" && subject.active ${
optionalString (!cfg.persistentAuth.enableRemote) "&& subject.local"
}) {
return polkit.Result.AUTH_ADMIN_KEEP;
}
});
'')
];
};
environment.systemPackages = lib.optional cfg.sudo-shim.enable cfg.sudo-shim.package;