From e17e60b2738bcddf4e0661da3d63872ceec2a9cb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B8rn=20Forsman?= <bjorn.forsman@gmail.com>
Date: Mon, 1 Apr 2024 14:14:34 +0200
Subject: [PATCH] nixos-generate-config: preserve vfat filesystem mount
 permissions

The default is to mount these world-readable, but that's a security risk
for the EFI System Partition.

Ref https://github.com/NixOS/nixpkgs/issues/279362.
---
 .../modules/installer/tools/nixos-generate-config.pl  | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/nixos/modules/installer/tools/nixos-generate-config.pl b/nixos/modules/installer/tools/nixos-generate-config.pl
index ef25b8b296e6..cf4173638b1a 100644
--- a/nixos/modules/installer/tools/nixos-generate-config.pl
+++ b/nixos/modules/installer/tools/nixos-generate-config.pl
@@ -453,6 +453,17 @@ EOF
         }
     }
 
+    # Preserve umask (fmask, dmask) settings for vfat filesystems.
+    # (The default is to mount these world-readable, but that's a security risk
+    # for the EFI System Partition.)
+    if ($fsType eq "vfat") {
+        for (@superOptions) {
+            if ($_ =~ /fmask|dmask/) {
+                push @extraOptions, $_;
+            }
+        }
+    }
+
     # is this a stratis fs?
     my $stableDevPath = findStableDevPath $device;
     my $stratisPool;