From e778520f714aac4f2fee751a6f8ab83f1d777c38 Mon Sep 17 00:00:00 2001 From: Majiir Paktu Date: Sat, 28 Jun 2025 19:50:59 -0400 Subject: [PATCH] nixos: use full path to PAM modules PAM rules with non-absolute module paths are rejected when apparmor is used. In general, it helps (aside from readability) for all the module paths to be absolute, especially when the user overrides the PAM package. --- nixos/modules/security/pam.nix | 16 ++++---- .../modules/services/display-managers/gdm.nix | 40 +++++++++---------- .../services/display-managers/sddm.nix | 24 +++++------ nixos/modules/services/networking/vsftpd.nix | 4 +- nixos/modules/services/wayland/cage.nix | 8 ++-- .../services/x11/display-managers/lightdm.nix | 32 +++++++-------- 6 files changed, 62 insertions(+), 62 deletions(-) diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix index d568b32a45a3..15a889ac7e11 100644 --- a/nixos/modules/security/pam.nix +++ b/nixos/modules/security/pam.nix @@ -2532,14 +2532,14 @@ in security.pam.services = { other.text = '' - auth required pam_warn.so - auth required pam_deny.so - account required pam_warn.so - account required pam_deny.so - password required pam_warn.so - password required pam_deny.so - session required pam_warn.so - session required pam_deny.so + auth required ${package}/lib/security/pam_warn.so + auth required ${package}/lib/security/pam_deny.so + account required ${package}/lib/security/pam_warn.so + account required ${package}/lib/security/pam_deny.so + password required ${package}/lib/security/pam_warn.so + password required ${package}/lib/security/pam_deny.so + session required ${package}/lib/security/pam_warn.so + session required ${package}/lib/security/pam_deny.so ''; # Most of these should be moved to specific modules. diff --git a/nixos/modules/services/display-managers/gdm.nix b/nixos/modules/services/display-managers/gdm.nix index 62b90efa92b9..18998ddeb34f 100644 --- a/nixos/modules/services/display-managers/gdm.nix +++ b/nixos/modules/services/display-managers/gdm.nix @@ -384,19 +384,19 @@ in # GDM LFS PAM modules, adapted somehow to NixOS security.pam.services = { gdm-launch-environment.text = '' - auth required pam_succeed_if.so audit quiet_success user ingroup gdm - auth optional pam_permit.so + auth required ${config.security.pam.package}/lib/security/pam_succeed_if.so audit quiet_success user ingroup gdm + auth optional ${config.security.pam.package}/lib/security/pam_permit.so - account required pam_succeed_if.so audit quiet_success user ingroup gdm - account sufficient pam_unix.so + account required ${config.security.pam.package}/lib/security/pam_succeed_if.so audit quiet_success user ingroup gdm + account sufficient ${config.security.pam.package}/lib/security/pam_unix.so - password required pam_deny.so + password required ${config.security.pam.package}/lib/security/pam_deny.so - session required pam_succeed_if.so audit quiet_success user ingroup gdm - session required pam_env.so conffile=/etc/pam/environment readenv=0 + session required ${config.security.pam.package}/lib/security/pam_succeed_if.so audit quiet_success user ingroup gdm + session required ${config.security.pam.package}/lib/security/pam_env.so conffile=/etc/pam/environment readenv=0 session optional ${config.systemd.package}/lib/security/pam_systemd.so - session optional pam_keyinit.so force revoke - session optional pam_permit.so + session optional ${config.security.pam.package}/lib/security/pam_keyinit.so force revoke + session optional ${config.security.pam.package}/lib/security/pam_permit.so ''; gdm-password.text = '' @@ -407,19 +407,19 @@ in ''; gdm-autologin.text = '' - auth requisite pam_nologin.so - auth required pam_succeed_if.so uid >= 1000 quiet + auth requisite ${config.security.pam.package}/lib/security/pam_nologin.so + auth required ${config.security.pam.package}/lib/security/pam_succeed_if.so uid >= 1000 quiet ${lib.optionalString (pamLogin.enable && pamLogin.enableGnomeKeyring) '' auth [success=ok default=1] ${gdm}/lib/security/pam_gdm.so auth optional ${pkgs.gnome-keyring}/lib/security/pam_gnome_keyring.so ''} - auth required pam_permit.so + auth required ${config.security.pam.package}/lib/security/pam_permit.so - account sufficient pam_unix.so + account sufficient ${config.security.pam.package}/lib/security/pam_unix.so - password requisite pam_unix.so nullok yescrypt + password requisite ${config.security.pam.package}/lib/security/pam_unix.so nullok yescrypt - session optional pam_keyinit.so revoke + session optional ${config.security.pam.package}/lib/security/pam_keyinit.so revoke session include login ''; @@ -428,11 +428,11 @@ in login.fprintAuth = lib.mkIf config.services.fprintd.enable false; gdm-fingerprint.text = lib.mkIf config.services.fprintd.enable '' - auth required pam_shells.so - auth requisite pam_nologin.so - auth requisite pam_faillock.so preauth + auth required ${config.security.pam.package}/lib/security/pam_shells.so + auth requisite ${config.security.pam.package}/lib/security/pam_nologin.so + auth requisite ${config.security.pam.package}/lib/security/pam_faillock.so preauth auth required ${pkgs.fprintd}/lib/security/pam_fprintd.so - auth required pam_env.so conffile=/etc/pam/environment readenv=0 + auth required ${config.security.pam.package}/lib/security/pam_env.so conffile=/etc/pam/environment readenv=0 ${lib.optionalString (pamLogin.enable && pamLogin.enableGnomeKeyring) '' auth [success=ok default=1] ${gdm}/lib/security/pam_gdm.so auth optional ${pkgs.gnome-keyring}/lib/security/pam_gnome_keyring.so @@ -440,7 +440,7 @@ in account include login - password required pam_deny.so + password required ${config.security.pam.package}/lib/security/pam_deny.so session include login ''; diff --git a/nixos/modules/services/display-managers/sddm.nix b/nixos/modules/services/display-managers/sddm.nix index b960c7e63d8d..25f63007f9ac 100644 --- a/nixos/modules/services/display-managers/sddm.nix +++ b/nixos/modules/services/display-managers/sddm.nix @@ -376,25 +376,25 @@ in ''; sddm-greeter.text = '' - auth required pam_succeed_if.so audit quiet_success user = sddm - auth optional pam_permit.so + auth required ${config.security.pam.package}/lib/security/pam_succeed_if.so audit quiet_success user = sddm + auth optional ${config.security.pam.package}/lib/security/pam_permit.so - account required pam_succeed_if.so audit quiet_success user = sddm - account sufficient pam_unix.so + account required ${config.security.pam.package}/lib/security/pam_succeed_if.so audit quiet_success user = sddm + account sufficient ${config.security.pam.package}/lib/security/pam_unix.so - password required pam_deny.so + password required ${config.security.pam.package}/lib/security/pam_deny.so - session required pam_succeed_if.so audit quiet_success user = sddm - session required pam_env.so conffile=/etc/pam/environment readenv=0 + session required ${config.security.pam.package}/lib/security/pam_succeed_if.so audit quiet_success user = sddm + session required ${config.security.pam.package}/lib/security/pam_env.so conffile=/etc/pam/environment readenv=0 session optional ${config.systemd.package}/lib/security/pam_systemd.so - session optional pam_keyinit.so force revoke - session optional pam_permit.so + session optional ${config.security.pam.package}/lib/security/pam_keyinit.so force revoke + session optional ${config.security.pam.package}/lib/security/pam_permit.so ''; sddm-autologin.text = '' - auth requisite pam_nologin.so - auth required pam_succeed_if.so uid >= ${toString cfg.autoLogin.minimumUid} quiet - auth required pam_permit.so + auth requisite ${config.security.pam.package}/lib/security/pam_nologin.so + auth required ${config.security.pam.package}/lib/security/pam_succeed_if.so uid >= ${toString cfg.autoLogin.minimumUid} quiet + auth required ${config.security.pam.package}/lib/security/pam_permit.so account include sddm diff --git a/nixos/modules/services/networking/vsftpd.nix b/nixos/modules/services/networking/vsftpd.nix index 3a129f1a610e..070f77115829 100644 --- a/nixos/modules/services/networking/vsftpd.nix +++ b/nixos/modules/services/networking/vsftpd.nix @@ -334,8 +334,8 @@ in }; security.pam.services.vsftpd.text = mkIf (cfg.enableVirtualUsers && cfg.userDbPath != null) '' - auth required pam_userdb.so db=${cfg.userDbPath} - account required pam_userdb.so db=${cfg.userDbPath} + auth required ${config.security.pam.package}/lib/security/pam_userdb.so db=${cfg.userDbPath} + account required ${config.security.pam.package}/lib/security/pam_userdb.so db=${cfg.userDbPath} ''; }; } diff --git a/nixos/modules/services/wayland/cage.nix b/nixos/modules/services/wayland/cage.nix index e39e31ef6272..76731622d50a 100644 --- a/nixos/modules/services/wayland/cage.nix +++ b/nixos/modules/services/wayland/cage.nix @@ -106,10 +106,10 @@ in security.polkit.enable = true; security.pam.services.cage.text = '' - auth required pam_unix.so nullok - account required pam_unix.so - session required pam_unix.so - session required pam_env.so conffile=/etc/pam/environment readenv=0 + auth required ${config.security.pam.package}/lib/security/pam_unix.so nullok + account required ${config.security.pam.package}/lib/security/pam_unix.so + session required ${config.security.pam.package}/lib/security/pam_unix.so + session required ${config.security.pam.package}/lib/security/pam_env.so conffile=/etc/pam/environment readenv=0 session required ${config.systemd.package}/lib/security/pam_systemd.so ''; diff --git a/nixos/modules/services/x11/display-managers/lightdm.nix b/nixos/modules/services/x11/display-managers/lightdm.nix index 467207ecd92b..b0e757b21f5f 100644 --- a/nixos/modules/services/x11/display-managers/lightdm.nix +++ b/nixos/modules/services/x11/display-managers/lightdm.nix @@ -288,36 +288,36 @@ in # https://github.com/elementary/switchboard-plug-parental-controls/blob/8.0.1/src/daemon/Server.vala#L325 # Must specify conffile since pam_time defaults to ${linux-pam}/etc/security/time.conf. + lib.optionalString config.services.pantheon.parental-controls.enable '' - account required pam_time.so conffile=/etc/security/time.conf + account required ${config.security.pam.package}/lib/security/pam_time.so conffile=/etc/security/time.conf ''; security.pam.services.lightdm-greeter.text = '' - auth required pam_succeed_if.so audit quiet_success user = lightdm - auth optional pam_permit.so + auth required ${config.security.pam.package}/lib/security/pam_succeed_if.so audit quiet_success user = lightdm + auth optional ${config.security.pam.package}/lib/security/pam_permit.so - account required pam_succeed_if.so audit quiet_success user = lightdm - account sufficient pam_unix.so + account required ${config.security.pam.package}/lib/security/pam_succeed_if.so audit quiet_success user = lightdm + account sufficient ${config.security.pam.package}/lib/security/pam_unix.so - password required pam_deny.so + password required ${config.security.pam.package}/lib/security/pam_deny.so - session required pam_succeed_if.so audit quiet_success user = lightdm - session required pam_env.so conffile=/etc/pam/environment readenv=0 + session required ${config.security.pam.package}/lib/security/pam_succeed_if.so audit quiet_success user = lightdm + session required ${config.security.pam.package}/lib/security/pam_env.so conffile=/etc/pam/environment readenv=0 session optional ${config.systemd.package}/lib/security/pam_systemd.so - session optional pam_keyinit.so force revoke - session optional pam_permit.so + session optional ${config.security.pam.package}/lib/security/pam_keyinit.so force revoke + session optional ${config.security.pam.package}/lib/security/pam_permit.so ''; security.pam.services.lightdm-autologin.text = '' - auth requisite pam_nologin.so + auth requisite ${config.security.pam.package}/lib/security/pam_nologin.so - auth required pam_succeed_if.so uid >= 1000 quiet - auth required pam_permit.so + auth required ${config.security.pam.package}/lib/security/pam_succeed_if.so uid >= 1000 quiet + auth required ${config.security.pam.package}/lib/security/pam_permit.so - account sufficient pam_unix.so + account sufficient ${config.security.pam.package}/lib/security/pam_unix.so - password requisite pam_unix.so nullok yescrypt + password requisite ${config.security.pam.package}/lib/security/pam_unix.so nullok yescrypt - session optional pam_keyinit.so revoke + session optional ${config.security.pam.package}/lib/security/pam_keyinit.so revoke session include login '';