From efc7aebda7f85f67b52cc334066c6dd344371103 Mon Sep 17 00:00:00 2001 From: euxane Date: Thu, 11 Jul 2024 15:36:30 +0200 Subject: [PATCH] nixos/fcgiwrap: require explicit owner for UNIX sockets The default in the previous option documentation was incorrect, resulting in the UNIX socket to be unreachable except by root by default. This fixes the documentation and requires consumers to set values explicitly for the socket's owning user and group. --- nixos/modules/services/web-servers/fcgiwrap.nix | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/nixos/modules/services/web-servers/fcgiwrap.nix b/nixos/modules/services/web-servers/fcgiwrap.nix index d352f4fdd2b4..36a327b9ab9f 100644 --- a/nixos/modules/services/web-servers/fcgiwrap.nix +++ b/nixos/modules/services/web-servers/fcgiwrap.nix @@ -68,7 +68,6 @@ in { default = null; description = '' User to be set as owner of the UNIX socket. - Defaults to the process running user. ''; }; @@ -77,7 +76,6 @@ in { default = null; description = '' Group to be set as owner of the UNIX socket. - Defaults to the process running group. ''; }; @@ -97,6 +95,14 @@ in { config = { assertions = concatLists (mapAttrsToList (name: cfg: [ + { + assertion = cfg.socket.type == "unix" -> cfg.socket.user != null; + message = "Socket owner is required for the UNIX socket type."; + } + { + assertion = cfg.socket.type == "unix" -> cfg.socket.group != null; + message = "Socket owner is required for the UNIX socket type."; + } { assertion = cfg.socket.user != null -> cfg.socket.type == "unix"; message = "Socket owner can only be set for the UNIX socket type.";