From f59623d1215dad2c8a62aea5318ff86d0887f62e Mon Sep 17 00:00:00 2001 From: nikstur Date: Thu, 4 Jun 2026 14:22:37 +0200 Subject: [PATCH] nixos/security/wrappers: add more context to enableWrappers description --- nixos/modules/security/wrappers/default.nix | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/nixos/modules/security/wrappers/default.nix b/nixos/modules/security/wrappers/default.nix index 20177350a740..52a2711e9dff 100644 --- a/nixos/modules/security/wrappers/default.nix +++ b/nixos/modules/security/wrappers/default.nix @@ -181,8 +181,23 @@ in ###### interface options = { - security.enableWrappers = lib.mkEnableOption "SUID/SGID wrappers" // { + security.enableWrappers = lib.mkEnableOption "" // { default = true; + description = '' + Whether to enable SUID/SGID wrappers. + + ::: {.warning} + ONLY DISABLE THIS OPTION IF YOU KNOW WHAT YOU'RE DOING. + ::: + + A normal interactive NixOS system requires SUID/SGID wrappers (e.g. for + PAM and sudo). Disabling them, thus will lock you out from your system. + + Disabling the SUID/SGID binaries is useful for non-interactive systems + (like a firewall appliance) to minimize the attack surface. In the + future, this might become available for interactive systems as well + (e.g. with systemd's [run0](https://www.freedesktop.org/software/systemd/man/latest/run0)). + ''; }; security.wrappers = lib.mkOption {