From ec4b7f30f5f4dfbc5b2164fdb6f25ff32e841cde Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 13 Apr 2019 14:49:48 +0200 Subject: l usershadow: add setuid wrapper for check_pw --- lass/3modules/usershadow.nix | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) (limited to 'lass/3modules') diff --git a/lass/3modules/usershadow.nix b/lass/3modules/usershadow.nix index cb2890969..383b9a537 100644 --- a/lass/3modules/usershadow.nix +++ b/lass/3modules/usershadow.nix @@ -31,13 +31,20 @@ session required pam_loginuid.so ''; - security.pam.services.dovecot2.text = '' - auth required pam_exec.so expose_authtok ${usershadow}/bin/verify_pam ${cfg.pattern} - auth required pam_permit.so - account required pam_permit.so - session required pam_permit.so - session required pam_env.so envfile=${config.system.build.pamEnvironment} - ''; + security.pam.services.dovecot2 = { + text = '' + auth required pam_exec.so debug expose_authtok log=/tmp/lol /run/wrappers/bin/shadow_verify_pam ${cfg.pattern} + auth required pam_permit.so + account required pam_permit.so + session required pam_permit.so + session required pam_env.so envfile=${config.system.build.pamEnvironment} + ''; + }; + + security.wrappers.shadow_verify_pam = { + source = "${usershadow}/bin/verify_pam"; + owner = "root"; + }; }; usershadow = let { -- cgit v1.2.3 From 91bab57c35d61550ae4fec98cd8e985c037ed7f7 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 13 Apr 2019 14:54:29 +0200 Subject: l usershadow: build without -threaded --- lass/3modules/usershadow.nix | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'lass/3modules') diff --git a/lass/3modules/usershadow.nix b/lass/3modules/usershadow.nix index 383b9a537..d967a108a 100644 --- a/lass/3modules/usershadow.nix +++ b/lass/3modules/usershadow.nix @@ -53,10 +53,13 @@ "bytestring" ]; body = pkgs.writeHaskellPackage "passwords" { + ghc-options = [ + "-rtsopts" + "-Wall" + ]; executables.verify_pam = { extra-depends = deps; text = '' - import Data.Monoid import System.IO import Data.Char (chr) import System.Environment (getEnv, getArgs) @@ -79,7 +82,6 @@ executables.verify_arg = { extra-depends = deps; text = '' - import Data.Monoid import System.Environment (getArgs) import Crypto.PasswordStore (verifyPasswordWith, pbkdf2) import qualified Data.ByteString.Char8 as BS8 -- cgit v1.2.3 From 24d7e2fa03a4533368a8ec90599211366feb1510 Mon Sep 17 00:00:00 2001 From: lassulus Date: Wed, 17 Apr 2019 20:16:06 +0200 Subject: l domsen: run verify_arg as root --- lass/3modules/usershadow.nix | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'lass/3modules') diff --git a/lass/3modules/usershadow.nix b/lass/3modules/usershadow.nix index d967a108a..51da2ec93 100644 --- a/lass/3modules/usershadow.nix +++ b/lass/3modules/usershadow.nix @@ -45,6 +45,10 @@ source = "${usershadow}/bin/verify_pam"; owner = "root"; }; + security.wrappers.shadow_verify_arg = { + source = "${usershadow}/bin/verify_arg"; + owner = "root"; + }; }; usershadow = let { -- cgit v1.2.3 From e4744b723728293fda24fccd9180f9e0bbdd80e8 Mon Sep 17 00:00:00 2001 From: lassulus Date: Thu, 18 Apr 2019 10:13:57 +0200 Subject: l: RIP ensure-permissions --- lass/3modules/default.nix | 1 - lass/3modules/ensure-permissions.nix | 66 ------------------------------------ 2 files changed, 67 deletions(-) delete mode 100644 lass/3modules/ensure-permissions.nix (limited to 'lass/3modules') diff --git a/lass/3modules/default.nix b/lass/3modules/default.nix index 59043aeb1..613c7c8ac 100644 --- a/lass/3modules/default.nix +++ b/lass/3modules/default.nix @@ -3,7 +3,6 @@ _: imports = [ ./dnsmasq.nix ./ejabberd - ./ensure-permissions.nix ./folderPerms.nix ./hosts.nix ./mysql-backup.nix diff --git a/lass/3modules/ensure-permissions.nix b/lass/3modules/ensure-permissions.nix deleted file mode 100644 index 36edc1127..000000000 --- a/lass/3modules/ensure-permissions.nix +++ /dev/null @@ -1,66 +0,0 @@ -{ config, pkgs, ... }: with import ; - -let - - cfg = config.lass.ensure-permissions; - -in - -{ - options.lass.ensure-permissions = mkOption { - default = []; - type = types.listOf (types.submodule ({ - options = { - - folder = mkOption { - type = types.absolute-pathname; - }; - - owner = mkOption { - # TODO user type - type = types.str; - default = "root"; - }; - - group = mkOption { - # TODO group type - type = types.str; - default = "root"; - }; - - permission = mkOption { - # TODO permission type - type = types.str; - default = "u+rw,g+rw"; - }; - - }; - })); - }; - - config = mkIf (cfg != []) { - - system.activationScripts.ensure-permissions = concatMapStringsSep "\n" (plan: '' - ${pkgs.coreutils}/bin/mkdir -p ${plan.folder} - ${pkgs.coreutils}/bin/chmod -R ${plan.permission} ${plan.folder} - ${pkgs.coreutils}/bin/chown -R ${plan.owner}:${plan.group} ${plan.folder} - '') cfg; - systemd.services = - listToAttrs (map (plan: nameValuePair "ensure-permisson.${replaceStrings ["/"] ["_"] plan.folder}" { - wantedBy = [ "multi-user.target" ]; - serviceConfig = { - Restart = "always"; - RestartSec = 10; - ExecStart = pkgs.writeDash "ensure-perms" '' - ${pkgs.inotifyTools}/bin/inotifywait -mrq -e CREATE --format %w%f ${plan.folder} \ - | while IFS= read -r FILE; do - ${pkgs.coreutils}/bin/chmod -R ${plan.permission} "$FILE" 2>/dev/null - ${pkgs.coreutils}/bin/chown -R ${plan.owner}:${plan.group} "$FILE" 2>/dev/null - done - ''; - }; - }) cfg) - ; - - }; -} -- cgit v1.2.3 [cgit] Unable to lock slot /tmp/cgit/71300000.lock: No such file or directory (2)