Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

nixos/pmount: add pmount programs module #51406

Closed
wants to merge 1 commit into
base: master
from

Conversation

Projects
None yet
4 participants
@Gerschtli
Copy link
Contributor

Gerschtli commented Dec 2, 2018

Motivation for this change

Add pmount module with setuid wrapper.

Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Assured whether relevant documentation is up to date
  • Fits CONTRIBUTING.md.

@matthewbauer

This comment has been minimized.

Copy link
Member

matthewbauer commented Dec 2, 2018

Shouldn't users set security.wrappers themselves? It's not clearly documented what is going on behind the scenes here. This looks like it will let anyone use pmount as root. See #50480 for why we should try to avoid this.

Anyway, why can't we just use udiskctl? It should do the same thing without the SUID bit.

@Gerschtli

This comment has been minimized.

Copy link
Contributor Author

Gerschtli commented Dec 2, 2018

I see your point, but without the security wrapper, pmount wouldn't work correctly. So either way, the documentation should clearly state, that such a wrapper is mandatory.

I didn't know udiskctl, will check it out!

pumount.source = "${pkgs.pmount.out}/bin/pumount";
};

system.activationScripts.pmount = "mkdir -p /media";

This comment has been minimized.

@jfrankenau

jfrankenau Dec 3, 2018

Contributor

I presume pmount does not create /media on its own? Personally, I prefer using a tmpfiles rule or maybe even a tmpfs for this. But it may be better to leave it up to the user in the first place.

This comment has been minimized.

@Gerschtli

Gerschtli Dec 3, 2018

Author Contributor

Yes, it's probably too restrictive and needs more flexibilty..

@Gerschtli

This comment has been minimized.

Copy link
Contributor Author

Gerschtli commented Dec 3, 2018

Closing this issue because the module assumes to much of what the user wants, isn't documented enough. If anyone wants to contribute an modified version of this module, feel free to do so, but I am going to use udiskctl which seems to be the better choice (no need of setuid).

Thank you both for your input though!

@Gerschtli Gerschtli closed this Dec 3, 2018

@Gerschtli Gerschtli deleted the Gerschtli:add/programs-pmount branch Dec 3, 2018

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session.