Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

nixos/users:added users.allowLoginless option #73082

Closed
wants to merge 3 commits into from
Closed

nixos/users:added users.allowLoginless option #73082

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b4307a1
home-manager:2019-10-23 -> 2019-10-29
pasqui23 Oct 29, 2019
0b14077
Merge branch 'master' of https://github.com/NixOS/nixpkgs
pasqui23 Nov 8, 2019
2bc74dc
nixos/users:added users.allowLoginless option
pasqui23 Nov 8, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
25 changes: 14 additions & 11 deletions nixos/modules/config/users-groups.nix
View file
Open in desktop
Expand Up @@ -441,6 +441,15 @@ in {
'';
};

users.allowLoginless = mkOption {
type = types.bool;
default = false;
description = ''
Whether to allow being locked out of your system by not allowing
login to any administrator user.
'';
};

users.users = mkOption {
default = {};
type = with types; loaOf (submodule userOpts);
Expand Down Expand Up @@ -473,14 +482,6 @@ in {
'';
};

# FIXME: obsolete - will remove.
security.initialRootPassword = mkOption {
type = types.str;
default = "!";
example = "";
visible = false;
};

};


Expand All @@ -495,7 +496,7 @@ in {
home = "/root";
shell = mkDefault cfg.defaultUserShell;
group = "root";
initialHashedPassword = mkDefault config.security.initialRootPassword;
initialHashedPassword = mkDefault "!";
};
nobody = {
uid = ids.uids.nobody;
Expand Down Expand Up @@ -578,7 +579,7 @@ in {
# there is at least one "privileged" account that has a
# password or an SSH authorized key. Privileged accounts are
# root and users in the wheel group.
assertion = !cfg.mutableUsers ->
assertion = (!cfg.mutableUsers && cfg.allowLoginless)->
any id (mapAttrsToList (name: cfg:
(name == "root"
|| cfg.group == "wheel"
Expand All @@ -592,7 +593,9 @@ in {
) cfg.users);
message = ''
Neither the root account nor any wheel user has a password or SSH authorized key.
You must set one to prevent being locked out of your system.'';
You must set one to prevent being locked out of your system.
Otherwise set users.allowLoginless = true to allow being locked out of your system.
'';
}
];

Expand Down
1 change: 1 addition & 0 deletions nixos/modules/rename.nix
View file
Open in desktop
Expand Up @@ -72,6 +72,7 @@ with lib;
(mkRemovedOptionModule [ "security" "setuidPrograms" ] "Use security.wrappers instead")

(mkRenamedOptionModule [ "security" "virtualization" "flushL1DataCache" ] [ "security" "virtualisation" "flushL1DataCache" ])
(mkRenamedOptionModule ["security" "initialRootPassword"] ["users" "users" "root" "initialHashedPassword"])
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

please add this to nixos/modules/config/users-groups.nix instead, like done in other places - we intend to move away from a global rename.nix.


# PAM
(mkRenamedOptionModule [ "security" "pam" "enableU2F" ] [ "security" "pam" "u2f" "enable" ])
Expand Down
6 changes: 3 additions & 3 deletions pkgs/tools/package-management/home-manager/default.nix
View file
Open in desktop
Expand Up @@ -6,13 +6,13 @@
stdenv.mkDerivation rec {

pname = "home-manager";
version = "2019-10-23";
version = "2019-10-29";
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this probably isn't related, and should go in a separate PR ;-)


src = fetchFromGitHub {
owner = "rycee";
repo = "home-manager";
rev = "1b987952b5f7d18f0bb66317cf18ffda43ad45aa";
sha256 = "1jdmxdnyd6jaiqjjkzw3qr0ia4qvmwmgfn05hbph37v03p55ah5q";
rev = "149c0593abac5879631f63e55ef5b68277020b66";
sha256 = "1a39mj238mxd5b6zglmsb1iclqpzs7av38g6gc1dfjxhnb731rvc";
};

nativeBuildInputs = [ makeWrapper ];
Expand Down