Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

pam_gnupg: init at fbd75b7 #77002

Closed
wants to merge 3 commits into from
Closed

pam_gnupg: init at fbd75b7 #77002

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e4e0510
pam_gnupg: init at fbd75b7
ahesford Jan 6, 2020
12faef6
pam_gnupg: fbd75b7 -> unstable-2019-12-06
ahesford Jan 9, 2020
796a6d6
pam_gnupg: refactor configure phase
ahesford Jan 9, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
12 changes: 12 additions & 0 deletions nixos/modules/security/pam.nix
View file
Open in desktop
Expand Up @@ -361,12 +361,15 @@ let
# We use try_first_pass the second time to avoid prompting password twice
(optionalString (cfg.unixAuth &&
(config.security.pam.enableEcryptfs
|| config.security.pam.enableGnupg
|| cfg.pamMount
|| cfg.enableKwallet
|| cfg.enableGnomeKeyring
|| cfg.googleAuthenticator.enable
|| cfg.duoSecurity.enable)) ''
auth required pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} likeauth
${optionalString config.security.pam.enableGnupg
"auth optional ${pkgs.pam_gnupg}/lib/security/pam_gnupg.so"}
${optionalString config.security.pam.enableEcryptfs
"auth optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so unwrap"}
${optionalString cfg.pamMount
Expand Down Expand Up @@ -438,6 +441,8 @@ let
"session optional ${pkgs.otpw}/lib/security/pam_otpw.so"}
${optionalString cfg.startSession
"session optional ${pkgs.systemd}/lib/security/pam_systemd.so"}
${optionalString config.security.pam.enableGnupg
"session optional ${pkgs.pam_gnupg}/lib/security/pam_gnupg.so"}
${optionalString cfg.forwardXAuth
"session optional pam_xauth.so xauthpath=${pkgs.xorg.xauth}/bin/xauth systemuser=99"}
${optionalString (cfg.limits != [])
Expand Down Expand Up @@ -726,6 +731,13 @@ in
'';
};

security.pam.enableGnupg = mkOption {
default = false;
description = ''
Enable pam_gnupg module to unlock GPG agent on login.
'';
};

users.motd = mkOption {
default = null;
example = "Today is Sweetmorn, the 4th day of The Aftermath in the YOLD 3178.";
Expand Down
24 changes: 24 additions & 0 deletions pkgs/os-specific/linux/pam_gnupg/default.nix
View file
Open in desktop
@@ -0,0 +1,24 @@
{ stdenv, fetchgit, autoreconfHook, gnupg, pam } :

stdenv.mkDerivation rec {
pname = "pam_gnupg";
version = "unstable-2019-12-06";

src = fetchgit {
url = https://github.com/cruegge/pam-gnupg;
rev = "fbd75b720877e4cf94e852ce7e2b811feb330bb5";
sha256 = "0kqn6xb85jfmhvvbd2lasnci46p2pcwy0wq233za9h7xwfr49f7d";
};

nativeBuildInputs = [ autoreconfHook ];
buildInputs = [ gnupg pam ];

configureFlags = [ "--with-moduledir=$\{out\}/lib/security" ];

meta = with stdenv.lib; {
description = "A PAM plugin to preset GPG passphrases on login";
homepage = "https://github.com/cruegge/pam-gnupg/";
license = licenses.gpl3;
platforms = platforms.linux;
};
}
2 changes: 2 additions & 0 deletions pkgs/top-level/all-packages.nix
View file
Open in desktop
Expand Up @@ -16837,6 +16837,8 @@ in

pam_ccreds = callPackage ../os-specific/linux/pam_ccreds { };

pam_gnupg = callPackage ../os-specific/linux/pam_gnupg { };

pam_krb5 = callPackage ../os-specific/linux/pam_krb5 { };

pam_ldap = callPackage ../os-specific/linux/pam_ldap { };
Expand Down