Commits on Mar 28, 2019

1. nixos/ldap: rename password file options properly …

   users.ldap.daemon.rootpwmodpw -> users.ldap.daemon.rootpwmodpwFile
   users.ldap.bind.password -> users.ldap.bind.passwordFile
   
   as users.ldap.daemon.rootpwmodpw never was part of a release, no
   mkRenamedOptionModule is introduced.
   
   (cherry picked from commit 0a1451a)

   

   flokli committed Mar 28, 2019
   Copy the full SHA

   9eafdb4 View commit details

   Browse the repository at this point in the history

2. nixos/ldap: set proper User= and Group= for nslcd service …

   eb90d97 broke nslcd, as /run/nslcd was
   created/chowned as root user, while nslcd wants to do parts as nslcd
   user.
   
   This commit changes the nslcd to run with the proper uid/gid from the
   start (through User= and Group=), so the RuntimeDirectory has proper
   permissions, too.
   
   In some cases, secrets are baked into nslcd's config file during startup
   (so we don't want to provide it from the store).
   
   This config file is normally hard-wired to /etc/nslcd.conf, but we don't
   want to use PermissionsStartOnly anymore (#56265), and activation
   scripts are ugly, so redirect /etc/nslcd.conf to /run/nslcd/nslcd.conf,
   which now gets provisioned inside ExecStartPre=.
   
   This change requires the files referenced to in
   users.ldap.bind.passwordFile and users.ldap.daemon.rootpwmodpwFile to be
   readable by the nslcd user (in the non-nslcd case, this was already the
   case for users.ldap.bind.passwordFile)
   
   fixes #57783
   
   (cherry picked from commit 8817bbe)

   

   flokli committed Mar 28, 2019
   Copy the full SHA

   8ae24ed View commit details

   Browse the repository at this point in the history