nixos/pmount: add pmount programs module #51406
Conversation
|
Shouldn't users set security.wrappers themselves? It's not clearly documented what is going on behind the scenes here. This looks like it will let anyone use pmount as root. See #50480 for why we should try to avoid this. Anyway, why can't we just use udiskctl? It should do the same thing without the SUID bit. |
|
I see your point, but without the security wrapper, pmount wouldn't work correctly. So either way, the documentation should clearly state, that such a wrapper is mandatory. I didn't know udiskctl, will check it out! |
| pumount.source = "${pkgs.pmount.out}/bin/pumount"; | ||
| }; | ||
|
|
||
| system.activationScripts.pmount = "mkdir -p /media"; |
There was a problem hiding this comment.
I presume pmount does not create /media on its own? Personally, I prefer using a tmpfiles rule or maybe even a tmpfs for this. But it may be better to leave it up to the user in the first place.
There was a problem hiding this comment.
Yes, it's probably too restrictive and needs more flexibilty..
|
Closing this issue because the module assumes to much of what the user wants, isn't documented enough. If anyone wants to contribute an modified version of this module, feel free to do so, but I am going to use Thank you both for your input though! |
Motivation for this change
Add pmount module with setuid wrapper.
Things done
sandboxinnix.confon non-NixOS)nix-shell -p nox --run "nox-review wip"./result/bin/)nix path-info -Sbefore and after)