Skip to content

Commit

Permalink
nixos/security.wrappers: improve documentation
Browse files Browse the repository at this point in the history 
* The source attribute is mandatory, not optional
* The program attribute is optional
* Move the info about the mandatory attribute first (most important,
  IMHO)
  • Loading branch information
@bjornfor
bjornfor committed Feb 15, 2017
1 parent aba35a5 commit ce0a52f
Showing 1 changed file with 8 additions and 6 deletions.
14 changes: 8 additions & 6 deletions nixos/modules/security/wrappers/default.nix
View file
Expand Up @@ -116,16 +116,18 @@ in
default (setuid root, but not setgid root).
<note>
<para>The sub-attribute <literal>source</literal> is mandatory,
it must be the absolute path to the program to be wrapped.
</para>
<para>The sub-attribute <literal>program</literal> is optional and
can give the wrapper program a new name. The default name is the same
as the attribute name itself.</para>
<para>Additionally, this option can set capabilities on a
wrapper program that propagates those capabilities down to the
wrapped, real program.</para>
<para>The <literal>program</literal> attribute is the name of
the program to be wrapped. If no <literal>source</literal>
attribute is provided, specifying the absolute path to the
program, then the program will be searched for in the path
environment variable.</para>
<para>NOTE: cap_setpcap, which is required for the wrapper
program to be able to raise caps into the Ambient set is NOT
raised to the Ambient set so that the real program cannot
Expand Down

2 comments on commit ce0a52f

@ixmatus
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@bjornfor thanks for cleaning this up, I have no problem taking care of the mistakes or improvements myself so please if you discover more push them onto me.

@bjornfor
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ixmatus: Thanks.

For improvement, I wonder if security.wrappers would benefit from being a submodule, so that each sub-attribute can get a proper type. That way we'd be able to catch some configuration errors early, and perhaps show a more friendly message than a build error with trace. But now we're getting way beyond bugfixing, and I don't plan to work on that.

Regarding me doing the fixes, it just felt easier/faster doing it like that. It was frustrating with yet another breaking change hit master, but better use frustration to something positive (fix things) :-)

Please sign in to comment.