Skip to content

Commit 61a75a1

Browse files
dezgegdezgeg
committedJan 17, 2018
Merge remote-tracking branch 'upstream/master' into staging
·
branch-off-24.1118.03-beta
2 parents 57da1b6 + 3eb311e commit 61a75a1

File tree

32 files changed

+784
-485
lines changed

32 files changed

+784
-485
lines changed
 

Diff for: ‎lib/maintainers.nix

+2
Original file line numberDiff line numberDiff line change
@@ -384,6 +384,7 @@
384384
lovek323 = "Jason O'Conal <jason@oconal.id.au>";
385385
lowfatcomputing = "Andreas Wagner <andreas.wagner@lowfatcomputing.org>";
386386
lsix = "Lancelot SIX <lsix@lancelotsix.com>";
387+
lschuermann = "Leon Schuermann <leon.git@is.currently.online>";
387388
ltavard = "Laure Tavard <laure.tavard@univ-grenoble-alpes.fr>";
388389
lucas8 = "Luc Chabassier <luc.linux@mailoo.org>";
389390
ludo = "Ludovic Courtès <ludo@gnu.org>";
@@ -442,6 +443,7 @@
442443
mjanczyk = "Marcin Janczyk <m@dragonvr.pl>";
443444
mjp = "Mike Playle <mike@mythik.co.uk>"; # github = "MikePlayle";
444445
mlieberman85 = "Michael Lieberman <mlieberman85@gmail.com>";
446+
mmahut = "Marek Mahut <marek.mahut@gmail.com>";
445447
moaxcp = "John Mercier <moaxcp@gmail.com>";
446448
modulistic = "Pablo Costa <modulistic@gmail.com>";
447449
mog = "Matthew O'Gorman <mog-lists@rldn.net>";

Diff for: ‎nixos/modules/security/sudo.nix

+126-3
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,22 @@ let
88

99
inherit (pkgs) sudo;
1010

11+
toUserString = user: if (isInt user) then "#${toString user}" else "${user}";
12+
toGroupString = group: if (isInt group) then "%#${toString group}" else "%${group}";
13+
14+
toCommandOptionsString = options:
15+
"${concatStringsSep ":" options}${optionalString (length options != 0) ":"} ";
16+
17+
toCommandsString = commands:
18+
concatStringsSep ", " (
19+
map (command:
20+
if (isString command) then
21+
command
22+
else
23+
"${toCommandOptionsString command.options}${command.command}"
24+
) commands
25+
);
26+
1127
in
1228

1329
{
@@ -47,6 +63,97 @@ in
4763
'';
4864
};
4965

66+
security.sudo.extraRules = mkOption {
67+
description = ''
68+
Define specific rules to be in the <filename>sudoers</filename> file.
69+
'';
70+
default = [];
71+
example = [
72+
# Allow execution of any command by all users in group sudo,
73+
# requiring a password.
74+
{ groups = [ "sudo" ]; commands = [ "ALL" ]; }
75+
76+
# Allow execution of "/home/root/secret.sh" by user `backup`, `database`
77+
# and the group with GID `1006` without a password.
78+
{ users = [ "backup" ]; groups = [ 1006 ];
79+
commands = [ { command = "/home/root/secret.sh"; options = [ "SETENV" "NOPASSWD" ]; } ]; }
80+
81+
# Allow all users of group `bar` to run two executables as user `foo`
82+
# with arguments being pre-set.
83+
{ groups = [ "bar" ]; runAs = "foo";
84+
commands =
85+
[ "/home/baz/cmd1.sh hello-sudo"
86+
{ command = ''/home/baz/cmd2.sh ""''; options = [ "SETENV" ]; } ]; }
87+
];
88+
type = with types; listOf (submodule {
89+
options = {
90+
users = mkOption {
91+
type = with types; listOf (either string int);
92+
description = ''
93+
The usernames / UIDs this rule should apply for.
94+
'';
95+
default = [];
96+
};
97+
98+
groups = mkOption {
99+
type = with types; listOf (either string int);
100+
description = ''
101+
The groups / GIDs this rule should apply for.
102+
'';
103+
default = [];
104+
};
105+
106+
host = mkOption {
107+
type = types.string;
108+
default = "ALL";
109+
description = ''
110+
For what host this rule should apply.
111+
'';
112+
};
113+
114+
runAs = mkOption {
115+
type = with types; string;
116+
default = "ALL:ALL";
117+
description = ''
118+
Under which user/group the specified command is allowed to run.
119+
120+
A user can be specified using just the username: <code>"foo"</code>.
121+
It is also possible to specify a user/group combination using <code>"foo:bar"</code>
122+
or to only allow running as a specific group with <code>":bar"</code>.
123+
'';
124+
};
125+
126+
commands = mkOption {
127+
description = ''
128+
The commands for which the rule should apply.
129+
'';
130+
type = with types; listOf (either string (submodule {
131+
132+
options = {
133+
command = mkOption {
134+
type = with types; string;
135+
description = ''
136+
A command being either just a path to a binary to allow any arguments,
137+
the full command with arguments pre-set or with <code>""</code> used as the argument,
138+
not allowing arguments to the command at all.
139+
'';
140+
};
141+
142+
options = mkOption {
143+
type = with types; listOf (enum [ "NOPASSWD" "PASSWD" "NOEXEC" "EXEC" "SETENV" "NOSETENV" "LOG_INPUT" "NOLOG_INPUT" "LOG_OUTPUT" "NOLOG_OUTPUT" ]);
144+
description = ''
145+
Options for running the command. Refer to the <a href="https://www.sudo.ws/man/1.7.10/sudoers.man.html">sudo manual</a>.
146+
'';
147+
default = [];
148+
};
149+
};
150+
151+
}));
152+
};
153+
};
154+
});
155+
};
156+
50157
security.sudo.extraConfig = mkOption {
51158
type = types.lines;
52159
default = "";
@@ -61,19 +168,35 @@ in
61168

62169
config = mkIf cfg.enable {
63170

171+
security.sudo.extraRules = [
172+
{ groups = [ "wheel" ];
173+
commands = [ { command = "ALL"; options = (if cfg.wheelNeedsPassword then [ "SETENV" ] else [ "NOPASSWD" "SETENV" ]); } ];
174+
}
175+
];
176+
64177
security.sudo.configFile =
65178
''
66179
# Don't edit this file. Set the NixOS options ‘security.sudo.configFile’
67-
# or ‘security.sudo.extraConfig’ instead.
180+
# or ‘security.sudo.extraRules’ instead.
68181
69182
# Keep SSH_AUTH_SOCK so that pam_ssh_agent_auth.so can do its magic.
70183
Defaults env_keep+=SSH_AUTH_SOCK
71184
72185
# "root" is allowed to do anything.
73186
root ALL=(ALL:ALL) SETENV: ALL
74187
75-
# Users in the "wheel" group can do anything.
76-
%wheel ALL=(ALL:ALL) ${if cfg.wheelNeedsPassword then "" else "NOPASSWD: ALL, "}SETENV: ALL
188+
# extraRules
189+
${concatStringsSep "\n" (
190+
lists.flatten (
191+
map (
192+
rule: if (length rule.commands != 0) then [
193+
(map (user: "${toUserString user} ${rule.host}=(${rule.runAs}) ${toCommandsString rule.commands}") rule.users)
194+
(map (group: "${toGroupString group} ${rule.host}=(${rule.runAs}) ${toCommandsString rule.commands}") rule.groups)
195+
] else []
196+
) cfg.extraRules
197+
)
198+
)}
199+
77200
${cfg.extraConfig}
78201
'';
79202

Diff for: ‎nixos/release.nix

+1
Original file line numberDiff line numberDiff line change
@@ -337,6 +337,7 @@ in rec {
337337
tests.smokeping = callTest tests/smokeping.nix {};
338338
tests.snapper = callTest tests/snapper.nix {};
339339
tests.statsd = callTest tests/statsd.nix {};
340+
tests.sudo = callTest tests/sudo.nix {};
340341
tests.switchTest = callTest tests/switch-test.nix {};
341342
tests.taskserver = callTest tests/taskserver.nix {};
342343
tests.tomcat = callTest tests/tomcat.nix {};

Diff for: ‎nixos/tests/misc.nix

-5
Original file line numberDiff line numberDiff line change
@@ -115,11 +115,6 @@ import ./make-test.nix ({ pkgs, ...} : {
115115
$machine->succeed("nix-store -qR /run/current-system | grep nixos-");
116116
};
117117
118-
# Test sudo
119-
subtest "sudo", sub {
120-
$machine->succeed("su - sybil -c 'sudo true'");
121-
};
122-
123118
# Test sysctl
124119
subtest "sysctl", sub {
125120
$machine->waitForUnit("systemd-sysctl.service");

Diff for: ‎nixos/tests/sudo.nix

+93
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
# Some tests to ensure sudo is working properly.
2+
3+
let
4+
password = "helloworld";
5+
6+
in
7+
import ./make-test.nix ({ pkgs, ...} : {
8+
name = "sudo";
9+
meta = with pkgs.stdenv.lib.maintainers; {
10+
maintainers = [ lschuermann ];
11+
};
12+
13+
machine =
14+
{ config, lib, pkgs, ... }:
15+
with lib;
16+
{
17+
users.extraGroups = { foobar = {}; barfoo = {}; baz = { gid = 1337; }; };
18+
users.users = {
19+
test0 = { isNormalUser = true; extraGroups = [ "wheel" ]; };
20+
test1 = { isNormalUser = true; password = password; };
21+
test2 = { isNormalUser = true; extraGroups = [ "foobar" ]; password = password; };
22+
test3 = { isNormalUser = true; extraGroups = [ "barfoo" ]; };
23+
test4 = { isNormalUser = true; extraGroups = [ "baz" ]; };
24+
test5 = { isNormalUser = true; };
25+
};
26+
27+
security.sudo = {
28+
enable = true;
29+
wheelNeedsPassword = false;
30+
31+
extraRules = [
32+
# SUDOERS SYNTAX CHECK (Test whether the module produces a valid output;
33+
# errors being detected by the visudo checks.
34+
35+
# These should not create any entries
36+
{ users = [ "notest1" ]; commands = [ ]; }
37+
{ commands = [ { command = "ALL"; options = [ ]; } ]; }
38+
39+
# Test defining commands with the options syntax, though not setting any options
40+
{ users = [ "notest2" ]; commands = [ { command = "ALL"; options = [ ]; } ]; }
41+
42+
43+
# CONFIGURATION FOR TEST CASES
44+
{ users = [ "test1" ]; groups = [ "foobar" ]; commands = [ "ALL" ]; }
45+
{ groups = [ "barfoo" 1337 ]; commands = [ { command = "ALL"; options = [ "NOPASSWD" "NOSETENV" ]; } ]; }
46+
{ users = [ "test5" ]; commands = [ { command = "ALL"; options = [ "NOPASSWD" "SETENV" ]; } ]; runAs = "test1:barfoo"; }
47+
];
48+
};
49+
};
50+
51+
testScript =
52+
''
53+
subtest "users in wheel group should have passwordless sudo", sub {
54+
$machine->succeed("su - test0 -c \"sudo -u root true\"");
55+
};
56+
57+
subtest "test1 user should have sudo with password", sub {
58+
$machine->succeed("su - test1 -c \"echo ${password} | sudo -S -u root true\"");
59+
};
60+
61+
subtest "test1 user should not be able to use sudo without password", sub {
62+
$machine->fail("su - test1 -c \"sudo -n -u root true\"");
63+
};
64+
65+
subtest "users in group 'foobar' should be able to use sudo with password", sub {
66+
$machine->succeed("sudo -u test2 echo ${password} | sudo -S -u root true");
67+
};
68+
69+
subtest "users in group 'barfoo' should be able to use sudo without password", sub {
70+
$machine->succeed("sudo -u test3 sudo -n -u root true");
71+
};
72+
73+
subtest "users in group 'baz' (GID 1337) should be able to use sudo without password", sub {
74+
$machine->succeed("sudo -u test4 sudo -n -u root echo true");
75+
};
76+
77+
subtest "test5 user should be able to run commands under test1", sub {
78+
$machine->succeed("sudo -u test5 sudo -n -u test1 true");
79+
};
80+
81+
subtest "test5 user should not be able to run commands under root", sub {
82+
$machine->fail("sudo -u test5 sudo -n -u root true");
83+
};
84+
85+
subtest "test5 user should be able to keep his environment", sub {
86+
$machine->succeed("sudo -u test5 sudo -n -E -u test1 true");
87+
};
88+
89+
subtest "users in group 'barfoo' should not be able to keep their environment", sub {
90+
$machine->fail("sudo -u test3 sudo -n -E -u root true");
91+
};
92+
'';
93+
})

Diff for: ‎pkgs/applications/editors/atom/beta.nix

+2-2
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,11 @@
22

33
stdenv.mkDerivation rec {
44
name = "atom-beta-${version}";
5-
version = "1.24.0-beta2";
5+
version = "1.24.0-beta3";
66

77
src = fetchurl {
88
url = "https://github.com/atom/atom/releases/download/v${version}/atom-amd64.deb";
9-
sha256 = "1s5zfccpiyg3nqq3a93dg5sr6pk8gvwf8assq9g78l7qkryqr4ac";
9+
sha256 = "02nnjjwlkxafi2fbi4gz276nqkmi92kf3q414vw1k3kc8q5zvxrs";
1010
name = "${name}.deb";
1111
};
1212

Diff for: ‎pkgs/applications/editors/atom/default.nix

+2-2
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,11 @@
22

33
stdenv.mkDerivation rec {
44
name = "atom-${version}";
5-
version = "1.23.2";
5+
version = "1.23.3";
66

77
src = fetchurl {
88
url = "https://github.com/atom/atom/releases/download/v${version}/atom-amd64.deb";
9-
sha256 = "04shnmy80ixjrc8d57i5w23xfxw1dmxj7kbygsal9l8kxgd76k7h";
9+
sha256 = "0vq0pics8ajjqwqlk396dxl10k80059f9bik0j4wj2cals42bifc";
1010
name = "${name}.deb";
1111
};
1212

Diff for: ‎pkgs/applications/editors/eclipse/plugins.nix

+23
Original file line numberDiff line numberDiff line change
@@ -102,6 +102,29 @@ rec {
102102
};
103103
};
104104

105+
ansi-econsole = buildEclipsePlugin rec {
106+
name = "ansi-econsole-${version}";
107+
version = "1.3.5.201612301822";
108+
109+
srcFeature = fetchurl {
110+
url = "https://mihnita.github.io/ansi-econsole/install/features/net.mihai-nita.ansicon_${version}.jar";
111+
sha256 = "086ylxpsrlpbvwv5mw7v6b44j63cwzgi8apg2mq058ydr5ak6hxs";
112+
};
113+
114+
srcPlugin = fetchurl {
115+
url = "https://mihnita.github.io/ansi-econsole/install/plugins/net.mihai-nita.ansicon.plugin_${version}.jar";
116+
sha256 = "1j42l0xxzs89shqkyn91lb0gia10mifzy0i73c3n7gj7sv2ddbjq";
117+
};
118+
119+
meta = with stdenv.lib; {
120+
homepage = "https://mihai-nita.net/java/#ePluginAEC";
121+
description = "Adds support for ANSI escape sequences in the Eclipse console";
122+
license = licenses.asl20;
123+
platforms = platforms.all;
124+
maintainers = [ maintainers.rycee ];
125+
};
126+
};
127+
105128
anyedittools = buildEclipsePlugin rec {
106129
name = "anyedit-${version}";
107130
version = "2.7.1.201709201439";

Diff for: ‎pkgs/applications/misc/kdeconnect/default.nix

+3-3
Original file line numberDiff line numberDiff line change
@@ -19,12 +19,12 @@
1919

2020
stdenv.mkDerivation rec {
2121
pname = "kdeconnect";
22-
version = "1.2";
22+
version = "1.2.1";
2323
name = "${pname}-${version}";
2424

2525
src = fetchurl {
26-
url = "mirror://kde/stable/${pname}/${version}/src/${pname}-kde-${version}.tar.xz";
27-
sha256 = "0w3rdldnr6md70r4ch255vk712d37vy63ml7ly2fhr4cfnk2i1ay";
26+
url = "mirror://kde/stable/${pname}/${version}/src/${pname}-kde-v${version}.tar.xz";
27+
sha256 = "01v432p9ylwss9gl6fvby8954bnjd91dni5jk1i44vv7x26yn8zg";
2828
};
2929

3030
buildInputs = [

Diff for: ‎pkgs/applications/misc/mencal/default.nix

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{ stdenv, fetchurl, perl }:
2+
3+
stdenv.mkDerivation rec {
4+
name = "mencal-3.0";
5+
6+
src = fetchurl {
7+
url = "http://kyberdigi.cz/projects/mencal/files/${name}.tar.gz";
8+
sha256 = "9328d0b2f3f57847e8753c5184531f4832be7123d1b6623afdff892074c03080";
9+
};
10+
11+
installPhase = ''
12+
mkdir -p $out/bin
13+
cp mencal $out/bin/
14+
'';
15+
16+
buildInputs = [ perl ];
17+
18+
meta = with stdenv.lib; {
19+
description = "Menstruation calendar";
20+
longDescription = ''
21+
Mencal is a simple variation of the well-known unix command cal.
22+
The main difference is that you can have some periodically repeating
23+
days highlighted in color. This can be used to track
24+
menstruation (or other) cycles conveniently.
25+
'';
26+
homepage = "http://www.kyberdigi.cz/projects/mencal/english.html";
27+
license = licenses.gpl2;
28+
maintainers = [ maintainers.mmahut ];
29+
platforms = platforms.all;
30+
};
31+
}

0 commit comments

Comments
 (0)
Please sign in to comment.