2017-01-29 04:48:03 +00:00
|
|
|
{ config, lib, pkgs, ... }:
|
|
|
|
let
|
|
|
|
|
2017-02-14 21:20:27 +00:00
|
|
|
inherit (config.security) wrapperDir wrappers;
|
2017-01-29 07:27:11 +00:00
|
|
|
|
2017-02-18 17:06:09 +00:00
|
|
|
parentWrapperDir = dirOf wrapperDir;
|
|
|
|
|
2017-01-29 07:27:11 +00:00
|
|
|
programs =
|
2017-01-29 07:41:39 +00:00
|
|
|
(lib.mapAttrsToList
|
2019-08-13 22:52:01 +01:00
|
|
|
(n: v: (if v ? program then v else v // {program=n;}))
|
2017-01-29 07:41:39 +00:00
|
|
|
wrappers);
|
2017-01-29 04:48:03 +00:00
|
|
|
|
2017-02-14 00:03:06 +00:00
|
|
|
securityWrapper = pkgs.stdenv.mkDerivation {
|
2017-02-14 14:27:40 +00:00
|
|
|
name = "security-wrapper";
|
|
|
|
phases = [ "installPhase" "fixupPhase" ];
|
|
|
|
buildInputs = [ pkgs.libcap pkgs.libcap_ng pkgs.linuxHeaders ];
|
|
|
|
hardeningEnable = [ "pie" ];
|
2017-02-14 00:03:06 +00:00
|
|
|
installPhase = ''
|
|
|
|
mkdir -p $out/bin
|
2017-12-17 04:05:51 +00:00
|
|
|
$CC -Wall -O2 -DWRAPPER_DIR=\"${parentWrapperDir}\" \
|
2017-02-14 14:27:40 +00:00
|
|
|
-lcap-ng -lcap ${./wrapper.c} -o $out/bin/security-wrapper
|
2017-02-14 00:03:06 +00:00
|
|
|
'';
|
|
|
|
};
|
2017-01-29 04:48:03 +00:00
|
|
|
|
|
|
|
###### Activation script for the setcap wrappers
|
|
|
|
mkSetcapProgram =
|
|
|
|
{ program
|
|
|
|
, capabilities
|
2017-02-14 00:28:13 +00:00
|
|
|
, source
|
2017-01-29 04:48:03 +00:00
|
|
|
, owner ? "nobody"
|
|
|
|
, group ? "nogroup"
|
2017-02-17 14:41:31 +00:00
|
|
|
, permissions ? "u+rx,g+x,o+x"
|
2017-01-29 07:20:02 +00:00
|
|
|
, ...
|
2017-01-30 18:26:56 +00:00
|
|
|
}:
|
2017-01-29 07:07:12 +00:00
|
|
|
assert (lib.versionAtLeast (lib.getVersion config.boot.kernelPackages.kernel) "4.3");
|
2017-02-14 00:03:06 +00:00
|
|
|
''
|
|
|
|
cp ${securityWrapper}/bin/security-wrapper $wrapperDir/${program}
|
2017-02-14 00:28:13 +00:00
|
|
|
echo -n "${source}" > $wrapperDir/${program}.real
|
2017-01-29 04:48:03 +00:00
|
|
|
|
|
|
|
# Prevent races
|
|
|
|
chmod 0000 $wrapperDir/${program}
|
|
|
|
chown ${owner}.${group} $wrapperDir/${program}
|
|
|
|
|
|
|
|
# Set desired capabilities on the file plus cap_setpcap so
|
|
|
|
# the wrapper program can elevate the capabilities set on
|
|
|
|
# its file into the Ambient set.
|
|
|
|
${pkgs.libcap.out}/bin/setcap "cap_setpcap,${capabilities}" $wrapperDir/${program}
|
|
|
|
|
|
|
|
# Set the executable bit
|
2017-02-17 14:41:31 +00:00
|
|
|
chmod ${permissions} $wrapperDir/${program}
|
2017-01-29 04:48:03 +00:00
|
|
|
'';
|
|
|
|
|
|
|
|
###### Activation script for the setuid wrappers
|
|
|
|
mkSetuidProgram =
|
|
|
|
{ program
|
2017-02-14 00:28:13 +00:00
|
|
|
, source
|
2017-01-29 04:48:03 +00:00
|
|
|
, owner ? "nobody"
|
|
|
|
, group ? "nogroup"
|
|
|
|
, setuid ? false
|
|
|
|
, setgid ? false
|
|
|
|
, permissions ? "u+rx,g+x,o+x"
|
2017-01-29 07:20:02 +00:00
|
|
|
, ...
|
2017-01-30 18:26:56 +00:00
|
|
|
}:
|
2017-02-14 00:03:06 +00:00
|
|
|
''
|
|
|
|
cp ${securityWrapper}/bin/security-wrapper $wrapperDir/${program}
|
2017-02-14 00:28:13 +00:00
|
|
|
echo -n "${source}" > $wrapperDir/${program}.real
|
2017-01-29 04:48:03 +00:00
|
|
|
|
|
|
|
# Prevent races
|
|
|
|
chmod 0000 $wrapperDir/${program}
|
|
|
|
chown ${owner}.${group} $wrapperDir/${program}
|
|
|
|
|
|
|
|
chmod "u${if setuid then "+" else "-"}s,g${if setgid then "+" else "-"}s,${permissions}" $wrapperDir/${program}
|
|
|
|
'';
|
2017-01-29 07:27:11 +00:00
|
|
|
|
|
|
|
mkWrappedPrograms =
|
|
|
|
builtins.map
|
2019-08-13 22:52:01 +01:00
|
|
|
(s: if (s ? capabilities)
|
2017-02-14 14:40:12 +00:00
|
|
|
then mkSetcapProgram
|
|
|
|
({ owner = "root";
|
2017-02-14 14:42:08 +00:00
|
|
|
group = "root";
|
2017-02-14 14:40:12 +00:00
|
|
|
} // s)
|
2017-12-17 04:05:51 +00:00
|
|
|
else if
|
2019-08-13 22:52:01 +01:00
|
|
|
(s ? setuid && s.setuid) ||
|
|
|
|
(s ? setgid && s.setgid) ||
|
|
|
|
(s ? permissions)
|
2017-01-29 07:27:11 +00:00
|
|
|
then mkSetuidProgram s
|
2017-01-29 22:47:14 +00:00
|
|
|
else mkSetuidProgram
|
|
|
|
({ owner = "root";
|
|
|
|
group = "root";
|
|
|
|
setuid = true;
|
|
|
|
setgid = false;
|
|
|
|
permissions = "u+rx,g+x,o+x";
|
|
|
|
} // s)
|
2017-01-29 07:27:11 +00:00
|
|
|
) programs;
|
2017-01-29 04:48:03 +00:00
|
|
|
in
|
|
|
|
{
|
|
|
|
|
|
|
|
###### interface
|
|
|
|
|
|
|
|
options = {
|
|
|
|
security.wrappers = lib.mkOption {
|
|
|
|
type = lib.types.attrs;
|
|
|
|
default = {};
|
2017-02-15 08:07:16 +00:00
|
|
|
example = lib.literalExample
|
|
|
|
''
|
|
|
|
{ sendmail.source = "/nix/store/.../bin/sendmail";
|
|
|
|
ping = {
|
|
|
|
source = "${pkgs.iputils.out}/bin/ping";
|
|
|
|
owner = "nobody";
|
|
|
|
group = "nogroup";
|
|
|
|
capabilities = "cap_net_raw+ep";
|
|
|
|
};
|
|
|
|
}
|
|
|
|
'';
|
2017-01-29 04:48:03 +00:00
|
|
|
description = ''
|
2017-02-15 03:30:04 +00:00
|
|
|
This option allows the ownership and permissions on the setuid
|
|
|
|
wrappers for specific programs to be overridden from the
|
|
|
|
default (setuid root, but not setgid root).
|
|
|
|
|
|
|
|
<note>
|
2017-02-15 18:51:12 +00:00
|
|
|
<para>The sub-attribute <literal>source</literal> is mandatory,
|
|
|
|
it must be the absolute path to the program to be wrapped.
|
|
|
|
</para>
|
|
|
|
|
|
|
|
<para>The sub-attribute <literal>program</literal> is optional and
|
|
|
|
can give the wrapper program a new name. The default name is the same
|
|
|
|
as the attribute name itself.</para>
|
|
|
|
|
2017-02-15 03:30:04 +00:00
|
|
|
<para>Additionally, this option can set capabilities on a
|
|
|
|
wrapper program that propagates those capabilities down to the
|
|
|
|
wrapped, real program.</para>
|
|
|
|
|
|
|
|
<para>NOTE: cap_setpcap, which is required for the wrapper
|
|
|
|
program to be able to raise caps into the Ambient set is NOT
|
|
|
|
raised to the Ambient set so that the real program cannot
|
|
|
|
modify its own capabilities!! This may be too restrictive for
|
|
|
|
cases in which the real program needs cap_setpcap but it at
|
|
|
|
least leans on the side security paranoid vs. too
|
|
|
|
relaxed.</para>
|
|
|
|
</note>
|
2017-01-29 04:48:03 +00:00
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
|
|
|
security.wrapperDir = lib.mkOption {
|
|
|
|
type = lib.types.path;
|
2017-01-29 10:11:01 +00:00
|
|
|
default = "/run/wrappers/bin";
|
2017-01-29 04:48:03 +00:00
|
|
|
internal = true;
|
|
|
|
description = ''
|
|
|
|
This option defines the path to the wrapper programs. It
|
|
|
|
should not be overriden.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
};
|
|
|
|
|
|
|
|
###### implementation
|
|
|
|
config = {
|
2017-01-29 23:10:32 +00:00
|
|
|
|
2017-08-19 17:50:53 +01:00
|
|
|
security.wrappers = {
|
|
|
|
fusermount.source = "${pkgs.fuse}/bin/fusermount";
|
|
|
|
fusermount3.source = "${pkgs.fuse3}/bin/fusermount3";
|
|
|
|
};
|
2017-01-29 23:10:32 +00:00
|
|
|
|
2017-02-18 17:06:09 +00:00
|
|
|
boot.specialFileSystems.${parentWrapperDir} = {
|
|
|
|
fsType = "tmpfs";
|
|
|
|
options = [ "nodev" ];
|
|
|
|
};
|
|
|
|
|
2017-01-29 07:07:12 +00:00
|
|
|
# Make sure our wrapperDir exports to the PATH env variable when
|
|
|
|
# initializing the shell
|
2017-01-29 04:48:03 +00:00
|
|
|
environment.extraInit = ''
|
2017-01-29 07:07:12 +00:00
|
|
|
# Wrappers override other bin directories.
|
2017-01-29 04:48:03 +00:00
|
|
|
export PATH="${wrapperDir}:$PATH"
|
|
|
|
'';
|
|
|
|
|
|
|
|
###### setcap activation script
|
|
|
|
system.activationScripts.wrappers =
|
2017-06-25 20:42:07 +01:00
|
|
|
lib.stringAfter [ "specialfs" "users" ]
|
2017-01-29 04:48:03 +00:00
|
|
|
''
|
|
|
|
# Look in the system path and in the default profile for
|
|
|
|
# programs to be wrapped.
|
|
|
|
WRAPPER_PATH=${config.system.path}/bin:${config.system.path}/sbin
|
|
|
|
|
2017-02-18 17:06:09 +00:00
|
|
|
# We want to place the tmpdirs for the wrappers to the parent dir.
|
|
|
|
wrapperDir=$(mktemp --directory --tmpdir="${parentWrapperDir}" wrappers.XXXXXXXXXX)
|
2017-01-29 04:48:03 +00:00
|
|
|
chmod a+rx $wrapperDir
|
|
|
|
|
2017-01-29 07:07:12 +00:00
|
|
|
${lib.concatStringsSep "\n" mkWrappedPrograms}
|
2017-01-29 10:11:01 +00:00
|
|
|
|
|
|
|
if [ -L ${wrapperDir} ]; then
|
|
|
|
# Atomically replace the symlink
|
|
|
|
# See https://axialcorps.com/2013/07/03/atomically-replacing-files-and-directories/
|
2017-01-29 11:05:30 +00:00
|
|
|
old=$(readlink -f ${wrapperDir})
|
2017-01-29 10:11:01 +00:00
|
|
|
ln --symbolic --force --no-dereference $wrapperDir ${wrapperDir}-tmp
|
|
|
|
mv --no-target-directory ${wrapperDir}-tmp ${wrapperDir}
|
|
|
|
rm --force --recursive $old
|
|
|
|
else
|
|
|
|
# For initial setup
|
|
|
|
ln --symbolic $wrapperDir ${wrapperDir}
|
|
|
|
fi
|
2017-01-29 04:48:03 +00:00
|
|
|
'';
|
|
|
|
};
|
|
|
|
}
|