alioth/nixpkgs
3
0
Fork 0
forked from mirrors/nixpkgs
Code Releases Activity

nixos/nextcloud: Do not run sudo if not needed

Browse source 
Only use sudo if we are currently not running as the nextcloud user.
This is problematic when occ is called from a systemd service with
NoNewPrivileges=true
This commit is contained in:
Janne Heß 2019-11-26 15:31:13 +01:00 committed by Lassulus
parent 8582e5a759
commit d21f5cf36f
1 changed files with 7 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
nixos/modules/services/web-apps/nextcloud.nix
View file

@ -31,8 +31,12 @@ let
occ = pkgs.writeScriptBin "nextcloud-occ" '' occ = pkgs.writeScriptBin "nextcloud-occ" ''
#! ${pkgs.stdenv.shell} #! ${pkgs.stdenv.shell}
cd ${pkgs.nextcloud} cd ${pkgs.nextcloud}
exec /run/wrappers/bin/sudo -u nextcloud \ sudo=exec
NEXTCLOUD_CONFIG_DIR="${cfg.home}/config" \ if [[ "$USER" != nextcloud ]]; then
sudo='exec /run/wrappers/bin/sudo -u nextcloud --preserve-env=NEXTCLOUD_CONFIG_DIR'
fi
export NEXTCLOUD_CONFIG_DIR="${cfg.home}/config"
$sudo \
${phpPackage}/bin/php \ ${phpPackage}/bin/php \
-c ${pkgs.writeText "php.ini" phpOptionsStr}\ -c ${pkgs.writeText "php.ini" phpOptionsStr}\
occ $* occ $*
@ -420,6 +424,7 @@ in {
nextcloud-update-plugins = mkIf cfg.autoUpdateApps.enable { nextcloud-update-plugins = mkIf cfg.autoUpdateApps.enable {
serviceConfig.Type = "oneshot"; serviceConfig.Type = "oneshot";
serviceConfig.ExecStart = "${occ}/bin/nextcloud-occ app:update --all"; serviceConfig.ExecStart = "${occ}/bin/nextcloud-occ app:update --all";
serviceConfig.User = "nextcloud";
startAt = cfg.autoUpdateApps.startAt; startAt = cfg.autoUpdateApps.startAt;
}; };
}; };