mirrors/nixpkgs
1
0
Fork 1
mirror of https://github.com/NixOS/nixpkgs.git synced 2024-11-20 04:31:52 +00:00
Code Issues Wiki Activity

security: Updating the machinery for creating the wrapper programs dir in var and updating ping and ping6 for changed config interface.

Browse source
This commit is contained in:
Parnell Springmeyer 2016-07-15 18:15:08 -05:00
parent 79e81aa31b
commit 81b33eb466
3 changed files with 19 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
nixos/modules/installer/tools/nixos-generate-config.pl
View file

@ -328,8 +328,7 @@ foreach my $fs (read_file("/proc/self/mountinfo")) {
# Skip special filesystems.
next if in($mountPoint, "/proc") || in($mountPoint, "/dev") || in($mountPoint, "/sys") || in($mountPoint, "/run") || $mountPoint eq "/var/lib/nfs/rpc_pipefs";
next if $mountPoint eq "/var/setuid-wrappers";
next if $mountPoint eq "/var/setcap-wrappers";
next if $mountPoint eq "/var/permissions-wrappers";
# Skip the optional fields.
my $n = 6; $n++ while $fields[$n] ne "-"; $n++;

3
nixos/modules/module-list.nix
View file

@ -103,8 +103,7 @@
./security/prey.nix
./security/rngd.nix
./security/rtkit.nix
./security/setuid-wrappers.nix
./security/setcap-wrappers.nix
./security/permissions-wrappers
./security/sudo.nix
./services/amqp/activemq/default.nix
./services/amqp/rabbitmq.nix

20
nixos/modules/tasks/network-interfaces.nix
View file

@ -891,7 +891,7 @@ in
# Capabilities won't work unless we have at-least a 4.3 Linux
# kernel because we need the ambient capability
security.setcapCapabilities = mkIf (versionAtLeast (getVersion config.boot.kernelPackages.kernel) "4.3") (
security.permissionsWrappers.setcap = mkIf (versionAtLeast (getVersion config.boot.kernelPackages.kernel) "4.3") (
[
{ program = "ping";
source = "${pkgs.iputils.out}/bin/ping";
@ -908,8 +908,22 @@ in
);
# If our linux kernel IS older than 4.3, let's setuid ping and ping6
security.setuidPrograms = mkIf (versionOlder (getVersion config.boot.kernelPackages.kernel) "4.3") (
[ "ping" "ping6" ]
security.permissionsWrappers.setuid = mkIf (versionOlder (getVersion config.boot.kernelPackages.kernel) "4.3") (
[
{ program = "ping";
source = "${pkgs.iputils.out}/bin/ping";
owner = "root";
group = "root";
setuid = true;
}
{ program = "ping6";
source = "${pkgs.iputils.out}/bin/ping6";
owner = "root";
group = "root";
setuid = true;
}
]
);
# Set the host and domain names in the activation script. Don't