mirrors/nixpkgs
1
0
Fork 1
mirror of https://github.com/NixOS/nixpkgs.git synced 2024-12-25 03:17:13 +00:00
Code Issues Wiki Activity
nixpkgs/nixos/modules/services/networking
History
Niklas Hambüchen 0dc08b4138 wireguard module: generatePrivateKeyFile: Fix chmod security race. Fixes #121288 
Until now, the `touch + chmod 600 + write` approach made it possible for
an unprivileged local user read the private key file, by opening
the file after the touch, before the read permissions are restricted.

This was only the case if `generatePrivateKeyFile = true` and the parent
directory of `privateKeyFile` already existed and was readable.

This commit fixes it by using `umask`, which ensures kernel-side that
the `touch` creates the file with the correct permissions atomically.

This commit also:

* Removes `mkdir --mode 0644 -p "${dirOf values.privateKeyFile}"`
  because setting permissions `drw-r--r--` ("nobody can enter that dir")
  is awkward. `drwx------` would perhaps make sense, like for `.ssh`.
  However, setting the permissions on the private key file is enough,
  and likely better, because `privateKeyFile` is about that file
  specifically and no docs suggest that there's something special
  about its parent dir.
* Removes the `chmod 0400 "${values.privateKeyFile}"`
  because there isn't really a point in removing write access from
  the owner of the private key.
2021-04-30 18:55:38 +02:00
..
firefox
hylafax treewide: fix double quoted strings in meta.description 2021-01-24 19:56:59 +07:00
icecream nixos/icecream: add modules 2020-11-01 08:13:08 +01:00
ircd-hybrid iproute: deprecate alias 2021-04-04 01:43:46 +02:00
iscsi nixos/iscsi/root-initiator: init 2021-04-06 18:34:32 +00:00
keepalived
nghttpx nixos/modules: remove trailing whitespace 2020-08-07 14:45:39 +01:00
ntp nixos/chrony: add types 2021-01-24 13:50:35 +01:00
ssh nixos/lshd: add types 2021-01-31 11:27:20 +01:00
strongswan-swanctl iproute: deprecate alias 2021-04-04 01:43:46 +02:00
znc
3proxy.nix small treewide: his -> theirs/its 2020-06-23 16:49:50 +02:00
amuled.nix treewide: fix double quoted strings in meta.description 2021-01-24 19:56:59 +07:00
aria2.nix nixos: remove dependencies on local-fs.target 2019-09-01 19:06:38 +02:00
asterisk.nix nixos/asterisk: /var/run -> /run 2019-03-24 21:13:19 +01:00
atftpd.nix nixos/atftpd: various improvements 2016-10-17 16:20:24 +02:00
autossh.nix
avahi-daemon.nix nixos/avahi: Enable IPv6 by default 2020-10-26 04:06:26 +01:00
babeld.nix nixos/babeld: run as DynamicUser 2021-04-25 00:54:52 +02:00
bee-clef.nix nixos/bee-clef: init at 0.4.7 2021-02-01 10:56:04 +01:00
bee.nix nixos/bee: init at 0.4.2 2021-02-01 10:56:04 +01:00
biboumi.nix nixos/biboumi: init 2020-09-02 08:31:53 +02:00
bind.nix nixos/bind: update zone file type 2021-01-31 14:59:54 +01:00
bird.nix nixos/users: require one of users.users.name.{isSystemUser,isNormalUser} 2021-04-14 20:40:00 +02:00
bitcoind.nix maintainers: 1000101 -> _1000101 2020-08-18 07:59:48 +10:00
bitlbee.nix nixos/bitlbee: Add types to options (#110446) 2021-01-22 11:07:29 +01:00
blockbook-frontend.nix blockbook-frontend: fix&update extraConfig example 2020-10-29 11:41:41 +01:00
charybdis.nix
cjdns.nix cjdns: reduce password length to 32 2021-03-26 11:35:09 +01:00
cntlm.nix nixos/cntlm: add types 2021-01-26 13:17:19 -08:00
connman.nix treewide: fix double quoted strings in meta.description 2021-01-24 19:56:59 +07:00
consul.nix iproute: deprecate alias 2021-04-04 01:43:46 +02:00
coredns.nix
corerad.nix nixos/corerad: use pkgs.formats.toml to generate TOML configuration 2020-12-29 17:47:01 -05:00
coturn.nix treewide: use attrs instead of list for types.loaOf options 2020-01-06 10:39:18 -05:00
croc.nix nixos/croc: init 2021-03-08 01:34:32 +01:00
dante.nix
ddclient.nix
dhcpcd.nix nixos/{networkd,dhcpcd}: remove udev-settle hack 2021-02-18 22:07:00 +01:00
dhcpd.nix nixos/dhcpd: make authoritative mode optional 2020-07-25 16:33:04 +02:00
dnscache.nix
dnscrypt-proxy2.nix nixos/dnscrypt-proxy2: reallow @sync syscalls 2021-02-21 14:53:54 +01:00
dnscrypt-wrapper.nix nixos/modules: pkgconfig -> pkg-config 2021-01-19 01:16:25 -08:00
dnsdist.nix nixos/dnsdist: dndist.conf -> dnsdist.conf 2021-04-18 13:34:28 +02:00
dnsmasq.nix
doh-proxy-rust.nix doh-proxy-rust: init at 0.3.8 2021-04-07 14:23:55 +02:00
ejabberd.nix
epmd.nix maintainers/teams: add beam team 2021-02-07 13:01:11 -06:00
ergo.nix nixos/ergo: init 2020-05-26 21:47:31 +02:00
eternal-terminal.nix nixos/eternal-terminal: add firewall information 2019-11-18 16:12:12 +01:00
fakeroute.nix nixos: add myself to maintainers 2019-12-04 17:09:53 +01:00
ferm.nix
fireqos.nix
firewall.nix
flannel.nix nixos/kubernetes: docker -> containerd 2021-03-07 12:51:14 +10:00
freenet.nix
freeradius.nix
gale.nix treewide: use attrs instead of list for types.loaOf options 2020-01-06 10:39:18 -05:00
gateone.nix treewide: fix double quoted strings in meta.description 2021-01-24 19:56:59 +07:00
gdomap.nix
git-daemon.nix
gnunet.nix
go-neb.nix nixos/go-neb: init 2020-06-02 15:25:05 +02:00
go-shadowsocks2.nix nixos/go-shadowsocks2: init 2019-10-06 11:18:20 +02:00
gobgpd.nix nixos/gobpgd: init 2021-04-09 14:57:11 +00:00
gogoclient.nix nixos/gogoclient: add types 2021-01-29 08:39:51 +01:00
gvpe.nix treewide: fix eval without aliases after 9378fdf87e 2021-04-08 13:33:09 +02:00
hans.nix
haproxy.nix nixos/haproxy: add reloading support, use upstream service hardening 2020-05-31 22:35:27 +02:00
helpers.nix nixos: fix ip46tables invocation in nat 2019-12-14 20:13:12 -08:00
hostapd.nix nixos/hostapd: add interface type 2021-01-29 13:04:50 +01:00
htpdate.nix
i2p.nix nixos/modules: users.(extraUsers|extraGroup->users|group) 2018-06-30 03:02:58 +02:00
i2pd.nix
inspircd.nix !fixup add myself as maintainer for the module 2021-03-22 15:19:49 +01:00
iodine.nix
iperf3.nix
iwd.nix nixos/iwd: add networkd link configuration matching the upstream .link unit file 2021-01-09 10:26:57 +01:00
jicofo.nix treewide: add Jitsi maintainers 2020-08-04 13:07:36 -07:00
jitsi-videobridge.nix nixos/jitsi-videobridge: add apis option (#112960) 2021-02-13 15:04:58 +01:00
keybase.nix nixos/keybase, nixos/kbfs: update service configs; add redirector 2019-12-23 22:55:06 -08:00
kippo.nix treewide: fix double quoted strings in meta.description 2021-01-24 19:56:59 +07:00
knot.nix knot: add keyFiles option 2020-02-12 16:36:42 +00:00
kresd.nix nixos/kresd.package: improve the generated docs 2021-04-27 21:38:30 +02:00
lambdabot.nix nixos/modules: users.(extraUsers|extraGroup->users|group) 2018-06-30 03:02:58 +02:00
libreswan.nix treewide: fix eval without aliases after 9378fdf87e 2021-04-08 13:33:09 +02:00
lldpd.nix nixos/lldpd: /var/run -> /run 2019-03-24 21:15:27 +01:00
logmein-hamachi.nix
magic-wormhole-mailbox-server.nix
mailpile.nix nixos/mailpile add types switch port to port type 2021-01-31 11:26:07 +01:00
matterbridge.nix
minidlna.nix
miniupnpd.nix
miredo.nix
mjpg-streamer.nix
monero.nix Merge pull request #86236 from ThibautMarty/fix-nullOr-types 2020-08-26 18:21:29 +02:00
morty.nix nixos/*: fix indentation 2020-11-23 08:42:51 +10:00
mosquitto.nix Merge pull request #85133 from snicket2100/mosquitto-service-sandboxing 2020-11-27 18:53:36 +01:00
mstpd.nix nixos/modules: remove trailing whitespace 2020-08-07 14:45:39 +01:00
mtprotoproxy.nix treewide: remove redundant quotes 2019-08-26 21:40:19 +00:00
mullvad-vpn.nix treewide: fix eval without aliases after 9378fdf87e 2021-04-08 13:33:09 +02:00
murmur.nix nixos/murmur: Add overrideable package switch 2021-01-11 00:08:23 +01:00
mxisd.nix mxisd: remove (#119372) 2021-04-19 11:26:08 -04:00
namecoind.nix nixos/modules: fix systemd start rate-limits 2020-10-31 01:35:56 -07:00
nar-serve.nix nar-serve: init at 0.3.0 (#95420) 2020-11-06 18:59:51 +01:00
nat.nix nixos/nat: support IPv6 NAT 2020-12-01 00:51:58 +01:00
ncdns.nix nixos/users: require one of users.users.name.{isSystemUser,isNormalUser} 2021-04-14 20:40:00 +02:00
ndppd.nix nixos/treewide: Fix incorrectly rendered examples 2020-04-02 07:49:25 +02:00
nebula.nix nixos/nebula: Add enable option defaulting to true to Nebula networks 2021-04-16 19:57:02 -07:00
networkmanager.nix Merge pull request #118658 from rhoriguchi/networkmanager 2021-04-12 20:18:32 +02:00
nextdns.nix nixos/modules: fix systemd start rate-limits 2020-10-31 01:35:56 -07:00
nftables.nix nftables: Warn about correct firewall setting 2020-10-02 00:25:57 +02:00
ngircd.nix
nix-serve.nix
nix-store-gcs-proxy.nix nixos/modules: fix systemd start rate-limits 2020-10-31 01:35:56 -07:00
nixops-dns.nix nixos/nixops-dns: init (#34511) 2018-02-20 10:14:55 +00:00
nntp-proxy.nix
nomad.nix treewide: fix eval without aliases after 9378fdf87e 2021-04-08 13:33:09 +02:00
nsd.nix nixos/modules: fix systemd start rate-limits 2020-10-31 01:35:56 -07:00
ntopng.nix types.uniq types.int -> types.int 2015-06-15 18:11:32 +02:00
nullidentdmod.nix
nylon.nix treewide: completely remove types.loaOf 2020-09-02 00:42:50 +02:00
ocserv.nix
ofono.nix
oidentd.nix oidentd: 2.2.2 -> 2.3.1 2018-11-07 14:51:45 +02:00
onedrive.nix nixos/onedrive: Remove verbose flag 2020-09-19 11:32:42 +05:30
onedrive.xml nixos/onedrive: init 2020-06-29 19:56:41 +05:30
openfire.nix treewide: add types to boolean / enable options or make use of mkEnableOption 2020-04-27 09:32:01 +02:00
openvpn.nix iproute: deprecate alias 2021-04-04 01:43:46 +02:00
ostinato.nix nixos/modules: Remove all usages of types.string 2019-08-31 18:19:00 +02:00
owamp.nix treewide: fix double quoted strings in meta.description 2021-01-24 19:56:59 +07:00
pdns-recursor.nix nixos/pdns-recursor: declare module user as system user 2020-10-18 08:15:29 -04:00
pdnsd.nix treewide: use attrs instead of list for types.loaOf options 2020-01-06 10:39:18 -05:00
pixiecore.nix nixos/users: require one of users.users.name.{isSystemUser,isNormalUser} 2021-04-14 20:40:00 +02:00
pleroma.nix nixos/users: require one of users.users.name.{isSystemUser,isNormalUser} 2021-04-14 20:40:00 +02:00
pleroma.xml nixos/pleroma: init 2021-01-26 18:11:38 +01:00
polipo.nix
powerdns.nix nixos/powerdns: use upstream systemd unit 2020-10-24 16:40:20 -04:00
pppd.nix
pptpd.nix nixos/modules: Remove all usages of types.string 2019-08-31 18:19:00 +02:00
prayer.nix nixos/prayer: Add port type 2021-01-31 12:01:41 +01:00
privoxy.nix nixos/privoxy: add missing "/" to "forward-socks5" option 2021-03-28 21:16:55 +02:00
prosody.nix treewide: De-inline uses of lib.boolToString 2020-10-14 01:46:17 +02:00
prosody.xml Merge pull request #91121 from m1cr0man/master 2020-09-06 18:26:22 +02:00
quassel.nix nixos/quassel: add types (#111429) 2021-01-31 13:46:29 +01:00
quicktun.nix
quorum.nix
racoon.nix nixos/raccoon: /var/run -> /run 2019-03-24 21:15:28 +01:00
radicale.nix nixos/radicale: use radicale3 2020-06-23 12:02:27 +02:00
radvd.nix nixos/radvd: add type (#111430) 2021-01-31 13:54:30 +01:00
rdnssd.nix treewide: add bool type to enable options, or make use of mkEnableOption 2020-04-21 08:55:36 +02:00
redsocks.nix
resilio.nix nixos/resilio: add sharedFolders type 2021-02-03 16:17:37 -08:00
robustirc-bridge.nix nixos/modules/robustirc-bridge: init 2020-08-30 18:34:22 +02:00
rpcbind.nix nixos/modules: users.(extraUsers|extraGroup->users|group) 2018-06-30 03:02:58 +02:00
rxe.nix treewide: fix eval without aliases after 9378fdf87e 2021-04-08 13:33:09 +02:00
sabnzbd.nix nixos/sabnzbd: add types 2021-01-31 12:12:59 +01:00
searx.nix nixos/searx: remove settings.yml merging script 2021-01-14 09:48:02 +01:00
shadowsocks.nix nixos/shadowsocks: add test without plugin 2020-09-14 22:35:05 +02:00
shairport-sync.nix nixos/shairport-sync: add types 2021-01-31 12:14:01 +01:00
shellhub-agent.nix nixos/shellhub-agent: initial service expression 2020-12-30 19:24:13 -03:00
shorewall.nix shorewall: fix RestartTriggers 2020-03-05 00:01:44 +01:00
shorewall6.nix
shout.nix
skydns.nix treewide: fix typo on word environment 2020-07-28 08:00:38 +02:00
smartdns.nix
smokeping.nix Merge pull request #100155 from primeos/nixos-add-fqdn-option 2021-01-25 16:45:45 +01:00
sniproxy.nix
softether.nix
spacecookie.nix spacecookie: add top-level attribute for haskellPackages.spacecookie 2021-04-10 15:44:19 +02:00
spiped.nix
squid.nix
sslh.nix iproute: deprecate alias 2021-04-04 01:43:46 +02:00
strongswan.nix iproute: deprecate alias 2021-04-04 01:43:46 +02:00
stubby.nix nixos/stubby: set Type=notify on the systemd service 2020-03-16 10:10:45 +05:30
stunnel.nix stunnel: make servers accept more lenient 2020-11-02 10:51:00 +01:00
supplicant.nix nixos/modules: remove trailing whitespace 2020-08-07 14:45:39 +01:00
supybot.nix nixos: use functionTo to prevent evaluation errors while merging 2021-01-24 17:18:37 +01:00
syncplay.nix
syncthing-relay.nix
syncthing.nix nixos/syncthing: add ignoreDelete folder option 2020-08-30 10:55:03 +03:00
tailscale.nix services.tailscale: add openresolv to path 2021-04-07 18:40:04 +02:00
tcpcrypt.nix treewide: add types to boolean / enable options or make use of mkEnableOption 2020-04-27 09:32:01 +02:00
teamspeak3.nix
tedicross.nix
tftpd.nix
thelounge.nix thelounge: write out default path for thelounge 2020-05-01 14:46:46 +01:00
tinc.nix Merge pull request #106073 from minijackson/tinc-rfc42-and-tests 2020-12-14 21:52:57 +01:00
tinydns.nix
tox-bootstrapd.nix
tox-node.nix
toxvpn.nix nixos/toxvpn: Fix typo in option description 2019-09-09 19:31:48 +02:00
trickster.nix maintainers: 1000101 -> _1000101 2020-08-18 07:59:48 +10:00
tvheadend.nix [bot] nixos/*: remove unused arguments in lambdas 2018-07-20 20:56:59 +00:00
unbound.nix unbound: Add AF_NETLINK to allowed address families. 2020-12-08 14:31:15 +08:00
unifi.nix nixos/unifi: restart service on package update 2020-07-03 22:34:29 +02:00
v2ray.nix
vsftpd.nix vsftpd: listen on both address families 2020-05-25 20:14:20 +02:00
wakeonlan.nix wakeonlan service: use powerUpCommands 2020-09-07 14:56:59 +02:00
wasabibackend.nix nixos/*: fix indentation 2020-11-23 08:42:51 +10:00
websockify.nix nixos/modules: remove trailing whitespace 2020-08-07 14:45:39 +01:00
wg-quick.nix treewide: fix eval without aliases after 9378fdf87e 2021-04-08 13:33:09 +02:00
wicd.nix treewide: add types to boolean / enable options or make use of mkEnableOption 2020-04-27 09:32:01 +02:00
wireguard.nix wireguard module: generatePrivateKeyFile: Fix chmod security race. Fixes #121288 2021-04-30 18:55:38 +02:00
wpa_supplicant.nix treewide: fix double quoted strings in meta.description 2021-01-24 19:56:59 +07:00
xandikos.nix maintainers: 0x4A6F -> _0x4A6F 2020-08-18 07:59:44 +10:00
xinetd.nix treewide: add bool type to enable options, or make use of mkEnableOption 2020-04-21 08:55:36 +02:00
xl2tpd.nix nixos/modules: Remove all usages of types.string 2019-08-31 18:19:00 +02:00
xrdp.nix nixos/xrdp: /var/run -> /run 2019-03-24 21:15:29 +01:00
yggdrasil.nix nixos/yggdrasil: add manual section 2020-07-25 16:34:20 +02:00
yggdrasil.xml fixup! nixos/yggdrasil: add manual section 2020-07-25 16:34:20 +02:00
zerobin.nix zerobin: 20160108 -> 1.0.5 2021-03-13 13:06:06 +01:00
zeronet.nix nixos/zeronet: improved config, dynamic user 2019-10-03 17:03:32 -05:00
zerotierone.nix nixos/zerotierone: switch from manually generating the .link file to use the module 2020-03-19 14:16:26 +01:00