user: add CAP_NET_ADMIN,CAP_NET_RAW even outside of systemd session
in fact, *only* outside of systemd session because they broke ambient caps in 255
This commit is contained in:
parent
87e2509af4
commit
30288cd67f
|
@ -51,102 +51,6 @@
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
security.pam.mount.enable = true;
|
|
||||||
|
|
||||||
# pam.d ordering:
|
|
||||||
# /etc/pam.d/greetd:
|
|
||||||
# auth optional pam_unix.so likeauth nullok # unix-early (order 11600)
|
|
||||||
# auth optional /nix/store/051v0pwqfy1z7ld6087y99fdrv12113n-pam_mount-2.20/lib/security/pam_mount.so disable_interactive # mount (order 12000)
|
|
||||||
# auth optional /nix/store/82zqzh7i88pxybcf48zapnz4v0jf19nm-gnome-keyring-42.1/lib/security/pam_gnome_keyring.so # gnome_keyring (order 12200)
|
|
||||||
# auth sufficient pam_unix.so likeauth nullok try_first_pass # unix (order 12800)
|
|
||||||
# auth required pam_deny.so # deny (order 13600)
|
|
||||||
# /etc/pam.d/login:
|
|
||||||
# auth optional pam_unix.so likeauth nullok # unix-early (order 11600)
|
|
||||||
# auth optional /nix/store/051v0pwqfy1z7ld6087y99fdrv12113n-pam_mount-2.20/lib/security/pam_mount.so disable_interactive # mount (order 12000)
|
|
||||||
# auth optional /nix/store/82zqzh7i88pxybcf48zapnz4v0jf19nm-gnome-keyring-42.1/lib/security/pam_gnome_keyring.so # gnome_keyring (order 12200)
|
|
||||||
# auth sufficient pam_unix.so likeauth nullok try_first_pass # unix (order 12800)
|
|
||||||
# auth required pam_deny.so # deny (order 13600)
|
|
||||||
# /etc/pam.d/sshd: `auth required pam_deny.so # deny (order 12400)`
|
|
||||||
# /etc/pam.d/sudo:
|
|
||||||
# auth optional pam_unix.so likeauth # unix-early (order 11600)
|
|
||||||
# auth optional /nix/store/051v0pwqfy1z7ld6087y99fdrv12113n-pam_mount-2.20/lib/security/pam_mount.so disable_interactive # mount (order 12000)
|
|
||||||
# auth sufficient pam_unix.so likeauth try_first_pass # unix (order 12800)
|
|
||||||
# auth required pam_deny.so # deny (order 13600)
|
|
||||||
# /etc/pam.d/systemd-user:
|
|
||||||
# auth sufficient pam_unix.so likeauth try_first_pass # unix (order 11600)
|
|
||||||
# auth required pam_deny.so # deny (order 12400)
|
|
||||||
|
|
||||||
# brief overview of PAM order/control:
|
|
||||||
# - rules are executed sequentially
|
|
||||||
# - a rule marked "optional": doesn't affect control flow.
|
|
||||||
# - a rule marked "sufficient": on success, early-returns a success value and no further rules are executed.
|
|
||||||
# on failure, control flow is normal.
|
|
||||||
# - a rule marked "required": on failure, early-returns a fail value and no further rules are executed.
|
|
||||||
# on success, control flow is normal.
|
|
||||||
# hence, supplementary things like pam_mount, pam_cap, should be marked "optional" and occur before the first "sufficient" rule.
|
|
||||||
#
|
|
||||||
# pam_cap module args are in pam_cap/pam_cap.c:parse_args:
|
|
||||||
# - debug
|
|
||||||
# - config=<filename>
|
|
||||||
# - keepcaps
|
|
||||||
# - autoauth
|
|
||||||
# - default=<string>
|
|
||||||
# - defer
|
|
||||||
#
|
|
||||||
# about propagating capabilities to PAM consumers:
|
|
||||||
# - `setuid` call typically drops all ambient capabilities.
|
|
||||||
# but setting keepcaps first will preserve the caps across a setuid call
|
|
||||||
# - pam_cap bug, and fix: <https://bugzilla.kernel.org/show_bug.cgi?id=212945#c5>
|
|
||||||
# - may need to use keepcaps + defer: <https://bugzilla.kernel.org/show_bug.cgi?id=214377#c3>
|
|
||||||
# security.pam.services.greetd.rules = {
|
|
||||||
# # 2024/01/28: greetd seems to get its caps from systemd (pid1), no matter what i do.
|
|
||||||
# auth.pam_cap = {
|
|
||||||
# order = 12700;
|
|
||||||
# control = "optional";
|
|
||||||
# modulePath = "${pkgs.libcap.pam}/lib/security/pam_cap.so";
|
|
||||||
# # args = [ "keepcaps" "defer" ]; #< doesn't take effect
|
|
||||||
# # args = [ "keepcaps" ]; #< doesn't take effect
|
|
||||||
# # args = []; #< doesn't take effect
|
|
||||||
# };
|
|
||||||
# };
|
|
||||||
security.pam.services.login.rules = {
|
|
||||||
# keepcaps + defer WORKS
|
|
||||||
auth.pam_cap = {
|
|
||||||
order = 12700;
|
|
||||||
control = "optional";
|
|
||||||
modulePath = "${pkgs.libcap.pam}/lib/security/pam_cap.so";
|
|
||||||
args = [ "keepcaps" "defer" ];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
# security.pam.services.sshd.rules = {
|
|
||||||
# 2024/01/28: sshd only supports caps in the I set, because of the keep-caps/setuid issue (above)
|
|
||||||
# auth.pam_cap = {
|
|
||||||
# order = 12300;
|
|
||||||
# control = "optional";
|
|
||||||
# modulePath = "${pkgs.libcap.pam}/lib/security/pam_cap.so";
|
|
||||||
# args = [ "keepcaps" "defer" ]; #< doesn't take effect
|
|
||||||
# };
|
|
||||||
# };
|
|
||||||
# security.pam.services.sudo.rules = {
|
|
||||||
# 2024/01/28: sudo only supports caps in the I set, because of the keep-caps/setuid issue (above)
|
|
||||||
# auth.pam_cap = {
|
|
||||||
# # order = 11500;
|
|
||||||
# order = 12700;
|
|
||||||
# control = "optional";
|
|
||||||
# modulePath = "${pkgs.libcap.pam}/lib/security/pam_cap.so";
|
|
||||||
# args = [ "keepcaps" "defer" ]; #< doesn't take effect
|
|
||||||
# };
|
|
||||||
# };
|
|
||||||
security.pam.services.systemd-user.rules = {
|
|
||||||
# 2024/01/28: systemd-user seems to override whatever pam_cap tries to set (?)
|
|
||||||
auth.pam_cap = {
|
|
||||||
order = 11500;
|
|
||||||
control = "optional";
|
|
||||||
modulePath = "${pkgs.libcap.pam}/lib/security/pam_cap.so";
|
|
||||||
# args = [ "keepcaps" "defer" ]; #< doesn't take effect
|
|
||||||
args = [ "keepcaps" ];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
environment.etc."/security/capability.conf".text = ''
|
environment.etc."/security/capability.conf".text = ''
|
||||||
# The pam_cap.so module accepts the following arguments:
|
# The pam_cap.so module accepts the following arguments:
|
||||||
#
|
#
|
||||||
|
@ -173,7 +77,7 @@
|
||||||
none *
|
none *
|
||||||
'';
|
'';
|
||||||
|
|
||||||
# grant myself extra capabilities so that i can e.g.:
|
# grant myself extra capabilities for systemd sessions so that i can e.g.:
|
||||||
# - run wireshark without root/setuid
|
# - run wireshark without root/setuid
|
||||||
# - (incidentally) create new network devices/routes without root/setuid, which ought to be useful for sandboxing if i deploy that right.
|
# - (incidentally) create new network devices/routes without root/setuid, which ought to be useful for sandboxing if i deploy that right.
|
||||||
# default systemd includes cap_wake_alarm unless we specify our own capabilityAmbientSet; might be helpful for things like rtcwake?
|
# default systemd includes cap_wake_alarm unless we specify our own capabilityAmbientSet; might be helpful for things like rtcwake?
|
||||||
|
@ -187,16 +91,18 @@
|
||||||
# - capabilityAmbientSet
|
# - capabilityAmbientSet
|
||||||
# - service
|
# - service
|
||||||
# - privileged
|
# - privileged
|
||||||
environment.etc."userdb/colin.user".text = ''
|
#
|
||||||
{
|
# XXX 2024/01/30: as of systemd 255, ambient capabilities are broken; not set at login and not usable via systemd --user services.
|
||||||
"userName" : "colin",
|
# environment.etc."userdb/colin.user".text = ''
|
||||||
"uid": ${builtins.toString config.users.users.colin.uid},
|
# {
|
||||||
"capabilityAmbientSet": [
|
# "userName" : "colin",
|
||||||
"cap_net_admin",
|
# "uid": ${builtins.toString config.users.users.colin.uid},
|
||||||
"cap_net_raw"
|
# "capabilityAmbientSet": [
|
||||||
]
|
# "cap_net_admin",
|
||||||
}
|
# "cap_net_raw"
|
||||||
'';
|
# ]
|
||||||
|
# }
|
||||||
|
# '';
|
||||||
|
|
||||||
sane.users.colin = {
|
sane.users.colin = {
|
||||||
default = true;
|
default = true;
|
||||||
|
|
|
@ -1,5 +1,18 @@
|
||||||
{ config, pkgs, lib, sane-lib, ... }:
|
{ config, pkgs, lib, sane-lib, ... }:
|
||||||
|
|
||||||
|
let
|
||||||
|
libcapForPam = pkgs.libcap;
|
||||||
|
# optional debug configuration for pam.
|
||||||
|
# enabling PAM_DEBUG for one module does not affect any other modules in the process space.
|
||||||
|
# with this, messages produced by `D((...))` supposedly go to `/var/run/pam-debug.log`,
|
||||||
|
# but in practice they just go to stderr (seems to be the failover in case the above can't be opened).
|
||||||
|
# libcapForPam = pkgs.libcap.overrideAttrs (base: {
|
||||||
|
# postPatch = (base.postPatch or "") + ''
|
||||||
|
# substituteInPlace pam_cap/pam_cap.c \
|
||||||
|
# --replace '/* #define PAM_DEBUG */' '#define PAM_DEBUG'
|
||||||
|
# '';
|
||||||
|
# });
|
||||||
|
in
|
||||||
{
|
{
|
||||||
imports = [
|
imports = [
|
||||||
./colin.nix
|
./colin.nix
|
||||||
|
@ -17,4 +30,118 @@
|
||||||
enable = true;
|
enable = true;
|
||||||
wheelNeedsPassword = false;
|
wheelNeedsPassword = false;
|
||||||
};
|
};
|
||||||
|
|
||||||
|
security.pam.mount.enable = true;
|
||||||
|
|
||||||
|
# pam.d ordering (auth section only):
|
||||||
|
# /etc/pam.d/greetd:
|
||||||
|
# auth optional pam_unix.so likeauth nullok # unix-early (order 11600)
|
||||||
|
# auth optional /nix/store/051v0pwqfy1z7ld6087y99fdrv12113n-pam_mount-2.20/lib/security/pam_mount.so disable_interactive # mount (order 12000)
|
||||||
|
# auth optional /nix/store/82zqzh7i88pxybcf48zapnz4v0jf19nm-gnome-keyring-42.1/lib/security/pam_gnome_keyring.so # gnome_keyring (order 12200)
|
||||||
|
# auth sufficient pam_unix.so likeauth nullok try_first_pass # unix (order 12800)
|
||||||
|
# auth required pam_deny.so # deny (order 13600)
|
||||||
|
# /etc/pam.d/login:
|
||||||
|
# auth optional pam_unix.so likeauth nullok # unix-early (order 11600)
|
||||||
|
# auth optional /nix/store/051v0pwqfy1z7ld6087y99fdrv12113n-pam_mount-2.20/lib/security/pam_mount.so disable_interactive # mount (order 12000)
|
||||||
|
# auth optional /nix/store/82zqzh7i88pxybcf48zapnz4v0jf19nm-gnome-keyring-42.1/lib/security/pam_gnome_keyring.so # gnome_keyring (order 12200)
|
||||||
|
# auth sufficient pam_unix.so likeauth nullok try_first_pass # unix (order 12800)
|
||||||
|
# auth required pam_deny.so # deny (order 13600)
|
||||||
|
# /etc/pam.d/sshd: `auth required pam_deny.so # deny (order 12400)`
|
||||||
|
# /etc/pam.d/su:
|
||||||
|
# auth sufficient pam_rootok.so # rootok (order 10200)
|
||||||
|
# auth required pam_faillock.so # faillock (order 10400)
|
||||||
|
# auth optional pam_unix.so likeauth # unix-early (order 11600)
|
||||||
|
# auth optional /nix/store/9adhmj7alv2wamnvkcv3746hwygrps52-pam_mount-2.20/lib/security/pam_mount.so disable_interactive # mount (order 12000)
|
||||||
|
# auth optional /nix/store/984ww6bccnlfvljy84d8y5dd7k9yd0h1-libcap-2.69-pam/lib/security/pam_cap.so keepcaps defer # pam_cap (order 12700)
|
||||||
|
# auth sufficient pam_unix.so likeauth try_first_pass # unix (order 12800)
|
||||||
|
# auth required pam_deny.so # deny (order 13600)
|
||||||
|
# /etc/pam.d/sudo:
|
||||||
|
# auth optional pam_unix.so likeauth # unix-early (order 11600)
|
||||||
|
# auth optional /nix/store/051v0pwqfy1z7ld6087y99fdrv12113n-pam_mount-2.20/lib/security/pam_mount.so disable_interactive # mount (order 12000)
|
||||||
|
# auth sufficient pam_unix.so likeauth try_first_pass # unix (order 12800)
|
||||||
|
# auth required pam_deny.so # deny (order 13600)
|
||||||
|
# /etc/pam.d/systemd-user:
|
||||||
|
# auth sufficient pam_unix.so likeauth try_first_pass # unix (order 11600)
|
||||||
|
# auth required pam_deny.so # deny (order 12400)
|
||||||
|
|
||||||
|
# brief overview of PAM order/control:
|
||||||
|
# - rules are executed sequentially
|
||||||
|
# - a rule marked "optional": doesn't affect control flow.
|
||||||
|
# - a rule marked "sufficient": on success, early-returns a success value and no further rules are executed.
|
||||||
|
# on failure, control flow is normal.
|
||||||
|
# - a rule marked "required": on failure, early-returns a fail value and no further rules are executed.
|
||||||
|
# on success, control flow is normal.
|
||||||
|
# hence, supplementary things like pam_mount, pam_cap, should be marked "optional" and occur before the first "sufficient" rule.
|
||||||
|
#
|
||||||
|
# pam_cap module args are in pam_cap/pam_cap.c:parse_args:
|
||||||
|
# - debug
|
||||||
|
# - config=<filename>
|
||||||
|
# - keepcaps
|
||||||
|
# - autoauth
|
||||||
|
# - default=<string>
|
||||||
|
# - defer
|
||||||
|
#
|
||||||
|
# about propagating capabilities to PAM consumers:
|
||||||
|
# - `setuid` call typically drops all ambient capabilities.
|
||||||
|
# but setting keepcaps first will preserve the caps across a setuid call
|
||||||
|
# - pam_cap bug, and fix: <https://bugzilla.kernel.org/show_bug.cgi?id=212945#c5>
|
||||||
|
# - may need to use keepcaps + defer: <https://bugzilla.kernel.org/show_bug.cgi?id=214377#c3>
|
||||||
|
|
||||||
|
# security.pam.services.greetd.rules = {
|
||||||
|
# # 2024/01/28: greetd seems to get its caps from systemd (pid1), no matter what i do.
|
||||||
|
# auth.pam_cap = {
|
||||||
|
# order = 12700;
|
||||||
|
# control = "optional";
|
||||||
|
# modulePath = "${libcapForPam.pam}/lib/security/pam_cap.so";
|
||||||
|
# args = [ "keepcaps" "defer" "debug" ]; #< doesn't take effect
|
||||||
|
# };
|
||||||
|
# };
|
||||||
|
security.pam.services.login.rules = {
|
||||||
|
# keepcaps + defer WORKS
|
||||||
|
auth.pam_cap = {
|
||||||
|
order = 12700;
|
||||||
|
control = "optional";
|
||||||
|
modulePath = "${libcapForPam.pam}/lib/security/pam_cap.so";
|
||||||
|
args = [ "keepcaps" "defer" ];
|
||||||
|
# args = [ "keepcaps" "defer" "debug" ];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
# security.pam.services.sshd.rules = {
|
||||||
|
# # 2024/01/28: sshd only supports caps in the I set, because of the keep-caps/setuid issue (above)
|
||||||
|
# auth.pam_cap = {
|
||||||
|
# order = 12300;
|
||||||
|
# control = "optional";
|
||||||
|
# modulePath = "${libcapForPam.pam}/lib/security/pam_cap.so";
|
||||||
|
# args = [ "keepcaps" "defer" "debug" ]; #< doesn't take effect
|
||||||
|
# };
|
||||||
|
# };
|
||||||
|
security.pam.services.su.rules = {
|
||||||
|
# keepcaps + defer WORKS
|
||||||
|
auth.pam_cap = {
|
||||||
|
order = 10100; #< must be early, before "auth sufficient pam_rootok.so"!
|
||||||
|
control = "optional";
|
||||||
|
modulePath = "${libcapForPam.pam}/lib/security/pam_cap.so";
|
||||||
|
args = [ "keepcaps" "defer" ];
|
||||||
|
# args = [ "keepcaps" "defer" "debug" ];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
# security.pam.services.sudo.rules = {
|
||||||
|
# # 2024/01/28: sudo only supports caps in the I set, because of the keep-caps/setuid issue (above)
|
||||||
|
# auth.pam_cap = {
|
||||||
|
# # order = 11500;
|
||||||
|
# order = 12700;
|
||||||
|
# control = "optional";
|
||||||
|
# modulePath = "${libcapForPam.pam}/lib/security/pam_cap.so";
|
||||||
|
# args = [ "keepcaps" "defer" "debug" ]; #< doesn't take effect
|
||||||
|
# };
|
||||||
|
# };
|
||||||
|
# security.pam.services.systemd-user.rules = {
|
||||||
|
# # 2024/01/28: systemd-user seems to override whatever pam_cap tries to set (?)
|
||||||
|
# auth.pam_cap = {
|
||||||
|
# order = 11500;
|
||||||
|
# control = "optional";
|
||||||
|
# modulePath = "${libcapForPam.pam}/lib/security/pam_cap.so";
|
||||||
|
# args = [ "keepcaps" "defer" "debug" ]; #< doesn't take effect
|
||||||
|
# };
|
||||||
|
# };
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in New Issue
Block a user