``` • Updated input 'nixpkgs-next-unpatched': 'github:nixos/nixpkgs/f7de25c01e4c073c06e0525226a0c2311d530cee' (2024-06-01) → 'github:nixos/nixpkgs/c987c730bbf2121264ebd68921b443db5bb28543' (2024-06-03) • Updated input 'nixpkgs-unpatched': 'github:nixos/nixpkgs/61c1d282153dbfcb5fe413c228d172d0fe7c2a7e' (2024-06-01) → 'github:nixos/nixpkgs/77a51024c0f953d503eb3ed364aa4bff378649f8' (2024-06-03) • Updated input 'sops-nix': 'github:Mic92/sops-nix/962797a8d7f15ed7033031731d0bb77244839960' (2024-05-26) → 'github:Mic92/sops-nix/ab2a43b0d21d1d37d4d5726a892f714eaeb4b075' (2024-06-02) • Updated input 'sops-nix/nixpkgs-stable': 'github:NixOS/nixpkgs/59a450646ec8ee0397f5fa54a08573e8240eb91f' (2024-05-25) → 'github:NixOS/nixpkgs/3b1b4895b2c5f9f5544d02132896aeb9ceea77bc' (2024-06-01) ```
161 lines
6.1 KiB
Nix
161 lines
6.1 KiB
Nix
{ config, pkgs, ... }:
|
|
let
|
|
networkmanager = pkgs.networkmanager.overrideAttrs (upstream: {
|
|
src = pkgs.fetchFromGitea {
|
|
domain = "git.uninsane.org";
|
|
owner = "colin";
|
|
repo = "NetworkManager";
|
|
# patched to fix polkit permissions (with `nmcli`) when NetworkManager runs as user networkmanager
|
|
rev = "dev-sane-1.46.0";
|
|
hash = "sha256-S5ZiOfCpwtVVVO+DP6OPodJqzSc/LW4waI42DRkT+RA=";
|
|
};
|
|
# patches = [];
|
|
});
|
|
# split the package into `daemon` and `nmcli` outputs, because the networkmanager *service*
|
|
# doesn't need `nmcli`/`nmtui` tooling
|
|
networkmanager-split = pkgs.networkmanager-split.override { inherit networkmanager; };
|
|
in {
|
|
networking.networkmanager.enable = true;
|
|
networking.networkmanager.enableDefaultPlugins = false;
|
|
networking.networkmanager.package = networkmanager-split.daemon.overrideAttrs (upstream: {
|
|
# postPatch = (upstream.postPatch or "") + ''
|
|
# substituteInPlace src/{core/org.freedesktop.NetworkManager,nm-dispatcher/nm-dispatcher}.conf --replace-fail \
|
|
# 'user="root"' 'user="networkmanager"'
|
|
# '';
|
|
postInstall = (upstream.postInstall or "") + ''
|
|
# allow the bus to owned by either root or networkmanager users
|
|
# use the group here, that way ordinary users can be elevated to control networkmanager
|
|
# (via e.g. `nmcli`)
|
|
for f in org.freedesktop.NetworkManager.conf nm-dispatcher.conf ; do
|
|
substitute $out/share/dbus-1/system.d/$f \
|
|
$out/share/dbus-1/system.d/networkmanager-$f \
|
|
--replace-fail 'user="root"' 'group="networkmanager"'
|
|
done
|
|
|
|
# remove unused services to prevent any unexpected interactions
|
|
rm $out/etc/systemd/system/{nm-cloud-setup.service,nm-cloud-setup.timer,nm-priv-helper.service}
|
|
'';
|
|
});
|
|
|
|
# fixup the services to run as `networkmanager` and with less permissions
|
|
systemd.services.NetworkManager = {
|
|
serviceConfig.RuntimeDirectory = "NetworkManager"; #< tells systemd to create /run/NetworkManager
|
|
# serviceConfig.StateDirectory = "NetworkManager"; #< tells systemd to create /var/lib/NetworkManager
|
|
serviceConfig.User = "networkmanager";
|
|
serviceConfig.Group = "networkmanager";
|
|
serviceConfig.AmbientCapabilities = [
|
|
# "CAP_DAC_OVERRIDE"
|
|
"CAP_NET_ADMIN"
|
|
"CAP_NET_RAW"
|
|
"CAP_NET_BIND_SERVICE" #< this *does* seem to be necessary, though i don't understand why. DHCP?
|
|
# "CAP_SYS_MODULE"
|
|
"CAP_AUDIT_WRITE" #< allow writing to the audit log
|
|
# "CAP_KILL"
|
|
];
|
|
# TODO: it needs these directories:
|
|
# - "/proc/net"
|
|
# - "/proc/sys/net"
|
|
# - "/run/NetworkManager"
|
|
# - "/run/systemd" # for trust-dns-nmhook
|
|
# - "/run/udev"
|
|
# - # "/run/wg-home.priv"
|
|
# - "/sys/class" #< TODO: specify this more precisely
|
|
# - "/sys/devices"
|
|
# - "/var/lib/NetworkManager"
|
|
# - "/var/lib/trust-dns" #< for trust-dns-nmhook
|
|
# - "/run/systemd"
|
|
};
|
|
|
|
systemd.services.NetworkManager-wait-online = {
|
|
serviceConfig.User = "networkmanager";
|
|
serviceConfig.Group = "networkmanager";
|
|
};
|
|
|
|
# fix NetworkManager-dispatcher to actually run as a daemon,
|
|
# and sandbox it a bit
|
|
systemd.services.NetworkManager-dispatcher = {
|
|
after = [ "trust-dns-localhost.service" ]; #< so that /var/lib/trust-dns will exist
|
|
# serviceConfig.ExecStart = [
|
|
# "" # first blank line is to clear the upstream `ExecStart` field.
|
|
# "${cfg.package}/libexec/nm-dispatcher --persist" # --persist is needed for it to actually run as a daemon
|
|
# ];
|
|
# serviceConfig.Restart = "always";
|
|
# serviceConfig.RestartSec = "1s";
|
|
serviceConfig.User = "networkmanager";
|
|
serviceConfig.Group = "networkmanager";
|
|
# TODO: it needs access only to the above mentioned directories
|
|
};
|
|
|
|
# harden wpa_supplicant (used by NetworkManager)
|
|
systemd.services.wpa_supplicant = {
|
|
serviceConfig.User = "networkmanager";
|
|
serviceConfig.Group = "networkmanager";
|
|
serviceConfig.AmbientCapabilities = [
|
|
"CAP_NET_ADMIN"
|
|
"CAP_NET_RAW"
|
|
];
|
|
# TODO: it needs only these paths:
|
|
# - "/dev/net"
|
|
# - "/dev/rfkill"
|
|
# - "/proc/sys/net"
|
|
# - "/sys/class/net"
|
|
# - "/sys/devices"
|
|
# - "/run/systemd"
|
|
};
|
|
|
|
networking.networkmanager.settings = {
|
|
# wifi.backend = "wpa_supplicant";
|
|
# wifi.scan-rand-mac-address = true;
|
|
|
|
# logging.audit = false;
|
|
logging.level = "INFO";
|
|
|
|
# main.dhcp = "internal";
|
|
main.dns = if config.services.resolved.enable then
|
|
"systemd-resolved"
|
|
else if config.sane.services.trust-dns.enable && config.sane.services.trust-dns.asSystemResolver then
|
|
"none"
|
|
else
|
|
"internal"
|
|
;
|
|
main.systemd-resolved = false;
|
|
};
|
|
environment.etc."NetworkManager/system-connections".source = "/var/lib/NetworkManager/system-connections";
|
|
|
|
# allow networkmanager to control systemd-resolved,
|
|
# which it needs to do to apply new DNS settings when using systemd-resolved.
|
|
security.polkit.extraConfig = ''
|
|
polkit.addRule(function(action, subject) {
|
|
if (subject.isInGroup("networkmanager") && action.id.indexOf("org.freedesktop.resolve1.") == 0) {
|
|
return polkit.Result.YES;
|
|
}
|
|
});
|
|
'';
|
|
|
|
users.users.networkmanager = {
|
|
isSystemUser = true;
|
|
group = "networkmanager";
|
|
extraGroups = [ "trust-dns" ];
|
|
};
|
|
|
|
# there is, unfortunately, no proper interface by which to plumb wpa_supplicant into the NixOS service, except by overlay.
|
|
nixpkgs.overlays = [(self: super: {
|
|
wpa_supplicant = super.wpa_supplicant.overrideAttrs (upstream: {
|
|
# postPatch = (upstream.postPatch or "") + ''
|
|
# substituteInPlace wpa_supplicant/dbus/dbus-wpa_supplicant.conf --replace-fail \
|
|
# 'user="root"' 'user="networkmanager"'
|
|
# '';
|
|
postInstall = (upstream.postInstall or "") + ''
|
|
substitute $out/share/dbus-1/system.d/dbus-wpa_supplicant.conf \
|
|
$out/share/dbus-1/system.d/networkmanager-wpa_supplicant.conf \
|
|
--replace-fail 'user="root"' 'group="networkmanager"'
|
|
'';
|
|
|
|
postFixup = (upstream.postFixup or "") + ''
|
|
# remove unused services to avoid unexpected interactions
|
|
rm $out/etc/systemd/system/{wpa_supplicant-nl80211@,wpa_supplicant-wired@,wpa_supplicant@}.service
|
|
'';
|
|
});
|
|
})];
|
|
}
|