82 lines
3.0 KiB
Nix
82 lines
3.0 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
let
|
|
cfg = config.sane.programs.modemmanager;
|
|
in
|
|
{
|
|
sane.programs.modemmanager = {
|
|
packageUnwrapped = pkgs.modemmanager-split.daemon.overrideAttrs (upstream: {
|
|
postInstall = (upstream.postInstall or "") + ''
|
|
substitute $out/share/dbus-1/system.d/org.freedesktop.ModemManager1.conf \
|
|
$out/share/dbus-1/system.d/networkmanager-org.freedesktop.ModemManager1.conf \
|
|
--replace-fail 'user="root"' 'group="networkmanager"'
|
|
'';
|
|
|
|
meta = upstream.meta // {
|
|
mainProgram = "ModemManager";
|
|
};
|
|
});
|
|
# mmcli needs /run/current-system/sw/share/dbus-1 files to function
|
|
enableFor.system = lib.mkIf (builtins.any (en: en) (builtins.attrValues cfg.enableFor.user)) true;
|
|
|
|
suggestedPrograms = [ "mmcli" ];
|
|
|
|
# bwrap sandboxing works, but requires the real user to be root.
|
|
# landlock sandboxing works, and allows the real user to be someone else (like `networkmanager`).
|
|
# non-root is very important, because of how many things in e.g. /dev are r/w based on uid=0.
|
|
# TODO: have the services run as `networkmanager` user
|
|
sandbox.method = "bwrap";
|
|
# sandbox.method = "landlock";
|
|
sandbox.wrapperType = "inplace"; #< .pc files, GIR files with absolute paths,
|
|
sandbox.net = "all"; #< needed for modem bringup
|
|
# sandbox.isolatePids = false;
|
|
sandbox.capabilities = [
|
|
"net_admin"
|
|
"net_raw"
|
|
];
|
|
sandbox.extraPaths = lib.warn "TODO: modemmanager: sandbox more aggressively" [
|
|
# "/"
|
|
"/dev" #v modem-power + net are not enough
|
|
# "/dev/modem-power"
|
|
# "/dev/net"
|
|
"/proc"
|
|
# /run #v can likely be reduced more
|
|
"/run/dbus"
|
|
"/run/NetworkManager"
|
|
"/run/resolvconf"
|
|
"/run/systemd"
|
|
"/run/udev"
|
|
"/sys"
|
|
# "/var"
|
|
];
|
|
};
|
|
|
|
systemd.services.ModemManager = lib.mkIf cfg.enabled {
|
|
aliases = [ "dbus-org.freedesktop.ModemManager1.service" ];
|
|
after = [ "polkit.service" ];
|
|
requires = [ "polkit.service" ];
|
|
wantedBy = [ "network.target" ];
|
|
path = [ "/run/current-system/sw" ]; #< so it can find `sanebox`
|
|
|
|
serviceConfig.Type = "dbus";
|
|
serviceConfig.BusName = "org.freedesktop.ModemManager1";
|
|
|
|
# only if started with `--debug` does mmcli let us issue AT commands like
|
|
# `mmcli --modem any --command=<AT_CMD>`
|
|
serviceConfig.ExecStart = "${lib.getExe cfg.package} --debug";
|
|
# --debug sets DEBUG level logging: so reset
|
|
serviceConfig.ExecStartPost = "${lib.getExe config.sane.programs.mmcli.package} --set-logging=INFO";
|
|
|
|
serviceConfig.Restart = "on-abort";
|
|
serviceConfig.StandardError = "null";
|
|
serviceConfig.CapabilityBoundingSet = "CAP_SYS_ADMIN CAP_NET_ADMIN";
|
|
serviceConfig.ProtectSystem = true;
|
|
serviceConfig.ProtectHome = true;
|
|
serviceConfig.PrivateTmp = true;
|
|
serviceConfig.RestrictAddressFamilies = "AF_NETLINK AF_UNIX AF_QIPCRTR";
|
|
serviceConfig.NoNewPrivileges = true;
|
|
};
|
|
|
|
# so that ModemManager can discover when the modem appears
|
|
services.udev.packages = lib.mkIf cfg.enabled [ cfg.package ];
|
|
}
|