colin/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
617,485 Commits 124 Branches 0 Tags 3.3 GiB
af223e6426
Commit Graph

969 Commits

Author SHA1 Message Date
Victor Engmark
c11815167f nixos/duosec: Split mkdir mode into chmod command for clarity 
As recommended by ShellCheck
<https://github.com/koalaman/shellcheck/wiki/SC2174>.
 2024-04-22 01:40:55 +10:00
stuebinm
6afb255d97 nixos: remove all uses of lib.mdDoc 
these changes were generated with nixq 0.0.2, by running

  nixq ">> lib.mdDoc[remove] Argument[keep]" --batchmode nixos/**.nix
  nixq ">> mdDoc[remove] Argument[keep]" --batchmode nixos/**.nix
  nixq ">> Inherit >> mdDoc[remove]" --batchmode nixos/**.nix

two mentions of the mdDoc function remain in nixos/, both of which
are inside of comments.

Since lib.mdDoc is already defined as just id, this commit is a no-op as
far as Nix (and the built manual) is concerned.
 2024-04-13 10:07:35 -07:00
Bjørn Forsman
a29010fe79 nixos: improve many 'enable' descriptions 2024-04-09 07:10:17 +02:00
Noah S-C
5c4858ad7b
More specific link to tag spec 
Co-authored-by: Aleksana <alexander.huang.y@gmail.com>
 2024-04-03 17:52:28 +01:00
Noah Santschi-Cooney
1a5acce391
nixos/sudo: update command options enum for newer sudo version 
The enum of allowed command options (NOPASSWD, NOEXEC etc) had not been updated when bumping sudo version.
MAIL/NOMAIL were added in [1.8.13](https://www.sudo.ws/releases/legacy/#1.8.13), FOLLOW/NOFOLLOW were added in [1.8.15](https://www.sudo.ws/releases/legacy/#1.8.15) and INTERCEPT/NOINTERCEPT in [1.9.8](https://www.sudo.ws/releases/stable/#1.9.8)
 2024-04-02 15:15:53 +01:00
Janne Heß
fcc95ff817 treewide: Fix all Nix ASTs in all markdown files 
This allows for correct highlighting and maybe future automatic
formatting. The AST was verified to work with nixfmt only.
 2024-03-28 09:28:12 +01:00
Nick Cao
cee0d0bac7
nixos/pam: use services.fprintd.package for fprintd rule 2024-03-22 20:14:49 -04:00
Adam C. Stephens
b52452f8c7
Merge pull request #291951 from amarshall/zfs-pkgs-renaming 
zfs: rename zfsStable -> zfs_2_2; zfsUnstable -> zfs_unstable; remove enableUnstable option in favor of package
 2024-03-01 10:09:12 -05:00
K900
8be79e54c5 nixos/pam/kwallet: rename option, allow setting package 2024-02-28 18:49:33 +03:00
Andrew Marshall
2e36c49949 nixos/pam: Do not incorrectly use zfs.enableUnstable in assertion 
`zfs.enableUnstable` only has an effect if `zfs.enabled = true`, so only
require `zfs.enabled` to be true here.
 2024-02-27 18:46:00 -05:00
Ryan Lahfa
d9e7a2a88a
Merge pull request #286857 from RaitoBezarius/cacerts 
nixos/security/ca: enable support for compatibility bundles
 2024-02-11 19:44:02 +01:00
Raito Bezarius
19159a2349 nixos/security/ca: enable support for compatibility bundles 
Certain software stacks have no support for OpenSSL non-standard PEM format and will fail to use
our NixOS CA bundle.

For this, it is necessary to fallback on a 'compatibility' bundle which will contain no additional
trust rules.

Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
 2024-02-11 17:51:00 +01:00
Raito Bezarius
2d78f55438 pam_usb, nixos/pam-usb: drop 
`security.pam.usb` is broken anyway and upstream has abandoned the software.
 2024-02-08 02:59:45 +01:00
Sandro
4494fcaab7
nixos/acme: default to lets encrypt production URL instead of null, mention lets encrypt staging URI (#270221) 2024-02-06 01:51:09 +01:00
Rhys Davies
d102910f47
nixos/pam: Add pam_intune 2024-02-02 10:01:52 +13:00
Pierre Bourdon
3484985991
Merge pull request #285587 from edef1c/wrapper-cve-2023-6246 
nixos/modules/security/wrappers: limit argv0 to 512 bytes
 2024-02-01 19:18:45 +01:00
edef
b4c9840652 nixos/modules/security/wrappers: limit argv0 to 512 bytes 
This mitigates CVE-2023-6246, crucially without a mass-rebuild.

Change-Id: I762a0d489ade88dafd3775d54a09f555dc8c2527
 2024-02-01 18:16:55 +00:00
Adam Stephens
75ec325cb9
nixos/pam: remove pam_cgfs 
pam_cgfs is a cgroups-v1 pam module. Verified with upstream that
this module no longer necessary on cgroups-v2 systems.
 2024-01-31 17:19:23 -05:00
éclairevoyant
b43dcaf48f
nixos/acme: fix assertion for renamed option 2024-01-19 16:28:56 -05:00
mian | mian
fbe9d95ed9
fix semi-colon missing 2024-01-18 16:31:54 +08:00
Peder Bergebakken Sundt
dff635f38d
Merge pull request #243169 from 2xsaiko/outgoing/krb5 
nixos/krb5: cleanup, fix and RFC42-ify
 2024-01-10 21:06:15 +01:00
nicoo
0e5c95035d nixos/pam: Fix use of renamed enableSSHAgentAuth option 2024-01-08 18:13:46 +00:00
Maciej Krüger
b5b2f6bec4
Merge pull request #277620 from nbraud/nixos/pam/ssh-agent-auth-31611 
nixos/pam: Add option for ssh-agent auth's trusted authorized_keys files
 2024-01-08 17:42:02 +01:00
Maciej Krüger
c931d73fba
Merge pull request #276499 from nbraud/nixos/pam/ssh-agent-auth 
nixos/pam: Add assertion for SSH-agent auth
 2024-01-07 13:54:27 +01:00
nicoo
2eac5106f1 nixos/sudo: Remove unused enableSSHAgentAuth let-binding 2024-01-04 17:30:09 +00:00
nicoo
9ed1423dcf nixos/pam: Warn on insecure sshAgentAuth configurations 2024-01-04 17:30:09 +00:00
nicoo
822c0a86bd nixos/pam: Add sshAgentAuth.authorizedKeysFiles option 2024-01-03 14:49:36 +00:00
nicoo
a46ea51ca3 nixos/pam: Rename option enableSSHAgentAuth to sshAgentAuth.enable 2024-01-03 14:49:36 +00:00
Maciej Krüger
4f9e98905e
nixos/auditd: fix typo 
Would otherwise fail with

```
       error: A definition for option `systemd.services.auditd.conflicts."[definition 1-entry 1]"' is not of type `string matching the pattern [a-zA-Z0-9@%:_.\-]+[.](service|socket|device|mount|automount|swap|target|path|timer|scope|slice)'. Definition values:
       - In `/nix/store/x2khl2yx0vz2i357x7mz5xm1kagql8ag-source/nixos/modules/security/auditd.nix': "shutdown.target "
```
 2024-01-01 17:28:46 +01:00
nicoo
607679c6d3 nixos/pam: Assert that authorizedKeysFiles is non-empty when using pam_ssh_agent_auth 2023-12-30 22:19:38 +00:00
nikstur
d0014a531e nixos/wrappers: order service after sysusers service 2023-12-29 03:41:45 +01:00
nikstur
65ff518a0d nixos/ipa: replace activationScript 
Replaced with a dedicated systemd service.
 2023-12-29 03:41:45 +01:00
nikstur
c9569af3e0
Merge pull request #271326 from philiptaron/shutdown.target 
treewide: depend on `shutdown.target` if `DefaultDependencies=no` in almost every case
 2023-12-27 08:33:26 +01:00
Sandro Jäckel
35ca689119
nixos/wrapper: add basename of the wrapped program to the wrappers name to easily identify it 
Also fix the comment with test instructions
 2023-12-24 20:36:12 +01:00
nicoo
1e9e8a0db0 nixos/sudo-rs: Removed unused let-binding 
Leftover from bcc2d1238a
 2023-12-24 13:58:08 +00:00
Marco Rebhan
5ee94c0170
nixos/krb5: add h7x4 as maintainer 2023-12-21 11:38:22 +01:00
Marco Rebhan
a4a9be35f4
nixos/krb5: add myself as maintainer for module & tests 2023-12-21 11:38:18 +01:00
Marco Rebhan
fed77d1705
nixos/krb5: move to security.krb5 2023-12-21 11:35:26 +01:00
pennae
90c53f5341
Merge pull request #270224 from SuperSandro2000/patch-2 
nixos/acme: add syntax highlighting to code blocks
 2023-12-11 09:03:32 +01:00
Sandro
5a64fb2799
nixos/acme: add syntax highlighting to code blocks 2023-12-10 19:59:22 +01:00
Philip Taron
a7a5b2eca1
nixos/suid-sgid-wrappers: ensure correct ordering w.r.t. shutdown.target 2023-11-30 15:03:56 -08:00
Philip Taron
d7ab46ed87
nixos/duosec: ensure correct ordering w.r.t. shutdown.target 2023-11-30 15:02:51 -08:00
Philip Taron
407ef67228
nixos/auditd: ensure correct ordering w.r.t. shutdown.target 
This looks like it's got a few other idiosyncrasies, but I'll leave it
alone for now.
 2023-11-30 15:00:39 -08:00
Philip Taron
454f3cb58d
nixos/apparmor: ensure correct ordering w.r.t. shutdown.target 2023-11-30 14:57:59 -08:00
Weijia Wang
feeae486de
Merge pull request #261702 from h7x4/replace-mkoption-with-mkpackageoption 
treewide: use `mkPackageOption`
 2023-11-30 02:49:30 +01:00
h7x4
0a37316d6c
treewide: use mkPackageOption 
This commit replaces a lot of usages of `mkOption` with the package
type, to be `mkPackageOption`, in order to reduce the amount of code.
 2023-11-27 01:28:36 +01:00
nicoo
bcc2d1238a nixos/sudo-rs: Move support for pam_ssh_agent_auth(8) to PAM's NixOS module 
Similar to delroth's suggestion in #262790.
 2023-11-25 14:11:25 +00:00
nicoo
f5d059b1f5 nixos/sudo-rs: Clarify security.sudo-rs.enable's description 2023-11-25 14:11:24 +00:00
nicoo
46aaa5be70 nixos/sudo-rs: Refactor option definitions 2023-11-25 14:11:24 +00:00
nicoo
03db94319a nixos/sudo-rs: refactor processing of cfg.extraRules 2023-11-25 14:11:24 +00:00