mirror of https://github.com/nixos/nixpkgs
eb2f44c18c
This is a rather large commit that switches user/group creation from using useradd/groupadd on activation to just generating the contents of /etc/passwd and /etc/group, and then on activation merging the generated files with the files that exist in the system. This makes the user activation process much cleaner, in my opinion. The users.extraUsers.<user>.uid and users.extraGroups.<group>.gid must all be properly defined (if <user>.createUser is true, which it is by default). My pull request adds a lot of uids/gids to config.ids to solve this problem for existing nixos services, but there might be configurations that break because this change. However, this will be discovered during the build. Option changes introduced by this commit: * Remove the options <user>.isSystemUser and <user>.isAlias since they don't make sense when generating /etc/passwd statically. * Add <group>.members as a complement to <user>.extraGroups. * Add <user>.passwordFile for setting a user's password from an encrypted (shadow-style) file. * Add users.mutableUsers which is true by default. This means you can keep managing your users as previously, by using useradd/groupadd manually. This is accomplished by merging the generated passwd/group file with the existing files in /etc on system activation. The merging of the files is simplistic. It just looks at the user/group names. If a user/group exists both on the system and in the generated files, the system entry will be kept un-changed and the generated entries will be ignored. The merging itself is performed with the help of vipw/vigr to properly lock the account files during edit. If mutableUsers is set to false, the generated passwd and group files will not be merged with the system files on activation. Instead they will simply replace the system files, and overwrite any changes done on the running system. The same logic holds for user password, if the <user>.password or <user>.passwordFile options are used. If mutableUsers is false, password will simply be replaced on activation. If true, the initial user passwords will be set according to the configuration, but existing passwords will not be touched. I have tested this on a couple of different systems and it seems to work fine so far. If you think this is a good idea, please test it. This way of adding local users has been discussed in issue #103 (and this commit solves that issue). |
||
|---|---|---|
| doc | ||
| lib | ||
| maintainers/scripts | ||
| nixos | ||
| pkgs | ||
| .gitignore | ||
| .version | ||
| COPYING | ||
| default.nix | ||
| README.md | ||