Commit Graph

708 Commits

Author SHA1 Message Date
github-actions[bot]
9b5359861c
Merge master into staging-next 2022-01-12 12:01:06 +00:00
pennae
b458e5133f
Merge pull request #146937 from amarshall/pam-apparmor-fix
nixos/pam: Fix apparmor syntax error
2022-01-12 06:31:35 +00:00
github-actions[bot]
e8dc263ca3
Merge staging-next into staging 2022-01-11 18:01:57 +00:00
Vladimír Čunát
c3805ba16c
Merge #153104: linux-pam: don't create dangling symlink during build
... into staging
2022-01-09 10:26:43 +01:00
Winter
b52607f43b nixos/acme: ensure web servers using certs can access them 2022-01-08 15:05:34 -05:00
Andrew Marshall
f62c11fcc3 nixos/pam: Fix apparmor syntax error
When running e.g. `aa-genprof` get error:

> ERROR: Syntax Error: Unknown line found in file /etc/apparmor.d/abstractions/pam line 26:
>     r /nix/store/XXXXX.pam,mr /nix/store/XXXXX-linux-pam-1.5.1/lib/security/pam_filter/*,

So add an explicit newline as concatMapStringsSep only adds them
between.
2022-01-02 22:51:26 -05:00
Winter
0715ef5968 linux-pam: don't create dangling symlink during build 2022-01-01 15:39:55 -05:00
Michele Guerini Rocco
59bfda7248
Merge pull request #152594 from ju1m/apparmor
security/wrappers: remove C compiler from the nixos/security.wrappers…
2021-12-31 15:09:52 +01:00
Julien Moutinho
0e5611e0be security/wrappers: remove C compiler from the nixos/security.wrappers AppArmor profile 2021-12-29 16:26:57 +01:00
Lucas Savva
65f1b8c6ae
nixos/acme: Add test for lego's built-in web server
In the process I also found that the CapabilityBoundingSet
was restricting the service from listening on port 80, and
the AmbientCapabilities was ineffective. Fixed appropriately.
2021-12-26 16:49:59 +00:00
Silvan Mosberger
2dcc3daadf
nixos/acme: Clean up default handling 2021-12-26 16:49:58 +00:00
Lucas Savva
41fb8d71ab
nixos/acme: Add useRoot option 2021-12-26 16:49:57 +00:00
Lucas Savva
8d01b0862d
nixos/acme: Update documentation
- Added defaultText for all inheritable options.
- Add docs on using new defaults option to configure
  DNS validation for all domains.
- Update DNS docs to show using a service to configure
  rfc2136 instead of manual steps.
2021-12-26 16:49:55 +00:00
Lucas Savva
377c6bcefc
nixos/acme: Add defaults and inheritDefaults option
Allows configuring many default settings for certificates,
all of which can still be overridden on a per-cert basis.
Some options have been moved into .defaults from security.acme,
namely email, server, validMinDays and renewInterval. These
changes will not break existing configurations thanks to
mkChangedOptionModule.

With this, it is also now possible to configure DNS-01 with
web servers whose virtualHosts utilise enableACME. The only
requirement is you set `acmeRoot = null` for each vhost.

The test suite has been revamped to cover these additions
and also to generally make it easier to maintain. Test config
for apache and nginx has been fully standardised, and it
is now much easier to add a new web server if it follows
the same configuration patterns as those two. I have also
optimised the use of switch-to-configuration which should
speed up testing.
2021-12-26 16:44:10 +00:00
Lucas Savva
a7f0001328
nixos/acme: Check for revoked certificates
Closes #129838

It is possible for the CA to revoke a cert that has not yet
expired. We must run lego to validate this before expiration,
but we must still ignore failures on unexpired certs to retain
compatibility with #85794

Also changed domainHash logic such that a renewal will only
be attempted at all if domains are unchanged, and do a full
run otherwises. Resolves #147540 but will be partially
reverted when go-acme/lego#1532 is resolved + available.
2021-12-26 16:44:09 +00:00
Lucas Savva
87403a0b07
nixos/acme: Add a human readable error on run failure
Closes NixOS/nixpkgs#108237

When a user first adds an ACME cert to their configuration,
it's likely to fail to renew due to DNS misconfig. This is
non-fatal for other services since selfsigned certs are
(usually) put in place to let dependant services start.
Tell the user about this in the logs, and exit 2 for
differentiation purposes.
2021-12-26 16:44:08 +00:00
Lucas Savva
a88d846b91
nixos/acme: Remove selfsignedDeps from finished targets
selfsignedDeps is already appended to the after and wants
of a cert's renewal service, making these redundant.

You can see this if you run the following command:
systemctl list-dependencies --all --reverse acme-selfsigned-mydomain.com.service
2021-12-26 16:44:07 +00:00
Graham Christensen
06edb74413
Merge pull request #148785 from pennae/more-option-doc-staticizing
treewide: more defaultText for options
2021-12-17 11:14:08 -05:00
Martin Weinelt
e675946ecd
Merge pull request #125256 from deviant/acme-standalone 2021-12-11 22:06:48 +01:00
Janne Heß
7b5fb05a0d
nixos/pam: Type all limit options 2021-12-09 12:48:02 +01:00
pennae
e24a8775a8 treewide: set defaultText for options using simple path defaults
adds defaultText for all options that set their default to a path expression
using the ubiquitous `cfg` shortcut bindings.
2021-12-09 01:12:13 +01:00
ajs124
eee45bb295
Merge pull request #146815 from ElvishJerricco/systemd-utils-expressions
Move systemd-lib.nix and systemd-unit-options.nix into utils
2021-12-08 15:07:28 +00:00
Janne Heß
e37aab2130
nixos/acme: Allow disabling bash tracing
This is horrible if you want to debug failures that happened during
system switches but your 30-ish acme clients spam the log with the same
messages over and over again.
2021-12-07 14:17:56 +01:00
pennae
2512455639 nixos/*: add trivial defaultText for options with simple defaults 2021-12-02 22:35:04 +01:00
Roman Frołow
de6181dc51
nixos/acme: fix typo in docs 2021-11-30 21:31:50 +08:00
Lucas Savva
be952aba1c nixos/acme: Fix rate limiting of selfsigned services
Closes NixOS/nixpkgs#147348

I was able to reproduce this intermittently in the
test suite during the tests for HTTPd. Adding
StartLimitIntervalSec=0 to disable rate limiting
for these services works fine. I added it anywhere
there was a ConditionPathExists.
2021-11-29 11:15:31 +01:00
Victor Engmark
dcb941f3ed security/pam: Document test location 2021-11-27 20:36:50 +02:00
Poscat
942f57e79b nixos/acme: add an option for reloading systemd services after renewal 2021-11-24 13:50:20 -08:00
Will Fancher
851495a752 Move systemd-lib.nix and systemd-unit-options.nix into utils 2021-11-20 17:52:29 -05:00
Victor Engmark
ef58bbf9b7 nixos/pam: avoid extra lines in pam files 2021-11-16 19:26:43 +13:00
github-actions[bot]
707b006bf7
Merge master into staging-next 2021-11-09 00:01:30 +00:00
sternenseemann
d14ae62671 nixos/terminfo: inherit TERMINFO* env vars also for doas
This should mirror the behavior we implement for sudo: The TERMINFO and
TERMINFO_DIRS variables are inherited from the normal user's
environment, so terminfo files installed in the user's profile can be
found by ncurses applications running as root.
2021-11-08 14:05:24 -08:00
github-actions[bot]
eeb7e66e97
Merge master into staging-next 2021-11-06 18:01:01 +00:00
Nico Berlee
90bac670c0 nixos/pam: pam_mkhomedir umask to 0077
pam_mkhomedir should create homedirs with the same umask as the rest
of the system. Currently it creates homedirs with go+rx which makes
it readable for other non-privileged users.
2021-11-06 17:45:00 +02:00
github-actions[bot]
9e0658fa12
Merge staging-next into staging 2021-10-27 06:01:57 +00:00
github-actions[bot]
160c71e060
Merge master into staging-next 2021-10-27 06:01:21 +00:00
Peter Hoeg
22a500a3f8 pam_mount: do not re-prompt for password
nixos-rebuild test causes pam_mount to prompt for a password when running with
an encrypted home:

building '/nix/store/p6bflh7n5zy2dql8l45mix9qnzq65hbk-nixos-system-mildred-18.09.git.98592c5da79M.drv'...
activating the configuration...
setting up /etc...
reenter password for pam_mount:
(mount.c:68): Messages from underlying mount program:
(mount.c:72): crypt_activate_by_passphrase: File exists
(pam_mount.c:522): mount of /dev/mapper/vg0-lv_home_peter failed
kbuildsycoca5 running...

This change makes pam_mount not prompt. It still tries to remount (and fails in
the process) but that message can be ignored.

Fixes: #44586
2021-10-27 08:53:15 +08:00
github-actions[bot]
47ad670e14
Merge staging-next into staging 2021-10-26 00:02:18 +00:00
Martin Weinelt
a47e0a6554 Merge remote-tracking branch 'origin/master' into staging-next 2021-10-25 21:03:48 +02:00
Martin Weinelt
1c20719373
Merge pull request #139311 from NinjaTrappeur/nin-acme-fix-webroot 2021-10-25 20:27:29 +02:00
Maciej Krüger
b33ac6e5c0
Merge pull request #137646 from mkg20001/pam-audit 2021-10-19 15:28:51 +02:00
Luke Granger-Brown
1b74469cd0 nixos/ca: use cacert package build for options and p11-kit output
The cacert package can now generate p11-kit-compatible output itself,
as well as generating the correct set of outputs for fully-joined
and unbundled "traditional" outputs (in standard PEM and
OpenSSL-compatible formats).
2021-10-08 01:21:57 +00:00
Naïm Favier
2ddc335e6f
nixos/doc: clean up defaults and examples 2021-10-04 12:47:20 +02:00
Félix Baylac-Jacqué
73846b372f
nixos/acme: add webroots to ReadWritePaths
Since 7a10478ea7, all /var except
/var/lib/acme gets mounted in a read-only fashion. This behavior
breaks the existing acme deployments having a webroot set outside of
/var/lib/acme.

Collecting the webroots and adding them to the paths read/write
mounted to the systemd service runtime tree.

Fixes #139310
2021-10-04 10:08:35 +02:00
Maciej Krüger
f3d00b3a94
nixos/pam: add pam_tty_audit option 2021-10-03 20:47:44 +02:00
Michele Guerini Rocco
2fcef20cb1
Merge pull request #138600 from austinbutler/tpm2-tss-group
nixos/tpm2: define group, fix after #133166
2021-09-20 18:34:39 +02:00
Austin Butler
8b6fa3c821 nixos/tpm2: define group, fix after NixOS#133166 2021-09-19 12:40:54 -07:00
rnhmjoj
1bd7260adb
nixos/lock-kernel-modules: reorder before/after
Moving the service before multi-user.target (so the `hardened` test
continue to work the way it did before) can result in locking the kernel
too early. It's better to lock it a bit later and changing the test to
wait specifically for the disable-kernel-module-loading.service.
2021-09-19 12:06:00 +02:00
Guillaume Girol
ceb2e6667b
Merge pull request #126289 from rnhmjoj/wrappers
nixos/security/wrappers: make well-typed
2021-09-18 15:28:49 +00:00
rnhmjoj
dc34788a25
nixos/lock-kernel-modules: use udevadm settle
Instead of relying on systemd-udev-settle, which is deprecated,
directly call `udevamd settle` to wait for hardware to settle.
2021-09-15 14:36:50 +02:00