Commit Graph

13358 Commits

Author SHA1 Message Date
Jamey Sharp
d79584c902 nixos/nscd: document why it is configured this way 2019-07-12 12:07:45 -07:00
Jamey Sharp
f7c776760b nixos/nscd: only drop privs after nss module init
NixOS usually needs nscd just to have a single place where
LD_LIBRARY_PATH can be set to include all NSS modules, but nscd is also
useful if some of the NSS modules need to read files which are only
accessible by root.

For example, nixos/modules/config/ldap.nix needs this when
  users.ldap.enable = true;
  users.ldap.daemon.enable = false;
and users.ldap.bind.passwordFile exists. In that case, the module
creates an /etc/ldap.conf which is only readable by root, but which the
NSS module needs to read in order to find out what LDAP server to
connect to and with what credentials.

If nscd is started as root and configured with the server-user option in
nscd.conf, then it gives each NSS module the opportunity to initialize
itself before dropping privileges. The initialization happens in the
glibc-internal __nss_disable_nscd function, which pre-loads all the
configured NSS modules for passwd, group, hosts, and services (but not
netgroup for some reason?) and, for each loaded module, calls an init
function if one is defined. After that finishes, nscd's main() calls
nscd_init() which ends by calling finish_drop_privileges().

There are provisions in systemd for using DynamicUser with a service
which needs to drop privileges itself, so this patch does that.
2019-07-07 08:43:41 -07:00
Jamey Sharp
c38fa99757 nixos/nscd: don't need to specify username
Thanks to @arianvp for pointing out that when DynamicUser is true,
systemd defaults the value of User to be the name of the unit, which in
this case is already "nscd".
2019-07-06 09:24:49 -07:00
Jamey Sharp
4c64375e91 nixos/nscd: delete redundant nscd.conf options
These options were being set to the same value as the defaults that are
hardcoded in nscd. Delete them so it's clear which settings are actually
important for NixOS.

One exception is `threads 1`, which is different from the built-in
default of 4. However, both values are equivalent because nscd forces
the number of threads to be at least as many as the number of kinds of
databases it supports, which is 5.
2019-07-03 15:34:44 -07:00
Jamey Sharp
de251704d6 nixos/nscd: run with a dynamic user
nscd doesn't create any files outside of /run/nscd unless the nscd.conf
"persistent" option is used, which we don't do by default. Therefore it
doesn't matter what UID/GID we run this service as, so long as it isn't
shared with any other running processes.

/run/nscd does need to be owned by the same UID that the service is
running as, but systemd takes care of that for us thanks to the
RuntimeDirectory directive.

If someone wants to turn on the "persistent" option, they need to
manually configure users.users.nscd and systemd.tmpfiles.rules so that
/var/db/nscd is owned by the same user that nscd runs as.

In an all-defaults boot.isContainer configuration of NixOS, this removes
the only user which did not have a pre-assigned UID.
2019-07-03 13:27:29 -07:00
Jamey Sharp
597563d248 nixos/nscd: let systemd manage directories
Previously this module created both /var/db/nscd and /run/nscd using
shell commands in a preStart script. Note that both of these paths are
hard-coded in the nscd source. (Well, the latter is actually
/var/run/nscd but /var/run is a symlink to /run so it works out the
same.)

/var/db/nscd is only used if the nscd.conf "persistent" option is turned
on for one or more databases, which it is not in our default config
file. I'm not even sure persistent mode can work under systemd, since
`nscd --shutdown` is not synchronous so systemd will always
unceremoniously kill nscd without reliably giving it time to mark the
databases as unused. Nonetheless, if someone wants to use that option,
they can ensure the directory exists using systemd.tmpfiles.rules.

systemd can create /run/nscd for us with the RuntimeDirectory directive,
with the added benefit of causing systemd to delete the directory on
service stop or restart. The default value of RuntimeDirectoryMode is
755, the same as the mode which this module was using before.

I don't think the `rm -f /run/nscd/nscd.pid` was necessary after NixOS
switched to systemd and used its PIDFile directive, because systemd
deletes the specified file after the service stops, and because the file
can't persist across reboots since /run is a tmpfs. Even if the file
still exists when nscd starts, it's only a problem if the pid it
contains has been reused by another process, which is unlikely. Anyway,
this change makes that deletion even less necessary, because now systemd
deletes the entire /run/nscd directory when the service stops.
2019-07-03 12:39:48 -07:00
Jamey Sharp
93f185df65 nixos/nscd: no longer need to wait for readiness
This postStart step was introduced on 2014-04-24 with the comment that
"Nscd forks into the background before it's ready to accept
connections."

However, that was fixed upstream almost two months earlier, on
2014-03-03, with the comment that "This, along with setting the nscd
service type to forking in its systemd configuration file, allows
systemd to be certain that the nscd service is ready and is accepting
connections."

The fix was released several months later in glibc 2.20, which was
merged in NixOS sometime before 15.09, so it certainly should be safe to
remove this workaround by now.
2019-07-03 12:26:47 -07:00
Aaron Andersen
8d7dc105b1
Merge pull request #63931 from aanderse/phpfpm
phpfpm: revert #63156
2019-07-03 07:04:17 -04:00
Aaron Andersen
9f2518da59
Merge pull request #64199 from thorstenweber83/fix-mysql-test
nixos/mysql: fix mysql test after #63862
2019-07-03 06:27:40 -04:00
Aaron Andersen
ec80ffc621
Merge pull request #62061 from aanderse/nagios
nixos/nagios: module updates
2019-07-03 06:19:35 -04:00
talyz
732af03ace networkmanager: Documentation cleanup.
- Refer to external documentation for dns option
- Clean up macAddress option
- Improve references
2019-07-03 09:40:05 +00:00
talyz
80acb28bee networkmanager: Add rc-manager option
Add an option to set the rc-manager parameter in NetworkManager.conf,
which controls how NetworkManager handles resolv.conf. This sets the
default rc-manager to "resolvconf", which solves #61490. It
additionally allows the user to change rc-manager without interference
from configuration activations.
2019-07-03 09:40:05 +00:00
Thorsten Weber
46ea3ebc19 nixos/mysql: make ExecStartPost script fail on error 2019-07-03 08:50:21 +02:00
Thorsten Weber
b7907dc1ae fix mysql test after #63862 introduced non-functional initialScript 2019-07-03 00:35:35 +02:00
Peter Hoeg
10dd03e0a3
Merge pull request #63551 from Steell/roon-server
roon-server: init at 100600401
2019-07-02 10:06:29 +08:00
Aaron Andersen
d9193f9eda nixos/mysql: secure access to database in one of the nixos tests 2019-06-30 22:01:02 -04:00
Aaron Andersen
d0a147e841 nixos/mysql: run ExecStartPost as root (again) to preserve compatibility with installs that have been secured 2019-06-30 21:59:47 -04:00
Aaron Andersen
e0590da813 nixos/mysql: turn ExecStartPost into a shell script and simplify code 2019-06-30 21:58:27 -04:00
Matthias Beyer
fe6bb17872 Add missing semicolon (#63919)
Signed-off-by: Matthias Beyer <mail@beyermatthias.de>
2019-06-29 15:52:21 +00:00
Aaron Andersen
278d867a9b Revert "Merge pull request #63156 from Izorkin/phpfpm-rootless"
This reverts commit b5478fd1a2, reversing
changes made to dbb00bfcbf.
2019-06-28 21:47:43 -04:00
Aaron Andersen
4b98e262a0 Revert "nixos/phpfpm: Remove usage of undefined variable fpmCfg"
This reverts commit 54645ce43a.
2019-06-28 21:47:17 -04:00
worldofpeace
8789ff3179
Merge pull request #63822 from worldofpeace/dde-control-center/init
deepin.dde-control-center: init at 4.10.11
2019-06-27 22:15:52 -04:00
worldofpeace
8c2bcb181e nixos/deepin: add dde-control-center 2019-06-27 22:15:13 -04:00
Elis Hirwing
54645ce43a
nixos/phpfpm: Remove usage of undefined variable fpmCfg 2019-06-27 20:39:18 +02:00
Elis Hirwing
b5478fd1a2
Merge pull request #63156 from Izorkin/phpfpm-rootless
phpfpm: do not run anything as root
2019-06-27 19:13:53 +02:00
Elis Hirwing
dbb00bfcbf
Merge pull request #63726 from davidtwco/lidarr/specify-package
nixos/lidarr: allow specifying package
2019-06-27 19:06:51 +02:00
Aaron Andersen
fa01a229e7
Merge pull request #63101 from dasJ/gitea-jwt
nixos/gitea: Generate a JWT secret for git LFS
2019-06-27 13:06:17 -04:00
Aaron Andersen
ae02678a9d
Merge pull request #63786 from aanderse/mysql
mysql: drop support for deprecated package & module option
2019-06-27 12:14:35 -04:00
Domen Kožar
2072043efb
duplicati: fix StateDirectory 2019-06-27 14:15:37 +02:00
Peter Hoeg
67cca52fd9
Merge pull request #53204 from peterhoeg/m/libvirt
libvirt: support proper networking in user session
2019-06-27 11:39:48 +08:00
Janne Heß
8c3dd6f5e7 nixos/gitea: Generate a JWT secret for git LFS 2019-06-27 03:29:02 +02:00
Aaron Andersen
616e52e21b
Merge pull request #63622 from aanderse/zoneminder
nixos/zoneminder: fix some issues with database.createLocally option
2019-06-26 20:36:26 -04:00
pacien
b05870d223 nixos/cgit: fix config example
The order of the keys matters: scan-path must be the last key for other settings
to be taken into account.
2019-06-26 19:59:31 +02:00
Eelco Dolstra
8e620e1bc5
Merge pull request #63810 from NixOS/binaryCaches-default
nix.binaryCaches: always set https://cache.nixos.org
2019-06-26 18:51:17 +02:00
Domen Kožar
f572d4eb91
duplicati: PermissionsStartOnly is deprecated 2019-06-26 15:52:00 +02:00
Domen Kožar
036728f3f4
nix.binaryCaches: always set https://cache.nixos.org
There are many support questions when people add a new binary cache
and they suddenly lose nixos substitutions.

Most of the users want to keep that, so we're doing a breaking change.

Previously to disable all binary caches one had to do:

  nix.binaryCache = [];

Now the same is possible via:

  nix.binaryCache = lib.mkForce;
2019-06-26 14:30:56 +02:00
Frederik Rietdijk
d843e16cb8 Merge master into staging-next 2019-06-26 13:22:30 +02:00
José Romildo Malaquias
b86c7b8568 nixos/deepin: add dde-launcher usb service 2019-06-26 00:40:17 -03:00
Samuel Dionne-Riel
6fba2c3565 sd-image-raspberrypi: populateBoot -> populateFirmware
Fixes an incomplete change from the last changes.
2019-06-25 20:49:34 -04:00
Graham Christensen
7b8a7cee78
Merge pull request #63699 from NinjaTrappeur/nin-hostapd-noscan
hostapd: add noscan mode
2019-06-25 18:08:58 -04:00
Graham Christensen
38c28ef10c
Merge pull request #56265 from aanderse/permissions-start-only
replace deprecated usage of PermissionsStartOnly (part 2)
2019-06-25 18:04:22 -04:00
Aaron Andersen
fb918a9254 nixos/mysql: drop rootPassword option 2019-06-25 17:26:53 -04:00
Aaron Andersen
74ff20fae7 nixos/zoneminder: fix some issues with database.createLocally option 2019-06-25 12:20:22 -04:00
Frederik Rietdijk
4589a04299 Merge master into staging-next 2019-06-25 16:26:29 +02:00
Steve Elliott
725e2793dd roon-server: init at 100600401 2019-06-25 09:34:07 -04:00
Eelco Dolstra
aef7f1b31a
Typo 2019-06-25 14:46:04 +02:00
Domen Kožar
e8916cc6af
duplicati: allow changing the user 2019-06-25 14:28:03 +02:00
Vladimír Čunát
145a620802
Merge branch 'master' into staging-next
Hydra nixpkgs: ?compare=1527134
2019-06-25 14:04:12 +02:00
Aaron Andersen
931921664f
Merge pull request #63392 from ivan/cassandra-default-cluster-name
nixos/cassandra: use cassandra's default cluster name "Test Cluster"
2019-06-25 07:18:10 -04:00
Samuel Dionne-Riel
6bc2d30ee3
Merge pull request #62462 from samueldr/sd-image/fat-free
sd-image: FAT free /boot
2019-06-24 14:53:49 -04:00