git.iko.soy/typeable/nixpkgs
on master help sign in
users-groups service: add autoSubUidGidRange option

Previously we allocated subuids automatically for all normal users. Make this explicitly configurable, so that one can use this for system users too (or explicitly disable for normal users). Also don't allocate automatically by default if a user already has ranges specified statically.

commitf2c5970a7654c8fed9ba13f70071c29161d80c7c authorNikolay Amiantov <ab@fmap.me> dateWed 5 Jan 2022, 13:20 (5 years ago) parent95e4f1e
4 files changed+26−2
compare with master
unifiedsplit
nixos/doc/manual/from_md/release-notes/rl-2205.section.xml+9 nixos/doc/manual/release-notes/rl-2205.section.md+2 nixos/modules/config/update-users-groups.pl+1−1 nixos/modules/config/users-groups.nix+14−1
nixos/doc/manual/from_md/release-notes/rl-2205.section.xml+9
@@ -228,6 +228,15 @@
228228 to your configuration.
229229 </para>
230230 </listitem>
231+ <listitem>
232+ <para>
233+ Normal users (with <literal>isNormalUser = true</literal>)
234+ which have non-empty <literal>subUidRanges</literal> or
235+ <literal>subGidRanges</literal> set no longer have additional
236+ implicit ranges allocated. To enable automatic allocation back
237+ set <literal>autoSubUidGidRange = true</literal>.
238+ </para>
239+ </listitem>
231240 </itemizedlist>
232241 </section>
233242 <section xml:id="sec-release-22.05-notable-changes">
nixos/doc/manual/release-notes/rl-2205.section.md+2
@@ -77,6 +77,8 @@ In addition to numerous new and upgraded packages, this release has the followin
7777
7878- `documentation.man` has been refactored to support choosing a man implementation other than GNU's `man-db`. For this, `documentation.man.manualPages` has been renamed to `documentation.man.man-db.manualPages`. If you want to use the new alternative man implementation `mandoc`, add `documentation.man = { enable = true; man-db.enable = false; mandoc.enable = true; }` to your configuration.
7979
80+- Normal users (with `isNormalUser = true`) which have non-empty `subUidRanges` or `subGidRanges` set no longer have additional implicit ranges allocated. To enable automatic allocation back set `autoSubUidGidRange = true`.
81+
8082## Other Notable Changes {#sec-release-22.05-notable-changes}
8183
8284- The option [services.redis.servers](#opt-services.redis.servers) was added
nixos/modules/config/update-users-groups.pl+1−1
@@ -351,7 +351,7 @@ foreach my $u (values %usersOut) {
351351 push @subGids, $value;
352352 }
353353
354− if($u->{isNormalUser}) {
354+ if($u->{autoSubUidGidRange}) {
355355 my $subordinate = allocSubUid($name);
356356 $subUidMap->{$name} = $subordinate;
357357 my $value = join(":", ($name, $subordinate, 65536));
nixos/modules/config/users-groups.nix+14−1
@@ -204,6 +204,16 @@ let
204204 '';
205205 };
206206
207+ autoSubUidGidRange = mkOption {
208+ type = types.bool;
209+ default = false;
210+ example = true;
211+ description = ''
212+ Automatically allocate subordinate user and group ids for this user.
213+ Allocated range is currently always of size 65536.
214+ '';
215+ };
216+
207217 createHome = mkOption {
208218 type = types.bool;
209219 default = false;
@@ -320,6 +330,9 @@ let
320330 (mkIf (!cfg.mutableUsers && config.initialHashedPassword != null) {
321331 hashedPassword = mkDefault config.initialHashedPassword;
322332 })
333+ (mkIf (config.isNormalUser && config.subUidRanges == [] && config.subGidRanges == []) {
334+ autoSubUidGidRange = mkDefault true;
335+ })
323336 ];
324337
325338 };
@@ -419,7 +432,7 @@ let
419432 { inherit (u)
420433 name uid group description home createHome isSystemUser
421434 password passwordFile hashedPassword
422− isNormalUser subUidRanges subGidRanges
435+ autoSubUidGidRange subUidRanges subGidRanges
423436 initialPassword initialHashedPassword;
424437 shell = utils.toShellPath u.shell;
425438 }) cfg.users;