2009-01-02 17:07:15 +01:00
|
|
|
{pkgs, config, ...}:
|
|
|
|
|
2009-08-16 16:49:14 +02:00
|
|
|
with pkgs.lib;
|
|
|
|
|
2009-01-02 17:07:15 +01:00
|
|
|
let
|
2009-08-16 16:49:14 +02:00
|
|
|
|
|
|
|
cfg = config.security.sudo;
|
2011-09-14 20:20:50 +02:00
|
|
|
|
2009-08-16 16:49:14 +02:00
|
|
|
inherit (pkgs) sudo;
|
|
|
|
|
|
|
|
in
|
|
|
|
|
|
|
|
{
|
|
|
|
|
|
|
|
###### interface
|
2009-01-02 17:07:15 +01:00
|
|
|
|
|
|
|
options = {
|
|
|
|
|
2009-08-16 16:49:14 +02:00
|
|
|
security.sudo.enable = mkOption {
|
|
|
|
default = true;
|
|
|
|
description =
|
|
|
|
''
|
|
|
|
Whether to enable the <command>sudo</command> command, which
|
|
|
|
allows non-root users to execute commands as root.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
|
|
|
security.sudo.configFile = mkOption {
|
|
|
|
# Note: if syntax errors are detected in this file, the NixOS
|
|
|
|
# configuration will fail to build.
|
|
|
|
default =
|
|
|
|
''
|
2009-10-13 23:29:30 +02:00
|
|
|
# Don't edit this file. Set nixos option security.sudo.configFile instead
|
2009-08-16 16:49:14 +02:00
|
|
|
|
2012-01-12 08:54:14 +01:00
|
|
|
# env vars to keep for root and %wheel also if not explicitly set
|
|
|
|
Defaults:root,%wheel env_keep+=LOCALE_ARCHIVE
|
|
|
|
Defaults:root,%wheel env_keep+=TERMINFO_DIRS
|
|
|
|
|
2009-08-16 16:49:14 +02:00
|
|
|
# "root" is allowed to do anything.
|
|
|
|
root ALL=(ALL) SETENV: ALL
|
|
|
|
|
|
|
|
# Users in the "wheel" group can do anything.
|
|
|
|
%wheel ALL=(ALL) SETENV: ALL
|
|
|
|
'';
|
|
|
|
description =
|
|
|
|
''
|
|
|
|
This string contains the contents of the
|
|
|
|
<filename>sudoers</filename> file.
|
|
|
|
'';
|
2009-01-02 17:07:15 +01:00
|
|
|
};
|
|
|
|
};
|
|
|
|
|
|
|
|
|
2009-08-16 16:49:14 +02:00
|
|
|
###### implementation
|
2009-01-02 17:07:15 +01:00
|
|
|
|
2009-08-16 16:49:14 +02:00
|
|
|
config = mkIf cfg.enable {
|
2009-01-02 17:07:15 +01:00
|
|
|
|
2010-05-14 23:01:06 +02:00
|
|
|
security.setuidPrograms = [ "sudo" ];
|
2009-01-02 17:07:15 +01:00
|
|
|
|
2009-08-16 16:49:14 +02:00
|
|
|
environment.systemPackages = [ sudo ];
|
2009-01-02 17:07:15 +01:00
|
|
|
|
2009-08-16 16:49:14 +02:00
|
|
|
security.pam.services = [ { name = "sudo"; } ];
|
2009-01-02 17:07:15 +01:00
|
|
|
|
2009-08-16 16:49:14 +02:00
|
|
|
environment.etc = singleton
|
|
|
|
{ source = pkgs.runCommand "sudoers"
|
2009-01-02 17:07:15 +01:00
|
|
|
{ src = pkgs.writeText "sudoers-in" cfg.configFile; }
|
|
|
|
# Make sure that the sudoers file is syntactically valid.
|
|
|
|
# (currently disabled - NIXOS-66)
|
|
|
|
#"${pkgs.sudo}/sbin/visudo -f $src -c && cp $src $out";
|
|
|
|
"cp $src $out";
|
|
|
|
target = "sudoers";
|
|
|
|
mode = "0440";
|
2009-08-16 16:49:14 +02:00
|
|
|
};
|
|
|
|
|
2009-01-02 17:07:15 +01:00
|
|
|
};
|
2009-08-16 16:49:14 +02:00
|
|
|
|
2009-01-02 17:07:15 +01:00
|
|
|
}
|