diff --git a/nixos/modules/security/pam_mount.nix b/nixos/modules/security/pam_mount.nix
index 462b7f89e2f..1d0efee8ca8 100644
--- a/nixos/modules/security/pam_mount.nix
+++ b/nixos/modules/security/pam_mount.nix
@@ -5,6 +5,14 @@ with lib;
let
cfg = config.security.pam.mount;
+ oflRequired = cfg.logoutHup || cfg.logoutTerm || cfg.logoutKill;
+
+ fake_ofl = pkgs.writeShellScriptBin "fake_ofl" ''
+ SIGNAL=$1
+ MNTPT=$2
+ ${pkgs.lsof}/bin/lsof | ${pkgs.gnugrep}/bin/grep $MNTPT | ${pkgs.gawk}/bin/awk '{print $2}' | ${pkgs.findutils}/bin/xargs ${pkgs.util-linux}/bin/kill -$SIGNAL
+ '';
+
anyPamMount = any (attrByPath ["pamMount"] false) (attrValues config.security.pam.services);
in
@@ -51,6 +59,71 @@ in
You can define volume-specific options in the volume definitions.
'';
};
+
+ debugLevel = mkOption {
+ type = types.int;
+ default = 0;
+ example = 1;
+ description = ''
+ Sets the Debug-Level. 0 disables debugging, 1 enables pam_mount tracing,
+ and 2 additionally enables tracing in mount.crypt. The default is 0.
+ For more information, visit .
+ '';
+ };
+
+ logoutWait = mkOption {
+ type = types.int;
+ default = 0;
+ description = ''
+ Amount of microseconds to wait until killing remaining processes after
+ final logout.
+ For more information, visit .
+ '';
+ };
+
+ logoutHup = mkOption {
+ type = types.bool;
+ default = false;
+ description = ''
+ Kill remaining processes after logout by sending a SIGHUP.
+ '';
+ };
+
+ logoutTerm = mkOption {
+ type = types.bool;
+ default = false;
+ description = ''
+ Kill remaining processes after logout by sending a SIGTERM.
+ '';
+ };
+
+ logoutKill = mkOption {
+ type = types.bool;
+ default = false;
+ description = ''
+ Kill remaining processes after logout by sending a SIGKILL.
+ '';
+ };
+
+ createMountPoints = mkOption {
+ type = types.bool;
+ default = true;
+ description = ''
+ Create mountpoints for volumes if they do not exist.
+ '';
+ };
+
+ removeCreatedMountPoints = mkOption {
+ type = types.bool;
+ default = true;
+ description = ''
+ Remove mountpoints created by pam_mount after logout. This
+ only affects mountpoints that have been created by pam_mount
+ in the same session.
+ '';
+ };
};
};
@@ -77,21 +150,20 @@ in
-
-
+
-
+
${makeBinPath ([ pkgs.util-linux ] ++ cfg.additionalSearchPaths)}
-
-
+
${pkgs.fuse}/bin/mount.fuse %(VOLUME) %(MNTPT) -o ${concatStringsSep "," (cfg.fuseMountOptions ++ [ "%(OPTIONS)" ])}
+ ${pkgs.fuse}/bin/fusermount -u %(MNTPT)
${pkgs.pam_mount}/bin/mount.crypt %(VOLUME) %(MNTPT)
${pkgs.pam_mount}/bin/umount.crypt %(MNTPT)
${pkgs.pam_mount}/bin/pmvarrun -u %(USER) -o %(OPERATION)
-
+ ${optionalString oflRequired "${fake_ofl}/bin/fake_ofl %(SIGNAL) %(MNTPT)"}
${concatStrings (map userVolumeEntry (attrValues extraUserVolumes))}
${concatStringsSep "\n" cfg.extraVolumes}