Merge pull request #190944 from nh2/ecryptfs-security-wrapper

Add `programs.ecryptfs` for mount wrappers
This commit is contained in:
Niklas Hambüchen 2023-09-06 01:14:52 +02:00 committed by GitHub
commit 4a7f846937
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 32 additions and 0 deletions

View file

@ -163,6 +163,7 @@
./programs/direnv.nix
./programs/dmrconfig.nix
./programs/droidcam.nix
./programs/ecryptfs.nix
./programs/environment.nix
./programs/evince.nix
./programs/extra-container.nix

View file

@ -0,0 +1,31 @@
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.programs.ecryptfs;
in {
options.programs.ecryptfs = {
enable = mkEnableOption (lib.mdDoc "ecryptfs setuid mount wrappers");
};
config = mkIf cfg.enable {
security.wrappers = {
"mount.ecryptfs_private" = {
setuid = true;
owner = "root";
group = "root";
source = "${lib.getBin pkgs.ecryptfs}/bin/mount.ecryptfs_private";
};
"umount.ecryptfs_private" = {
setuid = true;
owner = "root";
group = "root";
source = "${lib.getBin pkgs.ecryptfs}/bin/umount.ecryptfs_private";
};
};
};
}