Merge pull request #190944 from nh2/ecryptfs-security-wrapper
Add `programs.ecryptfs` for mount wrappers
This commit is contained in:
commit
4a7f846937
|
@ -163,6 +163,7 @@
|
||||||
./programs/direnv.nix
|
./programs/direnv.nix
|
||||||
./programs/dmrconfig.nix
|
./programs/dmrconfig.nix
|
||||||
./programs/droidcam.nix
|
./programs/droidcam.nix
|
||||||
|
./programs/ecryptfs.nix
|
||||||
./programs/environment.nix
|
./programs/environment.nix
|
||||||
./programs/evince.nix
|
./programs/evince.nix
|
||||||
./programs/extra-container.nix
|
./programs/extra-container.nix
|
||||||
|
|
31
nixos/modules/programs/ecryptfs.nix
Normal file
31
nixos/modules/programs/ecryptfs.nix
Normal file
|
@ -0,0 +1,31 @@
|
||||||
|
{ config, lib, pkgs, ... }:
|
||||||
|
|
||||||
|
with lib;
|
||||||
|
|
||||||
|
let
|
||||||
|
cfg = config.programs.ecryptfs;
|
||||||
|
|
||||||
|
in {
|
||||||
|
options.programs.ecryptfs = {
|
||||||
|
enable = mkEnableOption (lib.mdDoc "ecryptfs setuid mount wrappers");
|
||||||
|
};
|
||||||
|
|
||||||
|
config = mkIf cfg.enable {
|
||||||
|
security.wrappers = {
|
||||||
|
|
||||||
|
"mount.ecryptfs_private" = {
|
||||||
|
setuid = true;
|
||||||
|
owner = "root";
|
||||||
|
group = "root";
|
||||||
|
source = "${lib.getBin pkgs.ecryptfs}/bin/mount.ecryptfs_private";
|
||||||
|
};
|
||||||
|
"umount.ecryptfs_private" = {
|
||||||
|
setuid = true;
|
||||||
|
owner = "root";
|
||||||
|
group = "root";
|
||||||
|
source = "${lib.getBin pkgs.ecryptfs}/bin/umount.ecryptfs_private";
|
||||||
|
};
|
||||||
|
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
Loading…
Reference in a new issue