b12f/nixpkgs
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

namecoind nixos module: security enhancements

Browse source
This commit is contained in:
Thomas Strobel 2015-09-10 18:04:04 +02:00
parent 13e2d2245e
commit 8db7c14e56
2 changed files with 24 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
nixos/modules/misc/ids.nix
View file

@ -437,7 +437,7 @@
riak = 205;
#shout = 206; #unused
gateone = 207;
#namecoin = 208; #unused
namecoin = 208;
# When adding a gid, make sure it doesn't match an existing
# uid. Users and groups with the same name should have equal

24
nixos/modules/services/networking/namecoind.nix
View file

@ -45,7 +45,8 @@ in
type = types.path;
example = "/etc/namecoin/wallet.dat";
description = ''
Wallet file.
Wallet file. The ownership of the file has to be
namecoin:namecoin, and the permissions must be 0640.
'';
};
@ -61,6 +62,8 @@ in
USER=namecoin
PASSWORD=secret
</literal>
The ownership of the file has to be namecoin:namecoin,
and the permissions must be 0640.
'';
};
@ -107,10 +110,29 @@ in
createHome = true;
};
users.extraGroups = singleton
{ name = "namecoin";
gid = config.ids.gids.namecoin;
};
systemd.services.namecoind = {
description = "Namecoind Daemon";
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
preStart = ''
if [ "$(stat --printf '%u' ${cfg.userFile})" != "${toString config.ids.uids.namecoin}" \
-o "$(stat --printf '%g' ${cfg.userFile})" != "${toString config.ids.gids.namecoin}" \
-o "$(stat --printf '%a' ${cfg.userFile})" != "640" ]; then
echo "ERROR: bad ownership or rights on ${cfg.userFile}" >&2
exit 1
fi
if [ "$(stat --printf '%u' ${cfg.wallet})" != "${toString config.ids.uids.namecoin}" \
-o "$(stat --printf '%g' ${cfg.wallet})" != "${toString config.ids.gids.namecoin}" \
-o "$(stat --printf '%a' ${cfg.wallet})" != "640" ]; then
echo "ERROR: bad ownership or rights on ${cfg.wallet}" >&2
exit 1
fi
'';
serviceConfig = {
Type = "simple";
User = "namecoin";