nixos: add programs.wireshark option
To be able to use Wireshark as an ordinary user, the 'dumpcap' program must be installed setuid root. This module module simplifies such a configuration to simply: programs.wireshark.enable = true; The setuid wrapper is available for users in the 'wireshark' group. Changes v1 -> v2: - add "defaultText" to the programs.wireshark.package option (AFAIK, that prevents the manual from being needlessly rebuilt when the package changes)
This commit is contained in:
parent
070825d443
commit
8f3e6fdd8c
|
@ -288,6 +288,7 @@
|
|||
kresd = 270;
|
||||
rpc = 271;
|
||||
geoip = 272;
|
||||
#wireshark = 273; # unused
|
||||
|
||||
# When adding a uid, make sure it doesn't match an existing gid. And don't use uids above 399!
|
||||
|
||||
|
@ -545,6 +546,7 @@
|
|||
kresd = 270;
|
||||
#rpc = 271; # unused
|
||||
#geoip = 272; # unused
|
||||
wireshark = 273;
|
||||
|
||||
# When adding a gid, make sure it doesn't match an existing
|
||||
# uid. Users and groups with the same name should have equal
|
||||
|
|
|
@ -91,6 +91,7 @@
|
|||
./programs/tmux.nix
|
||||
./programs/venus.nix
|
||||
./programs/vim.nix
|
||||
./programs/wireshark.nix
|
||||
./programs/wvdial.nix
|
||||
./programs/xfs_quota.nix
|
||||
./programs/xonsh.nix
|
||||
|
|
57
nixos/modules/programs/wireshark.nix
Normal file
57
nixos/modules/programs/wireshark.nix
Normal file
|
@ -0,0 +1,57 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
|
||||
let
|
||||
|
||||
cfg = config.programs.wireshark;
|
||||
wireshark = cfg.package;
|
||||
|
||||
in
|
||||
|
||||
{
|
||||
|
||||
options = {
|
||||
|
||||
programs.wireshark = {
|
||||
|
||||
enable = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = ''
|
||||
Whether to add Wireshark to the global environment and configure a
|
||||
setuid wrapper for 'dumpcap' for users in the 'wireshark' group.
|
||||
'';
|
||||
};
|
||||
|
||||
package = mkOption {
|
||||
type = types.package;
|
||||
default = pkgs.wireshark-cli;
|
||||
defaultText = "pkgs.wireshark-cli";
|
||||
description = ''
|
||||
Which Wireshark package to install in the global environment.
|
||||
'';
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
|
||||
environment.systemPackages = [ wireshark ];
|
||||
|
||||
security.wrappers.dumpcap = {
|
||||
source = "${wireshark}/bin/dumpcap";
|
||||
owner = "root";
|
||||
group = "wireshark";
|
||||
setuid = true;
|
||||
setgid = false;
|
||||
permissions = "u+rx,g+x";
|
||||
};
|
||||
|
||||
users.extraGroups.wireshark.gid = config.ids.gids.wireshark;
|
||||
|
||||
};
|
||||
|
||||
}
|
Loading…
Reference in a new issue