nixos: add programs.wireshark option
To be able to use Wireshark as an ordinary user, the 'dumpcap' program must be installed setuid root. This module module simplifies such a configuration to simply: programs.wireshark.enable = true; The setuid wrapper is available for users in the 'wireshark' group. Changes v1 -> v2: - add "defaultText" to the programs.wireshark.package option (AFAIK, that prevents the manual from being needlessly rebuilt when the package changes)
This commit is contained in:
parent
070825d443
commit
8f3e6fdd8c
|
@ -288,6 +288,7 @@
|
||||||
kresd = 270;
|
kresd = 270;
|
||||||
rpc = 271;
|
rpc = 271;
|
||||||
geoip = 272;
|
geoip = 272;
|
||||||
|
#wireshark = 273; # unused
|
||||||
|
|
||||||
# When adding a uid, make sure it doesn't match an existing gid. And don't use uids above 399!
|
# When adding a uid, make sure it doesn't match an existing gid. And don't use uids above 399!
|
||||||
|
|
||||||
|
@ -545,6 +546,7 @@
|
||||||
kresd = 270;
|
kresd = 270;
|
||||||
#rpc = 271; # unused
|
#rpc = 271; # unused
|
||||||
#geoip = 272; # unused
|
#geoip = 272; # unused
|
||||||
|
wireshark = 273;
|
||||||
|
|
||||||
# When adding a gid, make sure it doesn't match an existing
|
# When adding a gid, make sure it doesn't match an existing
|
||||||
# uid. Users and groups with the same name should have equal
|
# uid. Users and groups with the same name should have equal
|
||||||
|
|
|
@ -91,6 +91,7 @@
|
||||||
./programs/tmux.nix
|
./programs/tmux.nix
|
||||||
./programs/venus.nix
|
./programs/venus.nix
|
||||||
./programs/vim.nix
|
./programs/vim.nix
|
||||||
|
./programs/wireshark.nix
|
||||||
./programs/wvdial.nix
|
./programs/wvdial.nix
|
||||||
./programs/xfs_quota.nix
|
./programs/xfs_quota.nix
|
||||||
./programs/xonsh.nix
|
./programs/xonsh.nix
|
||||||
|
|
57
nixos/modules/programs/wireshark.nix
Normal file
57
nixos/modules/programs/wireshark.nix
Normal file
|
@ -0,0 +1,57 @@
|
||||||
|
{ config, lib, pkgs, ... }:
|
||||||
|
|
||||||
|
with lib;
|
||||||
|
|
||||||
|
let
|
||||||
|
|
||||||
|
cfg = config.programs.wireshark;
|
||||||
|
wireshark = cfg.package;
|
||||||
|
|
||||||
|
in
|
||||||
|
|
||||||
|
{
|
||||||
|
|
||||||
|
options = {
|
||||||
|
|
||||||
|
programs.wireshark = {
|
||||||
|
|
||||||
|
enable = mkOption {
|
||||||
|
type = types.bool;
|
||||||
|
default = false;
|
||||||
|
description = ''
|
||||||
|
Whether to add Wireshark to the global environment and configure a
|
||||||
|
setuid wrapper for 'dumpcap' for users in the 'wireshark' group.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
package = mkOption {
|
||||||
|
type = types.package;
|
||||||
|
default = pkgs.wireshark-cli;
|
||||||
|
defaultText = "pkgs.wireshark-cli";
|
||||||
|
description = ''
|
||||||
|
Which Wireshark package to install in the global environment.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
};
|
||||||
|
|
||||||
|
};
|
||||||
|
|
||||||
|
config = mkIf cfg.enable {
|
||||||
|
|
||||||
|
environment.systemPackages = [ wireshark ];
|
||||||
|
|
||||||
|
security.wrappers.dumpcap = {
|
||||||
|
source = "${wireshark}/bin/dumpcap";
|
||||||
|
owner = "root";
|
||||||
|
group = "wireshark";
|
||||||
|
setuid = true;
|
||||||
|
setgid = false;
|
||||||
|
permissions = "u+rx,g+x";
|
||||||
|
};
|
||||||
|
|
||||||
|
users.extraGroups.wireshark.gid = config.ids.gids.wireshark;
|
||||||
|
|
||||||
|
};
|
||||||
|
|
||||||
|
}
|
Loading…
Reference in a new issue