diff --git a/nixos/doc/manual/release-notes/rl-1809.xml b/nixos/doc/manual/release-notes/rl-1809.xml
index ae0f35046ff..5799354c6e9 100644
--- a/nixos/doc/manual/release-notes/rl-1809.xml
+++ b/nixos/doc/manual/release-notes/rl-1809.xml
@@ -121,6 +121,12 @@ $ nix-instantiate -E '(import <nixpkgsunstable> {}).gitFull'
gnucash24.
+
+
+ services.munge now runs as user (and group) munge instead of root.
+ Make sure the key file is accessible to the daemon.
+
+
diff --git a/nixos/modules/services/security/munge.nix b/nixos/modules/services/security/munge.nix
index 919c2c2b0e1..5bca1583354 100644
--- a/nixos/modules/services/security/munge.nix
+++ b/nixos/modules/services/security/munge.nix
@@ -35,7 +35,15 @@ in
environment.systemPackages = [ pkgs.munge ];
- systemd.services.munged = {
+ users.users.munge = {
+ description = "Munge daemon user";
+ isSystemUser = true;
+ group = "munge";
+ };
+
+ users.groups.munge = {};
+
+ systemd.services.munged = {
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ];
@@ -44,14 +52,20 @@ in
preStart = ''
chmod 0700 ${cfg.password}
mkdir -p /var/lib/munge -m 0711
+ chown -R munge:munge /var/lib/munge
mkdir -p /var/log/munge -m 0700
+ chown -R munge:munge /var/log/munge
mkdir -p /run/munge -m 0755
+ chown -R munge:munge /run/munge
'';
serviceConfig = {
ExecStart = "${pkgs.munge}/bin/munged --syslog --key-file ${cfg.password}";
PIDFile = "/run/munge/munged.pid";
ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+ PermissionsStartOnly = "true";
+ User = "munge";
+ Group = "munge";
};
};
diff --git a/nixos/tests/slurm.nix b/nixos/tests/slurm.nix
index c23d85e4002..ec67ea09287 100644
--- a/nixos/tests/slurm.nix
+++ b/nixos/tests/slurm.nix
@@ -61,6 +61,7 @@ in {
$node->succeed("mkdir /etc/munge");
$node->succeed("echo '${mungekey}' > /etc/munge/munge.key");
$node->succeed("chmod 0400 /etc/munge/munge.key");
+ $node->succeed("chown munge:munge /etc/munge/munge.key");
$node->succeed("systemctl restart munged");
}