nixos/update-users-groups: let hashedPassword take precedence over initialHashedPassword
Without this change, users that have both `initialHashedPassword` and `hashedPassword` set will have `initialHashedPassword` take precedence, but only for the first time `/etc/passwd` is generated. After that, `hashedPassword` takes precedence. This is surprising behavior as it would generally be expected for `hashedPassword` to win if both are set. This wouldn't be a noticeable problem (and an assert could just be made instead) if the users-groups module did not default the `root.intialHashedPassword` value to `!`, to prevent login by default. That means that users who set `root.hashedPassword` and use an ephemeral rootfs (i.e. `/etc/passwd` is created every boot) are not able to log in to the root account by default, unless they switch to a new generation during the same boot (i.e. `/etc/passwd` already exists and `hashedPassword` is used instead of `initialHashedPassword`) or they set `root.initialHashedPassword = null` (which is unintuitive and seems redundant).
This commit is contained in:
parent
2b268baced
commit
bfa0bff644
|
@ -215,10 +215,12 @@ foreach my $u (@{$spec->{users}}) {
|
|||
} else {
|
||||
$u->{uid} = allocUid($name, $u->{isSystemUser}) if !defined $u->{uid};
|
||||
|
||||
if (defined $u->{initialPassword}) {
|
||||
$u->{hashedPassword} = hashPassword($u->{initialPassword});
|
||||
} elsif (defined $u->{initialHashedPassword}) {
|
||||
$u->{hashedPassword} = $u->{initialHashedPassword};
|
||||
if (!defined $u->{hashedPassword}) {
|
||||
if (defined $u->{initialPassword}) {
|
||||
$u->{hashedPassword} = hashPassword($u->{initialPassword});
|
||||
} elsif (defined $u->{initialHashedPassword}) {
|
||||
$u->{hashedPassword} = $u->{initialHashedPassword};
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in a new issue