nixos/ecryptfs: init
Currently, ecryptfs support is coupled to `security.pam.enableEcryptfs`, but one might want to use ecryptfs without enabling the PAM functionality. This commit splits it out into a `boot.supportedFilesystems` switch.
This commit is contained in:
parent
7867b50881
commit
ea35bc94bf
|
@ -696,6 +696,7 @@
|
||||||
./tasks/filesystems/bcachefs.nix
|
./tasks/filesystems/bcachefs.nix
|
||||||
./tasks/filesystems/btrfs.nix
|
./tasks/filesystems/btrfs.nix
|
||||||
./tasks/filesystems/cifs.nix
|
./tasks/filesystems/cifs.nix
|
||||||
|
./tasks/filesystems/ecryptfs.nix
|
||||||
./tasks/filesystems/exfat.nix
|
./tasks/filesystems/exfat.nix
|
||||||
./tasks/filesystems/ext.nix
|
./tasks/filesystems/ext.nix
|
||||||
./tasks/filesystems/f2fs.nix
|
./tasks/filesystems/f2fs.nix
|
||||||
|
|
|
@ -486,8 +486,9 @@ in
|
||||||
++ optionals config.krb5.enable [pam_krb5 pam_ccreds]
|
++ optionals config.krb5.enable [pam_krb5 pam_ccreds]
|
||||||
++ optionals config.security.pam.enableOTPW [ pkgs.otpw ]
|
++ optionals config.security.pam.enableOTPW [ pkgs.otpw ]
|
||||||
++ optionals config.security.pam.oath.enable [ pkgs.oathToolkit ]
|
++ optionals config.security.pam.oath.enable [ pkgs.oathToolkit ]
|
||||||
++ optionals config.security.pam.enableU2F [ pkgs.pam_u2f ]
|
++ optionals config.security.pam.enableU2F [ pkgs.pam_u2f ];
|
||||||
++ optionals config.security.pam.enableEcryptfs [ pkgs.ecryptfs ];
|
|
||||||
|
boot.supportedFilesystems = optionals config.security.pam.enableEcryptfs [ "ecryptfs" ];
|
||||||
|
|
||||||
security.wrappers = {
|
security.wrappers = {
|
||||||
unix_chkpwd = {
|
unix_chkpwd = {
|
||||||
|
@ -495,10 +496,7 @@ in
|
||||||
owner = "root";
|
owner = "root";
|
||||||
setuid = true;
|
setuid = true;
|
||||||
};
|
};
|
||||||
} // (if config.security.pam.enableEcryptfs then {
|
};
|
||||||
"mount.ecryptfs_private".source = "${pkgs.ecryptfs.out}/bin/mount.ecryptfs_private";
|
|
||||||
"umount.ecryptfs_private".source = "${pkgs.ecryptfs.out}/bin/umount.ecryptfs_private";
|
|
||||||
} else {});
|
|
||||||
|
|
||||||
environment.etc =
|
environment.etc =
|
||||||
mapAttrsToList (n: v: makePAMService v) config.security.pam.services;
|
mapAttrsToList (n: v: makePAMService v) config.security.pam.services;
|
||||||
|
|
14
nixos/modules/tasks/filesystems/ecryptfs.nix
Normal file
14
nixos/modules/tasks/filesystems/ecryptfs.nix
Normal file
|
@ -0,0 +1,14 @@
|
||||||
|
{ config, lib, pkgs, ... }:
|
||||||
|
# TODO: make ecryptfs work in initramfs?
|
||||||
|
|
||||||
|
with lib;
|
||||||
|
|
||||||
|
{
|
||||||
|
config = mkIf (any (fs: fs == "ecryptfs") config.boot.supportedFilesystems) {
|
||||||
|
system.fsPackages = [ pkgs.ecryptfs ];
|
||||||
|
security.wrappers = {
|
||||||
|
"mount.ecryptfs_private".source = "${pkgs.ecryptfs.out}/bin/mount.ecryptfs_private";
|
||||||
|
"umount.ecryptfs_private".source = "${pkgs.ecryptfs.out}/bin/umount.ecryptfs_private";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
Loading…
Reference in a new issue