nathan/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2026-10-03 13:30:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

nixos/sudo-rs: Move support for pam_ssh_agent_auth(8) to PAM's NixOS module

Browse Source 
Similar to delroth's suggestion in #262790.

(cherry picked from commit bcc2d1238a)
This commit is contained in:
nicoo
2023-09-04 21:06:12 +00:00
committed by github-actions[bot]
parent 9f4b1c3050
commit 20d2649068
2 changed files with 8 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
nixos/modules/security/pam.nix
View File

@@ -943,6 +943,11 @@ let
value.source = pkgs.writeText "${name}.pam" service.text;
};
optionalSudoConfigForSSHAgentAuth = optionalString config.security.pam.enableSSHAgentAuth ''
# Keep SSH_AUTH_SOCK so that pam_ssh_agent_auth.so can do its magic.
Defaults env_keep+=SSH_AUTH_SOCK
'';
in
{
@@ -1532,9 +1537,7 @@ in
concatLines
]);
security.sudo.extraConfig = optionalString config.security.pam.enableSSHAgentAuth ''
# Keep SSH_AUTH_SOCK so that pam_ssh_agent_auth.so can do its magic.
Defaults env_keep+=SSH_AUTH_SOCK
'';
};
security.sudo.extraConfig = optionalSudoConfigForSSHAgentAuth;
security.sudo-rs.extraConfig = optionalSudoConfigForSSHAgentAuth;
};
}

4
nixos/modules/security/sudo-rs.nix
View File

@@ -220,10 +220,6 @@ in
# Don't edit this file. Set the NixOS options ‘security.sudo-rs.configFile’
# or ‘security.sudo-rs.extraRules’ instead.
''
(optionalString enableSSHAgentAuth ''
# Keep SSH_AUTH_SOCK so that pam_ssh_agent_auth.so can do its magic.
Defaults env_keep+=SSH_AUTH_SOCK
'')
(pipe cfg.extraRules [
(filter (rule: length rule.commands != 0))
(map (rule: [