nathan/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2026-10-30 16:10:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

doc/wrappers: add release note, module doc: wrapped programs must be ELFs

Browse Source
This commit is contained in:
Paul Joubert
2026-10-23 19:18:35 +02:00
parent d1e022dd17
commit 590fbfb318
2 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
nixos/doc/manual/release-notes/rl-2611.section.md
View File

@@ -328,6 +328,8 @@
- The [bazarr](#opt-services.bazarr.enable) systemd service has been security hardened. If you are storing/accessing data in `/home`, you will need to adjust the `ProtectHome` option.
- For security reasons, wrapped programs in `security.wrappers` are now required to be ELF executables.
- `security.polkit.enablePkexecWrapper` has been introduced, making the `pkexec` setuid wrapper opt-in.
- `services.pghero` has been removed because the `pghero` package was unmaintained and thus dropped from Nixpkgs.

8
nixos/modules/security/wrappers/default.nix
View File

@@ -60,7 +60,10 @@ let
};
options.source = lib.mkOption {
type = lib.types.path;
description = "The absolute path to the program to be wrapped.";
description = ''
The absolute path to the program to be wrapped.
This must be an ELF executable.
'';
};
options.program = lib.mkOption {
type = with lib.types; nullOr str;
@@ -234,7 +237,8 @@ in
This option effectively allows adding setuid/setgid bits, capabilities,
changing file ownership and permissions of a program without directly
modifying it. This works by creating a wrapper program in a directory
(not configurable), which is then added to the shell `PATH`.
(not configurable), which is then added to the shell `PATH`. Source
programs are required to be ELF executables.
'';
};