From 590fbfb318c73c461b438b17b7e1ece4ea107eda Mon Sep 17 00:00:00 2001
From: Paul Joubert <paul@trespaul.com>
Date: Fri, 23 Oct 2026 19:18:35 +0200
Subject: [PATCH] doc/wrappers: add release note, module doc: wrapped programs
 must be ELFs

---
 nixos/doc/manual/release-notes/rl-2611.section.md | 2 ++
 nixos/modules/security/wrappers/default.nix       | 8 ++++++--
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md
index 5148a686195d..d97befde2881 100644
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -328,6 +328,8 @@
 
 - The [bazarr](#opt-services.bazarr.enable) systemd service has been security hardened. If you are storing/accessing data in `/home`, you will need to adjust the `ProtectHome` option.
 
+- For security reasons, wrapped programs in `security.wrappers` are now required to be ELF executables.
+
 - `security.polkit.enablePkexecWrapper` has been introduced, making the `pkexec` setuid wrapper opt-in.
 
 - `services.pghero` has been removed because the `pghero` package was unmaintained and thus dropped from Nixpkgs.
diff --git a/nixos/modules/security/wrappers/default.nix b/nixos/modules/security/wrappers/default.nix
index 941a99323f9b..7d1c24674d09 100644
--- a/nixos/modules/security/wrappers/default.nix
+++ b/nixos/modules/security/wrappers/default.nix
@@ -60,7 +60,10 @@ let
       };
       options.source = lib.mkOption {
         type = lib.types.path;
-        description = "The absolute path to the program to be wrapped.";
+        description = ''
+          The absolute path to the program to be wrapped.
+          This must be an ELF executable.
+        '';
       };
       options.program = lib.mkOption {
         type = with lib.types; nullOr str;
@@ -234,7 +237,8 @@ in
         This option effectively allows adding setuid/setgid bits, capabilities,
         changing file ownership and permissions of a program without directly
         modifying it. This works by creating a wrapper program in a directory
-        (not configurable), which is then added to the shell `PATH`.
+        (not configurable), which is then added to the shell `PATH`. Source
+        programs are required to be ELF executables.
       '';
     };