passless: init at 0.11.2 (#516879)

nixos/doc/manual/release-notes/rl-2605.section.md

@@ -110,6 +110,8 @@
 
 - [clevis-luks-askpass](https://github.com/latchset/clevis), automatic LUKS unlocking in initrd using clevis token bindings stored in LUKS headers. Available as [boot.initrd.clevisLuksAskpass](#opt-boot.initrd.clevisLuksAskpass.enable).
 
+- [passless](https://github.com/pando85/passless), a daemon for using Webauthn Passkeys backed by password-store.
+
 - [bentopdf](https://github.com/alam00000/bentopdf), a privacy-first PDF toolkit running completely in-browser. Available as [services.bentopdf](#opt-services.bentopdf.enable).
 
 - [hyprwhspr-rs](https://github.com/better-slop/hyprwhspr-rs), a keybind activated speech-to-text voice dictation utility built for use with Hyprland. Available as [services.hyprwhspr-rs](#opt-services.hyprwhspr-rs.enable).

nixos/modules/module-list.nix

@@ -296,6 +296,7 @@
   ./programs/opengamepadui.nix
   ./programs/openvpn3.nix
   ./programs/partition-manager.nix
+  ./programs/passless.nix
   ./programs/pay-respects.nix
   ./programs/plotinus.nix
   ./programs/pmount.nix

nixos/modules/programs/passless.nix

@@ -0,0 +1,134 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.programs.passless;
+  settingsFormat = pkgs.formats.toml { };
+  settingsFile = settingsFormat.generate "passless.toml" cfg.settings;
+in
+{
+
+  options.programs.passless = {
+    enable = lib.mkEnableOption "passless";
+
+    package = lib.mkPackageOption pkgs "passless" { };
+
+    users = lib.options.mkOption {
+      type = with lib.types; listOf str;
+      description = ''
+        Users that intend to use passless and should be added to the fido group.
+      '';
+      default = [ ];
+      example = [ "alice" ];
+    };
+
+    settings = lib.mkOption {
+      inherit (settingsFormat) type;
+      default = { };
+      example = {
+        pass.store-path = "/home/alice/.local/share/password-store";
+      };
+      description = ''
+        Configuration included in `config.toml`.
+
+        See <https://github.com/pando85/passless#configuration-1> for documentation or run `passless config print` to see default configuration.
+      '';
+    };
+  };
+
+  config = lib.mkIf config.programs.passless.enable {
+    users.groups.fido.members = cfg.users;
+
+    boot.kernelModules = [ "uhid" ];
+
+    services.udev.extraRules = ''
+      KERNEL=="uhid", GROUP="fido", MODE="0660"
+    '';
+
+    # From https://github.com/pando85/passless/blob/master/contrib/systemd/passless.service
+    systemd.user.services.passless = {
+      description = "Passless FIDO2 Software Authenticator";
+      documentation = [ "https://github.com/pando85/passless" ];
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+      wantedBy = [ "default.target" ];
+      path = [ config.programs.gnupg.package ];
+      serviceConfig = {
+        Type = "simple";
+        ExecStart = "${lib.getExe cfg.package} --config-path ${settingsFile}";
+        Restart = "on-failure";
+        RestartSec = "5s";
+        # Security hardening
+        # The application already handles its own memory locking and core dump prevention
+        # but we can add additional systemd protections
+        NoNewPrivileges = true;
+        LimitMEMLOCK = "2M";
+        SyslogIdentifier = "passless";
+
+        # Found with shh
+        ProtectSystem = "strict";
+        PrivateTmp = "disconnected";
+        PrivateMounts = "true";
+        ProtectKernelTunables = "true";
+        ProtectKernelModules = true;
+        ProtectKernelLogs = true;
+        LockPersonality = true;
+        RestrictRealtime = true;
+        ProtectClock = true;
+        MemoryDenyWriteExecute = true;
+        RestrictAddressFamilies = "AF_UNIX";
+        SocketBindDeny = [
+          "ipv4:tcp"
+          "ipv4:udp"
+          "ipv6:tcp"
+          "ipv6:udp"
+        ];
+        CapabilityBoundingSet = [
+          "~CAP_BLOCK_SUSPEND"
+          "CAP_BPF"
+          "CAP_CHOWN"
+          "CAP_MKNOD"
+          "CAP_NET_RAW"
+          "CAP_PERFMON"
+          "CAP_SYS_BOOT"
+          "CAP_SYS_CHROOT"
+          "CAP_SYS_MODULE"
+          "CAP_SYS_NICE"
+          "CAP_SYS_PACCT"
+          "CAP_SYS_PTRACE"
+          "CAP_SYS_TIME"
+          "CAP_SYSLOG"
+          "CAP_WAKE_ALARM"
+        ];
+        SystemCallFilter = [
+          "~@aio:EPERM"
+          "@chown:EPERM"
+          "@clock:EPERM"
+          "@cpu-emulation:EPERM"
+          "@debug:EPERM"
+          "@ipc:EPERM"
+          "@keyring:EPERM"
+          "@module:EPERM"
+          "@mount:EPERM"
+          "@obsolete:EPERM"
+          "@pkey:EPERM"
+          "@privileged:EPERM"
+          "@raw-io:EPERM"
+          "@reboot:EPERM"
+          "@resources:EPERM"
+          "@sandbox:EPERM"
+          "@setuid:EPERM"
+          "@swap:EPERM"
+          "@sync:EPERM"
+        ];
+
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ erictapen ];
+
+}

pkgs/by-name/pa/passless/package.nix

@@ -0,0 +1,56 @@
+{
+  lib,
+  stdenv,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  installShellFiles,
+  udev,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "passless";
+  version = "0.12.0";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "pando85";
+    repo = "passless";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-tPlCiXokONUswwEDB2e23gR/NU6G+VYHgqfE+RyRsxw=";
+  };
+
+  cargoHash = "sha256-cNVmzK/W1jER6eK33JgFVnAN/6vGY4gw3GHB/H5DbIQ=";
+
+  nativeBuildInputs = [
+    pkg-config
+    installShellFiles
+  ];
+
+  buildInputs = [
+    udev
+  ];
+
+  postInstall = ''
+    install -Dm644 contrib/udev/* $out/etc/udev/rules.d
+
+    export COMPLETIONS="target/${stdenv.targetPlatform.config}/$cargoBuildType/build/passless-rs-*/out/completions"
+
+    installShellCompletion --cmd passless \
+      --bash $COMPLETIONS/passless.bash \
+      --fish $COMPLETIONS/passless.fish \
+      --zsh $COMPLETIONS/_passless
+  '';
+
+  meta = {
+    homepage = "https://github.com/pando85/passless";
+    description = "Virtual FIDO2 device and client FIDO 2 utility";
+    changelog = "https://github.com/pando85/passless/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    license = lib.licenses.gpl3Only;
+    mainProgram = "passless";
+    maintainers = [ lib.maintainers.erictapen ];
+    platforms = lib.platforms.linux;
+  };
+
+})