Add write permissions for tss group for tpm2-tss keystore
to enable provisioning for users in tss group.
Signed-off-by: JuergenReppSIT <juergen_repp@web.de>
We only want to create users and groups in the module if they are the module defaults; if a user is specifying something else, we can presume that they are creating that themselves and don't want to conflict.
The previous implementation caused problems when the module was configured to use the /dev/tpmrm0 kernel resource manager. In this configuration, /dev/tpmrm0 would be owned by root, but in the group tss, which caused there to be no tss user created. This in turn caused the tss group to be a "normal" group, not a system group, and udev does not assign devices to normal groups. Unfortunately, there is no isSystemGroup option corresponding to the isSystemUser option. To avoid messing with the user system, we add the tss user if we need the group.
resolves#489756
Use `tssUser` option value for FAPI log directory user in
systemd-tmpfiles rules, instead of hardcoding `tss`.
If `security.tpm2.abrmd.enable = false` (default), `tssUser` is root.
Fixes systemd-tmpfiles-resetup error:
/etc/tmpfiles.d/00-nixos.conf:<ln>: Failed to resolve user 'tss': No such process
tpm2-abrmd can't start up until /dev/tpm0 has been created and its
udev rules applied. This prevents a failure on startup by waiting
for that to happen.
The package changes udev rules. A device change must be triggered
in order for these changes to be picked up, otherwise services
which depend on the configuration will fail.
Updating the udev rules to match what is in recent versions of the
suggested rules from the tpm2-tss package. The old rules were based
on an old version of the suggested rules and never updated when
they were updated in subsequent version upgrades.
Since there are now variants of tpm2-pkcs11 with and without ABRMD
support (for the kernel resource manager), ensure we pick the correct
default.
Fixes an accidental backwards incompatibility with the module.
After final improvements to the official formatter implementation,
this commit now performs the first treewide reformat of Nix files using it.
This is part of the implementation of RFC 166.
Only "inactive" files are reformatted, meaning only files that
aren't being touched by any PR with activity in the past 2 months.
This is to avoid conflicts for PRs that might soon be merged.
Later we can do a full treewide reformat to get the rest,
which should not cause as many conflicts.
A CI check has already been running for some time to ensure that new and
already-formatted files are formatted, so the files being reformatted here
should also stay formatted.
This commit was automatically created and can be verified using
nix-build a08b3a4d19.tar.gz \
--argstr baseRev b32a094368
result/bin/apply-formatting $NIXPKGS_PATH
these changes were generated with nixq 0.0.2, by running
nixq ">> lib.mdDoc[remove] Argument[keep]" --batchmode nixos/**.nix
nixq ">> mdDoc[remove] Argument[keep]" --batchmode nixos/**.nix
nixq ">> Inherit >> mdDoc[remove]" --batchmode nixos/**.nix
two mentions of the mdDoc function remain in nixos/, both of which
are inside of comments.
Since lib.mdDoc is already defined as just id, this commit is a no-op as
far as Nix (and the built manual) is concerned.
conversions were done using https://github.com/pennae/nix-doc-munge
using (probably) rev f34e145 running
nix-doc-munge nixos/**/*.nix
nix-doc-munge --import nixos/**/*.nix
the tool ensures that only changes that could affect the generated
manual *but don't* are committed, other changes require manual review
and are discarded.
mostly no rendering changes. some lists (like simplelist) don't have an
exact translation to markdown, so we use a comma-separated list of
literals instead.
the conversion procedure is simple:
- find all things that look like options, ie calls to either `mkOption`
or `lib.mkOption` that take an attrset. remember the attrset as the
option
- for all options, find a `description` attribute who's value is not a
call to `mdDoc` or `lib.mdDoc`
- textually convert the entire value of the attribute to MD with a few
simple regexes (the set from mdize-module.sh)
- if the change produced a change in the manual output, discard
- if the change kept the manual unchanged, add some text to the
description to make sure we've actually found an option. if the
manual changes this time, keep the converted description
this procedure converts 80% of nixos options to markdown. around 2000
options remain to be inspected, but most of those fail the "does not
change the manual output check": currently the MD conversion process
does not faithfully convert docbook tags like <code> and <package>, so
any option using such tags will not be converted at all.
Since systemd 243, docs were already steering users towards using
`journal`:
eedaf7f322
systemd 246 will go one step further, it shows warnings for these units
during bootup, and will [automatically convert these occurences to
`journal`](f3dc6af20f):
> [ 6.955976] systemd[1]: /nix/store/hwyfgbwg804vmr92fxc1vkmqfq2k9s17-unit-display-manager.service/display-manager.service:27: Standard output type syslog is obsolete, automatically updating to journal. Please update│······················
your unit file, and consider removing the setting altogether.
So there's no point of keeping `syslog` here, and it's probably a better
idea to just not set it, due to:
> This setting defaults to the value set with DefaultStandardOutput= in
> systemd-system.conf(5), which defaults to journal.
