mirror of
https://github.com/NixOS/nixpkgs.git
synced 2026-08-31 20:54:56 +00:00
44e15166e0
Since e73170e38a, we no longer patch
systemd to prevent it resetting `PATH` for generators. Generators that
depended on this deviating behavior will no longer work, which
ironically includes the upstream `systemd-xdg-autostart-generator`.
Previously, generators would see systemd's actual environment, which
included environment variables set for the PAM session like `PATH`. To
preserve the old behavior *exactly*, we'd really want to be
replicating exactly what the `systemd-user` PAM service sets up, which
could technically include things other than just what we put in
`/etc/pam/environment`. But this is arguably a systemd bug (either
because `systemd-xdg-autostart-generator` shouldn't use the
generator's `PATH`, or because systemd should pass along the `PATH` it
got from PAM), so for now, we can keep it simple and fix it by
replicating what `/etc/pam/environment` does in `/etc/environment.d`.
114 lines
3.5 KiB
Nix
114 lines
3.5 KiB
Nix
# This module defines a system-wide environment that will be
|
|
# initialised by pam_env (that is, not only in shells).
|
|
{
|
|
config,
|
|
lib,
|
|
options,
|
|
pkgs,
|
|
...
|
|
}:
|
|
let
|
|
|
|
cfg = config.environment;
|
|
|
|
suffixedVariables = lib.flip lib.mapAttrs cfg.profileRelativeSessionVariables (
|
|
envVar: suffixes:
|
|
lib.flip lib.concatMap cfg.profiles (profile: map (suffix: "${profile}${suffix}") suffixes)
|
|
);
|
|
|
|
combinedSessionVars = lib.zipAttrsWith (n: lib.concatLists) [
|
|
# Make sure security wrappers are prioritized without polluting
|
|
# shell environments with an extra entry. Sessions which depend on
|
|
# pam for its environment will otherwise have eg. broken sudo. In
|
|
# particular Gnome Shell sometimes fails to source a proper
|
|
# environment from a shell.
|
|
{ PATH = [ config.security.wrapperDir ]; }
|
|
|
|
(lib.mapAttrs (n: lib.toList) cfg.sessionVariables)
|
|
suffixedVariables
|
|
];
|
|
|
|
in
|
|
|
|
{
|
|
|
|
options = {
|
|
|
|
environment.sessionVariables = lib.mkOption {
|
|
default = { };
|
|
description = ''
|
|
A set of environment variables used in the global environment.
|
|
These variables will be set by PAM early in the login process.
|
|
|
|
The value of each session variable can be either a string or a
|
|
list of strings. The latter is concatenated, interspersed with
|
|
colon characters.
|
|
|
|
Setting a variable to `null` does nothing. You can override a
|
|
variable set by another module to `null` to unset it.
|
|
|
|
Note, due to limitations in the PAM format values may not
|
|
contain the `"` character.
|
|
|
|
Also, these variables are merged into
|
|
[](#opt-environment.variables) and it is
|
|
therefore not possible to use PAM style variables such as
|
|
`@{HOME}`.
|
|
'';
|
|
inherit (options.environment.variables) type apply;
|
|
};
|
|
|
|
environment.profileRelativeSessionVariables = lib.mkOption {
|
|
type = lib.types.attrsOf (lib.types.listOf lib.types.str);
|
|
example = {
|
|
PATH = [ "/bin" ];
|
|
MANPATH = [
|
|
"/man"
|
|
"/share/man"
|
|
];
|
|
};
|
|
description = ''
|
|
Attribute set of environment variable used in the global
|
|
environment. These variables will be set by PAM early in the
|
|
login process.
|
|
|
|
Variable substitution is available as described in
|
|
{manpage}`pam_env.conf(5)`.
|
|
|
|
Each attribute maps to a list of relative paths. Each relative
|
|
path is appended to the each profile of
|
|
{option}`environment.profiles` to form the content of
|
|
the corresponding environment variable.
|
|
|
|
Also, these variables are merged into
|
|
[](#opt-environment.profileRelativeEnvVars) and it is
|
|
therefore not possible to use PAM style variables such as
|
|
`@{HOME}`.
|
|
'';
|
|
};
|
|
|
|
};
|
|
|
|
config = {
|
|
environment.etc."environment.d/50-systemd-path.conf".text = ''
|
|
PATH="${lib.concatStringsSep ":" combinedSessionVars.PATH}"
|
|
'';
|
|
environment.etc."pam/environment".text =
|
|
let
|
|
# We're trying to use the same syntax for PAM variables and env variables.
|
|
# That means we need to map the env variables that people might use to their
|
|
# equivalent PAM variable.
|
|
replaceEnvVars = lib.replaceStrings [ "$HOME" "$USER" ] [ "@{HOME}" "@{PAM_USER}" ];
|
|
|
|
pamVariable =
|
|
n: v: ''${n} DEFAULT="${lib.concatStringsSep ":" (map replaceEnvVars (lib.toList v))}"'';
|
|
|
|
pamVariables = lib.concatStringsSep "\n" (lib.mapAttrsToList pamVariable combinedSessionVars);
|
|
in
|
|
''
|
|
${pamVariables}
|
|
'';
|
|
};
|
|
|
|
}
|