infra/localhost
1
0
Fork 0
Code Releases Activity

remove fhs env

Browse Source
This commit is contained in:
dump_stack()
2023-02-13 09:14:21 +00:00
parent b2b6e49d98
commit e87b9d1d5f
1 changed files with 1 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
security.nix
View File

@@ -1,10 +1,6 @@
{ config, pkgs, ... }: { config, pkgs, ... }:
let {
fhs = pkgs.writeShellScriptBin "fhs"
("${pkgs.docker}/bin/docker run -v /home/user:/home/user -v /nix:/nix "+
"-e \"HOST_PWD=$PWD\" -it fhs");
in {
security.allowUserNamespaces = true; security.allowUserNamespaces = true;
security.allowSimultaneousMultithreading = true; security.allowSimultaneousMultithreading = true;
security.lockKernelModules = false; security.lockKernelModules = false;
@@ -45,7 +41,6 @@ in {
extraConfig = '' extraConfig = ''
%wheel ALL=(ALL:ALL) NOPASSWD: ${pkgs.light}/bin/light %wheel ALL=(ALL:ALL) NOPASSWD: ${pkgs.light}/bin/light
%wheel ALL=(captive) NOPASSWD: ${pkgs.firefox}/bin/firefox %wheel ALL=(captive) NOPASSWD: ${pkgs.firefox}/bin/firefox
%wheel ALL=(root) NOPASSWD: ${fhs}/bin/fhs
%wheel ALL=(out-of-tree) NOPASSWD: ${pkgs.out-of-tree}/bin/out-of-tree %wheel ALL=(out-of-tree) NOPASSWD: ${pkgs.out-of-tree}/bin/out-of-tree
''; '';
}; };
@@ -60,12 +55,7 @@ in {
users.groups.out-of-tree = {}; users.groups.out-of-tree = {};
environment.systemPackages = with pkgs; [ environment.systemPackages = with pkgs; [
(writeShellScriptBin "fhs" "sudo ${fhs}/bin/fhs")
(writeShellScriptBin "captive" "sudo -H -u captive ${pkgs.firefox}/bin/firefox") (writeShellScriptBin "captive" "sudo -H -u captive ${pkgs.firefox}/bin/firefox")
(writeShellScriptBin "fhs-ptrace"
("sudo ${pkgs.docker}/bin/docker run -v /home/user:/home/user " +
"--cap-add=SYS_PTRACE --security-opt seccomp=unconfined" +
" -e \"HOST_PWD=$PWD\" -v /nix=/nix -it fhs"))
(writeShellScriptBin "out-of-tree" (writeShellScriptBin "out-of-tree"
"sudo -H -u out-of-tree ${pkgs.out-of-tree}/bin/out-of-tree $@") "sudo -H -u out-of-tree ${pkgs.out-of-tree}/bin/out-of-tree $@")
]; ];