88 lines
2.3 KiB
Nix
88 lines
2.3 KiB
Nix
{ config, pkgs, ... }:
|
|
|
|
with import <stockholm/lib>;
|
|
{
|
|
options.lass.xjail = mkOption {
|
|
type = types.attrsOf (types.submodule ({ config, ...}: {
|
|
options = {
|
|
user = mkOption {
|
|
type = types.string;
|
|
default = "nobody";
|
|
};
|
|
groups = mkOption {
|
|
type = types.listOf types.str;
|
|
default = [];
|
|
};
|
|
name = mkOption {
|
|
type = types.string;
|
|
default = config._module.args.name;
|
|
};
|
|
display = mkOption {
|
|
type = types.string;
|
|
default = toString (genid_signed config._module.args.name);
|
|
};
|
|
script = mkOption {
|
|
type = types.path;
|
|
default = pkgs.writeScript "echo_lol" "echo lol";
|
|
};
|
|
from = mkOption {
|
|
type = types.string;
|
|
default = "lass";
|
|
};
|
|
};
|
|
}));
|
|
default = {};
|
|
};
|
|
|
|
options.lass.xjail-bins = mkOption {
|
|
type = types.attrsOf types.path;
|
|
};
|
|
|
|
# implementation
|
|
config = {
|
|
|
|
users.users = mapAttrs' (_: cfg:
|
|
nameValuePair cfg.name {
|
|
uid = genid cfg.name;
|
|
home = "/home/${cfg.name}";
|
|
useDefaultShell = true;
|
|
createHome = true;
|
|
extraGroups = cfg.groups;
|
|
}
|
|
) config.lass.xjail;
|
|
|
|
users.groups = mapAttrs' (_: cfg:
|
|
nameValuePair cfg.name {
|
|
members = [
|
|
cfg.name
|
|
cfg.from
|
|
];
|
|
}
|
|
) config.lass.xjail;
|
|
|
|
security.sudo.extraConfig = (concatStringsSep "\n" (mapAttrsToList (_: cfg:
|
|
# TODO allow just the right script with sudo
|
|
"${cfg.from} ALL=(${cfg.name}) NOPASSWD: ALL"
|
|
) config.lass.xjail));
|
|
|
|
lass.xjail-bins = mapAttrs' (name: cfg:
|
|
let
|
|
sudo-wrapper = pkgs.writeScript name ''
|
|
/var/run/wrappers/bin/sudo -u ${cfg.name} -i ${cfg.script} "$@"
|
|
'';
|
|
in nameValuePair name (pkgs.writeScriptBin cfg.name ''
|
|
export NDISPLAY=${cfg.display}
|
|
DISPLAY=:$NDISPLAY ${pkgs.xorg.xrandr}/bin/xrandr
|
|
if test $? -eq 0; then
|
|
echo xephyr already running
|
|
export DISPLAY=:$NDISPLAY
|
|
${sudo-wrapper} "$@"
|
|
else
|
|
echo xephyr not running
|
|
DROP_TO_USER=${cfg.name} ${pkgs.xephyrify}/bin/xephyrify ${sudo-wrapper} "$@"
|
|
fi
|
|
'')
|
|
) config.lass.xjail;
|
|
};
|
|
}
|