29 lines
751 B
Nix
29 lines
751 B
Nix
|
{
|
|||
|
|
executor,
|
|||
|
|
enable,
|
|||
|
|
controlGroup,
|
|||
|
|
}:
|
|||
|
|
{ config, lib, ... }:
|
|||
|
|
{
|
|||
|
|
config = lib.mkIf enable {
|
|||
|
|
assertions = [
|
|||
|
|
{
|
|||
|
|
assertion = lib.all (user: user.uid == null || user.uid < 610000 || user.uid >= 610064) (
|
|||
|
|
builtins.attrValues config.users.users
|
|||
|
|
);
|
|||
|
|
message = "UIDs 610000–610063 are reserved for restricted engine identities.";
|
|||
|
|
}
|
|||
|
|
];
|
|||
|
|
systemd.tmpfiles.rules = [
|
|||
|
|
"d /run/quixos-restricted-engines 0711 quixos-graph ${controlGroup} -"
|
|||
|
|
];
|
|||
|
|
security.wrappers.quixos-restricted-engine = {
|
|||
|
|
source = "${executor.identityLauncher}/bin/quixos-restricted-engine";
|
|||
|
|
owner = "root";
|
|||
|
|
group = controlGroup;
|
|||
|
|
permissions = "u+rx,g+rx,o-rwx";
|
|||
|
|
setuid = true;
|
|||
|
|
};
|
|||
|
|
};
|
|||
|
|
}
|