51 lines
1.4 KiB
Nix
51 lines
1.4 KiB
Nix
{
|
||
executor,
|
||
enable,
|
||
controlGroup,
|
||
authorityUser ? "quixos-graph",
|
||
engineDirectory ? "/run/quixos-restricted-engines",
|
||
firstUid ? 610000,
|
||
identityCount ? 64,
|
||
wrapperName ? "quixos-restricted-engine",
|
||
}:
|
||
{ config, lib, ... }:
|
||
{
|
||
config = lib.mkIf enable {
|
||
assertions = [
|
||
{
|
||
assertion = lib.all (
|
||
user: user.uid == null || user.uid < firstUid || user.uid >= firstUid + identityCount
|
||
) (builtins.attrValues config.users.users);
|
||
message = "UIDs ${toString firstUid}–${
|
||
toString (firstUid + identityCount - 1)
|
||
} are reserved for restricted engine identities.";
|
||
}
|
||
{
|
||
assertion = lib.all (
|
||
group: group.gid == null || group.gid < firstUid || group.gid >= firstUid + identityCount
|
||
) (builtins.attrValues config.users.groups);
|
||
message = "Restricted engine GIDs must not overlap host groups.";
|
||
}
|
||
];
|
||
systemd.tmpfiles.rules = [
|
||
"d ${engineDirectory} 0711 ${authorityUser} ${controlGroup} -"
|
||
];
|
||
security.wrappers.${wrapperName} = {
|
||
source = "${
|
||
executor.mkIdentityLauncher {
|
||
inherit
|
||
authorityUser
|
||
engineDirectory
|
||
firstUid
|
||
identityCount
|
||
;
|
||
}
|
||
}/bin/quixos-restricted-engine";
|
||
owner = "root";
|
||
group = controlGroup;
|
||
permissions = "u+rx,g+rx,o-rwx";
|
||
setuid = true;
|
||
};
|
||
};
|
||
}
|