29 lines
751 B
Nix
29 lines
751 B
Nix
{
|
||
executor,
|
||
enable,
|
||
controlGroup,
|
||
}:
|
||
{ config, lib, ... }:
|
||
{
|
||
config = lib.mkIf enable {
|
||
assertions = [
|
||
{
|
||
assertion = lib.all (user: user.uid == null || user.uid < 610000 || user.uid >= 610064) (
|
||
builtins.attrValues config.users.users
|
||
);
|
||
message = "UIDs 610000–610063 are reserved for restricted engine identities.";
|
||
}
|
||
];
|
||
systemd.tmpfiles.rules = [
|
||
"d /run/quixos-restricted-engines 0711 quixos-graph ${controlGroup} -"
|
||
];
|
||
security.wrappers.quixos-restricted-engine = {
|
||
source = "${executor.identityLauncher}/bin/quixos-restricted-engine";
|
||
owner = "root";
|
||
group = controlGroup;
|
||
permissions = "u+rx,g+rx,o-rwx";
|
||
setuid = true;
|
||
};
|
||
};
|
||
}
|