80 lines
2.3 KiB
Nix
80 lines
2.3 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
mylib,
|
|
username,
|
|
...
|
|
}:
|
|
with lib;
|
|
with mylib.modules; let
|
|
cfg = config.modules.polkit;
|
|
in {
|
|
options.modules.polkit = import ./options.nix {inherit lib mylib;};
|
|
|
|
config = mkIf cfg.enable {
|
|
security.polkit.enable = true;
|
|
|
|
# NOTE: Polkit stuff:
|
|
# - subject.active: The subject is part of the currently active session
|
|
# - subject.local: The subject is spawned from a local seat/session
|
|
# - subject.user == ${username}: Only unlock stuff for the user defined by this config
|
|
security.polkit.extraConfig = let
|
|
# Services that should always get a rule
|
|
always-services = [];
|
|
|
|
mkServicePredicate = service: "action.lookup(\"unit\") == \"${service}\"";
|
|
servicePredicates =
|
|
(cfg.allowedSystemServices ++ always-services)
|
|
|> builtins.map mkServicePredicate
|
|
|> builtins.concatStringsSep " ||\n";
|
|
|
|
# Actions that should always be allowed
|
|
always-actions = [];
|
|
|
|
mkActionPredicate = action: "action.id == \"${action}\"";
|
|
actionPredicates =
|
|
(cfg.allowedActions ++ always-actions)
|
|
|> builtins.map mkActionPredicate
|
|
|> builtins.concatStringsSep " ||\n";
|
|
in
|
|
lib.concatStrings [
|
|
''
|
|
// NixOS PolKit Rules Start
|
|
''
|
|
|
|
# Only add this ruleset if (len servicePredicates) > 0
|
|
(lib.optionalString (builtins.lessThan 0 (builtins.length cfg.allowedSystemServices)) ''
|
|
polkit.addRule(function(action, subject) {
|
|
if (
|
|
action.id == "org.freedesktop.systemd1.manage-units" &&
|
|
subject.user == "${username}" &&
|
|
subject.local &&
|
|
subject.active &&
|
|
(${servicePredicates})
|
|
) {
|
|
return polkit.Result.YES;
|
|
}
|
|
});
|
|
'')
|
|
|
|
# Only add this ruleset if (len actionPredicates) > 0
|
|
(lib.optionalString (builtins.lessThan 0 (builtins.length cfg.allowedActions)) ''
|
|
polkit.addRule(function(action, subject) {
|
|
if (
|
|
subject.user == "${username}" &&
|
|
subject.local &&
|
|
subject.active &&
|
|
(${actionPredicates})
|
|
) {
|
|
return polkit.Result.YES;
|
|
}
|
|
});
|
|
'')
|
|
|
|
''
|
|
// NixOS PolKit Rules End
|
|
''
|
|
];
|
|
};
|
|
}
|