diff options
| author | rnhmjoj <rnhmjoj@inventati.org> | 2021-05-02 15:47:13 +0200 |
|---|---|---|
| committer | rnhmjoj <rnhmjoj@inventati.org> | 2021-05-03 09:53:50 +0200 |
| commit | 9ea6c1979cb02644c8df8ad4262e9cc0dc024c09 (patch) | |
| tree | 7fd95d53c3a5cdd970aac22671d899cc3687c8b5 | |
| parent | aacbc7385c5757a20b9b3ec172e58e7bc1039257 (diff) | |
| download | nixpkgs-9ea6c1979cb02644c8df8ad4262e9cc0dc024c09.tar nixpkgs-9ea6c1979cb02644c8df8ad4262e9cc0dc024c09.tar.gz nixpkgs-9ea6c1979cb02644c8df8ad4262e9cc0dc024c09.tar.bz2 nixpkgs-9ea6c1979cb02644c8df8ad4262e9cc0dc024c09.tar.lz nixpkgs-9ea6c1979cb02644c8df8ad4262e9cc0dc024c09.tar.xz nixpkgs-9ea6c1979cb02644c8df8ad4262e9cc0dc024c09.tar.zst nixpkgs-9ea6c1979cb02644c8df8ad4262e9cc0dc024c09.zip | |
nixos/searx: set settings.yml permissions using umask
This should solve a leakage of secrets as suggested in #121293
| -rw-r--r-- | nixos/modules/services/networking/searx.nix | 14 |
1 files changed, 8 insertions, 6 deletions
diff --git a/nixos/modules/services/networking/searx.nix b/nixos/modules/services/networking/searx.nix index a515e4a3dc3..04f7d7e31f4 100644 --- a/nixos/modules/services/networking/searx.nix +++ b/nixos/modules/services/networking/searx.nix @@ -4,23 +4,25 @@ with lib; let runDir = "/run/searx"; + cfg = config.services.searx; + settingsFile = pkgs.writeText "settings.yml" + (builtins.toJSON cfg.settings); + generateConfig = '' cd ${runDir} # write NixOS settings as JSON - cat <<'EOF' > settings.yml - ${builtins.toJSON cfg.settings} - EOF + ( + umask 077 + cp --no-preserve=mode ${settingsFile} settings.yml + ) # substitute environment variables env -0 | while IFS='=' read -r -d ''' n v; do sed "s#@$n@#$v#g" -i settings.yml done - - # set strict permissions - chmod 400 settings.yml ''; settingType = with types; (oneOf |