diff options
| author | Joachim Fasting <joachifm@fastmail.fm> | 2015-04-03 13:02:27 +0200 |
|---|---|---|
| committer | Joachim Fasting <joachifm@fastmail.fm> | 2015-04-03 13:45:57 +0200 |
| commit | 3e847d512d9ab1c27f07b3a2bb531a3a324ad4fc (patch) | |
| tree | f69c8dc764f14b1828b15daf9377e68451faaa0b /nixos | |
| parent | 80283570848734d8473b6434141ce8f4406720e7 (diff) | |
| download | nixpkgs-3e847d512d9ab1c27f07b3a2bb531a3a324ad4fc.tar nixpkgs-3e847d512d9ab1c27f07b3a2bb531a3a324ad4fc.tar.gz nixpkgs-3e847d512d9ab1c27f07b3a2bb531a3a324ad4fc.tar.bz2 nixpkgs-3e847d512d9ab1c27f07b3a2bb531a3a324ad4fc.tar.lz nixpkgs-3e847d512d9ab1c27f07b3a2bb531a3a324ad4fc.tar.xz nixpkgs-3e847d512d9ab1c27f07b3a2bb531a3a324ad4fc.tar.zst nixpkgs-3e847d512d9ab1c27f07b3a2bb531a3a324ad4fc.zip | |
grsecurity module: configure gradm iff RBAC is enabled
Diffstat (limited to 'nixos')
| -rw-r--r-- | nixos/modules/security/grsecurity.nix | 25 |
1 files changed, 12 insertions, 13 deletions
diff --git a/nixos/modules/security/grsecurity.nix b/nixos/modules/security/grsecurity.nix index 8cd40093348..108eed638d2 100644 --- a/nixos/modules/security/grsecurity.nix +++ b/nixos/modules/security/grsecurity.nix @@ -313,22 +313,21 @@ in # }; # }; - system.activationScripts.grsec = - '' - mkdir -p /etc/grsec - if [ ! -f /etc/grsec/learn_config ]; then - cp ${pkgs.gradm}/etc/grsec/learn_config /etc/grsec - fi - if [ ! -f /etc/grsec/policy ]; then - cp ${pkgs.gradm}/etc/grsec/policy /etc/grsec - fi - chmod -R 0600 /etc/grsec - ''; + system.activationScripts = lib.optionalAttrs (!cfg.config.disableRBAC) { grsec = '' + mkdir -p /etc/grsec + if [ ! -f /etc/grsec/learn_config ]; then + cp ${pkgs.gradm}/etc/grsec/learn_config /etc/grsec + fi + if [ ! -f /etc/grsec/policy ]; then + cp ${pkgs.gradm}/etc/grsec/policy /etc/grsec + fi + chmod -R 0600 /etc/grsec + ''; }; # Enable AppArmor, gradm udev rules, and utilities security.apparmor.enable = true; boot.kernelPackages = customGrsecPkg; - services.udev.packages = [ pkgs.gradm ]; - environment.systemPackages = [ pkgs.gradm pkgs.paxctl pkgs.pax-utils ]; + services.udev.packages = lib.optional (!cfg.config.disableRBAC) pkgs.gradm; + environment.systemPackages = [ pkgs.paxctl pkgs.pax-utils ] ++ lib.optional (!cfg.config.disableRBAC) pkgs.gradm; }; } |