diff options
author | Alyssa Ross <hi@alyssa.is> | 2021-04-20 11:53:24 +0000 |
---|---|---|
committer | Alyssa Ross <hi@alyssa.is> | 2021-04-22 13:18:38 +0000 |
commit | 9e400a8b93cda6280be403c936e77cc006a28468 (patch) | |
tree | b1697e3c464a516b243720addb8036c65fc42edf /nixos | |
parent | d0a6d3b834e227046ea8a230e85984571a841e74 (diff) | |
download | nixpkgs-9e400a8b93cda6280be403c936e77cc006a28468.tar nixpkgs-9e400a8b93cda6280be403c936e77cc006a28468.tar.gz nixpkgs-9e400a8b93cda6280be403c936e77cc006a28468.tar.bz2 nixpkgs-9e400a8b93cda6280be403c936e77cc006a28468.tar.lz nixpkgs-9e400a8b93cda6280be403c936e77cc006a28468.tar.xz nixpkgs-9e400a8b93cda6280be403c936e77cc006a28468.tar.zst nixpkgs-9e400a8b93cda6280be403c936e77cc006a28468.zip |
nixos/users-groups: check format of passwd entries
Things will get quite broken if an /etc/passwd entry contains a colon (which terminates a field), or a newline (which terminates a record). I know because I just accidentally made a user whose home directory path contained a newline! So let's make sure that can't happen.
Diffstat (limited to 'nixos')
-rw-r--r-- | nixos/modules/config/users-groups.nix | 22 |
1 files changed, 14 insertions, 8 deletions
diff --git a/nixos/modules/config/users-groups.nix b/nixos/modules/config/users-groups.nix index 2b6a61e9a80..567a8b6f3b9 100644 --- a/nixos/modules/config/users-groups.nix +++ b/nixos/modules/config/users-groups.nix @@ -6,6 +6,12 @@ let ids = config.ids; cfg = config.users; + isPasswdCompatible = str: !(hasInfix ":" str || hasInfix "\n" str); + passwdEntry = type: lib.types.addCheck type isPasswdCompatible // { + name = "passwdEntry ${type.name}"; + description = "${type.description}, not containing newlines or colons"; + }; + # Check whether a password hash will allow login. allowsLogin = hash: hash == "" # login without password @@ -54,7 +60,7 @@ let options = { name = mkOption { - type = types.str; + type = passwdEntry types.str; apply = x: assert (builtins.stringLength x < 32 || abort "Username '${x}' is longer than 31 characters which is not allowed!"); x; description = '' The name of the user account. If undefined, the name of the @@ -63,7 +69,7 @@ let }; description = mkOption { - type = types.str; + type = passwdEntry types.str; default = ""; example = "Alice Q. User"; description = '' @@ -128,7 +134,7 @@ let }; home = mkOption { - type = types.path; + type = passwdEntry types.path; default = "/var/empty"; description = "The user's home directory."; }; @@ -157,7 +163,7 @@ let }; shell = mkOption { - type = types.nullOr (types.either types.shellPackage types.path); + type = types.nullOr (types.either types.shellPackage (passwdEntry types.path)); default = pkgs.shadow; defaultText = "pkgs.shadow"; example = literalExample "pkgs.bashInteractive"; @@ -217,7 +223,7 @@ let }; hashedPassword = mkOption { - type = with types; nullOr str; + type = with types; nullOr (passwdEntry str); default = null; description = '' Specifies the hashed password for the user. @@ -251,7 +257,7 @@ let }; initialHashedPassword = mkOption { - type = with types; nullOr str; + type = with types; nullOr (passwdEntry str); default = null; description = '' Specifies the initial hashed password for the user, i.e. the @@ -323,7 +329,7 @@ let options = { name = mkOption { - type = types.str; + type = passwdEntry types.str; description = '' The name of the group. If undefined, the name of the attribute set will be used. @@ -340,7 +346,7 @@ let }; members = mkOption { - type = with types; listOf str; + type = with types; listOf (passwdEntry str); default = []; description = '' The user names of the group members, added to the |