From fedd7cd6901646cb7e2a94a148d300f7b632d7e0 Mon Sep 17 00:00:00 2001 From: rnhmjoj Date: Sun, 12 Sep 2021 18:53:48 +0200 Subject: nixos: explicitely set security.wrappers ownership This is slightly more verbose and inconvenient, but it forces you to think about what the wrapper ownership and permissions will be. --- nixos/modules/tasks/network-interfaces.nix | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) (limited to 'nixos/modules/tasks/network-interfaces.nix') diff --git a/nixos/modules/tasks/network-interfaces.nix b/nixos/modules/tasks/network-interfaces.nix index 8f9c66b0157..d934e3cf022 100644 --- a/nixos/modules/tasks/network-interfaces.nix +++ b/nixos/modules/tasks/network-interfaces.nix @@ -1133,11 +1133,16 @@ in # kernel because we need the ambient capability security.wrappers = if (versionAtLeast (getVersion config.boot.kernelPackages.kernel) "4.3") then { ping = { - source = "${pkgs.iputils.out}/bin/ping"; + owner = "root"; + group = "root"; capabilities = "cap_net_raw+p"; + source = "${pkgs.iputils.out}/bin/ping"; }; } else { - ping.source = "${pkgs.iputils.out}/bin/ping"; + setuid = true; + owner = "root"; + group = "root"; + source = "${pkgs.iputils.out}/bin/ping"; }; security.apparmor.policies."bin.ping".profile = lib.mkIf config.security.apparmor.policies."bin.ping".enable (lib.mkAfter '' /run/wrappers/bin/ping { -- cgit 1.4.1