diff options
| author | rnhmjoj <rnhmjoj@inventati.org> | 2021-09-12 18:53:48 +0200 |
|---|---|---|
| committer | rnhmjoj <rnhmjoj@inventati.org> | 2021-09-13 13:48:13 +0200 |
| commit | fedd7cd6901646cb7e2a94a148d300f7b632d7e0 (patch) | |
| tree | 14b7af8318d75536656849335e20c51cdfdf3447 /nixos/modules/services/scheduling | |
| parent | 8f76a6eefcfa0c9904e0749f04b27090527ce09f (diff) | |
nixos: explicitely set security.wrappers ownership
This is slightly more verbose and inconvenient, but it forces you to think about what the wrapper ownership and permissions will be.
Diffstat (limited to 'nixos/modules/services/scheduling')
| -rw-r--r-- | nixos/modules/services/scheduling/cron.nix | 7 | ||||
| -rw-r--r-- | nixos/modules/services/scheduling/fcron.nix | 1 |
2 files changed, 7 insertions, 1 deletions
diff --git a/nixos/modules/services/scheduling/cron.nix b/nixos/modules/services/scheduling/cron.nix index 3bc31832946b9..c28956b3bfebe 100644 --- a/nixos/modules/services/scheduling/cron.nix +++ b/nixos/modules/services/scheduling/cron.nix @@ -93,7 +93,12 @@ in { services.cron.enable = mkDefault (allFiles != []); } (mkIf (config.services.cron.enable) { - security.wrappers.crontab.source = "${cronNixosPkg}/bin/crontab"; + security.wrappers.crontab = + { setuid = true; + owner = "root"; + group = "root"; + source = "${cronNixosPkg}/bin/crontab"; + }; environment.systemPackages = [ cronNixosPkg ]; environment.etc.crontab = { source = pkgs.runCommand "crontabs" { inherit allFiles; preferLocalBuild = true; } diff --git a/nixos/modules/services/scheduling/fcron.nix b/nixos/modules/services/scheduling/fcron.nix index 4f5d99ddf38f5..acaa995f73950 100644 --- a/nixos/modules/services/scheduling/fcron.nix +++ b/nixos/modules/services/scheduling/fcron.nix @@ -142,6 +142,7 @@ in source = "${pkgs.fcron}/bin/fcronsighup"; owner = "root"; group = "fcron"; + setuid = true; }; }; systemd.services.fcron = { |