diff options
author | emilylange <git@emilylange.de> | 2024-03-10 18:39:43 +0100 |
---|---|---|
committer | github-actions[bot] <github-actions[bot]@users.noreply.github.com> | 2024-03-11 16:35:05 +0000 |
commit | 6db2609ff6394d8a95e806b295d45242009e2d9b (patch) | |
tree | 5093a0eb416ffbadaa2545490d4709d512f2207e /nixos/modules | |
parent | 186c928ab27db1e04dcacf2267384024a16e6f8e (diff) |
nixos/lldap: set service `UMask=0027` and `StateDirectoryMode=0750`
While `/var/lib/lldap` isn't technically accessible by unprivileged users thanks to `DynamicUser=true`, a user might prefer and change it to `DynamicUser=false`. There is currently also a PR open that intends to make `DynamicUser` configurable via module option. As such, `jwt_secret_file`, if bootstrapped by the service start procedure, might be rendered world-readable due to its permissions (`0644/-rw-r--r--`) defaulting to the service's umask (`022`) and `/var/lib/lldap` to `0755/drwxr-xr-x` due to `StateDirectoryMode=0755`. This would usually be fixed by using `(umask 027; openssl ...)` instead of just `openssl ...`. However, it was found that another file (`users.db`), this time bootstrapped by `lldap` itself, also had insufficient permissions (`0644/-rw-r--r--`) inherited by the global umask and would be left world-readable as well. Due to this, we instead change the service's to `027`. And to lower the impact for already bootstrapped files on existing instances like `users.db`, set `StateDirectoryMode=0750`. (cherry picked from commit 3a1e06218adc58a5a160efe11a814edb2c298b04)
Diffstat (limited to 'nixos/modules')
-rw-r--r-- | nixos/modules/services/databases/lldap.nix | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/nixos/modules/services/databases/lldap.nix b/nixos/modules/services/databases/lldap.nix index b418dd01deacc..164325247cd8d 100644 --- a/nixos/modules/services/databases/lldap.nix +++ b/nixos/modules/services/databases/lldap.nix @@ -122,7 +122,9 @@ in ''; serviceConfig = { StateDirectory = "lldap"; + StateDirectoryMode = "0750"; WorkingDirectory = "%S/lldap"; + UMask = "0027"; User = "lldap"; Group = "lldap"; DynamicUser = true; |