nixos/modules/programs/ecryptfs.nix


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

{ config, lib, pkgs, ... }:

let
  cfg = config.programs.ecryptfs;

in {
  options.programs.ecryptfs = {
    enable = lib.mkEnableOption "ecryptfs setuid mount wrappers";
  };

  config = lib.mkIf cfg.enable {
    security.wrappers = {

      "mount.ecryptfs_private" = {
        setuid = true;
        owner = "root";
        group = "root";
        source = "${lib.getBin pkgs.ecryptfs}/bin/mount.ecryptfs_private";
      };
      "umount.ecryptfs_private" = {
        setuid = true;
        owner = "root";
        group = "root";
        source = "${lib.getBin pkgs.ecryptfs}/bin/umount.ecryptfs_private";
      };

    };
  };
}