blob: 8dba0aca64337593a69311736c23213aa33862e4 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
|
# D-Bus configuration and system bus daemon.
{ config, lib, pkgs, ... }:
let
cfg = config.services.dbus;
homeDir = "/run/dbus";
configDir = pkgs.makeDBusConf {
inherit (cfg) apparmor;
suidHelper = "${config.security.wrapperDir}/dbus-daemon-launch-helper";
serviceDirectories = cfg.packages;
};
inherit (lib) mkOption mkEnableOption mkIf mkMerge types;
in
{
options = {
boot.initrd.systemd.dbus = {
enable = mkEnableOption "dbus in stage 1";
};
services.dbus = {
enable = mkOption {
type = types.bool;
default = false;
internal = true;
description = ''
Whether to start the D-Bus message bus daemon, which is
required by many other system services and applications.
'';
};
implementation = mkOption {
type = types.enum [ "dbus" "broker" ];
default = "dbus";
description = ''
The implementation to use for the message bus defined by the D-Bus specification.
Can be either the classic dbus daemon or dbus-broker, which aims to provide high
performance and reliability, while keeping compatibility to the D-Bus
reference implementation.
'';
};
packages = mkOption {
type = types.listOf types.path;
default = [ ];
description = ''
Packages whose D-Bus configuration files should be included in
the configuration of the D-Bus system-wide or session-wide
message bus. Specifically, files in the following directories
will be included into their respective DBus configuration paths:
{file}`«pkg»/etc/dbus-1/system.d`
{file}`«pkg»/share/dbus-1/system.d`
{file}`«pkg»/share/dbus-1/system-services`
{file}`«pkg»/etc/dbus-1/session.d`
{file}`«pkg»/share/dbus-1/session.d`
{file}`«pkg»/share/dbus-1/services`
'';
};
apparmor = mkOption {
type = types.enum [ "enabled" "disabled" "required" ];
description = ''
AppArmor mode for dbus.
`enabled` enables mediation when it's
supported in the kernel, `disabled`
always disables AppArmor even with kernel support, and
`required` fails when AppArmor was not found
in the kernel.
'';
default = "disabled";
};
};
};
config = mkIf cfg.enable (mkMerge [
{
environment.etc."dbus-1".source = configDir;
environment.pathsToLink = [
"/etc/dbus-1"
"/share/dbus-1"
];
users.users.messagebus = {
uid = config.ids.uids.messagebus;
description = "D-Bus system message bus daemon user";
home = homeDir;
homeMode = "0755";
group = "messagebus";
};
users.groups.messagebus.gid = config.ids.gids.messagebus;
# Install dbus for dbus tools even when using dbus-broker
environment.systemPackages = [
pkgs.dbus
];
# You still need the dbus reference implementation installed to use dbus-broker
systemd.packages = [
pkgs.dbus
];
services.dbus.packages = [
pkgs.dbus
config.system.path
];
systemd.user.sockets.dbus.wantedBy = [
"sockets.target"
];
}
(mkIf config.boot.initrd.systemd.dbus.enable {
boot.initrd.systemd = {
users.messagebus = { };
groups.messagebus = { };
contents."/etc/dbus-1".source = pkgs.makeDBusConf {
inherit (cfg) apparmor;
suidHelper = "/bin/false";
serviceDirectories = [ pkgs.dbus ];
};
packages = [ pkgs.dbus ];
storePaths = [ "${pkgs.dbus}/bin/dbus-daemon" ];
targets.sockets.wants = [ "dbus.socket" ];
};
})
(mkIf (cfg.implementation == "dbus") {
security.wrappers.dbus-daemon-launch-helper = {
source = "${pkgs.dbus}/libexec/dbus-daemon-launch-helper";
owner = "root";
group = "messagebus";
setuid = true;
setgid = false;
permissions = "u+rx,g+rx,o-rx";
};
systemd.services.dbus = {
# Don't restart dbus-daemon. Bad things tend to happen if we do.
reloadIfChanged = true;
restartTriggers = [
configDir
];
environment = {
LD_LIBRARY_PATH = config.system.nssModules.path;
};
};
systemd.user.services.dbus = {
# Don't restart dbus-daemon. Bad things tend to happen if we do.
reloadIfChanged = true;
restartTriggers = [
configDir
];
};
})
(mkIf (cfg.implementation == "broker") {
environment.systemPackages = [
pkgs.dbus-broker
];
systemd.packages = [
pkgs.dbus-broker
];
# Just to be sure we don't restart through the unit alias
systemd.services.dbus.reloadIfChanged = true;
systemd.user.services.dbus.reloadIfChanged = true;
# NixOS Systemd Module doesn't respect 'Install'
# https://github.com/NixOS/nixpkgs/issues/108643
systemd.services.dbus-broker = {
aliases = [
"dbus.service"
];
unitConfig = {
# We get errors when reloading the dbus-broker service
# if /tmp got remounted after this service started
RequiresMountsFor = [ "/tmp" ];
};
# Don't restart dbus. Bad things tend to happen if we do.
reloadIfChanged = true;
restartTriggers = [
configDir
];
environment = {
LD_LIBRARY_PATH = config.system.nssModules.path;
};
};
systemd.user.services.dbus-broker = {
aliases = [
"dbus.service"
];
# Don't restart dbus. Bad things tend to happen if we do.
reloadIfChanged = true;
restartTriggers = [
configDir
];
};
})
]);
}
|
