diff options
| -rw-r--r-- | krebs/3modules/default.nix | 1 | ||||
| -rw-r--r-- | krebs/3modules/permown.nix | 74 | ||||
| -rw-r--r-- | lib/types.nix | 19 |
3 files changed, 88 insertions, 6 deletions
diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix index 567c077eb..4d40f3856 100644 --- a/krebs/3modules/default.nix +++ b/krebs/3modules/default.nix @@ -39,6 +39,7 @@ let ./nixpkgs.nix ./on-failure.nix ./os-release.nix + ./permown.nix ./per-user.nix ./power-action.nix ./Reaktor.nix diff --git a/krebs/3modules/permown.nix b/krebs/3modules/permown.nix new file mode 100644 index 000000000..7a86013e1 --- /dev/null +++ b/krebs/3modules/permown.nix @@ -0,0 +1,74 @@ +with import <stockholm/lib>; +{ config, pkgs, ... }: { + + options.krebs.permown = mkOption { + default = []; + type = types.listOf (types.submodule { + options = { + directory-mode = mkOption { + default = "=rwx"; + type = types.str; # TODO + }; + file-mode = mkOption { + default = "=rw"; + type = types.str; # TODO + }; + group = mkOption { + apply = x: if x == null then "" else x; + default = null; + type = types.nullOr types.groupname; + }; + owner = mkOption { + type = types.username; + }; + path = mkOption { + type = types.absolute-pathname; + }; + umask = mkOption { + default = "0027"; + type = types.file-mode; + }; + }; + }); + }; + + config.systemd.services = genAttrs' config.krebs.permown (plan: { + name = "permown.${replaceStrings ["/"] ["_"] plan.path}"; + value = { + environment = { + DIR_MODE = plan.directory-mode; + FILE_MODE = plan.file-mode; + OWNER_GROUP = "${plan.owner}:${plan.group}"; + ROOT_PATH = plan.path; + }; + path = [ + pkgs.coreutils + pkgs.findutils + pkgs.inotifyTools + ]; + serviceConfig = { + ExecStart = pkgs.writeDash "permown" '' + set -efu + + find "$ROOT_PATH" -exec chown "$OWNER_GROUP" {} + + find "$ROOT_PATH" -type d -exec chmod "$DIR_MODE" {} + + find "$ROOT_PATH" -type f -exec chmod "$FILE_MODE" {} + + + inotifywait -mrq -e CREATE --format %w%f "$ROOT_PATH" | + while read -r path; do + if test -d "$path"; then + exec "$0" "$@" + fi + chown "$OWNER_GROUP" "$path" + chmod "$FILE_MODE" "$path" + done + ''; + Restart = "always"; + RestartSec = 10; + UMask = plan.umask; + }; + wantedBy = [ "multi-user.target" ]; + }; + }); + +} diff --git a/lib/types.nix b/lib/types.nix index 23919af38..ffae8c7bc 100644 --- a/lib/types.nix +++ b/lib/types.nix @@ -542,21 +542,28 @@ rec { merge = mergeOneOption; }; - # POSIX.1‐2013, 3.278 Portable Filename Character Set + # POSIX.1‐2017, 3.190 Group Name + groupname = mkOptionType { + name = "POSIX group name"; + check = filename.check; + merge = mergeOneOption; + }; + + # POSIX.1‐2017, 3.281 Portable Filename filename = mkOptionType { - name = "POSIX filename"; + name = "POSIX portable filename"; check = test "[0-9A-Za-z._][0-9A-Za-z._-]*"; merge = mergeOneOption; }; - # POSIX.1‐2013, 3.2 Absolute Pathname + # POSIX.1‐2017, 3.2 Absolute Pathname absolute-pathname = mkOptionType { name = "POSIX absolute pathname"; check = x: isString x && substring 0 1 x == "/" && pathname.check x; merge = mergeOneOption; }; - # POSIX.1‐2013, 3.267 Pathname + # POSIX.1-2017, 3.271 Pathname pathname = mkOptionType { name = "POSIX pathname"; check = x: @@ -570,9 +577,9 @@ rec { merge = mergeOneOption; }; - # POSIX.1-2013, 3.431 User Name + # POSIX.1-2017, 3.216 Login Name username = mkOptionType { - name = "POSIX username"; + name = "POSIX login name"; check = filename.check; merge = mergeOneOption; }; |