e598fdf229
DBus seems to resolve user IDs directly via glibc, circumventing nscd. In more advanced setups this leads to user's coming from LDAP or SSSD not being resolved by the dbus system bus daemon. The effect for such users is, that all access to the system bus (e.g. busctl or nmcli) is denied. Adding the respective NSS modules to the service's environment solves the issue the same way it does for nscd.
118 lines
3.0 KiB
Nix
118 lines
3.0 KiB
Nix
# D-Bus configuration and system bus daemon.
|
|
|
|
{ config, lib, pkgs, ... }:
|
|
|
|
with lib;
|
|
|
|
let
|
|
|
|
cfg = config.services.dbus;
|
|
|
|
homeDir = "/run/dbus";
|
|
|
|
configDir = pkgs.makeDBusConf {
|
|
suidHelper = "${config.security.wrapperDir}/dbus-daemon-launch-helper";
|
|
serviceDirectories = cfg.packages;
|
|
};
|
|
|
|
in
|
|
|
|
{
|
|
|
|
###### interface
|
|
|
|
options = {
|
|
|
|
services.dbus = {
|
|
|
|
enable = mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
internal = true;
|
|
description = ''
|
|
Whether to start the D-Bus message bus daemon, which is
|
|
required by many other system services and applications.
|
|
'';
|
|
};
|
|
|
|
packages = mkOption {
|
|
type = types.listOf types.path;
|
|
default = [ ];
|
|
description = ''
|
|
Packages whose D-Bus configuration files should be included in
|
|
the configuration of the D-Bus system-wide or session-wide
|
|
message bus. Specifically, files in the following directories
|
|
will be included into their respective DBus configuration paths:
|
|
<filename><replaceable>pkg</replaceable>/etc/dbus-1/system.d</filename>
|
|
<filename><replaceable>pkg</replaceable>/share/dbus-1/system-services</filename>
|
|
<filename><replaceable>pkg</replaceable>/etc/dbus-1/session.d</filename>
|
|
<filename><replaceable>pkg</replaceable>/share/dbus-1/services</filename>
|
|
'';
|
|
};
|
|
|
|
socketActivated = mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
description = ''
|
|
Make the user instance socket activated.
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
|
|
###### implementation
|
|
|
|
config = mkIf cfg.enable {
|
|
|
|
environment.systemPackages = [ pkgs.dbus.daemon pkgs.dbus ];
|
|
|
|
environment.etc = singleton
|
|
{ source = configDir;
|
|
target = "dbus-1";
|
|
};
|
|
|
|
users.extraUsers.messagebus = {
|
|
uid = config.ids.uids.messagebus;
|
|
description = "D-Bus system message bus daemon user";
|
|
home = homeDir;
|
|
group = "messagebus";
|
|
};
|
|
|
|
users.extraGroups.messagebus.gid = config.ids.gids.messagebus;
|
|
|
|
systemd.packages = [ pkgs.dbus.daemon ];
|
|
|
|
security.wrappers.dbus-daemon-launch-helper = {
|
|
source = "${pkgs.dbus.daemon}/libexec/dbus-daemon-launch-helper";
|
|
owner = "root";
|
|
group = "messagebus";
|
|
setuid = true;
|
|
setgid = false;
|
|
permissions = "u+rx,g+rx,o-rx";
|
|
};
|
|
|
|
services.dbus.packages = [
|
|
pkgs.dbus.out
|
|
config.system.path
|
|
];
|
|
|
|
systemd.services.dbus = {
|
|
# Don't restart dbus-daemon. Bad things tend to happen if we do.
|
|
reloadIfChanged = true;
|
|
restartTriggers = [ configDir ];
|
|
environment = { LD_LIBRARY_PATH = config.system.nssModules.path; };
|
|
};
|
|
|
|
systemd.user = {
|
|
services.dbus = {
|
|
# Don't restart dbus-daemon. Bad things tend to happen if we do.
|
|
reloadIfChanged = true;
|
|
restartTriggers = [ configDir ];
|
|
};
|
|
sockets.dbus.wantedBy = mkIf cfg.socketActivated [ "sockets.target" ];
|
|
};
|
|
|
|
environment.pathsToLink = [ "/etc/dbus-1" "/share/dbus-1" ];
|
|
};
|
|
}
|