mirrors/nix-darwin
1
0
Fork 0
mirror of https://github.com/LnL7/nix-darwin.git synced 2024-12-14 11:57:34 +00:00
Code Activity

users: ensure Full Disk Access is granted before trying to delete users

Browse source
This commit is contained in:
Michael Hoang 2024-10-22 22:38:17 +11:00
parent 9ee30f2534
commit 8c02940d70
3 changed files with 43 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

40
modules/users/default.nix
View file

@ -148,6 +148,42 @@ in
system.activationScripts.users.text = mkIf (cfg.knownUsers != []) ''
echo "setting up users..." >&2
deleteUser() {
fullDiskAccess=false
if cat /Library/Preferences/com.apple.TimeMachine.plist > /dev/null 2>&1; then
fullDiskAccess=true
fi
if [[ "$fullDiskAccess" != true ]]; then
printf >&2 '\e[1;31merror: users cannot be deleted without Full Disk Access, aborting activation\e[0m\n'
printf >&2 'The user %s could not be deleted as `darwin-rebuild` was not executed with Full Disk Access.' "$1"
printf >&2 'Opening "Privacy & Security" > "Full Disk Access" in System Settings\n'
printf >&2 '\n'
# This command will fail if run as root and System Settings is already running
# even if System Settings was launched by root.
sudo -u $SUDO_USER open "x-apple.systempreferences:com.apple.preference.security?Privacy_AllFiles"
if [[ -n "$SSH_CONNECTION" ]]; then
printf >&2 'Please enable Full Disk Access for programs over SSH by flipping\n'
printf >&2 'the switch for `sshd-keygen-wrapper`.\n'
else
printf >&2 'Please enable Full Disk Access for your terminal emulator by flipping\n'
printf >&2 'the switch in System Settings.\n'
fi
exit 1
fi
sysadminctl -deleteUser "$1" 2> /dev/null
if id -u "$1" > /dev/null 2>&1; then
printf >&2 '\e[1;31merror: failed to delete user %s, aborting activation\e[0m\n', "$1"
exit 1
fi
}
${concatMapStringsSep "\n" (v: let
name = lib.escapeShellArg v.name;
dsclUser = lib.escapeShellArg "/Users/${v.name}";
@ -156,7 +192,7 @@ in
u=$(id -u ${name} 2> /dev/null) || true
if [[ "$u" -eq ${toString v.uid} ]]; then
echo "deleting user ${v.name}..." >&2
sysadminctl -deleteUser ${name} 2> /dev/null
deleteUser ${name}
else
echo "warning: existing user '${v.name}' has unexpected uid $u, skipping..." >&2
fi
@ -182,7 +218,7 @@ in
if [ -n "$u" ]; then
if [ "$u" -gt 501 ]; then
echo "deleting user ${name}..." >&2
sysadminctl -deleteUser ${lib.escapeShellArg name} 2> /dev/null
deleteUser ${lib.escapeShellArg name}
else
echo "warning: existing user '${name}' has unexpected uid $u, skipping..." >&2
fi

2
pkgs/nix-tools/darwin-rebuild.sh
View file

@ -23,7 +23,7 @@ sudo() {
if command sudo --help | grep -- --preserve-env= >/dev/null; then
# We use `env` before our command to ensure the preserved PATH gets checked
# when trying to resolve the command to execute
command sudo -H --preserve-env=PATH env "$@"
command sudo -H --preserve-env=PATH --preserve-env=SSH_CONNECTION env "$@"
else
command sudo -H "$@"
fi

8
tests/users-groups.nix
View file

@ -46,19 +46,19 @@
grep "sysadminctl -addUser ${lib.escapeShellArgs [ "foo" "-UID" 42000 "-GID" 42000 "-fullName" "Foo user" "-home" "/Users/foo" "-shell" "/run/current-system/sw/bin/bash" ]}" ${config.out}/activate
grep "createhomedir -cu ${lib.escapeShellArg "foo"}" ${config.out}/activate
grep "sysadminctl -addUser ${lib.escapeShellArgs [ "created.user" "-UID" 42001 ]} .* ${lib.escapeShellArgs [ "-shell" "/sbin/nologin" ]}" ${config.out}/activate
grep -qv "sysadminctl -deleteUser ${lib.escapeShellArg "created.user"}" ${config.out}/activate
grep -qv "sysadminctl -deleteUser ${lib.escapeShellArg "created.user"}" ${config.out}/activate
grep -qv "deleteUser ${lib.escapeShellArg "created.user"}" ${config.out}/activate
grep -qv "deleteUser ${lib.escapeShellArg "created.user"}" ${config.out}/activate
# checking user properties always get updated in /activate
grep "dscl . -create ${lib.escapeShellArg "/Users/foo"} UserShell ${lib.escapeShellArg "/run/current-system/sw/bin/bash"}" ${config.out}/activate
# checking user deletion in /activate
grep "sysadminctl -deleteUser ${lib.escapeShellArg "deleted.user"}" ${config.out}/activate
grep "deleteUser ${lib.escapeShellArg "deleted.user"}" ${config.out}/activate
grep -qv "sysadminctl -addUser ${lib.escapeShellArg "deleted.user"}" ${config.out}/activate
# checking unknown user in /activate
grep -qv "sysadminctl -addUser ${lib.escapeShellArg "unknown.user"}" ${config.out}/activate
grep -qv "sysadminctl -deleteUser ${lib.escapeShellArg "unknown.user"}" ${config.out}/activate
grep -qv "deleteUser ${lib.escapeShellArg "unknown.user"}" ${config.out}/activate
set +v
'';