mirrors/nix-darwin
1
0
Fork 0
mirror of https://github.com/LnL7/nix-darwin.git synced 2024-12-14 11:57:34 +00:00
Code Activity

Merge pull request #1117 from Enzime/push-owuqqzqkrnpn

Browse source 
users: prevent deleting the user calling `darwin-rebuild`
This commit is contained in:
Michael Hoang 2024-10-24 18:51:17 +11:00 committed by GitHub
commit a5d770b257
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 42 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

51
modules/users/default.nix
View file

@ -148,7 +148,7 @@ in
system.activationScripts.users.text = mkIf (cfg.knownUsers != []) ''
echo "setting up users..." >&2
deleteUser() {
requireFDA() {
fullDiskAccess=false
if cat /Library/Preferences/com.apple.TimeMachine.plist > /dev/null 2>&1; then
@ -156,9 +156,9 @@ in
fi
if [[ "$fullDiskAccess" != true ]]; then
printf >&2 '\e[1;31merror: users cannot be deleted without Full Disk Access, aborting activation\e[0m\n'
printf >&2 'The user %s could not be deleted as `darwin-rebuild` was not executed with Full Disk Access.' "$1"
printf >&2 '\e[1;31merror: users cannot be %s without Full Disk Access, aborting activation\e[0m\n' "$2"
printf >&2 'The user %s could not be %s as `darwin-rebuild` was not executed with Full Disk Access.\n' "$1" "$2"
printf >&2 '\n'
printf >&2 'Opening "Privacy & Security" > "Full Disk Access" in System Settings\n'
printf >&2 '\n'
# This command will fail if run as root and System Settings is already running
@ -175,10 +175,26 @@ in
exit 1
fi
}
sysadminctl -deleteUser "$1" 2> /dev/null
deleteUser() {
# FIXME: add `darwin.primaryUser` as well
if [[ "$1" == "$SUDO_USER" ]]; then
printf >&2 '\e[1;31merror: refusing to delete the user calling `darwin-rebuild` (%s), aborting activation\e[0m\n', "$1"
exit 1
elif [[ "$1" == "root" ]]; then
printf >&2 '\e[1;31merror: refusing to delete `root`, aborting activation\e[0m\n', "$1"
exit 1
fi
if id -u "$1" > /dev/null 2>&1; then
requireFDA "$1" deleted
dscl . -delete "/Users/$1" 2> /dev/null
# `dscl . -delete` should exit with a non-zero exit code when there's an error, but we'll leave
# this code here just in case and for when we switch to `sysadminctl -deleteUser`
# We need to check as `sysadminctl -deleteUser` still exits with exit code 0 when there's an error
if id "$1" &> /dev/null; then
printf >&2 '\e[1;31merror: failed to delete user %s, aborting activation\e[0m\n', "$1"
exit 1
fi
@ -191,8 +207,15 @@ in
${optionalString cfg.forceRecreate ''
u=$(id -u ${name} 2> /dev/null) || true
if [[ "$u" -eq ${toString v.uid} ]]; then
echo "deleting user ${v.name}..." >&2
deleteUser ${name}
# TODO: add `darwin.primaryUser` as well
if [[ ${name} == "$SUDO_USER" ]]; then
printf >&2 'warning: not going to recreate the user calling `darwin-rebuild` (%s), skipping...\n' "$SUDO_USER"
elif [[ ${name} == "root" ]]; then
printf >&2 'warning: not going to recreate root, skipping...\n'
else
printf >&2 'deleting user ${v.name}...\n'
deleteUser ${name}
fi
else
echo "warning: existing user '${v.name}' has unexpected uid $u, skipping..." >&2
fi
@ -204,7 +227,17 @@ in
else
if [ -z "$u" ]; then
echo "creating user ${v.name}..." >&2
sysadminctl -addUser ${lib.escapeShellArgs ([ v.name "-UID" v.uid "-GID" v.gid ] ++ (lib.optionals (v.description != null) [ "-fullName" v.description ]) ++ [ "-home" v.home "-shell" (shellPath v.shell) ])}
requireFDA ${name} "created"
sysadminctl -addUser ${lib.escapeShellArgs ([ v.name "-UID" v.uid "-GID" v.gid ] ++ (lib.optionals (v.description != null) [ "-fullName" v.description ]) ++ [ "-home" v.home "-shell" (shellPath v.shell) ])} 2> /dev/null
# We need to check as `sysadminctl -addUser` still exits with exit code 0 when there's an error
if ! id ${name} &> /dev/null; then
printf >&2 '\e[1;31merror: failed to create user %s, aborting activation\e[0m\n' ${name}
exit 1
fi
dscl . -create ${dsclUser} IsHidden ${if v.isHidden then "1" else "0"}
${optionalString v.createHome "createhomedir -cu ${name}"}
fi