mirrors/nix-darwin
1
0
Fork 0
mirror of https://github.com/LnL7/nix-darwin.git synced 2024-12-14 11:57:34 +00:00
Code Activity

Merge pull request #1108 from Enzime/users

Browse source 
Use `sysadminctl` instead of `dscl`
This commit is contained in:
Michael Hoang 2024-10-24 01:33:54 +11:00 committed by GitHub
commit d99f9ae9fd
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
7 changed files with 127 additions and 90 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
modules/networking/default.nix
View file

@ -1,4 +1,4 @@
{ config, lib, pkgs, ... }:
{ config, lib, ... }:
with lib;
@ -8,15 +8,14 @@ let
hostnameRegEx = ''^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9])$'';
emptyList = lst: if lst != [] then lst else ["empty"];
quoteStrings = concatMapStringsSep " " (str: "'${str}'");
setNetworkServices = optionalString (cfg.knownNetworkServices != []) ''
networkservices=$(networksetup -listallnetworkservices)
${concatMapStringsSep "\n" (srv: ''
case "$networkservices" in
*'${srv}'*)
networksetup -setdnsservers '${srv}' ${quoteStrings (emptyList cfg.dns)}
networksetup -setsearchdomains '${srv}' ${quoteStrings (emptyList cfg.search)}
*${lib.escapeShellArg srv}*)
networksetup -setdnsservers ${lib.escapeShellArgs ([ srv ] ++ (emptyList cfg.dns))}
networksetup -setsearchdomains ${lib.escapeShellArgs ([ srv ] ++ (emptyList cfg.search))}
;;
esac
'') cfg.knownNetworkServices}

92
modules/users/default.nix
View file

@ -8,7 +8,6 @@ let
group = import ./group.nix;
user = import ./user.nix;
toArguments = concatMapStringsSep " " (v: "'${v}'");
toGID = v: { "${toString v.gid}" = v.name; };
toUID = v: { "${toString v.uid}" = v.name; };
@ -96,45 +95,49 @@ in
system.activationScripts.groups.text = mkIf (cfg.knownGroups != []) ''
echo "setting up groups..." >&2
${concatMapStringsSep "\n" (v: ''
${concatMapStringsSep "\n" (v: let
dsclGroup = lib.escapeShellArg "/Groups/${v.name}";
in ''
${optionalString cfg.forceRecreate ''
g=$(dscl . -read '/Groups/${v.name}' PrimaryGroupID 2> /dev/null) || true
g=$(dscl . -read ${dsclGroup} PrimaryGroupID 2> /dev/null) || true
g=''${g#PrimaryGroupID: }
if [[ "$g" -eq ${toString v.gid} ]]; then
echo "deleting group ${v.name}..." >&2
dscl . -delete '/Groups/${v.name}' 2> /dev/null
dscl . -delete ${dsclGroup} 2> /dev/null
else
echo "warning: existing group '${v.name}' has unexpected gid $g, skipping..." >&2
fi
''}
g=$(dscl . -read '/Groups/${v.name}' PrimaryGroupID 2> /dev/null) || true
g=$(dscl . -read ${dsclGroup} PrimaryGroupID 2> /dev/null) || true
g=''${g#PrimaryGroupID: }
if [ -z "$g" ]; then
echo "creating group ${v.name}..." >&2
dscl . -create '/Groups/${v.name}' PrimaryGroupID ${toString v.gid}
dscl . -create '/Groups/${v.name}' RealName '${v.description}'
dscl . -create ${dsclGroup} PrimaryGroupID ${toString v.gid}
dscl . -create ${dsclGroup} RealName ${lib.escapeShellArg v.description}
g=${toString v.gid}
fi
if [ "$g" -eq ${toString v.gid} ]; then
g=$(dscl . -read '/Groups/${v.name}' GroupMembership 2> /dev/null) || true
g=$(dscl . -read ${dsclGroup} GroupMembership 2> /dev/null) || true
if [ "$g" != 'GroupMembership: ${concatStringsSep " " v.members}' ]; then
echo "updating group members ${v.name}..." >&2
dscl . -create '/Groups/${v.name}' GroupMembership ${toArguments v.members}
dscl . -create ${dsclGroup} GroupMembership ${lib.escapeShellArgs v.members}
fi
else
echo "warning: existing group '${v.name}' has unexpected gid $g, skipping..." >&2
fi
'') createdGroups}
${concatMapStringsSep "\n" (name: ''
g=$(dscl . -read '/Groups/${name}' PrimaryGroupID 2> /dev/null) || true
${concatMapStringsSep "\n" (name: let
dsclGroup = lib.escapeShellArg "/Groups/${name}";
in ''
g=$(dscl . -read ${dsclGroup} PrimaryGroupID 2> /dev/null) || true
g=''${g#PrimaryGroupID: }
if [ -n "$g" ]; then
if [ "$g" -gt 501 ]; then
echo "deleting group ${name}..." >&2
dscl . -delete '/Groups/${name}' 2> /dev/null
dscl . -delete ${dsclGroup} 2> /dev/null
else
echo "warning: existing group '${name}' has unexpected gid $g, skipping..." >&2
fi
@ -145,44 +148,77 @@ in
system.activationScripts.users.text = mkIf (cfg.knownUsers != []) ''
echo "setting up users..." >&2
${concatMapStringsSep "\n" (v: ''
deleteUser() {
fullDiskAccess=false
if cat /Library/Preferences/com.apple.TimeMachine.plist > /dev/null 2>&1; then
fullDiskAccess=true
fi
if [[ "$fullDiskAccess" != true ]]; then
printf >&2 '\e[1;31merror: users cannot be deleted without Full Disk Access, aborting activation\e[0m\n'
printf >&2 'The user %s could not be deleted as `darwin-rebuild` was not executed with Full Disk Access.' "$1"
printf >&2 'Opening "Privacy & Security" > "Full Disk Access" in System Settings\n'
printf >&2 '\n'
# This command will fail if run as root and System Settings is already running
# even if System Settings was launched by root.
sudo -u $SUDO_USER open "x-apple.systempreferences:com.apple.preference.security?Privacy_AllFiles"
if [[ -n "$SSH_CONNECTION" ]]; then
printf >&2 'Please enable Full Disk Access for programs over SSH by flipping\n'
printf >&2 'the switch for `sshd-keygen-wrapper`.\n'
else
printf >&2 'Please enable Full Disk Access for your terminal emulator by flipping\n'
printf >&2 'the switch in System Settings.\n'
fi
exit 1
fi
sysadminctl -deleteUser "$1" 2> /dev/null
if id -u "$1" > /dev/null 2>&1; then
printf >&2 '\e[1;31merror: failed to delete user %s, aborting activation\e[0m\n', "$1"
exit 1
fi
}
${concatMapStringsSep "\n" (v: let
name = lib.escapeShellArg v.name;
dsclUser = lib.escapeShellArg "/Users/${v.name}";
in ''
${optionalString cfg.forceRecreate ''
u=$(dscl . -read '/Users/${v.name}' UniqueID 2> /dev/null) || true
u=''${u#UniqueID: }
u=$(id -u ${name} 2> /dev/null) || true
if [[ "$u" -eq ${toString v.uid} ]]; then
echo "deleting user ${v.name}..." >&2
dscl . -delete '/Users/${v.name}' 2> /dev/null
deleteUser ${name}
else
echo "warning: existing user '${v.name}' has unexpected uid $u, skipping..." >&2
fi
''}
u=$(dscl . -read '/Users/${v.name}' UniqueID 2> /dev/null) || true
u=''${u#UniqueID: }
u=$(id -u ${name} 2> /dev/null) || true
if [[ -n "$u" && "$u" -ne "${toString v.uid}" ]]; then
echo "warning: existing user '${v.name}' has unexpected uid $u, skipping..." >&2
else
if [ -z "$u" ]; then
echo "creating user ${v.name}..." >&2
dscl . -create '/Users/${v.name}' UniqueID ${toString v.uid}
dscl . -create '/Users/${v.name}' PrimaryGroupID ${toString v.gid}
dscl . -create '/Users/${v.name}' IsHidden ${if v.isHidden then "1" else "0"}
dscl . -create '/Users/${v.name}' RealName '${v.description}'
dscl . -create '/Users/${v.name}' NFSHomeDirectory '${v.home}'
${optionalString v.createHome "createhomedir -cu '${v.name}'"}
sysadminctl -addUser ${lib.escapeShellArgs ([ v.name "-UID" v.uid "-GID" v.gid ] ++ (lib.optionals (v.description != null) [ "-fullName" v.description ]) ++ [ "-home" v.home "-shell" (shellPath v.shell) ])}
dscl . -create ${dsclUser} IsHidden ${if v.isHidden then "1" else "0"}
${optionalString v.createHome "createhomedir -cu ${name}"}
fi
# Always set the shell path, in case it was updated
dscl . -create '/Users/${v.name}' UserShell ${lib.escapeShellArg (shellPath v.shell)}
dscl . -create ${dsclUser} UserShell ${lib.escapeShellArg (shellPath v.shell)}
fi
'') createdUsers}
${concatMapStringsSep "\n" (name: ''
u=$(dscl . -read '/Users/${name}' UniqueID 2> /dev/null) || true
u=''${u#UniqueID: }
u=$(id -u ${lib.escapeShellArg name} 2> /dev/null) || true
if [ -n "$u" ]; then
if [ "$u" -gt 501 ]; then
echo "deleting user ${name}..." >&2
dscl . -delete '/Users/${name}' 2> /dev/null
deleteUser ${lib.escapeShellArg name}
else
echo "warning: existing user '${name}' has unexpected uid $u, skipping..." >&2
fi

13
modules/users/group.nix
View file

@ -1,11 +1,12 @@
{ name, lib, ... }:
with lib;
{
options = {
options = let
inherit (lib) mkOption types;
in {
name = mkOption {
type = types.str;
default = name;
description = ''
The group's name. If undefined, the name of the attribute set
will be used.
@ -29,10 +30,4 @@ with lib;
description = "The group's description.";
};
};
config = {
name = mkDefault name;
};
}

25
modules/users/user.nix
View file

@ -1,11 +1,12 @@
{ name, lib, ... }:
with lib;
{
options = {
options = let
inherit (lib) literalExpression mkOption types;
in {
name = mkOption {
type = types.str;
type = types.nonEmptyStr;
default = name;
description = ''
The name of the user account. If undefined, the name of the
attribute set will be used.
@ -13,12 +14,18 @@ with lib;
};
description = mkOption {
type = types.str;
default = "";
type = types.nullOr types.nonEmptyStr;
default = null;
example = "Alice Q. User";
description = ''
A short description of the user account, typically the
user's full name.
This defaults to `null` which means, on creation, `sysadminctl`
will pick the description which is usually always {option}`name`.
Using an empty name is not supported and breaks macOS like
making the user not appear in Directory Utility.
'';
};
@ -75,10 +82,4 @@ with lib;
'';
};
};
config = {
name = mkDefault name;
};
}

6
pkgs/nix-tools/darwin-rebuild.sh
View file

@ -18,8 +18,12 @@ showSyntax() {
}
sudo() {
# REMOVEME when support for macOS 10.13 is dropped
# macOS 10.13 does not support sudo --preserve-env so we make this conditional
if command sudo --help | grep -- --preserve-env= >/dev/null; then
command sudo -H --preserve-env=PATH env "$@"
# We use `env` before our command to ensure the preserved PATH gets checked
# when trying to resolve the command to execute
command sudo -H --preserve-env=PATH --preserve-env=SSH_CONNECTION env "$@"
else
command sudo -H "$@"
fi

10
tests/networking-networkservices.nix
View file

@ -1,4 +1,4 @@
{ config, pkgs, ... }:
{ config, lib, ... }:
{
networking.knownNetworkServices = [ "Wi-Fi" "Thunderbolt Ethernet" ];
@ -6,10 +6,10 @@
test = ''
echo checking dns settings in /activate >&2
grep "networksetup -setdnsservers 'Wi-Fi' '8.8.8.8' '8.8.4.4'" ${config.out}/activate
grep "networksetup -setdnsservers 'Thunderbolt Ethernet' '8.8.8.8' '8.8.4.4'" ${config.out}/activate
grep "networksetup -setdnsservers ${lib.escapeShellArgs [ "Wi-Fi" "8.8.8.8" "8.8.4.4" ]}" ${config.out}/activate
grep "networksetup -setdnsservers ${lib.escapeShellArgs [ "Thunderbolt Ethernet" "8.8.8.8" "8.8.4.4" ]}" ${config.out}/activate
echo checking empty searchdomain settings in /activate >&2
grep "networksetup -setsearchdomains 'Wi-Fi' 'empty'" ${config.out}/activate
grep "networksetup -setsearchdomains 'Thunderbolt Ethernet' 'empty'" ${config.out}/activate
grep "networksetup -setsearchdomains ${lib.escapeShellArgs [ "Wi-Fi" "empty" ]}" ${config.out}/activate
grep "networksetup -setsearchdomains ${lib.escapeShellArgs [ "Thunderbolt Ethernet" "empty" ]}" ${config.out}/activate
'';
}

62
tests/users-groups.nix
View file

@ -22,42 +22,44 @@
users.users."unknown.user".uid = 42002;
test = ''
echo "checking group creation in /activate" >&2
grep "dscl . -create '/Groups/foo' PrimaryGroupID 42000" ${config.out}/activate
grep "dscl . -create '/Groups/foo' RealName 'Foo group'" ${config.out}/activate
grep "dscl . -create '/Groups/created.group' PrimaryGroupID 42001" ${config.out}/activate
grep -qv "dscl . -delete '/Groups/created.group'" ${config.out}/activate
set -v
echo "checking group deletion in /activate" >&2
grep "dscl . -delete '/Groups/deleted.group'" ${config.out}/activate
grep -qv "dscl . -create '/Groups/deleted.group'" ${config.out}/activate
# checking group creation in /activate
grep "dscl . -create ${lib.escapeShellArg "/Groups/foo"} PrimaryGroupID 42000" ${config.out}/activate
grep "dscl . -create ${lib.escapeShellArg "/Groups/foo"} RealName ${lib.escapeShellArg "Foo group"}" ${config.out}/activate
grep "dscl . -create ${lib.escapeShellArg "/Groups/created.group"} PrimaryGroupID 42001" ${config.out}/activate
grep -qv "dscl . -delete ${lib.escapeShellArg "/Groups/created.group"}" ${config.out}/activate
# checking group deletion in /activate
grep "dscl . -delete ${lib.escapeShellArg "/Groups/deleted.group"}" ${config.out}/activate
grep -qv "dscl . -create ${lib.escapeShellArg "/Groups/deleted.group"}" ${config.out}/activate
echo "checking group membership in /activate" >&2
grep "dscl . -create '/Groups/foo' GroupMembership 'admin' 'foo'" ${config.out}/activate
grep "dscl . -create '/Groups/created.group' GroupMembership" ${config.out}/activate
grep "dscl . -create ${lib.escapeShellArg "/Groups/foo"} GroupMembership ${lib.escapeShellArgs [ "admin" "foo" ]}" ${config.out}/activate
grep "dscl . -create ${lib.escapeShellArg "/Groups/created.group"} GroupMembership" ${config.out}/activate
echo "checking unknown group in /activate" >&2
grep -qv "dscl . -create '/Groups/unknown.group'" ${config.out}/activate
grep -qv "dscl . -delete '/Groups/unknown.group'" ${config.out}/activate
# checking unknown group in /activate
grep -qv "dscl . -create ${lib.escapeShellArg "/Groups/unknown.group"}" ${config.out}/activate
grep -qv "dscl . -delete ${lib.escapeShellArg "/Groups/unknown.group"}" ${config.out}/activate
echo "checking user creation in /activate" >&2
grep "dscl . -create '/Users/foo' UniqueID 42000" ${config.out}/activate
grep "dscl . -create '/Users/foo' PrimaryGroupID 42000" ${config.out}/activate
grep "dscl . -create '/Users/foo' IsHidden 0" ${config.out}/activate
grep "dscl . -create '/Users/foo' RealName 'Foo user'" ${config.out}/activate
grep "dscl . -create '/Users/foo' NFSHomeDirectory '/Users/foo'" ${config.out}/activate
grep "dscl . -create '/Users/foo' UserShell ${lib.escapeShellArg "/run/current-system/sw/bin/bash"}" ${config.out}/activate
grep "dscl . -create '/Users/created.user' UniqueID 42001" ${config.out}/activate
grep "dscl . -create '/Users/created.user' UserShell ${lib.escapeShellArg "/sbin/nologin"}" ${config.out}/activate
grep "createhomedir -cu 'foo'" ${config.out}/activate
grep -qv "dscl . -delete '/Groups/created.user'" ${config.out}/activate
# checking user creation in /activate
grep "sysadminctl -addUser ${lib.escapeShellArgs [ "foo" "-UID" 42000 "-GID" 42000 "-fullName" "Foo user" "-home" "/Users/foo" "-shell" "/run/current-system/sw/bin/bash" ]}" ${config.out}/activate
grep "createhomedir -cu ${lib.escapeShellArg "foo"}" ${config.out}/activate
grep "sysadminctl -addUser ${lib.escapeShellArgs [ "created.user" "-UID" 42001 ]} .* ${lib.escapeShellArgs [ "-shell" "/sbin/nologin" ]}" ${config.out}/activate
grep -qv "deleteUser ${lib.escapeShellArg "created.user"}" ${config.out}/activate
grep -qv "deleteUser ${lib.escapeShellArg "created.user"}" ${config.out}/activate
echo "checking user deletion in /activate" >&2
grep "dscl . -delete '/Users/deleted.user'" ${config.out}/activate
grep -qv "dscl . -create '/Users/deleted.user'" ${config.out}/activate
# checking user properties always get updated in /activate
grep "dscl . -create ${lib.escapeShellArg "/Users/foo"} UserShell ${lib.escapeShellArg "/run/current-system/sw/bin/bash"}" ${config.out}/activate
echo "checking unknown user in /activate" >&2
grep -qv "dscl . -create '/Users/unknown.user'" ${config.out}/activate
grep -qv "dscl . -delete '/Users/unknown.user'" ${config.out}/activate
# checking user deletion in /activate
grep "deleteUser ${lib.escapeShellArg "deleted.user"}" ${config.out}/activate
grep -qv "sysadminctl -addUser ${lib.escapeShellArg "deleted.user"}" ${config.out}/activate
# checking unknown user in /activate
grep -qv "sysadminctl -addUser ${lib.escapeShellArg "unknown.user"}" ${config.out}/activate
grep -qv "deleteUser ${lib.escapeShellArg "unknown.user"}" ${config.out}/activate
set +v
'';
}