Commit 20d26490 authored by nicoo's avatar nicoo Committed by github-actions[bot]
Browse files

nixos/sudo-rs: Move support for `pam_ssh_agent_auth(8)` to PAM's NixOS module 

Similar to delroth's suggestion in #262790.

(cherry picked from commit bcc2d123)
parent 9f4b1c30

nixos/modules/security/pam.nix

+8 −5
Original line number Diff line number Diff line
@@ -943,6 +943,11 @@ let 
      value.source = pkgs.writeText "${name}.pam" service.text;

    };



  optionalSudoConfigForSSHAgentAuth = optionalString config.security.pam.enableSSHAgentAuth ''

    # Keep SSH_AUTH_SOCK so that pam_ssh_agent_auth.so can do its magic.

    Defaults env_keep+=SSH_AUTH_SOCK

  '';



in



{
@@ -1532,9 +1537,7 @@ in 
        concatLines

      ]);



    security.sudo.extraConfig = optionalString config.security.pam.enableSSHAgentAuth ''

      # Keep SSH_AUTH_SOCK so that pam_ssh_agent_auth.so can do its magic.

      Defaults env_keep+=SSH_AUTH_SOCK

    '';

    security.sudo.extraConfig = optionalSudoConfigForSSHAgentAuth;

    security.sudo-rs.extraConfig = optionalSudoConfigForSSHAgentAuth;

  };

}

nixos/modules/security/sudo-rs.nix

+0 −4
Original line number Diff line number Diff line
@@ -220,10 +220,6 @@ in 
        # Don't edit this file. Set the NixOS options ‘security.sudo-rs.configFile’

        # or ‘security.sudo-rs.extraRules’ instead.

      ''

      (optionalString enableSSHAgentAuth ''

        # Keep SSH_AUTH_SOCK so that pam_ssh_agent_auth.so can do its magic.

        Defaults env_keep+=SSH_AUTH_SOCK

      '')

      (pipe cfg.extraRules [

        (filter (rule: length rule.commands != 0))

        (map (rule: [