Unverified Commit 577b32b0 authored by rnhmjoj's avatar rnhmjoj
Browse files

treewide: remove nobody/nogroup from examples 

The nobody/nogroup pair of should only ever be used by NFS to map remote
uid/guids that are missing locally. Every other use is an abuse and
generally a security concern.

Specifically, they're NOT some special user/group that can be used to
run programs without giving them any privileges. In fact, the opposite
is true: the more programs you run as nobody/nogroup the more valuable
files and resources become accessible to "nobody" and consequently
exposed to a potentially compromised program.

This removes mentions of nobody/nogroup from documentation and examples.
parent fcf23489

nixos/modules/hardware/cpu/x86-msr.nix

+2 −2
Original line number Diff line number Diff line
@@ -45,13 +45,13 @@ in 
      owner = mkOption {

        type = str;

        default = "root";

        example = "nobody";

        example = "alice";

        description = "Owner ${set}";

      };

      group = mkOption {

        type = str;

        default = defaultGroup;

        example = "nobody";

        example = "users";

        description = "Group ${set}";

      };

      mode = mkOption {

nixos/modules/services/networking/nftables.nix

+2 −1
Original line number Diff line number Diff line
@@ -111,7 +111,8 @@ in 
      type = lib.types.lines;

      default = "";

      example = lib.literalExpression ''

        sed 's/skgid meadow/skgid nogroup/g' -i ruleset.conf

        # replace users/groups that don't exist in the test

        sed 's/skgid meadow/skgid root/g' -i ruleset.conf

      '';

      description = ''

        This script gets run before the ruleset is checked. It can be used to

nixos/modules/services/networking/ocserv.nix

+2 −2
Original line number Diff line number Diff line
@@ -34,8 +34,8 @@ in 
        auth = "plain[passwd=./sample.passwd]"

        tcp-port = 443

        udp-port = 443

        run-as-user = nobody

        run-as-group = nogroup

        run-as-user = ocserv

        run-as-group = ocserv

        socket-file = /run/ocserv-socket

        server-cert = certs/server-cert.pem

        server-key = certs/server-key.pem

nixos/modules/services/web-servers/mighttpd2.nix

+2 −4
Original line number Diff line number Diff line
@@ -24,10 +24,8 @@ in 
        # IP address or "*"

        Host: *

        Debug_Mode: Yes # Yes or No

        # If available, "nobody" is much more secure for User:.

        User: root

        # If available, "nobody" is much more secure for Group:.

        Group: root

        User: mighttpd2

        Group: mighttpd2

        Pid_File: /run/mighty.pid

        Logging: Yes # Yes or No

        Log_File: /var/log/mighty # The directory must be writable by User:

nixos/modules/virtualisation/oci-containers.nix

+1 −1
Original line number Diff line number Diff line
@@ -197,7 +197,7 @@ let 
            Override the username or UID (and optionally groupname or GID) used

            in the container.

          '';

          example = "nobody:nogroup";

          example = "alice:users";

        };



        volumes = mkOption {