Commit 83817d62 authored by Will Fancher's avatar Will Fancher
Browse files

nixos/systemd: Restrict `register-machine` to privileged users only 

https://github.com/systemd/systemd/security/advisories/GHSA-4h6x-r8vx-3862
parent 205a4a03

nixos/modules/system/boot/systemd.nix

+10 −0
Original line number Diff line number Diff line
@@ -852,6 +852,16 @@ in 
      };

    };



    # Remove with systemd 259.4

    security.polkit.extraConfig = mkIf config.security.polkit.enable ''

      polkit.addRule(function(action, subject) {

          if (action.id == "org.freedesktop.machine1.register-machine" &&

              subject.user != "root") {

              return polkit.Result.AUTH_ADMIN_KEEP;

          }

      });

    '';



    # run0 is supposed to authenticate the user via polkit and then run a command. Without this next

    # part, run0 would fail to run the command even if authentication is successful and the user has

    # permission to run the command. This next part is only enabled if polkit is enabled because the