diff options
| author | nicoo <nicoo@mur.at> | 2023-11-15 15:48:56 +0000 |
|---|---|---|
| committer | nicoo <nicoo@mur.at> | 2023-12-19 01:30:47 +0000 |
| commit | 081ec8a6363c1d2ac8dd8ad27e130feb50547629 (patch) | |
| tree | c2936dad3c1a6cd76233fb13375cfa3c3199f426 | |
| parent | Merge pull request #275244 from NixOS/backport-269407-to-release-23.11 (diff) | |
| download | nixpkgs-081ec8a6363c1d2ac8dd8ad27e130feb50547629.tar.gz | |
nixos/wpa_supplicant: Ensure the generated config isn't world-readable
Otherwise, `environmentFile` cannot be used to pass secrets in.
(cherry picked from commit a351c9b530bd7bd385c4f0e89606e09f46f50829)
| -rw-r--r-- | nixos/doc/manual/release-notes/rl-2311.section.md | 8 | ||||
| -rw-r--r-- | nixos/modules/services/networking/wpa_supplicant.nix | 4 |
2 files changed, 12 insertions, 0 deletions
diff --git a/nixos/doc/manual/release-notes/rl-2311.section.md b/nixos/doc/manual/release-notes/rl-2311.section.md index 4992e2b8af45..24d7531d3c9d 100644 --- a/nixos/doc/manual/release-notes/rl-2311.section.md +++ b/nixos/doc/manual/release-notes/rl-2311.section.md @@ -1292,6 +1292,14 @@ Make sure to also check the many updates in the [Nixpkgs library](#sec-release-2 qemu-vm module from overriding `fileSystems` by setting `virtualisation.fileSystems = lib.mkForce { };`. +- `wpa_supplicant`'s configuration file cannot be read by non-root users, and + secrets (such as Pre-Shared Keys) can safely be passed via + `networking.wireless.environmentFile`. + + The configuration file could previously be read, when `userControlled.enable` (non-default), + by users who are in both `wheel` and `userControlled.group` (defaults to `wheel`) + + ## Nixpkgs Library {#sec-release-23.11-nixpkgs-lib} ### Breaking Changes {#sec-release-23.11-lib-breaking} diff --git a/nixos/modules/services/networking/wpa_supplicant.nix b/nixos/modules/services/networking/wpa_supplicant.nix index 90d9c68433cf..4586550ed75e 100644 --- a/nixos/modules/services/networking/wpa_supplicant.nix +++ b/nixos/modules/services/networking/wpa_supplicant.nix @@ -107,6 +107,10 @@ let stopIfChanged = false; path = [ package ]; + # if `userControl.enable`, the supplicant automatically changes the permissions + # and owning group of the runtime dir; setting `umask` ensures the generated + # config file isn't readable (except to root); see nixpkgs#267693 + serviceConfig.UMask = "066"; serviceConfig.RuntimeDirectory = "wpa_supplicant"; serviceConfig.RuntimeDirectoryMode = "700"; serviceConfig.EnvironmentFile = mkIf (cfg.environmentFile != null) |