diff options
author | makefu <github@syntax-fehler.de> | 2023-01-30 23:43:04 +0100 |
---|---|---|
committer | makefu <github@syntax-fehler.de> | 2023-01-30 23:43:04 +0100 |
commit | 369fa6b7eb3f0fa3e1034bcad438eeda017949f8 (patch) | |
tree | 22f7891595fba32a7e66b755617e0d49b91993f3 /tv/3modules/systemd.nix | |
parent | dbc3870841223051e4f617b4c06065c168c69c10 (diff) | |
parent | c7417c8bc1b50d466dae493ac3619d9f324f34f8 (diff) |
Merge remote-tracking branch 'lass/master'
Diffstat (limited to 'tv/3modules/systemd.nix')
-rw-r--r-- | tv/3modules/systemd.nix | 47 |
1 files changed, 47 insertions, 0 deletions
diff --git a/tv/3modules/systemd.nix b/tv/3modules/systemd.nix new file mode 100644 index 000000000..db8a51994 --- /dev/null +++ b/tv/3modules/systemd.nix @@ -0,0 +1,47 @@ +with import ./lib; +{ config, ... }: let + normalUsers = filterAttrs (_: getAttr "isNormalUser") config.users.users; +in { + options = { + tv.systemd.services = mkOption { + type = types.attrsOf (types.submodule (self: { + options = { + operators = mkOption { + type = with types; listOf (enum (attrNames normalUsers)); + default = []; + }; + }; + })); + default = {}; + }; + }; + config = { + security.polkit.extraConfig = let + access = + mapAttrs' + (name: cfg: + nameValuePair "${name}.service" + (genAttrs cfg.operators (const true)) + ) + config.tv.systemd.services; + in optionalString (access != {}) /* js */ '' + polkit.addRule(function () { + const access = ${lib.toJSON access}; + return function (action, subject) { + if (action.id === "org.freedesktop.systemd1.manage-units") { + const unit = action.lookup("unit"); + if ( + (access[unit]||{})[subject.user] || + ( + unit.includes("@") && + (access[unit.replace(/@[^.]+/, "@")]||{})[subject.user] + ) + ) { + return polkit.Result.YES; + } + } + } + }()); + ''; + }; +} |