From 84ad0b0a93eccdef0e4ca05fd4091f014cb1ac25 Mon Sep 17 00:00:00 2001 From: tv Date: Wed, 17 Apr 2019 20:45:33 +0200 Subject: krebs.permown: init Derived from lass/3modules/ensure-permissions.nix --- krebs/3modules/default.nix | 1 + krebs/3modules/permown.nix | 74 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 75 insertions(+) create mode 100644 krebs/3modules/permown.nix (limited to 'krebs') diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix index 567c077eb..4d40f3856 100644 --- a/krebs/3modules/default.nix +++ b/krebs/3modules/default.nix @@ -39,6 +39,7 @@ let ./nixpkgs.nix ./on-failure.nix ./os-release.nix + ./permown.nix ./per-user.nix ./power-action.nix ./Reaktor.nix diff --git a/krebs/3modules/permown.nix b/krebs/3modules/permown.nix new file mode 100644 index 000000000..7a86013e1 --- /dev/null +++ b/krebs/3modules/permown.nix @@ -0,0 +1,74 @@ +with import ; +{ config, pkgs, ... }: { + + options.krebs.permown = mkOption { + default = []; + type = types.listOf (types.submodule { + options = { + directory-mode = mkOption { + default = "=rwx"; + type = types.str; # TODO + }; + file-mode = mkOption { + default = "=rw"; + type = types.str; # TODO + }; + group = mkOption { + apply = x: if x == null then "" else x; + default = null; + type = types.nullOr types.groupname; + }; + owner = mkOption { + type = types.username; + }; + path = mkOption { + type = types.absolute-pathname; + }; + umask = mkOption { + default = "0027"; + type = types.file-mode; + }; + }; + }); + }; + + config.systemd.services = genAttrs' config.krebs.permown (plan: { + name = "permown.${replaceStrings ["/"] ["_"] plan.path}"; + value = { + environment = { + DIR_MODE = plan.directory-mode; + FILE_MODE = plan.file-mode; + OWNER_GROUP = "${plan.owner}:${plan.group}"; + ROOT_PATH = plan.path; + }; + path = [ + pkgs.coreutils + pkgs.findutils + pkgs.inotifyTools + ]; + serviceConfig = { + ExecStart = pkgs.writeDash "permown" '' + set -efu + + find "$ROOT_PATH" -exec chown "$OWNER_GROUP" {} + + find "$ROOT_PATH" -type d -exec chmod "$DIR_MODE" {} + + find "$ROOT_PATH" -type f -exec chmod "$FILE_MODE" {} + + + inotifywait -mrq -e CREATE --format %w%f "$ROOT_PATH" | + while read -r path; do + if test -d "$path"; then + exec "$0" "$@" + fi + chown "$OWNER_GROUP" "$path" + chmod "$FILE_MODE" "$path" + done + ''; + Restart = "always"; + RestartSec = 10; + UMask = plan.umask; + }; + wantedBy = [ "multi-user.target" ]; + }; + }); + +} -- cgit v1.2.3