From c2869eb6aa032a24d704f432a07439d67b654ef6 Mon Sep 17 00:00:00 2001 From: Zynh Ludwig Date: Sun, 24 Nov 2024 14:35:48 -0800 Subject: [PATCH] little-lightning: pam_reattach.so --- builders.nix | 12 ++ home/modules/tmux.nix | 4 +- hosts/little-lightning/configuration.nix | 5 + hosts/little-lightning/darwin-modules/pam.nix | 114 ++++++++++++++++++ hosts/little-lightning/home.nix | 22 +++- 5 files changed, 151 insertions(+), 6 deletions(-) create mode 100644 hosts/little-lightning/darwin-modules/pam.nix diff --git a/builders.nix b/builders.nix index 5f6f640..d5ff90b 100644 --- a/builders.nix +++ b/builders.nix @@ -9,6 +9,18 @@ let self.overlays.default inputs.niri.overlays.niri inputs.lix-module.overlays.lixFromNixpkgs + + (final: prev: { + tmux = prev.tmux.overrideAttrs (old: rec { + version = "3.5"; + src = prev.fetchFromGitHub { + owner = "tmux"; + repo = "tmux"; + rev = version; + hash = "sha256-8CRZj7UyBhuB5QO27Y+tHG62S/eGxPOHWrwvh1aBqq0="; + }; + }); + }) ]; }); diff --git a/home/modules/tmux.nix b/home/modules/tmux.nix index 57082cb..575874e 100644 --- a/home/modules/tmux.nix +++ b/home/modules/tmux.nix @@ -14,9 +14,9 @@ in config = lib.mkIf cfg.enable { programs.tmux = { enable = true; - # shell = getExe (if macos then pkgs.zsh else pkgs.fish); + shell = getExe (if macos then pkgs.zsh else pkgs.fish); # shell = if macos then "/bin/zsh" else (getExe pkgs.fish); - shell = getExe pkgs.fish; + # shell = getExe pkgs.fish; mouse = true; baseIndex = 1; terminal = "screen-256color"; diff --git a/hosts/little-lightning/configuration.nix b/hosts/little-lightning/configuration.nix index 85a940d..5c7bac9 100644 --- a/hosts/little-lightning/configuration.nix +++ b/hosts/little-lightning/configuration.nix @@ -1,4 +1,8 @@ { pkgs, lib, self, ... }: { + imports = [ + ./darwin-modules/pam.nix + ]; + # List packages installed in system profile. To search by name, run: # $ nix-env -qaP | grep wget environment.systemPackages = [ ]; @@ -56,6 +60,7 @@ ]; security.pam.enableSudoTouchIdAuth = true; + security.pam.enableSudoTouchIdReattach = true; users.users.zynh = { name = "zynh"; diff --git a/hosts/little-lightning/darwin-modules/pam.nix b/hosts/little-lightning/darwin-modules/pam.nix new file mode 100644 index 0000000..04301bf --- /dev/null +++ b/hosts/little-lightning/darwin-modules/pam.nix @@ -0,0 +1,114 @@ +{ config, lib, pkgs, ... }: + +with lib; + +let + cfg = config.security.pam; + + # Implementation Notes + # + # We don't use `environment.etc` because this would require that the user manually delete + # `/etc/pam.d/sudo` which seems unwise given that applying the nix-darwin configuration requires + # sudo. We also can't use `system.patchs` since it only runs once, and so won't patch in the + # changes again after OS updates (which remove modifications to this file). + # + # As such, we resort to line addition/deletion in place using `sed`. We add a comment to the + # added line that includes the name of the option, to make it easier to identify the line that + # should be deleted when the option is disabled. + sudoTouchIdAuthScript = + let + isEnabled = cfg.enableSudoTouchIdAuth; + file = "/etc/pam.d/sudo"; + option = "security.pam.enableSudoTouchIdAuth"; + sed = "${pkgs.gnused}/bin/sed"; + in + '' + ${if isEnabled then '' + # Enable sudo Touch ID authentication, if not already enabled + if ! grep 'pam_tid.so' ${file} > /dev/null; then + ${sed} -i '2i\ + auth sufficient pam_tid.so # nix-darwin: ${option} + ' ${file} + fi + '' else '' + # Disable sudo Touch ID authentication, if added by nix-darwin + if grep '${option}' ${file} > /dev/null; then + ${sed} -i '/${option}/d' ${file} + fi + ''} + ''; + + sudoTouchIdReattachScript = + let + isEnabled = cfg.enableSudoTouchIdReattach; + file = "/etc/pam.d/sudo"; + option = "security.pam.enableSudoTouchIdReattach"; + sed = "${pkgs.gnused}/bin/sed"; + in + '' + ${if isEnabled then '' + # Enable sudo Touch ID authentication, if not already enabled + if ! grep 'pam_tid.so' ${file} > /dev/null; then + ${sed} -i '2i\ + auth sufficient /opt/homebrew/lib/pam/pam_reattach.so # nix-darwin: ${option} + ' ${file} + fi + '' else '' + # Disable sudo Touch ID authentication, if added by nix-darwin + if grep '${option}' ${file} > /dev/null; then + ${sed} -i '/${option}/d' ${file} + fi + ''} + ''; +in + +{ + options = { + # security.pam.enableSudoTouchIdAuth = lib.mkForce (mkEnableOption "" // { + # description = '' + # Enable sudo authentication with Touch ID. + # + # When enabled, this option adds the following line to + # {file}`/etc/pam.d/sudo`: + # + # ``` + # auth sufficient pam_tid.so + # ``` + # + # ::: {.note} + # macOS resets this file when doing a system update. As such, sudo + # authentication with Touch ID won't work after a system update + # until the nix-darwin configuration is reapplied. + # ::: + # ''; + # }); + + security.pam.enableSudoTouchIdReattach = mkEnableOption "" // { + description = '' + Enable sudo authentication with Touch ID. + + When enabled, this option adds the following line to + {file}`/etc/pam.d/sudo`: + + ``` + auth sufficient /opt/homebrew/lib/pam/pam_reattach.so + ``` + + ::: {.note} + macOS resets this file when doing a system update. As such, sudo + authentication with Touch ID won't work after a system update + until the nix-darwin configuration is reapplied. + ::: + ''; + }; + }; + + config = { + system.activationScripts.pam.text = lib.mkForce '' + # PAM settings + echo >&2 "setting up pam..." + ${sudoTouchIdAuthScript} + ${sudoTouchIdReattachScript} + ''; + }; +} diff --git a/hosts/little-lightning/home.nix b/hosts/little-lightning/home.nix index 107c4f2..862affb 100644 --- a/hosts/little-lightning/home.nix +++ b/hosts/little-lightning/home.nix @@ -19,10 +19,24 @@ direnv.enable = true; }; - programs.tmux.extraConfig = '' - set -gu default-command - set -g default-shell "$SHELL" - ''; + # nixpkgs.overlays = [ + # (final: prev: { + # tmux = prev.tmux.overrideAttrs (old: rec { + # version = "3.5"; + # src = prev.fetchFromGitHub { + # owner = "tmux"; + # repo = "tmux"; + # rev = version; + # hash = "sha256-8CRZj7UyBhuB5QO27Y+tHG62S/eGxPOHWrwvh1aBqq0="; + # }; + # }); + # }) + # ]; + + # programs.tmux.extraConfig = '' + # set -gu default-command + # set -g default-shell "$SHELL" + # ''; programs.alacritty.settings = { font.size = lib.mkForce 16.0;