this post was submitted on 23 Jan 2024
22 points (92.3% liked)

Linux

48310 readers
645 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 5 years ago
MODERATORS
AgreeableLandscape@lemmy.ml
nooter692@lemmy.ml
MarcellusDrum@lemmy.ml
cypherpunks@lemmy.ml
cyclohexane@lemmy.ml
d3Xt3r@lemmy.nz
22
NixOS - edit system files (lemmy.ml)
submitted 10 months ago* (last edited 10 months ago) by wwwgem@lemmy.ml to c/linux@lemmy.ml
8 comments fedilink hide all child comments
 

Hello,

I'm experiencing with NixOS and would like to know what would be the nicest way to add a specific line to a system file.

As an example, how would you configure NixOS so the line
auth sufficient pam_fprintd.so
is added to the /etc/pam.d/doas file? As a bonus, it would be nice to know how to change an option (and not add an entire line) to a system file for which there is no NixOS default extraConfig/extraRules support for.

This would allow me to add this line or not depending on the machine NixOS will be installed on.

Thanks in advance for your suggestions.

you are viewing a single comment's thread
view the rest of the comments
[–] hallettj@beehaw.org 13 points 10 months ago* (last edited 10 months ago) (2 children)

I did some digging around in the manual, and I tested this option which seems to work:

security.pam.services.doas.fprintAuth = true;

On my machine that adds this line to /etc/pam.d/doas:

auth sufficient /nix/store/fq4vbhdk8dqywxirg3wb99zidfss7sbi-fprintd-1.94.2/lib/security/pam_fprintd.so # fprintd (order 11400)

Edit: Note that the NixOS option puts in the full path to pam_fprintd.so. That's necessary because NixOS doesn't put so files in search paths.

Without doing more research I don't know how to add arbitrary options to pam files in case you run into something that isn't mapped to a NixOS option yet. The implementation for the pam options is here; there might be something in there that would work.

[–] wwwgem@lemmy.ml 9 points 10 months ago (1 children)

Thanks very much. That's exactly what I needed. I'm still not used to the diversity of NixOS documentation and was not aware of this one.

[–] wwwgem@lemmy.ml 5 points 10 months ago

Just realized that I had this line in my config already but the change was not applied until I reboot. 😳

[–] 2xsaiko@discuss.tchncs.de 8 points 10 months ago (2 children)

Arbitrary options are internal so are not shown in the options search. They're at security.pam.services..rules.

Here's the options that get added using the public options including fprintAuth: https://github.com/NixOS/nixpkgs/blob/20d2649068508ea15323d8a7a9cbd3ddfd997103/nixos/modules/security/pam.nix#L621

[–] wwwgem@lemmy.ml 4 points 10 months ago

Thanks! I'm still not used to the diversity of all the NixOS documentarian and was not aware that arbitrary options can be found there.

[–] hallettj@beehaw.org 3 points 10 months ago (2 children)

Although they're not in the search, they are in the manual so you can find them searching that page. This one is listed as,

security.pam.services..fprintAuth

But it does take some inferences to find this, and to realize that you can put doas in place of ``

[–] 2xsaiko@discuss.tchncs.de 2 points 10 months ago

No, that one is in the search as well. It's a normal option. https://search.nixos.org/options?show=security.pam.services.%3Cname%3E.fprintAuth

What isn't and also isn't in the manual is the rules options. Those are all internal.

[–] wwwgem@lemmy.ml 1 points 10 months ago

As I said I've actually done it before asking... But I didn't reboot and and that was needed for the change to take effect ¯\_(ツ)_/¯