From 32f0cf2140af6a852f8c8b6c8f15e4855d461b87 Mon Sep 17 00:00:00 2001 From: Michael Hoang Date: Mon, 28 Oct 2024 00:37:55 +1100 Subject: [PATCH] users: replace FDA check with more fine grained permissions check --- modules/users/default.nix | 78 +++++++++++++++++++-------------------- tests/users-groups.nix | 6 +-- 2 files changed, 42 insertions(+), 42 deletions(-) diff --git a/modules/users/default.nix b/modules/users/default.nix index 3f614c6..c6c66f3 100644 --- a/modules/users/default.nix +++ b/modules/users/default.nix @@ -110,32 +110,44 @@ in # however currently that runs at user level activation as that runs before system level activation # TODO: replace `$USER` with `$SUDO_USER` when system.checks runs from system level system.checks.text = lib.mkAfter '' - requireFDA() { - fullDiskAccess=false - - if cat /Library/Preferences/com.apple.TimeMachine.plist > /dev/null 2>&1; then - fullDiskAccess=true - fi - - if [[ "$fullDiskAccess" != true ]]; then - printf >&2 '\e[1;31merror: users cannot be %s without Full Disk Access, aborting activation\e[0m\n' "$2" - printf >&2 'The user %s could not be %s as `darwin-rebuild` was not executed with Full Disk Access.\n' "$1" "$2" - printf >&2 '\n' - printf >&2 'Opening "Privacy & Security" > "Full Disk Access" in System Settings\n' - printf >&2 '\n' - # This command will fail if run as root and System Settings is already running - # even if System Settings was launched by root. - open "x-apple.systempreferences:com.apple.preference.security?Privacy_AllFiles" + ensurePerms() { + homeDirectory=$(dscl . -read /Users/nobody NFSHomeDirectory) + homeDirectory=''${homeDirectory#NFSHomeDirectory: } + if ! sudo dscl . -change /Users/nobody NFSHomeDirectory "$homeDirectory" "$homeDirectory" &> /dev/null; then if [[ -n "$SSH_CONNECTION" ]]; then - printf >&2 'Please enable Full Disk Access for programs over SSH by flipping\n' - printf >&2 'the switch for `sshd-keygen-wrapper`.\n' + printf >&2 '\e[1;31merror: users cannot be %s over SSH without Full Disk Access, aborting activation\e[0m\n' "$2" + printf >&2 'The user %s could not be %s as `darwin-rebuild` was not executed with Full Disk Access over SSH.\n' "$1" "$2" + printf >&2 'You can either:\n' + printf >&2 '\n' + printf >&2 ' grant Full Disk Access to all programs run over SSH\n' + printf >&2 '\n' + printf >&2 'or\n' + printf >&2 '\n' + printf >&2 ' run `darwin-rebuild` in a graphical session.\n' + printf >&2 '\n' + printf >&2 'The option "Allow full disk access for remote users" can be found by\n' + printf >&2 'navigating to System Settings > General > Sharing > Remote Login\n' + printf >&2 'and then pressing on the i icon next to the switch.\n' + exit 1 else - printf >&2 'Please enable Full Disk Access for your terminal emulator by flipping\n' - printf >&2 'the switch in System Settings.\n' + # The TCC service required to change home directories is `kTCCServiceSystemPolicySysAdminFiles` + # and we can reset it to ensure the user gets another prompt + tccutil reset SystemPolicySysAdminFiles > /dev/null + + if ! sudo dscl . -change /Users/nobody NFSHomeDirectory "$homeDirectory" "$homeDirectory" &> /dev/null; then + printf >&2 '\e[1;31merror: permission denied when trying to %s user %s, aborting activation\e[0m\n' "$2" "$1" + printf >&2 '`darwin-rebuild` requires permissions to administrate your computer,\n' "$1" "$2" + printf >&2 'please accept the dialog that pops up.\n' + printf >&2 '\n' + printf >&2 'If you do not wish to be prompted every time `darwin-rebuild updates your users,\n' + printf >&2 'you can grant Full Disk Access to your terminal emulator in System Settings.\n' + printf >&2 '\n' + printf >&2 'This can be found in System Settings > Privacy & Security > Full Disk Access.\n' + exit 1 + fi fi - exit 1 fi } @@ -149,7 +161,7 @@ in exit 1 fi - requireFDA "$1" deleted + ensurePerms "$1" delete } ${concatMapStringsSep "\n" (v: let @@ -169,7 +181,7 @@ in u=$(id -u ${name} 2> /dev/null) || true if ! [[ -n "$u" && "$u" -ne "${toString v.uid}" ]]; then if [ -z "$u" ]; then - requireFDA ${name} created + ensurePerms ${name} create fi ${optionalString (v.home != null && v.name != "root") '' @@ -211,7 +223,7 @@ in g=''${g#PrimaryGroupID: } if [[ "$g" -eq ${toString v.gid} ]]; then echo "deleting group ${v.name}..." >&2 - dscl . -delete ${dsclGroup} 2> /dev/null + dscl . -delete ${dsclGroup} else echo "warning: existing group '${v.name}' has unexpected gid $g, skipping..." >&2 fi @@ -245,7 +257,7 @@ in if [ -n "$g" ]; then if [ "$g" -gt 501 ]; then echo "deleting group ${name}..." >&2 - dscl . -delete ${dsclGroup} 2> /dev/null + dscl . -delete ${dsclGroup} else echo "warning: existing group '${name}' has unexpected gid $g, skipping..." >&2 fi @@ -256,18 +268,6 @@ in system.activationScripts.users.text = mkIf (cfg.knownUsers != []) '' echo "setting up users..." >&2 - deleteUser() { - dscl . -delete "/Users/$1" 2> /dev/null - - # `dscl . -delete` should exit with a non-zero exit code when there's an error, but we'll leave - # this code here just in case and for when we switch to `sysadminctl -deleteUser` - # We need to check as `sysadminctl -deleteUser` still exits with exit code 0 when there's an error - if id "$1" &> /dev/null; then - printf >&2 '\e[1;31merror: failed to delete user %s, aborting activation\e[0m\n', "$1" - exit 1 - fi - } - ${concatMapStringsSep "\n" (v: let name = lib.escapeShellArg v.name; dsclUser = lib.escapeShellArg "/Users/${v.name}"; @@ -282,7 +282,7 @@ in printf >&2 'warning: not going to recreate root, skipping...\n' else printf >&2 'deleting user ${v.name}...\n' - deleteUser ${name} + dscl . -delete ${dsclUser} fi else echo "warning: existing user '${v.name}' has unexpected uid $u, skipping..." >&2 @@ -329,7 +329,7 @@ in if [ -n "$u" ]; then if [ "$u" -gt 501 ]; then echo "deleting user ${name}..." >&2 - deleteUser ${lib.escapeShellArg name} + dscl . -delete ${lib.escapeShellArg "/Users/${name}"} else echo "warning: existing user '${name}' has unexpected uid $u, skipping..." >&2 fi diff --git a/tests/users-groups.nix b/tests/users-groups.nix index cf2f008..34ee5c2 100644 --- a/tests/users-groups.nix +++ b/tests/users-groups.nix @@ -52,7 +52,7 @@ grep "createhomedir -cu ${lib.escapeShellArg "foo"}" ${config.out}/activate grep "sysadminctl -addUser ${lib.escapeShellArgs [ "created.user" "-UID" 42001 ]} .* ${lib.escapeShellArgs [ "-shell" "/usr/bin/false" ] }" ${config.out}/activate (! grep "sysadminctl -addUser ${lib.escapeShellArg "created.user"} .* -home" ${config.out}/activate) - (! grep "deleteUser ${lib.escapeShellArg "created.user"}" ${config.out}/activate) + (! grep "dscl . -delete ${lib.escapeShellArg "/Users/created.user"}" ${config.out}/activate) (! grep "dscl . -delete ${lib.escapeShellArg "/Groups/created.user"}" ${config.out}/activate) # checking user properties always get updated in /activate @@ -67,12 +67,12 @@ (! grep "dscl . -create ${lib.escapeShellArg "/Users/created.user"} UserShell" ${config.out}/activate) # checking user deletion in /activate - grep "deleteUser ${lib.escapeShellArg "deleted.user"}" ${config.out}/activate + grep "dscl . -delete ${lib.escapeShellArg "/Users/deleted.user"}" ${config.out}/activate (! grep "sysadminctl -addUser ${lib.escapeShellArg "deleted.user"}" ${config.out}/activate) # checking that users not specified in knownUsers doesn't get changed in /activate (! grep "sysadminctl -addUser ${lib.escapeShellArg "unknown.user"}" ${config.out}/activate) - (! grep "deleteUser ${lib.escapeShellArg "unknown.user"}" ${config.out}/activate) + (! grep "dscl . -delete ${lib.escapeShellArg "/Users/unknown.user"}" ${config.out}/activate) (! grep "dscl . -create ${lib.escapeShellArg "/Users/unknown.user"}" ${config.out}/activate) set +v