aboutsummaryrefslogtreecommitdiff
path: root/gnu
diff options
context:
space:
mode:
Diffstat (limited to 'gnu')
-rw-r--r--gnu/local.mk1
-rw-r--r--gnu/services/pam-mount.scm111
2 files changed, 112 insertions, 0 deletions
diff --git a/gnu/local.mk b/gnu/local.mk
index 082465a24a..3f2e9f265f 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -551,6 +551,7 @@ GNU_SYSTEM_MODULES = \
%D%/services/networking.scm \
%D%/services/nix.scm \
%D%/services/nfs.scm \
+ %D%/services/pam-mount.scm \
%D%/services/security-token.scm \
%D%/services/shepherd.scm \
%D%/services/sound.scm \
diff --git a/gnu/services/pam-mount.scm b/gnu/services/pam-mount.scm
new file mode 100644
index 0000000000..98611462c2
--- /dev/null
+++ b/gnu/services/pam-mount.scm
@@ -0,0 +1,111 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2019 Guillaume Le Vaillant <glv@posteo.net>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix. If not, see <http://www.gnu.org/licenses/>.
+
+(define-module (gnu services pam-mount)
+ #:use-module (gnu packages admin)
+ #:use-module (gnu services)
+ #:use-module (gnu services configuration)
+ #:use-module (gnu system pam)
+ #:use-module (guix gexp)
+ #:use-module (guix records)
+ #:export (pam-mount-configuration
+ pam-mount-configuration?
+ pam-mount-service-type))
+
+(define %pam-mount-default-configuration
+ `((debug (@ (enable "0")))
+ (mntoptions (@ (allow ,(string-join
+ '("nosuid" "nodev" "loop"
+ "encryption" "fsck" "nonempty"
+ "allow_root" "allow_other")
+ ","))))
+ (mntoptions (@ (require "nosuid,nodev")))
+ (logout (@ (wait "0")
+ (hup "0")
+ (term "no")
+ (kill "no")))
+ (mkmountpoint (@ (enable "1")
+ (remove "true")))))
+
+(define (make-pam-mount-configuration-file config)
+ (computed-file
+ "pam_mount.conf.xml"
+ #~(begin
+ (use-modules (sxml simple))
+ (call-with-output-file #$output
+ (lambda (port)
+ (sxml->xml
+ '(*TOP*
+ (*PI* xml "version='1.0' encoding='utf-8'")
+ (pam_mount
+ #$@(pam-mount-configuration-rules config)
+ (pmvarrun
+ #$(file-append pam-mount
+ "/sbin/pmvarrun -u '%(USER)' -o '%(OPERATION)'"))
+ (cryptmount
+ #$(file-append pam-mount
+ (string-append
+ "/sbin/mount.crypt"
+ " '%(if %(CIPHER),-ocipher=%(CIPHER))'"
+ " '%(if %(FSKEYCIPHER),"
+ "-ofsk_cipher=%(FSKEYCIPHER))'"
+ " '%(if %(FSKEYHASH),-ofsk_hash=%(FSKEYHASH))'"
+ " '%(if %(FSKEYPATH),-okeyfile=%(FSKEYPATH))'"
+ " '%(if %(OPTIONS),-o%(OPTIONS))'"
+ " '%(VOLUME)' '%(MNTPT)'")))
+ (cryptumount
+ #$(file-append pam-mount "/sbin/umount.crypt '%(MNTPT)'"))))
+ port))))))
+
+(define-record-type* <pam-mount-configuration>
+ pam-mount-configuration
+ make-pam-mount-configuration
+ pam-mount-configuration?
+ (rules pam-mount-configuration-rules
+ (default %pam-mount-default-configuration)))
+
+(define (pam-mount-etc-service config)
+ `(("security/pam_mount.conf.xml"
+ ,(make-pam-mount-configuration-file config))))
+
+(define (pam-mount-pam-service config)
+ (define optional-pam-mount
+ (pam-entry
+ (control "optional")
+ (module #~(string-append #$pam-mount "/lib/security/pam_mount.so"))))
+ (list (lambda (pam)
+ (if (member (pam-service-name pam)
+ '("login" "su" "slim" "gdm-password"))
+ (pam-service
+ (inherit pam)
+ (auth (append (pam-service-auth pam)
+ (list optional-pam-mount)))
+ (session (append (pam-service-session pam)
+ (list optional-pam-mount))))
+ pam))))
+
+(define pam-mount-service-type
+ (service-type
+ (name 'pam-mount)
+ (extensions (list (service-extension etc-service-type
+ pam-mount-etc-service)
+ (service-extension pam-root-service-type
+ pam-mount-pam-service)))
+ (default-value (pam-mount-configuration))
+ (description "Activate PAM-Mount support. It allows mounting volumes for
+specific users when they log in.")))