;;; GNU Guix --- Functional package management for GNU
;;; Copyright © 2019 Guillaume Le Vaillant <glv@posteo.net>
;;;
;;; This file is part of GNU Guix.
;;;
;;; GNU Guix is free software; you can redistribute it and/or modify it
;;; under the terms of the GNU General Public License as published by
;;; the Free Software Foundation; either version 3 of the License, or (at
;;; your option) any later version.
;;;
;;; GNU Guix is distributed in the hope that it will be useful, but
;;; WITHOUT ANY WARRANTY; without even the implied warranty of
;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
;;; GNU General Public License for more details.
;;;
;;; You should have received a copy of the GNU General Public License
;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.

(define-module (gnu services pam-mount)
  #:use-module (gnu packages admin)
  #:use-module (gnu services)
  #:use-module (gnu services configuration)
  #:use-module (gnu system pam)
  #:use-module (guix gexp)
</td></tr></table>
<table class='tabs'><tr><td>
<a href='/guix/about/'>about</a><a href='/guix/'>summary</a><a href='/guix/refs/?id=9c1b8390ba36c0b9e3d5580b0f00206255f9b9a8'>refs</a><a class='active' href='/guix/log/gnu/services/mcron.scm'>log</a><a href='/guix/tree/gnu/services/mcron.scm?id=9c1b8390ba36c0b9e3d5580b0f00206255f9b9a8'>tree</a><a href='/guix/commit/gnu/services/mcron.scm?id=9c1b8390ba36c0b9e3d5580b0f00206255f9b9a8'>commit</a><a href='/guix/diff/gnu/services/mcron.scm?id=9c1b8390ba36c0b9e3d5580b0f00206255f9b9a8'>diff</a></td><td class='form'><form class='right' method='get' action='/guix/log/gnu/services/mcron.scm'>
<input type='hidden' name='id' value='9c1b8390ba36c0b9e3d5580b0f00206255f9b9a8'/><select name='qt'>
<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/guix/log/?id=9c1b8390ba36c0b9e3d5580b0f00206255f9b9a8'>root</a>/<a href='/guix/log/gnu?id=9c1b8390ba36c0b9e3d5580b0f00206255f9b9a8'>gnu</a>/<a href='/guix/log/gnu/services?id=9c1b8390ba36c0b9e3d5580b0f00206255f9b9a8'>services</a>/<a href='/guix/log/gnu/services/mcron.scm?id=9c1b8390ba36c0b9e3d5580b0f00206255f9b9a8'>mcron.scm</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/guix/log/gnu/services/mcron.scm?id=9c1b8390ba36c0b9e3d5580b0f00206255f9b9a8&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th></tr>
          " '%(if %(FSKEYPATH),-okeyfile=%(FSKEYPATH))'"
                                " '%(if %(OPTIONS),-o%(OPTIONS))'"
                                " '%(VOLUME)' '%(MNTPT)'")))
               (cryptumount
                #$(file-append pam-mount "/sbin/umount.crypt '%(MNTPT)'"))))
            port))))))

(define-record-type* <pam-mount-configuration>
  pam-mount-configuration
  make-pam-mount-configuration
  pam-mount-configuration?
  (rules pam-mount-configuration-rules
         (default %pam-mount-default-configuration)))

(define (pam-mount-etc-service config)
  `(("security/pam_mount.conf.xml"
     ,(make-pam-mount-configuration-file config))))

(define (pam-mount-pam-service config)
  (define optional-pam-mount
    (pam-entry
     (control "optional")
     (module #~(string-append #$pam-mount "/lib/security/pam_mount.so"))))
  (list (lambda (pam)
          (if (member (pam-service-name pam)
                      '("login" "su" "slim" "gdm-password"))
              (pam-service
               (inherit pam)
               (auth (append (pam-service-auth pam)
                             (list optional-pam-mount)))
               (session (append (pam-service-session pam)
                                (list optional-pam-mount))))
              pam))))

(define pam-mount-service-type
  (service-type
   (name 'pam-mount)
   (extensions (list (service-extension etc-service-type
                                        pam-mount-etc-service)
                     (service-extension pam-root-service-type
                                        pam-mount-pam-service)))
   (default-value (pam-mount-configuration))
   (description "Activate PAM-Mount support.  It allows mounting volumes for
specific users when they log in.")))