;;; GNU Guix --- Functional package management for GNU
;;; Copyright © 2019 Guillaume Le Vaillant <glv@posteo.net>
;;;
;;; This file is part of GNU Guix.
;;;
;;; GNU Guix is free software; you can redistribute it and/or modify it
;;; under the terms of the GNU General Public License as published by
;;; the Free Software Foundation; either version 3 of the License, or (at
;;; your option) any later version.
;;;
;;; GNU Guix is distributed in the hope that it will be useful, but
;;; WITHOUT ANY WARRANTY; without even the implied warranty of
;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
;;; GNU General Public License for more details.
;;;
;;; You should have received a copy of the GNU General Public License
;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.

(define-module (gnu services pam-mount)
  #:use-module (gnu packages admin)
  #:use-module (gnu services)
  #:use-module (gnu services configuration)
  #:use-module (gnu system pam)
  #:use-module (guix gexp)
  #:use-module (guix records)
  #:export (pam-mount-configuration
            pam-mount-configuration?
            pam-mount-service-type))

(define %pam-mount-default-configuration
  `((debug (@ (enable "0")))
    (mntoptions (@ (allow ,(string-join
                            '("nosuid" "nodev" "loop"
                              "encryption" "fsck" "nonempty"
                              "allow_root" "allow_other")
                            ","))))
    (mntoptions (@ (require "nosuid,nodev")))
    (logout (@ (wait "0")
               (hup "0")
               (term "no")
               (kill "no")))
    (mkmountpoint (@ (enable "1")
                     (remove "true")))))

(define (make-pam-mount-configuration-file config)
  (computed-file
   "pam_mount.conf.xml"
   #~(begin
       (use-modules (sxml simple))
       (call-with-output-file #$output
         (lambda (port)
           (sxml->xml
            '(*TOP*
              (*PI* xml "version='1.0' encoding='utf-8'")
              (pam_mount
               #$@(pam-mount-configuration-rules config)
               (pmvarrun
                #$(file-append pam-mount
                               "/sbin/pmvarrun -u '%(USER)' -o '%(OPERATION)'"))
               (cryptmount
                #$(file-append pam-mount
                               (string-append
                                "/sbin/mount.crypt"
                                " '%(if %(CIPHER),-ocipher=%(CIPHER))'"
                                " '%(if %(FSKEYCIPHER),"
                                "-ofsk_cipher=%(FSKEYCIPHER))'"
                                " '%(if %(FSKEYHASH),-ofsk_hash=%(FSKEYHASH))'"
                                " '%(if %(FSKEYPATH),-okeyfile=%(FSKEYPATH))'"
                                " '%(if %(OPTIONS),-o%(OPTIONS))'"
                                " '%(VOLUME)' '%(MNTPT)'")))
               (cryptumount
                #$(file-append pam-mount "/sbin/umount.crypt '%(MNTPT)'"))))
            port))))))

(define-record-type* <pam-mount-configuration>
  pam-mount-configuration
  make-pam-mount-configuration
  pam-mount-configuration?
  (rules pam-mount-configuration-rules
         (default %pam-mount-default-configuration)))

(define (pam-mount-etc-service config)
  `(("security/pam_mount.conf.xml"
     ,(make-pam-mount-configuration-file config))))

(define (pam-mount-pam-service config)
  (define optional-pam-mount
    (pam-entry
     (control "optional")
     (module #~(string-append #$pam-mount "/lib/security/pam_mount.so"))))
  (list (lambda (pam)
          (if (member (pam-service-name pam)
                      '("login" "su" "slim" "gdm-password"))
              (pam-service
               (inherit pam)
               (auth (append (pam-service-auth pam)
                             (list optional-pam-mount)))
               (session (append (pam-service-session pam)
                                (list optional-pam-mount))))
              pam))))

(define pam-mount-service-type
  (service-type
   (name 'pam-mount)
   (extensions (list (service-extension etc-service-type
                                        pam-mount-etc-service)
                     (service-extension pam-root-service-type
                                        pam-mount-pam-service)))
   (default-value (pam-mount-configuration))
   (description "Activate PAM-Mount support.  It allows mounting volumes for
specific users when they log in.")))
bias Geerinckx-Rice</td></tr>
<tr><td><span title='2021-02-08 17:21:34 -0800'>2021-02-08</span></td><td><a href='/guix/commit/gnu/bootloader?id=a65c935e29766940148d52b8116634b1e1cbcba6'>gnu: bootloader: Update install-allwinner64-u-boot.</a><span class='msg-avail'>...</span></td><td>Vagrant Cascadian</td></tr>
<tr><td><span title='2021-02-08 07:18:41 -0800'>2021-02-08</span></td><td><a href='/guix/commit/gnu/bootloader?id=15990546a5c26742fcbc7f7aa56b2a6db09dc643'>gnu: u-boot-puma-rk3399: Switch to using arm-trusted-firmware-rk3399.</a><span class='msg-avail'>...</span></td><td>Vagrant Cascadian</td></tr>
<tr><td><span title='2021-01-17 15:47:59 +0100'>2021-01-17</span></td><td><a href='/guix/commit/gnu/bootloader?id=b57056a9fd83c61efb5343853948a798da6e975e'>gnu: grub: Use installed unicode font.</a><span class='msg-avail'>...</span></td><td>Stefan</td></tr>
<tr><td><span title='2020-12-21 18:41:11 +0100'>2020-12-21</span></td><td><a href='/guix/commit/gnu/bootloader?id=f00e68ace070fd5240a4b5874e61c26f6e909b6c'>system: Allow separated /boot and encrypted root.</a><span class='msg-avail'>...</span></td><td>Miguel Ángel Arruga Vivas</td></tr>
<tr><td><span title='2020-12-15 17:32:09 +0100'>2020-12-15</span></td><td><a href='/guix/commit/gnu/bootloader?id=7a2897149d60816c33c63b7b7254ad283f8c3602'>Revert "gnu: grub: Fix unicode font loading when booting over TFTP."</a><span class='msg-avail'>...</span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2020-12-14 23:33:22 +0100'>2020-12-14</span></td><td><a href='/guix/commit/gnu/bootloader?id=03fb57ff77b57de510b59485845ed7cb4e0a77a7'>gnu: grub: Fix unicode font loading when booting over TFTP.</a><span class='msg-avail'>...</span></td><td>Stefan</td></tr>