diff --git a/nixos/doc/manual/release-notes/rl-1809.xml b/nixos/doc/manual/release-notes/rl-1809.xml index 13b244e12f8c6..b2f6b040bdc73 100644 --- a/nixos/doc/manual/release-notes/rl-1809.xml +++ b/nixos/doc/manual/release-notes/rl-1809.xml @@ -76,6 +76,12 @@ $ nix-instantiate -E '(import <nixpkgsunstable> {}).gitFull' + + + The installer is no longer running the graphical session as root. + To gain root privileges in the graphical session use sudo without a password. + + lib.strict is removed. Use diff --git a/nixos/modules/installer/cd-dvd/installation-cd-graphical-base.nix b/nixos/modules/installer/cd-dvd/installation-cd-graphical-base.nix new file mode 100644 index 0000000000000..24b78cc14df44 --- /dev/null +++ b/nixos/modules/installer/cd-dvd/installation-cd-graphical-base.nix @@ -0,0 +1,73 @@ +# This module contains the basic configuration for building a graphical NixOS +# installation CD. + +{ config, lib, pkgs, ... }: + +with lib; + +{ + imports = [ ./installation-cd-base.nix ]; + + users.extraUsers.live = { + isNormalUser = true; + uid = 1000; + extraGroups = [ "wheel" "networkmanager" "video" ]; + # Allow the graphical user to login without password + initialHashedPassword = ""; + }; + + # Allow passwordless sudo from live user + security.sudo = { + enable = lib.mkForce true; + wheelNeedsPassword = lib.mkForce false; + }; + + # Whitelist wheel users to do anything + # This is useful for things like pkexec + security.polkit.extraConfig = '' + polkit.addRule(function(action, subject) { + if (subject.isInGroup("wheel")) { + return polkit.Result.YES; + } + }); + ''; + + services.xserver = { + enable = true; + + # Don't start the X server by default. + autorun = mkForce false; + + # Automatically login as live user. + displayManager.slim = { + enable = true; + defaultUser = "live"; + autoLogin = true; + }; + + }; + + # Provide networkmanager for easy wireless configuration. + networking.networkmanager.enable = true; + networking.wireless.enable = mkForce false; + + # KDE complains if power management is disabled (to be precise, if + # there is no power management backend such as upower). + powerManagement.enable = true; + + environment.systemPackages = [ + # Include gparted for partitioning disks. + pkgs.gparted + + # Include some editors. + pkgs.vim + pkgs.bvi # binary editor + pkgs.joe + + # Firefox for reading the manual. + pkgs.firefox + + pkgs.glxinfo + ]; + +} diff --git a/nixos/modules/installer/cd-dvd/installation-cd-graphical-gnome.nix b/nixos/modules/installer/cd-dvd/installation-cd-graphical-gnome.nix index 4c4e69d60d9c7..ad319c2d5786d 100644 --- a/nixos/modules/installer/cd-dvd/installation-cd-graphical-gnome.nix +++ b/nixos/modules/installer/cd-dvd/installation-cd-graphical-gnome.nix @@ -6,16 +6,9 @@ with lib; { - imports = [ ./installation-cd-base.nix ]; + imports = [ ./installation-cd-graphical-base.nix ]; services.xserver = { - enable = true; - # GDM doesn't start in virtual machines with ISO - displayManager.slim = { - enable = true; - defaultUser = "root"; - autoLogin = true; - }; desktopManager.gnome3 = { enable = true; extraGSettingsOverrides = '' @@ -33,46 +26,10 @@ with lib; }; }; - environment.systemPackages = - [ # Include gparted for partitioning disks. - pkgs.gparted - - # Include some editors. - pkgs.vim - pkgs.bvi # binary editor - pkgs.joe - - pkgs.glxinfo - ]; - - # Don't start the X server by default. - services.xserver.autorun = mkForce false; - - # Auto-login as root. + # Auto-login as live. services.xserver.displayManager.gdm.autoLogin = { enable = true; - user = "root"; + user = "live"; }; - system.activationScripts.installerDesktop = let - # Must be executable - desktopFile = pkgs.writeScript "nixos-manual.desktop" '' - [Desktop Entry] - Version=1.0 - Type=Link - Name=NixOS Manual - URL=${config.system.build.manual.manual}/share/doc/nixos/index.html - Icon=system-help - ''; - - # use cp and chmod +x, we must be sure the apps are in the nix store though - in '' - mkdir -p /root/Desktop - ln -sfT ${desktopFile} /root/Desktop/nixos-manual.desktop - cp ${pkgs.gnome3.gnome-terminal}/share/applications/gnome-terminal.desktop /root/Desktop/gnome-terminal.desktop - chmod a+rx /root/Desktop/gnome-terminal.desktop - cp ${pkgs.gparted}/share/applications/gparted.desktop /root/Desktop/gparted.desktop - chmod a+rx /root/Desktop/gparted.desktop - ''; - } diff --git a/nixos/modules/installer/cd-dvd/installation-cd-graphical-kde.nix b/nixos/modules/installer/cd-dvd/installation-cd-graphical-kde.nix index 63227d5734954..d010f5264ffd7 100644 --- a/nixos/modules/installer/cd-dvd/installation-cd-graphical-kde.nix +++ b/nixos/modules/installer/cd-dvd/installation-cd-graphical-kde.nix @@ -6,18 +6,9 @@ with lib; { - imports = [ ./installation-cd-base.nix ]; + imports = [ ./installation-cd-graphical-base.nix ]; services.xserver = { - enable = true; - - # Automatically login as root. - displayManager.slim = { - enable = true; - defaultUser = "root"; - autoLogin = true; - }; - desktopManager.plasma5 = { enable = true; enableQt4Support = false; @@ -27,34 +18,14 @@ with lib; synaptics.enable = true; }; - environment.systemPackages = - [ pkgs.glxinfo - - # Include gparted for partitioning disks. - pkgs.gparted - - # Firefox for reading the manual. - pkgs.firefox - - # Include some editors. - pkgs.vim - pkgs.bvi # binary editor - pkgs.joe - ]; - - # Provide networkmanager for easy wireless configuration. - networking.networkmanager.enable = true; - networking.wireless.enable = mkForce false; - - # KDE complains if power management is disabled (to be precise, if - # there is no power management backend such as upower). - powerManagement.enable = true; - - # Don't start the X server by default. - services.xserver.autorun = mkForce false; + environment.systemPackages = with pkgs; [ + # Graphical text editor + kate + ]; system.activationScripts.installerDesktop = let - desktopFile = pkgs.writeText "nixos-manual.desktop" '' + + manualDesktopFile = pkgs.writeScript "nixos-manual.desktop" '' [Desktop Entry] Version=1.0 Type=Application @@ -63,11 +34,23 @@ with lib; Icon=text-html ''; + # Replace default gparted desktop file with one that does "sudo gparted" + gpartedDesktopFile = pkgs.runCommand "gparted.desktop" {} '' + mkdir -p $out + cp ${pkgs.gparted}/share/applications/gparted.desktop $out/gparted.desktop + substituteInPlace $out/gparted.desktop --replace "Exec=" "Exec=sudo " + ''; + + desktopDir = "/home/live/Desktop/"; + in '' - mkdir -p /root/Desktop - ln -sfT ${desktopFile} /root/Desktop/nixos-manual.desktop - ln -sfT ${pkgs.konsole}/share/applications/org.kde.konsole.desktop /root/Desktop/org.kde.konsole.desktop - ln -sfT ${pkgs.gparted}/share/applications/gparted.desktop /root/Desktop/gparted.desktop + mkdir -p ${desktopDir} + chown live /home/live ${desktopDir} + + ln -sfT ${manualDesktopFile} ${desktopDir + "nixos-manual.desktop"} + ln -sfT ${gpartedDesktopFile}/gparted.desktop ${desktopDir + "gparted.desktop"} + + ln -sfT ${pkgs.konsole}/share/applications/org.kde.konsole.desktop ${desktopDir + "org.kde.konsole.desktop"} ''; }