nixos/wireless: add enableHardening option by rnhmjoj · Pull Request #484382 · NixOS/nixpkgs

rnhmjoj · 2026-01-27T13:12:15Z

This may be necessary for more complex enterprise networks (for example requiring access to mutable files, smart cards or TPM devices), as pointed out in #480355 (comment).

Things done

nixos/modules/services/networking/wpa_supplicant.nix

theCapypara · 2026-01-27T18:07:39Z

Should this maybe be off by default based on the stateVersion?
(stateVersion <= "25.11" -> off, else on?)

rnhmjoj · 2026-01-27T19:35:37Z

Should this maybe be off by default based on the stateVersion?

There's no need: I intentionally postponed merging the hardening changes after 25.11 and I will not backport them, of course.

rnhmjoj · 2026-01-30T09:57:53Z

All the nixosTests.wpa_supplicant tests are passing with enableHardening = false, so the capabilities trick seems to work.
If someone could confirm this unbreaks the enterprisey setup, I will merge this now.

rnhmjoj · 2026-01-30T12:11:55Z

@tazjin, please check the new version of the PR.

SuperSandro2000 · 2026-01-30T12:59:41Z

nixos/modules/services/networking/wpa_supplicant.nix

+        ExecStartPre =
+          lib.optionals (cfg.allowAuxiliaryImperativeNetworks || !hasDeclarative) [
+            # set up imperative config file
+            "+${pkgs.coreutils}/bin/touch /etc/wpa_supplicant/imperative.conf"
+            "+${pkgs.coreutils}/bin/chmod 664 /etc/wpa_supplicant/imperative.conf"
+            "+${pkgs.coreutils}/bin/chown -R wpa_supplicant:wpa_supplicant /etc/wpa_supplicant"
+          ]
+          ++ lib.optionals cfg.userControlled [
+            # set up client sockets directory
+            "+${pkgs.coreutils}/bin/mkdir /run/wpa_supplicant/client"
+            "+${pkgs.coreutils}/bin/chown wpa_supplicant:wpa_supplicant /run/wpa_supplicant/client"
+            "+${pkgs.coreutils}/bin/chmod g=u /run/wpa_supplicant/client"
+          ];


Those should really be in tmpfiles 😓

I get that systemd-tmpfiles has a neater syntax and was made for this sort of thing, but it provides less guarantees. If the files permissions gets messed up or they get deleted, wpa_supplicant will fails to start until you reboot; with the setup in ExecStartPre it just works.

SuperSandro2000 · 2026-01-30T13:00:00Z

nixos/modules/services/networking/wpa_supplicant.nix

+          "CAP_SYS_ADMIN"
+          "CAP_DAC_OVERRIDE"


Can we add a TODO to revisit those in the future?

Now the daemon runs with full previleges again if enableHardening = false. I don't think we should try to make it more balanced: the setups that break under enableHardening are rare and complicated to reason about.

nixos/modules/services/networking/wpa_supplicant.nix

tazjin · 2026-01-30T13:43:43Z

@tazjin, please check the new version of the PR.

Doesn't work, in fact it triggered new kinds of errors I haven't seen before which also prevented wpa_supplicant from starting:

янв 30 16:02:13 khamovnik systemd[1]: Starting WPA Supplicant instance...
янв 30 16:02:13 khamovnik systemd[1]: Started WPA Supplicant instance.
янв 30 16:02:13 khamovnik wpa_supplicant[1244868]: dbus: Could not request service name: org.freedesktop.DBus.Error.AccessDenied Connection ":1.2340" is not allowed to own the service "fi.w1.wpa_supplicant1" due to security policies in the configuration file
янв 30 16:02:13 khamovnik wpa_supplicant[1244868]: Failed to initialize wpa_supplicant
янв 30 16:02:13 khamovnik systemd[1]: wpa_supplicant.service: Main process exited, code=exited, status=255/EXCEPTION

Here is my own commit which properly disables the hardening changes and makes things work again: tazjin@4f18477

rnhmjoj · 2026-01-31T00:18:35Z

is not allowed to own the service "fi.w1.wpa_supplicant1" due to security policies in the configuration file

There's something strange going on here: the dbus interface is tested in nixosTest.wpa_supplicant.basic and the test is passing with enableHardening = false. The policy being referred by the error message is this bit:

<policy user="wpa_supplicant">
    <allow own="fi.w1.wpa_supplicant1"/>
</policy>

It looks like you're running not running wpa_supplicant with the right user, or did not apply unprivileged patch.
Can you share your configuration for testing?

Here is my own commit which properly disables the hardening changes and makes things work again: tazjin@4f18477

Well, this is problematic: the unprivileged patch moves the location of the socket dir, so enableHardening = false will break wpa_cli and wpa_gui. That's why I wasn't doing it.

tazjin · 2026-01-31T13:13:20Z

Well, this is problematic: the unprivileged patch moves the location of the socket dir, so enableHardening = false will break wpa_cli and wpa_gui. That's why I wasn't doing it.

This would be fixed by also making the path in the config depending on the toggle, no? I don't use userControlled fwiw. My take is that disabling hardening should ... disable hardening, including all the changes that were made to enable it.

uninsane · 2026-02-02T05:52:28Z

nixos/modules/services/networking/wpa_supplicant.nix

      };

+      enableHardening = mkOption {
+        default = false;


don't forget to add a line that assigns this to true in nixos/modules/profiles/hardened.nix

Actually this was a left-over from testing. It's supposed to be on by default.

This may be necessary for more complex enterprise networks (for example requiring access to mutable files, smart cards or TPM devices), as pointed out in NixOS#480355 (comment).

rnhmjoj · 2026-02-02T10:54:05Z

Ok, I think I have a solution.

It turns out the patch works regardless of which user the daemon is running as. The only thing that depends on the user is the dbus auto-start mechanism, however wpa_supplicant is a systemd service, so the User= property is actually ignored.

So, I left User=root in the dbus service file, and just updated the dbus policy to allow either root or wpa_supplicant to own the interface.

I tested all nixosTests.wpa_supplicant and nixosTests.networking.networkmanager with or without enableHardening and everything looks ok. I also added a subtest for the dbus autostarting.

tazjin · 2026-02-07T09:30:20Z

@rnhmjoj Sorry for the delay, didn't get around to testing it during the week ...

With your commit, the diff to my previous unit is minimal:

and the connection works, so from my perspective this resolves the issue. I'm fine with keeping the default enabled, people with these kinds of complex network setups will probably find the toggle.

Code looks fine, and I support your explicit use of ExecStartPre over more systemd magic.

sternenseemann · 2026-02-07T11:25:56Z

I support your explicit use of ExecStartPre over more systemd magic.

I don't think this should be a point of discussion here anyway, that code is unchanged and has just been moved around for this change.

sternenseemann · 2026-02-07T11:31:39Z

So, I left User=root in the dbus service file, and just updated the dbus policy to allow either root or wpa_supplicant to own the interface.

Does this mean that some things will run as root when activated via dbus? Maybe we should override the setting if enableHardening is on which should be possible using systemd.services.….

rnhmjoj · 2026-02-07T13:34:51Z

Does this mean that some things will run as root when activated via dbus?

No, the service runs with the correct user even when activated by dbus, because in this case dbus simply starts our systemd service. It would be a problem if it were to run the command specified in the dbus service file, but it's not the case.

Maybe we should override the setting if enableHardening is on which should be possible using systemd.services.….

Note that the file in question is a dbus service: it looks like a systemd unit file, but it's a different thing and can't be modified from NixOS. But in this case it doesn't matter.

rnhmjoj mentioned this pull request Jan 27, 2026

nixos/wpa_supplicant: harden and run as unprivileged user #427528

Merged

16 tasks

rnhmjoj force-pushed the pr-wpa-toggle branch from ed506e5 to d0abc5c Compare January 27, 2026 14:19

SuperSandro2000 reviewed Jan 27, 2026

View reviewed changes

nixos/modules/services/networking/wpa_supplicant.nix Outdated Show resolved Hide resolved

nixpkgs-ci bot removed the 9.needs: reviewer This PR currently has no reviewers requested and needs attention. label Jan 27, 2026

rnhmjoj force-pushed the pr-wpa-toggle branch from d0abc5c to 1f00b56 Compare January 27, 2026 16:27

rnhmjoj force-pushed the pr-wpa-toggle branch from 1f00b56 to 80f8e04 Compare January 30, 2026 12:10

SuperSandro2000 reviewed Jan 30, 2026

View reviewed changes

nixos/modules/services/networking/wpa_supplicant.nix Outdated Show resolved Hide resolved

nixos/modules/services/networking/wpa_supplicant.nix Outdated Show resolved Hide resolved

rnhmjoj force-pushed the pr-wpa-toggle branch from 80f8e04 to fbeaf39 Compare January 31, 2026 00:19

uninsane reviewed Feb 2, 2026

View reviewed changes

nixos/wireless: add enableHardening option

4006a9b

This may be necessary for more complex enterprise networks (for example requiring access to mutable files, smart cards or TPM devices), as pointed out in NixOS#480355 (comment).

rnhmjoj force-pushed the pr-wpa-toggle branch from fbeaf39 to 4006a9b Compare February 2, 2026 10:44

rnhmjoj mentioned this pull request Feb 2, 2026

nixos/doc: improve networking.wireless chapter #483534

Merged

9 tasks

rnhmjoj requested a review from tazjin February 3, 2026 15:52

tazjin approved these changes Feb 7, 2026

View reviewed changes

nixpkgs-ci bot added the 12.approvals: 1 This PR was reviewed and approved by one person. label Feb 7, 2026

sternenseemann approved these changes Feb 7, 2026

View reviewed changes

nixpkgs-ci bot added 12.approvals: 2 This PR was reviewed and approved by two persons. and removed 12.approvals: 1 This PR was reviewed and approved by one person. labels Feb 7, 2026

sternenseemann added this pull request to the merge queue Feb 7, 2026

Merged via the queue into NixOS:master with commit c03cfff Feb 7, 2026
37 of 39 checks passed

Uh oh!

Conversation

rnhmjoj commented Jan 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Things done

Uh oh!

Uh oh!

theCapypara commented Jan 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rnhmjoj commented Jan 27, 2026

Uh oh!

rnhmjoj commented Jan 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rnhmjoj commented Jan 30, 2026

Uh oh!

SuperSandro2000 Jan 30, 2026

Choose a reason for hiding this comment

Uh oh!

rnhmjoj Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

SuperSandro2000 Jan 30, 2026

Choose a reason for hiding this comment

Uh oh!

rnhmjoj Feb 3, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

tazjin commented Jan 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rnhmjoj commented Jan 31, 2026

Uh oh!

tazjin commented Jan 31, 2026

Uh oh!

uninsane Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

rnhmjoj Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

rnhmjoj commented Feb 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tazjin commented Feb 7, 2026

Uh oh!

sternenseemann commented Feb 7, 2026

Uh oh!

sternenseemann commented Feb 7, 2026

Uh oh!

rnhmjoj commented Feb 7, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

rnhmjoj commented Jan 27, 2026 •

edited

Loading

theCapypara commented Jan 27, 2026 •

edited

Loading

rnhmjoj commented Jan 30, 2026 •

edited

Loading

tazjin commented Jan 30, 2026 •

edited

Loading

rnhmjoj commented Feb 2, 2026 •

edited

Loading