diff --git a/nixos/doc/manual/installation/installing.xml b/nixos/doc/manual/installation/installing.xml index 742376378dea8..6019feb096696 100644 --- a/nixos/doc/manual/installation/installing.xml +++ b/nixos/doc/manual/installation/installing.xml @@ -29,13 +29,14 @@ - You are logged-in automatically as root. (The - root user account has an empty password.) + You are logged-in automatically as live. + The live user account has an empty password so you + can use sudo without a password. If you downloaded the graphical ISO image, you can run systemctl - start display-manager to start KDE. If you want to continue on the + start display-manager to start the desktop environment. If you want to continue on the terminal, you can use loadkeys to switch to your preferred keyboard layout. (We even provide neo2 via loadkeys de neo!) diff --git a/nixos/doc/manual/release-notes/rl-1909.xml b/nixos/doc/manual/release-notes/rl-1909.xml index 6f049005ab694..e1debff859c43 100644 --- a/nixos/doc/manual/release-notes/rl-1909.xml +++ b/nixos/doc/manual/release-notes/rl-1909.xml @@ -33,6 +33,17 @@ PHP 7.1 is no longer supported due to upstream not supporting this version for the entire lifecycle of the 19.09 release. + + + The installer now uses a less privileged live user whereas before we logged in as root. + To gain root privileges use sudo without a password. + + + + + We now distribute a GNOME3 graphical ISO. + + diff --git a/nixos/modules/installer/cd-dvd/installation-cd-graphical-base.nix b/nixos/modules/installer/cd-dvd/installation-cd-graphical-base.nix index f65239a5bc0ae..b6d62c6454d40 100644 --- a/nixos/modules/installer/cd-dvd/installation-cd-graphical-base.nix +++ b/nixos/modules/installer/cd-dvd/installation-cd-graphical-base.nix @@ -8,6 +8,16 @@ with lib; { imports = [ ./installation-cd-base.nix ]; + # Whitelist wheel users to do anything + # This is useful for things like pkexec + security.polkit.extraConfig = '' + polkit.addRule(function(action, subject) { + if (subject.isInGroup("wheel")) { + return polkit.Result.YES; + } + }); + ''; + services.xserver = { enable = true; @@ -17,7 +27,7 @@ with lib; # Automatically login as root. displayManager.slim = { enable = true; - defaultUser = "root"; + defaultUser = "live"; autoLogin = true; }; @@ -33,7 +43,6 @@ with lib; # Enable sound in graphical iso's. hardware.pulseaudio.enable = true; - hardware.pulseaudio.systemWide = true; # Needed since we run plasma as root. environment.systemPackages = [ # Include gparted for partitioning disks. diff --git a/nixos/modules/installer/cd-dvd/installation-cd-graphical-gnome.nix b/nixos/modules/installer/cd-dvd/installation-cd-graphical-gnome.nix index 0b813bbf37b4c..1a44a27f35282 100644 --- a/nixos/modules/installer/cd-dvd/installation-cd-graphical-gnome.nix +++ b/nixos/modules/installer/cd-dvd/installation-cd-graphical-gnome.nix @@ -10,12 +10,19 @@ with lib; services.xserver.desktopManager.gnome3.enable = true; - services.xserver.displayManager.slim.enable = mkForce false; + services.xserver.displayManager.slim.enable = lib.mkForce false; - # Auto-login as root. - services.xserver.displayManager.gdm.autoLogin = { + # wayland can be problematic for some hardware + services.xserver.desktopManager.default = "gnome-xorg"; + + services.xserver.displayManager.gdm = { enable = true; - user = "root"; + # This might be problematic on a live system + autoSuspend = false; + autoLogin = { + enable = true; + user = "live"; + }; }; } diff --git a/nixos/modules/installer/cd-dvd/installation-cd-graphical-kde-new-kernel.nix b/nixos/modules/installer/cd-dvd/installation-cd-graphical-plasma5-new-kernel.nix similarity index 55% rename from nixos/modules/installer/cd-dvd/installation-cd-graphical-kde-new-kernel.nix rename to nixos/modules/installer/cd-dvd/installation-cd-graphical-plasma5-new-kernel.nix index 3336d512cfd86..d98325a99ac2a 100644 --- a/nixos/modules/installer/cd-dvd/installation-cd-graphical-kde-new-kernel.nix +++ b/nixos/modules/installer/cd-dvd/installation-cd-graphical-plasma5-new-kernel.nix @@ -1,7 +1,7 @@ { pkgs, ... }: { - imports = [ ./installation-cd-graphical-kde.nix ]; + imports = [ ./installation-cd-graphical-plasma5.nix ]; boot.kernelPackages = pkgs.linuxPackages_latest; } diff --git a/nixos/modules/installer/cd-dvd/installation-cd-graphical-kde.nix b/nixos/modules/installer/cd-dvd/installation-cd-graphical-plasma5.nix similarity index 51% rename from nixos/modules/installer/cd-dvd/installation-cd-graphical-kde.nix rename to nixos/modules/installer/cd-dvd/installation-cd-graphical-plasma5.nix index 1c3c9cb30b41b..32b32d8a37d0a 100644 --- a/nixos/modules/installer/cd-dvd/installation-cd-graphical-kde.nix +++ b/nixos/modules/installer/cd-dvd/installation-cd-graphical-plasma5.nix @@ -1,5 +1,5 @@ # This module defines a NixOS installation CD that contains X11 and -# Plasma5. +# Plasma 5. { config, lib, pkgs, ... }: @@ -30,15 +30,27 @@ with lib; Version=1.0 Type=Application Name=NixOS Manual - Exec=firefox ${config.system.build.manual.manualHTMLIndex} + Exec=firefox ${config.system.build.manual.manual}/share/doc/nixos/index.html Icon=text-html ''; + # Replace default gparted desktop file with one that does "sudo gparted" + gpartedDesktopFile = pkgs.runCommand "gparted.desktop" {} '' + mkdir -p $out + cp ${pkgs.gparted}/share/applications/gparted.desktop $out/gparted.desktop + substituteInPlace $out/gparted.desktop --replace "Exec=" "Exec=sudo " + ''; + + desktopDir = "/home/live/Desktop/"; + in '' - mkdir -p /root/Desktop - ln -sfT ${manualDesktopFile} /root/Desktop/nixos-manual.desktop - ln -sfT ${pkgs.konsole}/share/applications/org.kde.konsole.desktop /root/Desktop/org.kde.konsole.desktop - ln -sfT ${pkgs.gparted}/share/applications/gparted.desktop /root/Desktop/gparted.desktop + mkdir -p ${desktopDir} + chown live /home/live ${desktopDir} + + ln -sfT ${manualDesktopFile} ${desktopDir + "nixos-manual.desktop"} + ln -sfT ${gpartedDesktopFile}/gparted.desktop ${desktopDir + "gparted.desktop"} + + ln -sfT ${pkgs.konsole}/share/applications/org.kde.konsole.desktop ${desktopDir + "org.kde.konsole.desktop"} ''; } diff --git a/nixos/modules/profiles/installation-device.nix b/nixos/modules/profiles/installation-device.nix index 580ea4a58e5b4..55d800175c7ba 100644 --- a/nixos/modules/profiles/installation-device.nix +++ b/nixos/modules/profiles/installation-device.nix @@ -32,17 +32,33 @@ with lib; #services.rogue.enable = true; # Disable some other stuff we don't need. - security.sudo.enable = mkDefault false; services.udisks2.enable = mkDefault false; + # Use less privileged live user + users.users.live = { + isNormalUser = true; + extraGroups = [ "wheel" "networkmanager" "video" ]; + # Allow the graphical user to login without password + initialHashedPassword = ""; + }; + + # Allow the user to log in as root without a password. + users.users.root.initialHashedPassword = ""; + + # Allow passwordless sudo from live user + security.sudo = { + enable = mkDefault true; + wheelNeedsPassword = mkForce false; + }; + # Automatically log in at the virtual consoles. - services.mingetty.autologinUser = "root"; + services.mingetty.autologinUser = "live"; # Some more help text. services.mingetty.helpLine = '' - The "root" account has an empty password. ${ + The "live" and "root" account have empty passwords. ${ optionalString config.services.xserver.enable "Type `systemctl start display-manager' to\nstart the graphical user interface."} ''; @@ -86,8 +102,5 @@ with lib; # because we have the firewall enabled. This makes installs from the # console less cumbersome if the machine has a public IP. networking.firewall.logRefusedConnections = mkDefault false; - - # Allow the user to log in as root without a password. - users.users.root.initialHashedPassword = ""; }; } diff --git a/nixos/release-combined.nix b/nixos/release-combined.nix index b9a9515f94efd..1e7d4695b0072 100644 --- a/nixos/release-combined.nix +++ b/nixos/release-combined.nix @@ -54,7 +54,8 @@ in rec { (all nixos.dummy) (all nixos.manual) - nixos.iso_graphical.x86_64-linux or [] + nixos.iso_graphical_plasma5.x86_64-linux or [] + nixos.iso_graphical_gnome3.x86_64-linux or [] nixos.iso_minimal.aarch64-linux or [] nixos.iso_minimal.i686-linux or [] nixos.iso_minimal.x86_64-linux or [] diff --git a/nixos/release.nix b/nixos/release.nix index df2c52ccd0b66..b3f36e76bc4ad 100644 --- a/nixos/release.nix +++ b/nixos/release.nix @@ -149,9 +149,15 @@ in rec { inherit system; }); - iso_graphical = forMatchingSystems [ "x86_64-linux" ] (system: makeIso { - module = ./modules/installer/cd-dvd/installation-cd-graphical-kde.nix; - type = "graphical"; + iso_graphical_plasma5 = forMatchingSystems [ "x86_64-linux" ] (system: makeIso { + module = ./modules/installer/cd-dvd/installation-cd-graphical-plasma5.nix; + type = "graphical-plasma5"; + inherit system; + }); + + iso_graphical_gnome3 = forMatchingSystems [ "x86_64-linux" ] (system: makeIso { + module = ./modules/installer/cd-dvd/installation-cd-graphical-gnome.nix; + type = "graphical-gnome3"; inherit system; });