Skip to content

Commit

Permalink
nixos/stage-1: check secret paths before copying
Browse files Browse the repository at this point in the history
Fixes #84976.
  • Loading branch information
emilazy committed Apr 11, 2020
1 parent 8a37c3d commit 91c6809
Showing 1 changed file with 21 additions and 0 deletions.
21 changes: 21 additions & 0 deletions nixos/modules/system/boot/stage-1.nix
Original file line number Diff line number Diff line change
Expand Up @@ -137,6 +137,8 @@ let
''}
# Copy secrets if needed.
#
# TODO: move out to a separate script; see #85000.
${optionalString (!config.boot.loader.supportsInitrdSecrets)
(concatStringsSep "\n" (mapAttrsToList (dest: source:
let source' = if source == null then dest else source; in
Expand Down Expand Up @@ -579,6 +581,25 @@ in
message = "boot.resumeDevice has to be an absolute path."
+ " Old \"x:y\" style is no longer supported.";
}
# TODO: remove when #85000 is fixed
{ assertion = !config.boot.loader.supportsInitrdSecrets ->
all (source:
builtins.isPath source ||
(builtins.isString source && hasPrefix source builtins.storeDir))
(attrValues config.boot.initrd.secrets);
message = ''
boot.loader.initrd.secrets values must be unquoted paths when
using a bootloader that doesn't natively support initrd
secrets, e.g.:
boot.initrd.secrets = {
"/etc/secret" = /path/to/secret;
};
Note that this will result in all secrets being stored
world-readable in the Nix store!
'';
}
];

system.build =
Expand Down

0 comments on commit 91c6809

Please sign in to comment.