rebmit/nixos-config
1
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

security/sudo: disable lecture and no longer persist /var/db

Browse source
This commit is contained in:
Lu Wang 2024-12-14 02:02:41 +08:00
parent ee55e4a237
commit 2f202aac57
Signed by: rebmit
SSH key fingerprint: SHA256:3px8QV1zEerIrEWHaqtH5rR9kjetyRST5EipOPrd+bU
3 changed files with 12 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
flake/nixos.nix
View file

@ -17,6 +17,7 @@ let
# keep-sorted start # keep-sorted start
programs.tools.common programs.tools.common
security.polkit security.polkit
security.sudo
services.dbus services.dbus
services.journald services.journald
services.openssh services.openssh

10
nixos/profiles/security/sudo/default.nix Normal file
View file

@ -0,0 +1,10 @@
{ ... }:
{
security.sudo = {
execWheelOnly = true;
wheelNeedsPassword = true;
extraConfig = ''
Defaults lecture="never"
'';
};
}

2
nixos/profiles/system/global-persistence.nix
View file

@ -2,7 +2,7 @@
{ {
environment.globalPersistence = { environment.globalPersistence = {
directories = [ directories = [
"/var/db" "/var/cache"
"/var/lib" "/var/lib"
"/var/log" "/var/log"
"/var/tmp" "/var/tmp"