nixpkgs/nixos/modules/system/boot
Grimmauld fb51cc802d
nixos/systemd: run0: enable setLoginUid, disable pamMount
This brings our `run0` in line with the upstream defaults:
bcc73cafdb/src/run/systemd-run0.in

While working on `auditd`, i noticed differences in how `run0` behaves
in regard to `/proc/$pid/sessionid` and `/proc/$pid/loginuid`. Particularly,
both files were set to `4294967295`, the magic value denoting `unset`.

While the manual page says elevators such as sudo should not set the loginuid,
run0 is a bit of a special case: The unit spawned by it is not child of
the running user session, and as such there is no id to inherit.

`systemd` upstream uses `pam_loginuid`, and for consistency we should too.
Especially because it prevents a whole lot of pain when working with `auditd`.

As to pam mounts:
On nixos we enable those if they are globally enabled. Upstream does not.
Considering the password entered into polkit is usually not the user password
of the account which will own the unit, pam mount will fail for any partition
which requires a password. Thus it makes sense to also disable pam mounts
for our run0, it prevents unnecessary unexpected pain.
2025-07-25 23:49:59 +02:00
..
loader treewide: run nixfmt 1.0.0 2025-07-24 13:55:40 +02:00
systemd treewide: run nixfmt 1.0.0 2025-07-24 13:55:40 +02:00
binfmt.nix treewide: run nixfmt 1.0.0 2025-07-24 13:55:40 +02:00
clevis.md treewide: run treefmt with mdcr/nixfmt 2025-07-24 13:52:31 +02:00
clevis.nix nixos/clevis: fix clevis in scripted initrd 2025-05-25 01:34:06 +02:00
emergency-mode.nix emergencyMode, emergencyAccess: cross reference options in docs. 2025-05-24 14:01:22 +07:00
grow-partition.nix
initrd-network.nix
initrd-openvpn.nix
initrd-ssh.nix treewide: run nixfmt 1.0.0 2025-07-24 13:55:40 +02:00
kernel.nix treewide: run nixfmt 1.0.0 2025-07-24 13:55:40 +02:00
kernel_config.nix
kexec.nix
luksroot.nix treewide: run nixfmt 1.0.0 2025-07-24 13:55:40 +02:00
modprobe.nix lib.types.attrNamesToTrue: unpublish temporarily 2025-05-16 11:52:36 +02:00
networkd.nix treewide: run nixfmt 1.0.0 2025-07-24 13:55:40 +02:00
nix-store-veritysetup.nix nixos/nix-store-veritysetup: init 2025-06-16 10:28:53 +02:00
pbkdf2-sha512.c
plymouth.nix treewide: run nixfmt 1.0.0 2025-07-24 13:55:40 +02:00
resolved.nix treewide: run nixfmt 1.0.0 2025-07-24 13:55:40 +02:00
shutdown.nix
stage-1-init.sh nixos/stage-1.init.sh: only remount bind fsType 2025-05-30 12:13:13 +05:30
stage-1.nix treewide: run nixfmt 1.0.0 2025-07-24 13:55:40 +02:00
stage-2-init.sh nixos/stage-2-init: support nosuid/nodev mount options for /nix/store 2025-05-18 12:07:10 +02:00
stage-2.nix nixos/stage-2-init: remove 'readOnlyNixStore' option 2025-05-18 12:08:03 +02:00
stratisroot.nix treewide: run nixfmt 1.0.0 2025-07-24 13:55:40 +02:00
systemd.nix nixos/systemd: run0: enable setLoginUid, disable pamMount 2025-07-25 23:49:59 +02:00
timesyncd.nix treewide: run nixfmt 1.0.0 2025-07-24 13:55:40 +02:00
tmp.nix
uki.nix treewide: run nixfmt 1.0.0 2025-07-24 13:55:40 +02:00
unl0kr.nix nixos/unl0kr: fix touchpads 2025-05-09 00:29:43 +02:00
uvesafb.nix
zram-as-tmp.nix nixos/boot: add boot.tmp.useZram options 2025-05-24 23:01:41 +08:00