I'd call it a useful hack
---
modules/services/misc/autofs.nix | 74 +++++++++++++++++++++++++++-----------
1 files changed, 53 insertions(+), 21 deletions(-)
diff --git a/modules/services/misc/autofs.nix b/modules/services/misc/autofs.nix
index ec92212..ed0d0bd 100644
--- a/modules/services/misc/autofs.nix
+++ b/modules/services/misc/autofs.nix
@@ -6,28 +6,54 @@ let
cfg = config.services.autofs;
- # Try all running ssh-agents. They may know how to connect to the target.
- # This is more secure than using keys without passphrases!
+
+ # ugly but helpful script: if the sshfs mount arguments contain uid= setting
+ # it will try connecting to the remote location using all ssh-agents run by
that user.
+ # As the mount is done using sudo only that user can access it unless you use
+ # mount options such as allow_other
+ # See example autoMaster below.
sshfsWrapped = pkgs.writeScriptBin "sshfs-wrapped" ''
#!/bin/sh -e
- export
PATH=${pkgs.sshfsFuse}/bin:${pkgs.openssh}/bin:${pkgs.procps}/bin:${pkgs.lsof}/bin:${pkgs.gnused}/bin/
+
+ # This is to be run by automount when mounting sshfs-fuse filesystems
+ # for each running ssh-agent it will try connecting using its pid
+ # and auth socket only if the ssh-agent is running as uid = uid of mount
+ # target
+ # This should be much more secure than using empty passwords
+
+ # setuid-wrappers for fusermount
+ export
PATH=/var/setuid-wrappers:${pkgs.coreutils}/bin:${pkgs.sshfsFuse}/bin:${pkgs.openssh}/bin:${pkgs.procps}/bin:${pkgs.lsof}/bin:${pkgs.gnused}/bin/:${pkgs.sudo}/bin
pids=`pgrep ssh-agent`
+ # get uid=nr from arguments
+ uid=$(echo "$@"| sed -n 's...@.*uid=\([0123456789]\+\)....@\1@p')
connect(){
- sshfs -o ssh_command="ssh -o NumberOfPasswordPrompts=0" "$@" \
+ sudo=$1; shift
+ $sudo sshfs -o ssh_command="ssh -o NumberOfPasswordPrompts=0" "$@" \
&& exit 0 || true
}
- if [ -z "$pids" ]; then
- # no ssh-agent found. Maybe there is a key without password ? You
should not be using this!
- connect "$@"
- else
- for p in $pids; do
+ # Change ownership of mountpoint. Ownership will be overridden when mount
suceeds.
+ # Otherwise fusermount can't access it (?!)
+ chown $uid "$2"
+ chmod u+w "$2"
+ for p in $pids; do
+ res="$(lsof -p $p -a -U -Fnu)"
+ user_id=$(echo "$res"| sed -n 's/^u//p')
+ if [ "$user_id" == "$uid" ]; then
+ export SSH_AUTH_SOCK=$(echo "$res"| sed -n 's/^n//p')
export SSH_AGENT_PID=$p
- export SSH_AUTH_SOCK=$(lsof -p $p -a -U -Fn | sed -n 's/^n//p')
echo "trying to connect using ssh-agent $p $SSH_AUTH_SOCK" 1>&2
- connect "$@"
- done
- exit 1
- fi
+ # by using sudo -u allow accessing mount by target user - Is there a
better way to achieve this??
+ connect "sudo -E -u#$user_id" "$@"
+ echo -n " .. failed" 1>&2
+ fi
+ done
+ unset SSH_AGENT_PID; unset SSH_AUTH_SOCK
+
+ # no ssh-agent found or they all belong to different users..
+ # Try again. Maybe there is a key without password ?
+ # You should not be using this!
+ connect "" "$@"
+ exit 1
'';
in
@@ -42,7 +68,9 @@ in
enable = mkOption {
default = false;
description = "
- automatically mount and unmount filesystems
+ automatically mount and unmount filesystems.
+ Note: You should also know about afuse. But afuse doesn't unmount
automatically.
+ Known BUGS: If you cd /auto; pkill -TERM automount then /auto/*
won't be unmounted (Try umount -l /auto)
";
};
@@ -59,7 +87,8 @@ in
server -rw,hard,intr / -ro myserver.me.org:/ \
/usr myserver.me.org:/usr \
/home myserver.me.org:/home
- sshfstarget
-fstype=fuse,rw,nodev,nonempty,noatime,allow_other,max_read=65536,uid=YOUR_LOCAL_UID,gid=YOUR_LOCAL_GID
''${sshfs}:/home/marc/bin/sshfs\#u...@host\:
+ # replace constants:
+ sshfstarget
-fstype=fuse,rw,nodev,nonempty,noatime,max_read=65536,uid=LOCAL_UID,gid=LOCAL_GID
''${sshfs}\#u...@host\:
''';
in '''
/auto file:''${mapConf}
@@ -67,8 +96,7 @@ in
'';
description = "
file contents of /etc/auto.master. See man auto.master
- see
- man auto.master and man 5 autofs
+ See man 5 auto.master and man 5 autofs.
";
apply = textOrFunc: if builtins.isFunction textOrFunc then
@@ -80,6 +108,11 @@ in
else textOrFunc;
};
+ kernelModules = mkOption {
+ default = ["fuse"];
+ description="kernel modules to load";
+ };
+
timeout = mkOption {
default = 600;
description = "Set the global minimum timeout, in seconds, until
directories are unmounted";
@@ -115,9 +148,8 @@ in
};
preStart =
- ''
- modprobe autofs4 || true
- '';
+ pkgs.lib.concatMapStrings (module : "modprobe ${module} || true\n")
+ (["autofs4"] ++ cfg.kernelModules);
preStop =
''
--
1.6.5.6
_______________________________________________
nix-dev mailing list
[email protected]
https://mail.cs.uu.nl/mailman/listinfo/nix-dev
