33 lines
690 B
Nix
33 lines
690 B
Nix
{ pkgs, lib, ... }: {
|
|
security = {
|
|
rtkit.enable = true;
|
|
pam.services.hyprlock = {};
|
|
|
|
polkit = {
|
|
enable = true;
|
|
adminIdentities = [
|
|
"unix-group:wheel"
|
|
];
|
|
};
|
|
|
|
# For security reasons, we are disabling the use of regular sudo and...
|
|
sudo = {
|
|
enable = lib.mkForce false;
|
|
};
|
|
|
|
# ...switching over to sudo-rs which is a Rust rewrite of sudo.
|
|
# See https://cybersecsentinel.com/cve-2025-32463-privilege-escalation-in-sudo-triggers-urgent-linux-patching/.
|
|
sudo-rs = {
|
|
enable = true;
|
|
wheelNeedsPassword = true;
|
|
execWheelOnly = true;
|
|
};
|
|
};
|
|
|
|
environment.systemPackages = [
|
|
pkgs.vulnix
|
|
];
|
|
}
|
|
|
|
|