fix: harden nix by only allowing wheel users to configure daemon (#149)

tuckershea · Dec 16, 2024 · b2adcad · b2adcad
1 parent 964bec2
commit b2adcad
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/hosts/common/nixos/cis-hardening.nix b/hosts/common/nixos/cis-hardening.nix
@@ -24,7 +24,7 @@
 
   boot.kernelPackages = pkgs.linuxPackages_hardened;
 
-  nix.settings.allowed-users = [ "@users" ];
+  nix.settings.allowed-users = [ "@wheel" ];
 
   environment.memoryAllocator.provider = "scudo";
   environment.variables.SCUDO_OPTIONS = "ZeroContents=1";

diff --git a/hosts/common/users/tuckershea/default.nix b/hosts/common/users/tuckershea/default.nix
@@ -21,7 +21,7 @@ in {
     // lib.optionalAttrs stdenv.isLinux {
       group = "tuckershea";
       isNormalUser = true;
-      extraGroups = ["wheel"];
+      extraGroups = [ "wheel" ];
     };
 
   users.groups.tuckershea = {};