nixos/security
NixOS module · nixos/modules/security/default.nix
Health
NixOS test
no finished build of nixos/trunk-combined/nixos.tests.security.x86_64-linux
Maintainers
none
Area
Pull requests 76
nixos/tmp: add setting `boot.tmp.perUser`
#572933 by MrQubo · opened 5d ago
nixos/pam (u2f): fix typo in option description
#572212 by fk29g · opened 7d ago
nixos/wrappers: migrate to use overlayfs draft
#570566 by GrimmTheShrimp · opened 11d ago · checks fail
nixos/pam: fix systemd-homed fscrypt integration
#569901 by jmbaur · opened 13d ago · checks pass
nixos/isolate: improve package option and wrapping
#567288 by hey2022 · opened 2w ago
nixos/tpm2: small improvements
#562338 by lunagl · opened 5w ago
nixos/pam: make lastlog optional by default
#546598 by andre4ik3 · opened 2mo ago
nixos/oo7: module improvements
#544377 by salva09 · opened 2mo ago · checks pass
nixos/pam: add globalRules option
#539011 by BiggestGoos · opened 3mo ago · checks fail
[Backport release-26.05] nixos/acme: also allow _PATH-suffixed credential files
#535017 by nixpkgs-ci · opened 3mo ago
nixos/fprintd: Add separate enablePam option to fprintd service
#533026 by Skyb0rg007 · opened 4mo ago
nixos/security/wrappers: avoid linux-headers in closure
#532581 by getchoo · opened 4mo ago · checks pass
nixos/pam: add control and openasroot options to security.pam.oath
#531396 by asiantuntija · opened 4mo ago · checks pass
nixos/security/pam: install unix_chkpwd wrapper with capabilities instead of setuid
#524904 by zackw · opened 4mo ago
nixos/artifacts: backend-agnostic secret management interface draft
#519619 by Mutasem-mk4 · opened 5mo ago · checks fail
nixos/ipa: Exclude common virtual interfaces from dyndns defaults
#512816 by benley · opened 5mo ago
nixos/pam: guard all cross-module dependencies
#507727 by phaer · opened 6mo ago · checks pass
nixos: allow core modules to be evaluated more independently: optionalAttrs
#507695 by phaer · opened 6mo ago · checks pass
nixos/lock-kernel-modules: filter built-in pseudo-filesystems from boot.kernelModules
#506678 by nikzasel · opened 6mo ago
nixos/pam: add motd files and directories options
#501536 by andre4ik3 · opened 7mo ago
nixos/pam: don't fall through to unix for failed systemd_home auth
#501459 by andre4ik3 · opened 7mo ago
nixos/duosec: fix pam.enable
#486213 by EloToJaa · opened 8mo ago · checks pass
pam: adding assertion for use of googleAuthenticator
#483040 by d-goldin · opened 8mo ago · checks pass
nixos/polkit: add `packages` option
#481862 by h7x4 · opened 8mo ago
treewide: remove unused let in definitions
#478796 by jopejoe1 · opened 9mo ago · checks fail
yubico-pam: drop
#469246 by Aleksanaa · opened 10mo ago · checks fail
Remove most usages of `allowSubstitutes = false` and `preferLocalBuild = true` from the tree
#458878 by winterqt · opened 11mo ago
various: lib usage improvements - prefer `==`/`!=` over `length` when checking for emptiness
#455793 by h7x4 · opened 11mo ago
various: lib usage improvements - prefer `concatMap` over `flatten`/`concatLists` + `map`
#455788 by h7x4 · opened 11mo ago · checks pass
nixos/pam_mount: prepend security.wrapperDir to path
#453507 by ConcurAc · opened 12mo ago
cygwin: add a system builder with a working nix draft
#447520 by corngood · opened 12mo ago · checks fail
nixos/modules: remove with lib
#446700 by kuflierl · opened 12mo ago
Update asfp dependences
#440630 by Boom-Hacker · opened 13mo ago · checks pass
nixos: Add meta.tests
#413892 by roberth · opened 16mo ago · checks pass
nixos/pam: Add security.pam.fprintd.enable option
#405034 by adisbladis · opened 17mo ago · checks pass
nixos/selinux: init
#396177 by RossComputerGuy · opened 18mo ago · checks pass
security.acme: support encrypted credentials
#382053 by ceedubs · opened 20mo ago · checks pass
Add NixOS containers (or other `loc`) to crucial warning context
#345975 by roberth · opened 2y ago
nixos/pam: option to disable fprint if laptop lid is closed
#342676 by heywoodlh · opened 2y ago · checks pass
nixos/{assertions,warnings}: implement as tree-like attrs
#342372 by h7x4 · opened 2y ago
nixos/pam: add serviceDefaults
#340197 by xyven1 · opened 2y ago
acme: add TLS ALPN challenge
#340136 by nobodyinperson · opened 2y ago · checks pass
nixos/gnome-keyring: add SSH support by exporting SSH_AUTH_SOCK
#310978 by no-mood · opened 2y ago
nixos/ipa: Enable sudo, authorized_keys, and netgroups integration
#309612 by benley · opened 2y ago
Make gnome-keyring PAM module components configurable
#284173 by avitex · opened 2y ago
nixos/sudo{,-rs}: De-duplicate common code
#263488 by nicoonoclaste · opened 2y ago
nixos/security/ca: Increased description-verbosity
#228534 by sivizius · opened 3y ago
nixos/pam: add option to control how pam_unix hashes passwords draft
#208603 by obadz · opened 3y ago
nixos/pam: add options for access.conf (pam_access)
#184551 by danc86 · opened 4y ago
nixos/rtkit: Disable debug logging and fix sd_notify
#180102 by dasJ · opened 4y ago · checks pass
nixos/security: enable pam_mount when cryptHomeLuks is set
#178431 by christian-burger · opened 4y ago
Introduce a type for options that contain the path to a secret file
#174978 by symphorien · opened 4y ago
nixos/pam: Move `pam_fprintd.so` after `pam_unix.so`
#171140 by skeleten · opened 4y ago
Deprecate global pam options
#166429 by MalteT · opened 4y ago
nixos/pam: add pwquality
#158513 by 06kellyjac · opened 4y ago · checks fail
nixos/users-groups: Allow bypassing the at-least-one-privileged-user check
#153291 by chkno · opened 4y ago
Closed or merged in the synced window 25
staging-nixos merge for 2026-10-11
#572819 by zowoq · merged 5d ago
Reapply "nixos/wrappers: enforce target executable is ELF"
#570085 by GrimmTheShrimp · merged 12d ago
staging-nixos merge for 2026-10-03, attempt #2
#569867 by K900 · merged 13d ago
Revert "nixos/wrappers: enforce target executable is ELF"
#569862 by K900 · merged 13d ago
staging-nixos merge for 2026-10-03
#569772 by zowoq · merged 13d ago
nixos/security.ipa: allow specifying backup server
#568408 by kacper-uminski · merged 9d ago
nixos/wrappers: enforce target executable is ELF
#567913 by GrimmTheShrimp · merged 2w ago
nixos/account-utils, nixos/accounts-daemon: add NSS library path to services
#565369 by Skyb0rg007 · merged 2w ago
nixos/apparmor: use structuredAttrs instead of passAsFile
#563167 by SFrijters · merged 4w ago
nixos/systemd-confinement: fix with PrivateTmp=disconnected
#560614 by NyCodeGHG · merged 5w ago
nixos/polkit: allow devices: yubico and fprintd
#558856 by DerDennisOP · merged 5w ago
nixos/acme: retry a failed order instead of waiting for the daily timer
#555001 by KiaraGrouwstra · closed 7w ago
nixos/acme: Add renewal fail config option
#553704 by eiskasten · merged 3w ago
nixos/wireless: add pkcs11 option for smartcard/TPM EAP-TLS
#550650 by rudenkornk · merged 5w ago
nixos/tpm2: register pkcs11 module with p11-kit
#550647 by rudenkornk · merged 7w ago
nixos.security: remove option unprivilegedUsernsClone
#549611 by 71rd · merged 8w ago
nixos.acme: fix option descriptions
#547175 by 71rd · merged 8w ago
lego: 4.35.2 -> 5.4.1
#539076 by geri1701 · merged 4w ago
rosec: init at 0.0.28
#519494 by Mikilio · merged 7w ago
nixos/tpm2: Documentation changes
#509127 by Skyb0rg007 · merged 8w ago
fscrypt: drop -experimental suffix and corresponding comment
#482520 by jerith666 · merged 5w ago
nixos/config/sysctl: set options from nested set, as they become available
#392127 by illdefined · closed 3w ago
feat: add cue prompt support to pam-u2f
#157047 by mainrs · closed 3w ago
Issues 21
nixos/polkit: service restarts unnecessarily 6.topic: nixos
#571880 by baodrate · opened 8d ago · 2 comments
nixos/pam: password stack never runs optional modules 6.topic: nixos
#570569 by baodrate · opened 11d ago · 0 comments
nixos/acme: `acme-order-renew-<cert>` sets `RestartSec` but no `Restart=`, so a failed order never retries
#554998 by KiaraGrouwstra · opened 8w ago · 0 comments
nixos/security: assertion 'security parameter in boot.kernelParams cannot be used when security.lsm is used' always fires 6.topic: nixos
#510901 by maartenvanschagen · opened 6mo ago · 4 comments
Avoid using `default.target` in typical system-level systemd unit 6.topic: nixos 3.skill: sprintable 3.skill: good-first-bug
#495691 by jian-lin · opened 7mo ago · 11 comments
nixos/pam: security.pam.services.<name>.logFailures option does not work - pam_faillock misconfigured 6.topic: nixos 2.status: stale
#486259 by juan-sebastian · opened 8mo ago · 1 comments
nixos/security.pam: Update in gcp pam_oslogin_login rejects normal user logins 6.topic: nixos
#476160 by vypxl · opened 9mo ago · 7 comments
nixos/auditd: line 2 of filter.conf exceeds 160 column hard limit 6.topic: nixos 2.status: stale
#469127 by djds · opened 10mo ago · 0 comments
`security/pam.nix` - Add option `extraText` 2.status: stale
#410897 by Myzel394 · opened 16mo ago · 1 comments
nixos/security/wrappers: pam may fail if one of the security wrappers has incorrect capabilities set 6.topic: nixos 2.status: stale
#398934 by aviallon · opened 18mo ago · 3 comments
Perlless profile conflicts with apparmor 2.status: stale
#301809 by kampka · opened 2y ago · 2 comments
nginx.virtualhosts.<name>.enableACME requires HTTP Listener despite DNS-based defaults 2.status: stale
#253651 by dwmunster · opened 3y ago · 0 comments
NixOS PKI certification option names are unclear 6.topic: nixos 2.status: stale
#217382 by nova-nowiz · opened 3y ago · 0 comments
pam_mount: `/run/wrappers/bin` seems not to be in $PATH so `fusermount` fails 2.status: stale
#201368 by markusscherer · opened 3y ago · 1 comments
Document `security.acme.certs.<name>.directory` configuration value 6.topic: nixos 2.status: stale
#189349 by esclear · opened 4y ago · 3 comments
Enabling `fprintd` prevents authentication with password in graphical applications 6.topic: nixos
#171136 by skeleten · opened 4y ago · 44 comments
doas ignores environment variables set up in PAM, leading to many issues on NixOS 2.status: stale
#158988 by PaulGrandperrin · opened 4y ago · 4 comments
nobody/nogroup shouldn't be used 6.topic: nixos 1.severity: security 3.skill: sprintable
#55370 by peterhoeg · opened 7y ago · 17 comments
Deprecate explicit setting of `phases = [...]` 3.skill: sprintable 6.topic: hygiene 5.scope: tracking
#28910 by dezgeg · opened 9y ago · 28 comments
Provide options for storing secrets outside the Nix store 6.topic: nixos 1.severity: security 5.scope: tracking
#24288 by basvandijk · opened 9y ago · 76 comments
Closed or merged in the synced window 1
`security.acme` requires too strict assertions.
#370825 by mainrs · closed 7w ago · 11 comments