Merge pull request #1108 from Enzime/users

Use `sysadminctl` instead of `dscl`

4 files changed, 85 insertions, 54 deletions

diff --git a/modules/networking/default.nix b/modules/networking/default.nix
index 1065c26..099c705 100644
--- a/modules/networking/default.nix
+++ b/modules/networking/default.nix
@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, ... }:
 
 with lib;
 
@@ -8,15 +8,14 @@ let
   hostnameRegEx = ''^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9])$'';
 
   emptyList = lst: if lst != [] then lst else ["empty"];
-  quoteStrings = concatMapStringsSep " " (str: "'${str}'");
 
   setNetworkServices = optionalString (cfg.knownNetworkServices != []) ''
     networkservices=$(networksetup -listallnetworkservices)
     ${concatMapStringsSep "\n" (srv: ''
       case "$networkservices" in
-        *'${srv}'*)
-          networksetup -setdnsservers '${srv}' ${quoteStrings (emptyList cfg.dns)}
-          networksetup -setsearchdomains '${srv}' ${quoteStrings (emptyList cfg.search)}
+        *${lib.escapeShellArg srv}*)
+          networksetup -setdnsservers ${lib.escapeShellArgs ([ srv ] ++ (emptyList cfg.dns))}
+          networksetup -setsearchdomains ${lib.escapeShellArgs ([ srv ] ++ (emptyList cfg.search))}
           ;;
       esac
     '') cfg.knownNetworkServices}
diff --git a/modules/users/default.nix b/modules/users/default.nix
index cd0986d..ce77d4d 100644
--- a/modules/users/default.nix
+++ b/modules/users/default.nix
@@ -8,7 +8,6 @@ let
   group = import ./group.nix;
   user = import ./user.nix;
 
-  toArguments = concatMapStringsSep " " (v: "'${v}'");
   toGID = v: { "${toString v.gid}" = v.name; };
   toUID = v: { "${toString v.uid}" = v.name; };
 
@@ -96,45 +95,49 @@ in
     system.activationScripts.groups.text = mkIf (cfg.knownGroups != []) ''
       echo "setting up groups..." >&2
 
-      ${concatMapStringsSep "\n" (v: ''
+      ${concatMapStringsSep "\n" (v: let
+        dsclGroup = lib.escapeShellArg "/Groups/${v.name}";
+      in ''
         ${optionalString cfg.forceRecreate ''
-          g=$(dscl . -read '/Groups/${v.name}' PrimaryGroupID 2> /dev/null) || true
+          g=$(dscl . -read ${dsclGroup} PrimaryGroupID 2> /dev/null) || true
           g=''${g#PrimaryGroupID: }
           if [[ "$g" -eq ${toString v.gid} ]]; then
             echo "deleting group ${v.name}..." >&2
-            dscl . -delete '/Groups/${v.name}' 2> /dev/null
+            dscl . -delete ${dsclGroup} 2> /dev/null
           else
             echo "warning: existing group '${v.name}' has unexpected gid $g, skipping..." >&2
           fi
         ''}
 
-        g=$(dscl . -read '/Groups/${v.name}' PrimaryGroupID 2> /dev/null) || true
+        g=$(dscl . -read ${dsclGroup} PrimaryGroupID 2> /dev/null) || true
         g=''${g#PrimaryGroupID: }
         if [ -z "$g" ]; then
           echo "creating group ${v.name}..." >&2
-          dscl . -create '/Groups/${v.name}' PrimaryGroupID ${toString v.gid}
-          dscl . -create '/Groups/${v.name}' RealName '${v.description}'
+          dscl . -create ${dsclGroup} PrimaryGroupID ${toString v.gid}
+          dscl . -create ${dsclGroup} RealName ${lib.escapeShellArg v.description}
           g=${toString v.gid}
         fi
 
         if [ "$g" -eq ${toString v.gid} ]; then
-          g=$(dscl . -read '/Groups/${v.name}' GroupMembership 2> /dev/null) || true
+          g=$(dscl . -read ${dsclGroup} GroupMembership 2> /dev/null) || true
           if [ "$g" != 'GroupMembership: ${concatStringsSep " " v.members}' ]; then
             echo "updating group members ${v.name}..." >&2
-            dscl . -create '/Groups/${v.name}' GroupMembership ${toArguments v.members}
+            dscl . -create ${dsclGroup} GroupMembership ${lib.escapeShellArgs v.members}
           fi
         else
           echo "warning: existing group '${v.name}' has unexpected gid $g, skipping..." >&2
         fi
       '') createdGroups}
 
-      ${concatMapStringsSep "\n" (name: ''
-        g=$(dscl . -read '/Groups/${name}' PrimaryGroupID 2> /dev/null) || true
+      ${concatMapStringsSep "\n" (name: let
+        dsclGroup = lib.escapeShellArg "/Groups/${name}";
+      in ''
+        g=$(dscl . -read ${dsclGroup} PrimaryGroupID 2> /dev/null) || true
         g=''${g#PrimaryGroupID: }
         if [ -n "$g" ]; then
           if [ "$g" -gt 501 ]; then
             echo "deleting group ${name}..." >&2
-            dscl . -delete '/Groups/${name}' 2> /dev/null
+            dscl . -delete ${dsclGroup} 2> /dev/null
           else
             echo "warning: existing group '${name}' has unexpected gid $g, skipping..." >&2
           fi
@@ -145,44 +148,77 @@ in
     system.activationScripts.users.text = mkIf (cfg.knownUsers != []) ''
       echo "setting up users..." >&2
 
-      ${concatMapStringsSep "\n" (v: ''
+      deleteUser() {
+        fullDiskAccess=false
+
+        if cat /Library/Preferences/com.apple.TimeMachine.plist > /dev/null 2>&1; then
+          fullDiskAccess=true
+        fi
+
+        if [[ "$fullDiskAccess" != true ]]; then
+          printf >&2 '\e[1;31merror: users cannot be deleted without Full Disk Access, aborting activation\e[0m\n'
+          printf >&2 'The user %s could not be deleted as `darwin-rebuild` was not executed with Full Disk Access.' "$1"
+
+          printf >&2 'Opening "Privacy & Security" > "Full Disk Access" in System Settings\n'
+          printf >&2 '\n'
+          # This command will fail if run as root and System Settings is already running
+          # even if System Settings was launched by root.
+          sudo -u $SUDO_USER open "x-apple.systempreferences:com.apple.preference.security?Privacy_AllFiles"
+
+          if [[ -n "$SSH_CONNECTION" ]]; then
+            printf >&2 'Please enable Full Disk Access for programs over SSH by flipping\n'
+            printf >&2 'the switch for `sshd-keygen-wrapper`.\n'
+          else
+            printf >&2 'Please enable Full Disk Access for your terminal emulator by flipping\n'
+            printf >&2 'the switch in System Settings.\n'
+          fi
+
+          exit 1
+        fi
+
+        sysadminctl -deleteUser "$1" 2> /dev/null
+
+        if id -u "$1" > /dev/null 2>&1; then
+          printf >&2 '\e[1;31merror: failed to delete user %s, aborting activation\e[0m\n', "$1"
+          exit 1
+        fi
+      }
+
+      ${concatMapStringsSep "\n" (v: let
+        name = lib.escapeShellArg v.name;
+        dsclUser = lib.escapeShellArg "/Users/${v.name}";
+      in ''
         ${optionalString cfg.forceRecreate ''
-          u=$(dscl . -read '/Users/${v.name}' UniqueID 2> /dev/null) || true
-          u=''${u#UniqueID: }
+          u=$(id -u ${name} 2> /dev/null) || true
           if [[ "$u" -eq ${toString v.uid} ]]; then
             echo "deleting user ${v.name}..." >&2
-            dscl . -delete '/Users/${v.name}' 2> /dev/null
+            deleteUser ${name}
           else
             echo "warning: existing user '${v.name}' has unexpected uid $u, skipping..." >&2
           fi
         ''}
 
-        u=$(dscl . -read '/Users/${v.name}' UniqueID 2> /dev/null) || true
-        u=''${u#UniqueID: }
+        u=$(id -u ${name} 2> /dev/null) || true
         if [[ -n "$u" && "$u" -ne "${toString v.uid}" ]]; then
           echo "warning: existing user '${v.name}' has unexpected uid $u, skipping..." >&2
         else
           if [ -z "$u" ]; then
             echo "creating user ${v.name}..." >&2
-            dscl . -create '/Users/${v.name}' UniqueID ${toString v.uid}
-            dscl . -create '/Users/${v.name}' PrimaryGroupID ${toString v.gid}
-            dscl . -create '/Users/${v.name}' IsHidden ${if v.isHidden then "1" else "0"}
-            dscl . -create '/Users/${v.name}' RealName '${v.description}'
-            dscl . -create '/Users/${v.name}' NFSHomeDirectory '${v.home}'
-            ${optionalString v.createHome "createhomedir -cu '${v.name}'"}
+            sysadminctl -addUser ${lib.escapeShellArgs ([ v.name "-UID" v.uid "-GID" v.gid ] ++ (lib.optionals (v.description != null) [ "-fullName" v.description ]) ++ [ "-home" v.home "-shell" (shellPath v.shell) ])}
+            dscl . -create ${dsclUser} IsHidden ${if v.isHidden then "1" else "0"}
+            ${optionalString v.createHome "createhomedir -cu ${name}"}
           fi
           # Always set the shell path, in case it was updated
-          dscl . -create '/Users/${v.name}' UserShell ${lib.escapeShellArg (shellPath v.shell)}
+          dscl . -create ${dsclUser} UserShell ${lib.escapeShellArg (shellPath v.shell)}
         fi
       '') createdUsers}
 
       ${concatMapStringsSep "\n" (name: ''
-        u=$(dscl . -read '/Users/${name}' UniqueID 2> /dev/null) || true
-        u=''${u#UniqueID: }
+        u=$(id -u ${lib.escapeShellArg name} 2> /dev/null) || true
         if [ -n "$u" ]; then
           if [ "$u" -gt 501 ]; then
             echo "deleting user ${name}..." >&2
-            dscl . -delete '/Users/${name}' 2> /dev/null
+            deleteUser ${lib.escapeShellArg name}
           else
             echo "warning: existing user '${name}' has unexpected uid $u, skipping..." >&2
           fi
diff --git a/modules/users/group.nix b/modules/users/group.nix
index 0e74085..da3feb1 100644
--- a/modules/users/group.nix
+++ b/modules/users/group.nix
@@ -1,11 +1,12 @@
 { name, lib, ... }:
 
-with lib;
-
 {
-  options = {
+  options = let
+    inherit (lib) mkOption types;
+  in {
     name = mkOption {
       type = types.str;
+      default = name;
       description = ''
         The group's name. If undefined, the name of the attribute set
         will be used.
@@ -29,10 +30,4 @@ with lib;
       description = "The group's description.";
     };
   };
-
-  config = {
-
-    name = mkDefault name;
-
-  };
 }
diff --git a/modules/users/user.nix b/modules/users/user.nix
index 4e3f1c9..a0c8aab 100644
--- a/modules/users/user.nix
+++ b/modules/users/user.nix
@@ -1,11 +1,12 @@
 { name, lib, ... }:
 
-with lib;
-
 {
-  options = {
+  options = let
+    inherit (lib) literalExpression mkOption types;
+  in {
     name = mkOption {
-      type = types.str;
+      type = types.nonEmptyStr;
+      default = name;
       description = ''
         The name of the user account. If undefined, the name of the
         attribute set will be used.
@@ -13,12 +14,18 @@ with lib;
     };
 
     description = mkOption {
-      type = types.str;
-      default = "";
+      type = types.nullOr types.nonEmptyStr;
+      default = null;
       example = "Alice Q. User";
       description = ''
         A short description of the user account, typically the
         user's full name.
+
+        This defaults to `null` which means, on creation, `sysadminctl`
+        will pick the description which is usually always {option}`name`.
+
+        Using an empty name is not supported and breaks macOS like
+        making the user not appear in Directory Utility.
       '';
     };
 
@@ -75,10 +82,4 @@ with lib;
       '';
     };
   };
-
-  config = {
-
-    name = mkDefault name;
-
-  };
 }