nixos/modules/programs/ecryptfs.nix

   1 { config, lib, pkgs, ... }:
   2
   3 let
   4   cfg = config.programs.ecryptfs;
   5
   6 in {
   7   options.programs.ecryptfs = {
   8     enable = lib.mkEnableOption "ecryptfs setuid mount wrappers";
   9   };
  10
  11   config = lib.mkIf cfg.enable {
  12     security.wrappers = {
  13
  14       "mount.ecryptfs_private" = {
  15         setuid = true;
  16         owner = "root";
  17         group = "root";
  18         source = "${lib.getBin pkgs.ecryptfs}/bin/mount.ecryptfs_private";
  19       };
  20       "umount.ecryptfs_private" = {
  21         setuid = true;
  22         owner = "root";
  23         group = "root";
  24         source = "${lib.getBin pkgs.ecryptfs}/bin/umount.ecryptfs_private";
  25       };
  26
  27     };
  28   };
  29 }