PAM : changement de type

.gitignore

@@ -0,0 +1,46 @@
+.pwd.lock
+NetworkManager/
+asound.conf
+bashrc
+cups/
+dbus-1
+environment
+fstab
+group
+guix/
+hostname
+hosts
+issue
+libvirt/
+localtime
+login.defs
+lvm/
+machine-id
+mtab
+nonguix-key.pub
+nsswitch.conf
+os-release
+pam.d
+passwd
+polkit-1
+printcap
+profile
+profile.d/
+protocols
+pulse
+resolv.conf
+resolv.conf.bak
+rottlog
+rpc
+security
+services
+shadow
+shells
+skel
+ssl
+static
+sudoers
+sysconfig/
+syslog.conf
+timezone
+udev

config.scm

@@ -0,0 +1,201 @@
+;; Ceci est une configuration de système d'exploitation générée par
+;; l'installateur graphique.
+;;
+;; Une fois l'installation terminée, vous pouvez apprendre à modifier
+;; ce fichier pour ajuster la configuration du système et le passer à
+;; la commande « guix system reconfigure » pour rendre vos changements
+;; effectifs.
+
+
+;; Indique quels modules importer pour accéder aux variables
+;; utilisées dans cette configuration.
+(use-modules (gnu))
+(use-modules (srfi srfi-1))
+(use-modules (gnu system setuid) (gnu packages cups))
+(use-service-modules cups desktop networking ssh xorg virtualization vpn security-token)
+
+;; Configuration sudoer personnalisée
+(define %sudoers-specification
+  (plain-file "sudoers" "\
+root ALL=(ALL) ALL
+%wheel ALL=(ALL) NOPASSWD: ALL
+"))
+
+;; Configuration spice personnalisée
+;; Permet le partage de périphériques USB via virt-manager
+;; Permet l'utilisation d'une nitrokey
+(define %spice-rules
+  (udev-rule
+    "41-spice-and-nitrokey.rules"
+    (string-append "\
+SUBSYSTEM==\"usb\", GROUP=\"spice\", MODE=\"0660\"
+SUBSYSTEM==\"usb_device\", GROUP=\"spice\", MODE=\"0660\"
+ACTION!=\"add|change\", GOTO=\"u2f_end\"
+KERNEL==\"hidraw*\", SUBSYSTEM==\"hidraw\", ATTRS{idVendor}==\"2581\", ATTRS{idProduct}==\"f1d0\", TAG+=\"uaccess\"
+KERNEL==\"hidraw*\", SUBSYSTEM==\"hidraw\", ATTRS{idVendor}==\"20a0\", ATTRS{idProduct}==\"4287\", TAG+=\"uaccess\"
+KERNEL==\"hidraw*\", SUBSYSTEM==\"hidraw\", ATTRS{idVendor}==\"20a0\", ATTRS{idProduct}==\"42b1\", TAG+=\"uaccess\"
+KERNEL==\"hidraw*\", SUBSYSTEM==\"hidraw\", ATTRS{idVendor}==\"20a0\", ATTRS{idProduct}==\"42b2\", TAG+=\"uaccess\"
+KERNEL==\"hidraw*\", SUBSYSTEM==\"hidraw\", ATTRS{idVendor}==\"20a0\", ATTRS{idProduct}==\"42dd\", TAG+=\"uaccess\"
+ATTRS{idVendor}==\"20a0\", ATTRS{idProduct}==\"42e8\", TAG+=\"uaccess\"
+LABEL=\"u2f_end\"
+SUBSYSTEM!=\"usb\", GOTO=\"gnupg_rules_end\"
+ACTION!=\"add\", GOTO=\"gnupg_rules_end\"
+ATTR{idVendor}==\"20a0\", ATTR{idProduct}==\"4107\", ENV{ID_SMARTCARD_READER}=\"1\", ENV{ID_SMARTCARD_READER_DRIVER}=\"gnupg\", TAG+=\"uaccess\"
+ATTR{idVendor}==\"20a0\", ATTR{idProduct}==\"4108\", ENV{ID_SMARTCARD_READER}=\"1\", ENV{ID_SMARTCARD_READER_DRIVER}=\"gnupg\", TAG+=\"uaccess\"
+ATTRS{idVendor}==\"20a0\", ATTRS{idProduct}==\"42b4\", TAG+=\"uaccess\"
+ATTR{idVendor}==\"20a0\", ATTR{idProduct}==\"4109\", ENV{ID_SMARTCARD_READER}=\"1\", ENV{ID_SMARTCARD_READER_DRIVER}=\"gnupg\", TAG+=\"uaccess\"
+ATTR{idVendor}==\"03eb\", ATTR{idProduct}==\"2ff1\", TAG+=\"uaccess\"
+ATTR{idVendor}==\"20a0\", ATTR{idProduct}==\"4211\", ENV{ID_SMARTCARD_READER}=\"1\", ENV{ID_SMARTCARD_READER_DRIVER}=\"gnupg\", TAG+=\"uaccess\"
+ATTR{idVendor}==\"20a0\", ATTR{idProduct}==\"4230\", ENV{ID_SMARTCARD_READER}=\"1\", ENV{ID_SMARTCARD_READER_DRIVER}=\"gnupg\", TAG+=\"uaccess\"
+LABEL=\"gnupg_rules_end\"
+KERNEL==\"sd?1\", ATTRS{idVendor}==\"20a0\", ATTRS{idProduct}==\"4109\", SYMLINK+=\"nitrospace\"
+")))
+
+;; Configuration du système
+;; C'est le point d'entrée de la configuration
+(operating-system
+  (locale "fr_FR.utf8")
+  (timezone "Europe/Paris")
+  (keyboard-layout (keyboard-layout "fr" "oss"))
+  (host-name "n-guix-fix")
+
+  ;; Application de la configuration sudoer personnalisée (définie plus haut)
+  (kernel-arguments
+    (list "modprobe.blacklist=pcspkr,usbmouse,usbkbd" "iommu=pt" "nouveau.config=NvClkMode=15"))
+
+  (initrd-modules (append (list "vfio-pci" "vfio_iommu_type1" "dm-raid" "dm-cache" "dm-crypt") %base-initrd-modules))
+      
+  (sudoers-file %sudoers-specification)
+
+  ;; La liste des comptes utilisateurs (« root » est implicite).
+  (users (cons* (user-account
+                  (name "neox")
+                  (comment "neox")
+                  (group "users")
+                  (home-directory "/home/neox")
+                  (supplementary-groups '("users" "wheel" "netdev" "audio" "video" "libvirt" "kvm" "scanner" "spice" "cdrom" "lpadmin")))
+                %base-user-accounts))
+
+  (setuid-programs
+    (append (list 
+              (setuid-program
+                (program (file-append (specification->package "cdrtools") "/bin/cdrecord")))
+              (setuid-program
+                (program (file-append (specification->package "cdrtools") "/bin/readcd")))
+              (setuid-program
+                (program (file-append (specification->package "cdrtools") "/bin/mkisofs")))
+              (setuid-program
+                (program (file-append (specification->package "cdrdao") "/bin/cdrdao"))))	
+            %setuid-programs))
+
+  ;; Quelques paquets installés au niveau du système.
+  ;; On installe notamment network-manager et son extension pour openvpn, 
+  ;; ou encore libvirt/virt-manager pour la virtualisation
+  (packages (append (list (specification->package "nss-certs")
+                          (specification->package "qemu")
+                          (specification->package "virt-manager")
+                          (specification->package "libvirt") 
+                          (specification->package "lvm2") 
+                          (specification->package "mdadm") 
+                          (specification->package "network-manager")
+                          (specification->package "network-manager-openvpn")
+                          (specification->package "xf86-video-ati")
+                          (specification->package "thin-provisioning-tools"))
+                    %base-packages))
+
+  ;; Services du système.
+  ;; On en profite pour modifier le comportement par défaut de quelques services.
+  (services
+    (modify-services (append (list
+      (service gnome-desktop-service-type)
+      
+      ;; Service de gestion des clés de chiffrement physique
+      (service pcscd-service-type)
+
+      (service openssh-service-type
+        (openssh-configuration
+          (x11-forwarding? #t)
+          (permit-root-login 'prohibit-password)))
+
+      ;; Service impression et scanner
+      (service cups-service-type
+          (cups-configuration
+            (web-interface? #t)
+            (extensions
+              (list cups-filters epson-inkjet-printer-escpr hplip-minimal))))
+
+      (service sane-service-type)
+              
+      ;; Service KVM/Libvirt pour virt-manager
+      (service libvirt-service-type)
+      (service virtlog-service-type)
+      
+      ;; Application de la configuration spice personnalisée (définie plus haut)
+      (udev-rules-service 'spice %spice-rules #:groups '("spice"))
+
+      ;; Modification des limites mémoires pour les accès audio temps réel
+      ;; (utile notamment pour Ardour)
+      (service pam-limits-service-type
+        (list
+          (pam-limits-entry "@audio" 'both 'rtprio 99)
+          (pam-limits-entry "@audio" 'both 'memlock 'unlimited)))
+
+      ;; Configuration de l'environnement graphique (notamment clavier)
+      (set-xorg-configuration
+        (xorg-configuration (keyboard-layout keyboard-layout))))
+        %desktop-services)
+
+    ;; Configuration du service network-manager pour prendre en charge
+    ;; OpenVPN
+    (network-manager-service-type config => (network-manager-configuration 
+      (inherit config)
+      (vpn-plugins
+        (list (specification->package "network-manager-openvpn")))))
+
+    (guix-service-type config => (guix-configuration
+      (inherit config)
+      (extra-options '("--cores=10"))))))
+
+  ;; Chargeur de démarrage (GRUB)
+  ;; On indique ici où il doit être installé et comment le configurer
+  (bootloader (bootloader-configuration
+                (bootloader grub-efi-bootloader)
+                (targets (list "/boot/efi"))
+                (keyboard-layout keyboard-layout)))
+
+  ;; Périphériques mappés
+  ;; On configure notamment ici les partitions chiffrées (LUKS)
+  (mapped-devices
+   (list
+    (mapped-device
+      (source "HOMERAID")
+      (target "HOMERAID-HOMERAID_data")
+      (type lvm-device-mapping))
+    (mapped-device
+      (source "/dev/mapper/HOMERAID-HOMERAID_data")
+      (target "luks-f0a72a6c-499b-4445-8d13-21dc99337752")
+      (type luks-device-mapping))))
+
+  ;; La liste des systèmes de fichiers montés au démarrage
+  ;; On configure ici le montage des partitions chiffrées et non chiffrées  
+  (file-systems 
+    (cons* 
+      (file-system
+        (mount-point "/wiab")
+        (device (uuid "2a13cf03-fc71-44ac-8e1a-d6744201336f" 'ext4))
+        (create-mount-point? #t)
+        (type "ext4"))
+      (file-system
+        (mount-point "/")
+        (device (uuid "2e44f3f7-bb6b-43ac-933a-e8992bf10d29" 'ext4))
+        (type "ext4"))
+      (file-system
+        (mount-point "/home")
+        (device "/dev/mapper/luks-f0a72a6c-499b-4445-8d13-21dc99337752")
+        (type "ext4")
+        (dependencies mapped-devices))
+      (file-system
+        (mount-point "/boot/efi")
+        (device (uuid "DC58-946E" 'fat32))
+        (type "vfat"))
+     %base-file-systems)))