qbit/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/intel-sgx: remove with lib;

Browse Source
This commit is contained in:
Felix Buehler 2024-08-24 22:05:27 +02:00
parent 9a213a3a5b
commit 5a78f2c772
1 changed files with 15 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
nixos/modules/hardware/cpu/intel-sgx.nix
View File

@ -1,11 +1,10 @@
{ config, lib, ... }:
with lib;
let
cfg = config.hardware.cpu.intel.sgx;
defaultPrvGroup = "sgx_prv";
in
{
options.hardware.cpu.intel.sgx.enableDcapCompat = mkOption {
options.hardware.cpu.intel.sgx.enableDcapCompat = lib.mkOption {
description = ''
Whether to enable backward compatibility for SGX software build for the
out-of-tree Intel SGX DCAP driver.
@ -15,43 +14,43 @@ in
`/dev/sgx/enclave` and `/dev/sgx/provision`,
respectively.
'';
type = types.bool;
type = lib.types.bool;
default = true;
};
options.hardware.cpu.intel.sgx.provision = {
enable = mkEnableOption "access to the Intel SGX provisioning device";
user = mkOption {
enable = lib.mkEnableOption "access to the Intel SGX provisioning device";
user = lib.mkOption {
description = "Owner to assign to the SGX provisioning device.";
type = types.str;
type = lib.types.str;
default = "root";
};
group = mkOption {
group = lib.mkOption {
description = "Group to assign to the SGX provisioning device.";
type = types.str;
type = lib.types.str;
default = defaultPrvGroup;
};
mode = mkOption {
mode = lib.mkOption {
description = "Mode to set for the SGX provisioning device.";
type = types.str;
type = lib.types.str;
default = "0660";
};
};
config = mkMerge [
(mkIf cfg.provision.enable {
config = lib.mkMerge [
(lib.mkIf cfg.provision.enable {
assertions = [
{
assertion = hasAttr cfg.provision.user config.users.users;
assertion = lib.hasAttr cfg.provision.user config.users.users;
message = "Given user does not exist";
}
{
assertion = (cfg.provision.group == defaultPrvGroup) || (hasAttr cfg.provision.group config.users.groups);
assertion = (cfg.provision.group == defaultPrvGroup) || (lib.hasAttr cfg.provision.group config.users.groups);
message = "Given group does not exist";
}
];
users.groups = optionalAttrs (cfg.provision.group == defaultPrvGroup) {
users.groups = lib.optionalAttrs (cfg.provision.group == defaultPrvGroup) {
"${cfg.provision.group}" = { };
};
@ -59,7 +58,7 @@ in
SUBSYSTEM=="misc", KERNEL=="sgx_provision", OWNER="${user}", GROUP="${group}", MODE="${mode}"
'';
})
(mkIf cfg.enableDcapCompat {
(lib.mkIf cfg.enableDcapCompat {
services.udev.extraRules = ''
SUBSYSTEM=="misc", KERNEL=="sgx_enclave", SYMLINK+="sgx/enclave"
SUBSYSTEM=="misc", KERNEL=="sgx_provision", SYMLINK+="sgx/provision"