Skip to content

Commit 393e901

Browse files
SigmanificientSigmanificient
committed
ecryptfs: drop
1 parent ea30586 commit 393e901

10 files changed

Lines changed: 4 additions & 288 deletions

File tree

‎nixos/doc/manual/release-notes/rl-2605.section.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,8 @@ of pulling the upstream container image from Docker Hub. If you want the old beh
7171

7272
- Support for `reiserfs` in nixpkgs has been removed, following the removal in Linux 6.13.
7373

74+
- support for `ecryptfs` in nixpkgs has been removed.
75+
7476
- The `networking.wireless` module has been security hardened: the `wpa_supplicant` daemon now runs under an unprivileged user with restricted access to the system.
7577

7678
As part of these changes, `/etc/wpa_supplicant.conf` has been deprecated: the NixOS-generated configuration file is now linked to `/etc/wpa_supplicant/nixos.conf` and `/etc/wpa_supplicant/imperative.conf` has been added for imperatively configuring `wpa_supplicant` or when using [allowAuxiliaryImperativeNetworks](#opt-networking.wireless.allowAuxiliaryImperativeNetworks).

‎nixos/modules/misc/locate.nix‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,6 @@ in
8989
"devfs"
9090
"devpts"
9191
"devtmpfs"
92-
"ecryptfs"
9392
"eventpollfs"
9493
"exofs"
9594
"futexfs"

‎nixos/modules/module-list.nix‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -202,7 +202,6 @@
202202
./programs/droidcam.nix
203203
./programs/dsearch.nix
204204
./programs/dublin-traceroute.nix
205-
./programs/ecryptfs.nix
206205
./programs/ente-auth.nix
207206
./programs/environment.nix
208207
./programs/envision.nix
@@ -1918,7 +1917,6 @@
19181917
./tasks/filesystems/bindfs.nix
19191918
./tasks/filesystems/btrfs.nix
19201919
./tasks/filesystems/cifs.nix
1921-
./tasks/filesystems/ecryptfs.nix
19221920
./tasks/filesystems/envfs.nix
19231921
./tasks/filesystems/erofs.nix
19241922
./tasks/filesystems/exfat.nix

‎nixos/modules/programs/ecryptfs.nix‎

Lines changed: 0 additions & 35 deletions
This file was deleted.

‎nixos/modules/security/pam.nix‎

Lines changed: 1 addition & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -965,8 +965,7 @@ let
965965
(
966966
(cfg.unixAuth || config.services.homed.enable)
967967
&& (
968-
config.security.pam.enableEcryptfs
969-
|| config.security.pam.enableFscrypt
968+
config.security.pam.enableFscrypt
970969
|| cfg.pamMount
971970
|| cfg.kwallet.enable
972971
|| cfg.enableGnomeKeyring
@@ -996,15 +995,6 @@ let
996995
likeauth = true;
997996
};
998997
}
999-
{
1000-
name = "ecryptfs";
1001-
enable = config.security.pam.enableEcryptfs;
1002-
control = "optional";
1003-
modulePath = "${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so";
1004-
settings = {
1005-
unwrap = true;
1006-
};
1007-
}
1008998
{
1009999
name = "fscrypt";
10101000
enable = config.security.pam.enableFscrypt;
@@ -1191,12 +1181,6 @@ let
11911181
yescrypt = true;
11921182
};
11931183
}
1194-
{
1195-
name = "ecryptfs";
1196-
enable = config.security.pam.enableEcryptfs;
1197-
control = "optional";
1198-
modulePath = "${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so";
1199-
}
12001184
{
12011185
name = "fscrypt";
12021186
enable = config.security.pam.enableFscrypt;
@@ -1331,12 +1315,6 @@ let
13311315
silent = true;
13321316
};
13331317
}
1334-
{
1335-
name = "ecryptfs";
1336-
enable = config.security.pam.enableEcryptfs;
1337-
control = "optional";
1338-
modulePath = "${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so";
1339-
}
13401318
# Work around https://github.com/systemd/systemd/issues/8598
13411319
# Skips the pam_fscrypt module for systemd-user sessions which do not have a password
13421320
# anyways.
@@ -2223,7 +2201,6 @@ in
22232201

22242202
security.pam.enableUMask = lib.mkEnableOption "umask PAM module";
22252203

2226-
security.pam.enableEcryptfs = lib.mkEnableOption "eCryptfs PAM module (mounting ecryptfs home directory on login)";
22272204
security.pam.enableFscrypt = lib.mkEnableOption ''
22282205
fscrypt, to automatically unlock directories with the user's login password.
22292206
@@ -2324,8 +2301,6 @@ in
23242301
++ lib.optionals config.security.pam.enableFscrypt [ pkgs.fscrypt-experimental ]
23252302
++ lib.optionals config.security.pam.u2f.enable [ pkgs.pam_u2f ];
23262303

2327-
boot.supportedFilesystems = lib.mkIf config.security.pam.enableEcryptfs [ "ecryptfs" ];
2328-
23292304
security.wrappers = {
23302305
unix_chkpwd = {
23312306
setuid = true;

‎nixos/modules/tasks/filesystems/ecryptfs.nix‎

Lines changed: 0 additions & 29 deletions
This file was deleted.

‎nixos/tests/all-tests.nix‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -502,7 +502,6 @@ in
502502
ec2-image = runTest ./ec2-image.nix;
503503
ec2-nixops = (handleTestOn [ "x86_64-linux" ] ./ec2.nix { }).boot-ec2-nixops or { };
504504
echoip = runTest ./echoip.nix;
505-
ecryptfs = runTest ./ecryptfs.nix;
506505
ejabberd = runTest ./xmpp/ejabberd.nix;
507506
elk = handleTestOn [ "x86_64-linux" ] ./elk.nix { };
508507
emacs-daemon = runTest ./emacs-daemon.nix;

‎nixos/tests/ecryptfs.nix‎

Lines changed: 0 additions & 87 deletions
This file was deleted.

‎pkgs/by-name/ec/ecryptfs/package.nix‎

Lines changed: 0 additions & 107 deletions
This file was deleted.

‎pkgs/top-level/aliases.nix‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -566,6 +566,7 @@ mapAliases {
566566
easyloggingpp = throw "easyloggingpp has been removed, as it is deprecated upstream and does not build with CMake 4"; # Added 2025-09-17
567567
EBTKS = throw "'EBTKS' has been renamed to/replaced by 'ebtks'"; # Converted to throw 2025-10-27
568568
ec2-utils = throw "'ec2-utils' has been renamed to/replaced by 'amazon-ec2-utils'"; # Converted to throw 2025-10-27
569+
ecryptfs = throw "ecryptfs has been removed due to lack of maintenance. Consideer using fscrypt, gocryptfs or cryfs instead."; # Added 2026-01-14
569570
edid-decode = v4l-utils; # Added 2025-06-20
570571
eidolon = throw "eidolon was removed as it is unmaintained upstream."; # Added 2025-05-28
571572
eintopf = throw "'eintopf' has been renamed to/replaced by 'lauti'"; # Converted to throw 2025-10-27

0 commit comments

Comments
 (0)