Breaking changes announcement for unstable

Development
116

The networking.wireless module has been security hardened: the wpa_supplicant daemon now runs under an unprivileged user with restricted access to the system.

Some backward incompatibilities:

  • /etc/wpa_supplicant.conf has been deprecated: the NixOS-generated configuration file is now linked to /etc/wpa_supplicant/nixos.conf and /etc/wpa_supplicant/imperative.conf has been added for imperatively configuring wpa_supplicant or when using networking.wireless.allowAuxiliaryImperativeNetworks.

  • If client certificates, keys or other files are needed, these should be stored under /etc/wpa_supplicant and owned by wpa_supplicant to ensure the daemon can read them.

  • the networking.wireless.userControlled.group option has been removed since there is now a dedicated wpa_supplicant group to control the daemon, and networking.wireless.userControlled.enable has been renamed to networking.wireless.userControlled.

No functionality should have been impacted by these changes (including controlling via wpa_cli, integration with NetworkManager or connman), but if you find any problems, please open an issue on GitHub.

Note for NetworkManager users: before this changes NetworkManager spawned its own wpa_supplicant daemon, but now it uses networking.wireless. So, if you have a networking.wireless.enable = false in your configuration, you should remove that line.

link to PR: nixos/wpa_supplicant: harden and run as unprivileged user by rnhmjoj · Pull Request #427528 · NixOS/nixpkgs · GitHub

10 Likes