asxpi/nixOS
asxpi/nixOS
1
0
Fork 0
Code Issues Pull requests Activity

security: enable core dumps and on-demand debug symbols

Browse source 
gnome-shell keeps segfaulting in libmutter, and with the PAM core
limit at 0 systemd-coredump threw every dump away, so there was no
backtrace to work from. Raise the limit to unlimited; dumps land
root-owned in /var/lib/systemd/coredump, readable only by their
owner. Enable nixseparatedebuginfod2 so gdb/coredumpctl can fetch
symbols for store paths on demand.

The user manager inherits the limit at its first login, so it takes
a reboot (or a full logout) to apply.

Assisted-by: Claude:opus-5
This commit is contained in:
Sergei Poljanski 2026-10-13 06:31:49 +04:00
commit 1d1f5600eb
Signed by: asxpi
GPG key ID: 4F8851660FA4121B
2 changed files with 36 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

7
modules/security.nix
View file

@ -55,10 +55,15 @@
# OpenSnitch Application Firewall
services.opensnitch.enable = true;
# Core dumps enabled to debug gnome-shell/mutter segfaults; systemd-coredump
# stores them root-owned under /var/lib/systemd/coredump (ACL'd to the owner).
security.pam.loginLimits = [
{ domain = "*"; item = "core"; type = "-"; value = "0"; }
{ domain = "*"; item = "core"; type = "-"; value = "unlimited"; }
];
# On-demand debug symbols for coredumpctl/gdb (sets DEBUGINFOD_URLS)
services.nixseparatedebuginfod2.enable = true;
# Podman socket for all users
systemd.user.sockets.podman.wantedBy = [ "sockets.target" ];