nixos/shadow: use su from sudo-rs when enabled

[qweered]

When security.sudo-rs.enable is true, the su setuid wrapper now uses the memory-safe su implementation from sudo-rs instead of the one from the shadow package.

Users who opt into sudo-rs likely want the full benefit of its memory-safe tooling, including su.

Changes

• nixos/modules/programs/shadow.nix: Conditionally set the su wrapper source to sudo-rs's su binary when security.sudo-rs.enable is true.

Testing

Verified with nix-instantiate --eval:

• sudo-rs.enable = true → su source resolves to .../sudo-rs-0.2.12/bin/su
• sudo-rs.enable = false → su source resolves to .../shadow-4.19.3-su/bin/su

Things done

• Built on platform:
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• Tested, as applicable:
  • NixOS tests in nixos/tests.
  • Package tests at passthru.tests.
  • Tests in lib/tests or pkgs/test for functions and "core" functionality.
• Ran nixpkgs-review on this PR. See nixpkgs-review usage.
• Tested basic functionality of all binary files, usually in ./result/bin/.
• Nixpkgs Release Notes
  • Package update: when the change is major or breaking.
• NixOS Release Notes
  • Module addition: when adding a new NixOS module.
  • Module update: when the change is significant.
• Fits CONTRIBUTING.md, pkgs/README.md, maintainers/README.md and other READMEs.

Summary by CodeRabbit

• Bug Fixes
  • Fixed the su command to use the correct binary when sudo-rs is enabled in system configuration.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

Configuration used: defaults

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between c397316 and e60b5c5.

📒 Files selected for processing (1)

• nixos/modules/programs/shadow.nix

---

📝 Walkthrough

Walkthrough

The su wrapper in the NixOS shadow module now conditionally selects its binary: using the sudo-rs package's su binary when config.security.sudo-rs.enable is true, otherwise using the standard shadow package's su binary.

Changes

Cohort / File(s)	Summary
Su wrapper conditional logic nixos/modules/programs/shadow.nix	Modified su wrapper to select setuid-root binary based on sudo-rs enablement status via conditional expression.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~5 minutes

Poem

🐰 wiggles nose with glee
A su that splits two ways with care,
When sudo-rs floats through the air,
It picks the newer path so bright,
When not enabled, shadows in sight—
One wrapper, two choices, both right! ✨

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch shadow-sudo-rs-su

Tip

Try Coding Plans. Let us write the prompt for your AI agent so you can ship faster (with fewer bugs).
Share your feedback on Discord.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}