pyrox.dev
1import ./make-test-python.nix {
2 name = "systemd-confinement";
3
4 machine = { pkgs, lib, ... }: let
5 testServer = pkgs.writeScript "testserver.sh" ''
6 #!${pkgs.runtimeShell}
7 export PATH=${lib.escapeShellArg "${pkgs.coreutils}/bin"}
8 ${lib.escapeShellArg pkgs.runtimeShell} 2>&1
9 echo "exit-status:$?"
10 '';
11
12 testClient = pkgs.writeScriptBin "chroot-exec" ''
13 #!${pkgs.runtimeShell} -e
14 output="$(echo "$@" | nc -NU "/run/test$(< /teststep).sock")"
15 ret="$(echo "$output" | sed -nre '$s/^exit-status:([0-9]+)$/\1/p')"
16 echo "$output" | head -n -1
17 exit "''${ret:-1}"
18 '';
19
20 mkTestStep = num: { config ? {}, testScript }: {
21 systemd.sockets."test${toString num}" = {
22 description = "Socket for Test Service ${toString num}";
23 wantedBy = [ "sockets.target" ];
24 socketConfig.ListenStream = "/run/test${toString num}.sock";
25 socketConfig.Accept = true;
26 };
27
28 systemd.services."test${toString num}@" = {
29 description = "Confined Test Service ${toString num}";
30 confinement = (config.confinement or {}) // { enable = true; };
31 serviceConfig = (config.serviceConfig or {}) // {
32 ExecStart = testServer;
33 StandardInput = "socket";
34 };
35 } // removeAttrs config [ "confinement" "serviceConfig" ];
36
37 __testSteps = lib.mkOrder num (''
38 machine.succeed("echo ${toString num} > /teststep")
39 '' + testScript);
40 };
41
42 in {
43 imports = lib.imap1 mkTestStep [
44 { config.confinement.mode = "chroot-only";
45 testScript = ''
46 with subtest("chroot-only confinement"):
47 machine.succeed(
48 'test "$(chroot-exec ls -1 / | paste -sd,)" = bin,nix',
49 'test "$(chroot-exec id -u)" = 0',
50 "chroot-exec chown 65534 /bin",
51 )
52 '';
53 }
54 { testScript = ''
55 with subtest("full confinement with APIVFS"):
56 machine.fail(
57 "chroot-exec ls -l /etc",
58 "chroot-exec ls -l /run",
59 "chroot-exec chown 65534 /bin",
60 )
61 machine.succeed(
62 'test "$(chroot-exec id -u)" = 0',
63 "chroot-exec chown 0 /bin",
64 )
65 '';
66 }
67 { config.serviceConfig.BindReadOnlyPaths = [ "/etc" ];
68 testScript = ''
69 with subtest("check existence of bind-mounted /etc"):
70 machine.succeed('test -n "$(chroot-exec cat /etc/passwd)"')
71 '';
72 }
73 { config.serviceConfig.User = "chroot-testuser";
74 config.serviceConfig.Group = "chroot-testgroup";
75 testScript = ''
76 with subtest("check if User/Group really runs as non-root"):
77 machine.succeed("chroot-exec ls -l /dev")
78 machine.succeed('test "$(chroot-exec id -u)" != 0')
79 machine.fail("chroot-exec touch /bin/test")
80 '';
81 }
82 (let
83 symlink = pkgs.runCommand "symlink" {
84 target = pkgs.writeText "symlink-target" "got me\n";
85 } "ln -s \"$target\" \"$out\"";
86 in {
87 config.confinement.packages = lib.singleton symlink;
88 testScript = ''
89 with subtest("check if symlinks are properly bind-mounted"):
90 machine.fail("chroot-exec test -e /etc")
91 machine.succeed(
92 "chroot-exec cat ${symlink} >&2",
93 'test "$(chroot-exec cat ${symlink})" = "got me"',
94 )
95 '';
96 })
97 { config.serviceConfig.User = "chroot-testuser";
98 config.serviceConfig.Group = "chroot-testgroup";
99 config.serviceConfig.StateDirectory = "testme";
100 testScript = ''
101 with subtest("check if StateDirectory works"):
102 machine.succeed("chroot-exec touch /tmp/canary")
103 machine.succeed('chroot-exec "echo works > /var/lib/testme/foo"')
104 machine.succeed('test "$(< /var/lib/testme/foo)" = works')
105 machine.succeed("test ! -e /tmp/canary")
106 '';
107 }
108 { testScript = ''
109 with subtest("check if /bin/sh works"):
110 machine.succeed(
111 "chroot-exec test -e /bin/sh",
112 'test "$(chroot-exec \'/bin/sh -c "echo bar"\')" = bar',
113 )
114 '';
115 }
116 { config.confinement.binSh = null;
117 testScript = ''
118 with subtest("check if suppressing /bin/sh works"):
119 machine.succeed("chroot-exec test ! -e /bin/sh")
120 machine.succeed('test "$(chroot-exec \'/bin/sh -c "echo foo"\')" != foo')
121 '';
122 }
123 { config.confinement.binSh = "${pkgs.hello}/bin/hello";
124 testScript = ''
125 with subtest("check if we can set /bin/sh to something different"):
126 machine.succeed("chroot-exec test -e /bin/sh")
127 machine.succeed('test "$(chroot-exec /bin/sh -g foo)" = foo')
128 '';
129 }
130 { config.environment.FOOBAR = pkgs.writeText "foobar" "eek\n";
131 testScript = ''
132 with subtest("check if only Exec* dependencies are included"):
133 machine.succeed('test "$(chroot-exec \'cat "$FOOBAR"\')" != eek')
134 '';
135 }
136 { config.environment.FOOBAR = pkgs.writeText "foobar" "eek\n";
137 config.confinement.fullUnit = true;
138 testScript = ''
139 with subtest("check if all unit dependencies are included"):
140 machine.succeed('test "$(chroot-exec \'cat "$FOOBAR"\')" = eek')
141 '';
142 }
143 ];
144
145 options.__testSteps = lib.mkOption {
146 type = lib.types.lines;
147 description = "All of the test steps combined as a single script.";
148 };
149
150 config.environment.systemPackages = lib.singleton testClient;
151
152 config.users.groups.chroot-testgroup = {};
153 config.users.users.chroot-testuser = {
154 isSystemUser = true;
155 description = "Chroot Test User";
156 group = "chroot-testgroup";
157 };
158 };
159
160 testScript = { nodes, ... }: ''
161 machine.wait_for_unit("multi-user.target")
162 '' + nodes.machine.config.__testSteps;
163}