pyrox.dev
1import ./make-test-python.nix ({ pkgs, ... }:
2let
3 userUid = 1000;
4 usersGid = 100;
5 busybox = pkgs : pkgs.busybox.override {
6 # Without this, the busybox binary drops euid to ruid for most applets, including id.
7 # See https://bugs.busybox.net/show_bug.cgi?id=15101
8 extraConfig = "CONFIG_FEATURE_SUID n";
9 };
10in
11{
12 name = "wrappers";
13
14 nodes.machine = { config, pkgs, ... }: {
15 ids.gids.users = usersGid;
16
17 users.users = {
18 regular = {
19 uid = userUid;
20 isNormalUser = true;
21 };
22 };
23
24 security.apparmor.enable = true;
25
26 security.wrappers = {
27 suidRoot = {
28 owner = "root";
29 group = "root";
30 setuid = true;
31 source = "${busybox pkgs}/bin/busybox";
32 program = "suid_root_busybox";
33 };
34 sgidRoot = {
35 owner = "root";
36 group = "root";
37 setgid = true;
38 source = "${busybox pkgs}/bin/busybox";
39 program = "sgid_root_busybox";
40 };
41 withChown = {
42 owner = "root";
43 group = "root";
44 source = "${pkgs.libcap}/bin/capsh";
45 program = "capsh_with_chown";
46 capabilities = "cap_chown+ep";
47 };
48 };
49 };
50
51 testScript =
52 ''
53 def cmd_as_regular(cmd):
54 return "su -l regular -c '{0}'".format(cmd)
55
56 def test_as_regular(cmd, expected):
57 out = machine.succeed(cmd_as_regular(cmd)).strip()
58 assert out == expected, "Expected {0} to output {1}, but got {2}".format(cmd, expected, out)
59
60 def test_as_regular_in_userns_mapped_as_root(cmd, expected):
61 out = machine.succeed(f"su -l regular -c '${pkgs.util-linux}/bin/unshare -rm {cmd}'").strip()
62 assert out == expected, "Expected {0} to output {1}, but got {2}".format(cmd, expected, out)
63
64 test_as_regular('${busybox pkgs}/bin/busybox id -u', '${toString userUid}')
65 test_as_regular('${busybox pkgs}/bin/busybox id -ru', '${toString userUid}')
66 test_as_regular('${busybox pkgs}/bin/busybox id -g', '${toString usersGid}')
67 test_as_regular('${busybox pkgs}/bin/busybox id -rg', '${toString usersGid}')
68
69 test_as_regular('/run/wrappers/bin/suid_root_busybox id -u', '0')
70 test_as_regular('/run/wrappers/bin/suid_root_busybox id -ru', '${toString userUid}')
71 test_as_regular('/run/wrappers/bin/suid_root_busybox id -g', '${toString usersGid}')
72 test_as_regular('/run/wrappers/bin/suid_root_busybox id -rg', '${toString usersGid}')
73
74 test_as_regular('/run/wrappers/bin/sgid_root_busybox id -u', '${toString userUid}')
75 test_as_regular('/run/wrappers/bin/sgid_root_busybox id -ru', '${toString userUid}')
76 test_as_regular('/run/wrappers/bin/sgid_root_busybox id -g', '0')
77 test_as_regular('/run/wrappers/bin/sgid_root_busybox id -rg', '${toString usersGid}')
78
79 test_as_regular_in_userns_mapped_as_root('/run/wrappers/bin/suid_root_busybox id -u', '0')
80 test_as_regular_in_userns_mapped_as_root('/run/wrappers/bin/suid_root_busybox id -ru', '0')
81 test_as_regular_in_userns_mapped_as_root('/run/wrappers/bin/suid_root_busybox id -g', '0')
82 test_as_regular_in_userns_mapped_as_root('/run/wrappers/bin/suid_root_busybox id -rg', '0')
83
84 test_as_regular_in_userns_mapped_as_root('/run/wrappers/bin/sgid_root_busybox id -u', '0')
85 test_as_regular_in_userns_mapped_as_root('/run/wrappers/bin/sgid_root_busybox id -ru', '0')
86 test_as_regular_in_userns_mapped_as_root('/run/wrappers/bin/sgid_root_busybox id -g', '0')
87 test_as_regular_in_userns_mapped_as_root('/run/wrappers/bin/sgid_root_busybox id -rg', '0')
88
89 # Test that in nonewprivs environment the wrappers simply exec their target.
90 test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/suid_root_busybox id -u', '${toString userUid}')
91 test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/suid_root_busybox id -ru', '${toString userUid}')
92 test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/suid_root_busybox id -g', '${toString usersGid}')
93 test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/suid_root_busybox id -rg', '${toString usersGid}')
94
95 test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/sgid_root_busybox id -u', '${toString userUid}')
96 test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/sgid_root_busybox id -ru', '${toString userUid}')
97 test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/sgid_root_busybox id -g', '${toString usersGid}')
98 test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/sgid_root_busybox id -rg', '${toString usersGid}')
99
100 # We are only testing the permitted set, because it's easiest to look at with capsh.
101 machine.fail(cmd_as_regular('${pkgs.libcap}/bin/capsh --has-p=CAP_CHOWN'))
102 machine.fail(cmd_as_regular('${pkgs.libcap}/bin/capsh --has-p=CAP_SYS_ADMIN'))
103 machine.succeed(cmd_as_regular('/run/wrappers/bin/capsh_with_chown --has-p=CAP_CHOWN'))
104 machine.fail(cmd_as_regular('/run/wrappers/bin/capsh_with_chown --has-p=CAP_SYS_ADMIN'))
105
106 # Test that the only user of apparmor policy includes generated by
107 # wrappers works. Ideally this'd be located in a test for the module that
108 # actually makes the apparmor policy for ping, but there's no convenient
109 # test for that one.
110 machine.succeed("ping -c 1 127.0.0.1")
111 '';
112})