pyrox.dev
1import ./make-test-python.nix ({ pkgs, ... } : {
2 name = "apparmor";
3 meta.maintainers = with lib.maintainers; [ julm ];
4
5 nodes.machine =
6 { lib, pkgs, config, ... }:
7 {
8 security.apparmor.enable = lib.mkDefault true;
9 };
10
11 testScript =
12 ''
13 machine.wait_for_unit("multi-user.target")
14
15 with subtest("AppArmor profiles are loaded"):
16 machine.succeed("systemctl status apparmor.service")
17
18 # AppArmor securityfs
19 with subtest("AppArmor securityfs is mounted"):
20 machine.succeed("mountpoint -q /sys/kernel/security")
21 machine.succeed("cat /sys/kernel/security/apparmor/profiles")
22
23 # Test apparmorRulesFromClosure by:
24 # 1. Prepending a string of the relevant packages' name and version on each line.
25 # 2. Sorting according to those strings.
26 # 3. Removing those prepended strings.
27 # 4. Using `diff` against the expected output.
28 with subtest("apparmorRulesFromClosure"):
29 machine.succeed(
30 "${pkgs.diffutils}/bin/diff ${pkgs.writeText "expected.rules" ''
31 mr ${pkgs.bash}/lib/**.so*,
32 r ${pkgs.bash},
33 r ${pkgs.bash}/etc/**,
34 r ${pkgs.bash}/lib/**,
35 r ${pkgs.bash}/share/**,
36 x ${pkgs.bash}/foo/**,
37 mr ${pkgs.glibc}/lib/**.so*,
38 r ${pkgs.glibc},
39 r ${pkgs.glibc}/etc/**,
40 r ${pkgs.glibc}/lib/**,
41 r ${pkgs.glibc}/share/**,
42 x ${pkgs.glibc}/foo/**,
43 mr ${pkgs.libcap}/lib/**.so*,
44 r ${pkgs.libcap},
45 r ${pkgs.libcap}/etc/**,
46 r ${pkgs.libcap}/lib/**,
47 r ${pkgs.libcap}/share/**,
48 x ${pkgs.libcap}/foo/**,
49 mr ${pkgs.libcap.lib}/lib/**.so*,
50 r ${pkgs.libcap.lib},
51 r ${pkgs.libcap.lib}/etc/**,
52 r ${pkgs.libcap.lib}/lib/**,
53 r ${pkgs.libcap.lib}/share/**,
54 x ${pkgs.libcap.lib}/foo/**,
55 mr ${pkgs.libidn2.out}/lib/**.so*,
56 r ${pkgs.libidn2.out},
57 r ${pkgs.libidn2.out}/etc/**,
58 r ${pkgs.libidn2.out}/lib/**,
59 r ${pkgs.libidn2.out}/share/**,
60 x ${pkgs.libidn2.out}/foo/**,
61 mr ${pkgs.libunistring}/lib/**.so*,
62 r ${pkgs.libunistring},
63 r ${pkgs.libunistring}/etc/**,
64 r ${pkgs.libunistring}/lib/**,
65 r ${pkgs.libunistring}/share/**,
66 x ${pkgs.libunistring}/foo/**,
67 ''} ${pkgs.runCommand "actual.rules" { preferLocalBuild = true; } ''
68 ${pkgs.gnused}/bin/sed -e 's:^[^ ]* ${builtins.storeDir}/[^,/-]*-\([^/,]*\):\1 \0:' ${
69 pkgs.apparmorRulesFromClosure {
70 name = "ping";
71 additionalRules = ["x $path/foo/**"];
72 } [ pkgs.libcap ]
73 } |
74 ${pkgs.coreutils}/bin/sort -n -k1 |
75 ${pkgs.gnused}/bin/sed -e 's:^[^ ]* ::' >$out
76 ''}"
77 )
78 '';
79})