pyrox.dev
1import ./make-test-python.nix (
2 { pkgs, ... }:
3 {
4 name = "hardened";
5 meta = with pkgs.lib.maintainers; {
6 maintainers = [ joachifm ];
7 };
8
9 nodes.machine =
10 {
11 lib,
12 pkgs,
13 config,
14 ...
15 }:
16 {
17 users.users.alice = {
18 isNormalUser = true;
19 extraGroups = [ "proc" ];
20 };
21 users.users.sybil = {
22 isNormalUser = true;
23 group = "wheel";
24 };
25 imports = [ ../modules/profiles/hardened.nix ];
26 environment.memoryAllocator.provider = "graphene-hardened";
27 nix.settings.sandbox = false;
28 virtualisation.emptyDiskImages = [ 4096 ];
29 boot.initrd.postDeviceCommands = ''
30 ${pkgs.dosfstools}/bin/mkfs.vfat -n EFISYS /dev/vdb
31 '';
32 virtualisation.fileSystems = {
33 "/efi" = {
34 device = "/dev/disk/by-label/EFISYS";
35 fsType = "vfat";
36 options = [ "noauto" ];
37 };
38 };
39 boot.extraModulePackages = pkgs.lib.optional (pkgs.lib.versionOlder config.boot.kernelPackages.kernel.version "5.6") config.boot.kernelPackages.wireguard;
40 boot.kernelModules = [ "wireguard" ];
41 };
42
43 testScript =
44 let
45 hardened-malloc-tests = pkgs.graphene-hardened-malloc.ld-preload-tests;
46 in
47 ''
48 machine.wait_for_unit("multi-user.target")
49
50
51 with subtest("AppArmor profiles are loaded"):
52 machine.succeed("systemctl status apparmor.service")
53
54
55 # AppArmor securityfs
56 with subtest("AppArmor securityfs is mounted"):
57 machine.succeed("mountpoint -q /sys/kernel/security")
58 machine.succeed("cat /sys/kernel/security/apparmor/profiles")
59
60
61 # Test loading out-of-tree modules
62 with subtest("Out-of-tree modules can be loaded"):
63 machine.succeed("grep -Fq wireguard /proc/modules")
64
65
66 # Test kernel module hardening
67 with subtest("No more kernel modules can be loaded"):
68 # note: this better a be module we normally wouldn't load ...
69 machine.wait_for_unit("disable-kernel-module-loading.service")
70 machine.fail("modprobe dccp")
71
72
73 # Test userns
74 with subtest("User namespaces are restricted"):
75 machine.succeed("unshare --user true")
76 machine.fail("su -l alice -c 'unshare --user true'")
77
78
79 # Test dmesg restriction
80 with subtest("Regular users cannot access dmesg"):
81 machine.fail("su -l alice -c dmesg")
82
83
84 # Test access to kcore
85 with subtest("Kcore is inaccessible as root"):
86 machine.fail("cat /proc/kcore")
87
88
89 # Test deferred mount
90 with subtest("Deferred mounts work"):
91 machine.fail("mountpoint -q /efi") # was deferred
92 machine.execute("mkdir -p /efi")
93 machine.succeed("mount /dev/disk/by-label/EFISYS /efi")
94 machine.succeed("mountpoint -q /efi") # now mounted
95
96
97 # Test Nix dæmon usage
98 with subtest("nix-daemon cannot be used by all users"):
99 machine.fail("su -l nobody -s /bin/sh -c 'nix --extra-experimental-features nix-command ping-store'")
100 machine.succeed("su -l alice -c 'nix --extra-experimental-features nix-command ping-store'")
101
102
103 # Test kernel image protection
104 with subtest("The kernel image is protected"):
105 machine.fail("systemctl hibernate")
106 machine.fail("systemctl kexec")
107
108
109 with subtest("The hardened memory allocator works"):
110 machine.succeed("${hardened-malloc-tests}/bin/run-tests")
111 '';
112 }
113)