pyrox.dev / nixpkgs
lol
fork atom

nixos/systemd-confinement: Make / read-only

Our more thorough parametrised tests uncovered that with the changes for
supporting DynamicUser, we now have the situation that for static users
the root directory within the confined environment is now writable for
the user in question.

This is obviously not what we want and I'd consider that a regression.
However while discussing this with @ju1m and my suggestion being to
set TemporaryFileSystem to "/" (as we had previously), they had an even
better idea[1]:

> The goal is to deny write access to / to non-root users,
>
> * TemporaryFileSystem=/ gives us that through the ownership of / by
> root (instead of the service's user inherited from
> RuntimeDirectory=).
> * ProtectSystem=strict gives us that by mounting / read-only (while
> keeping its ownership to the service's user).
>
> To avoid the incompatibilities of TemporaryFileSystem=/ mentioned
> above, I suggest to mount / read-only in all cases with
> ReadOnlyPaths = [ "+/" ]:
>
> ...
>
> I guess this would require at least two changes to the current tests:
>
> 1. to no longer expect root to be able to write to some paths (like
> /bin) (at least not without first remounting / in read-write
> mode).
> 2. to no longer expect non-root users to fail to write to certain
> paths with a "permission denied" error code, but with a
> "read-only file system" error code.

I like the solution with ReadOnlyPaths even more because it further
reduces the attack surface if the user is root. In chroot-only mode this
is especially useful, since if there are no other bind-mounted paths
involved in the unit configuration, the whole file system within the
confined environment is read-only.

[1]: https://github.com/NixOS/nixpkgs/pull/289593#discussion_r1586794215

Signed-off-by: aszlig <aszlig@nix.build>

aszlig 0a9cecc3 27f36b5e

options
unified split
Changed files
+8 -8
nixos
modules
security
systemd-confinement.nix
tests
systemd-confinement
default.nix
+1
nixos/modules/security/systemd-confinement.nix 
···

       
105

       
105

       
 

       
        wantsAPIVFS = lib.mkDefault (config.confinement.mode == "full-apivfs");


     

       
106

       
106

       
 

       
      in lib.mkIf config.confinement.enable {


     

       
107

       
107

       
 

       
        serviceConfig = {


     

       

       
108

       
+

       
          ReadOnlyPaths = [ "+/" ];


     

       
108

       
109

       
 

       
          RuntimeDirectory = [ "confinement/${mkPathSafeName name}" ];


     

       
109

       
110

       
 

       
          RootDirectory = lib.mkDefault "/run/confinement/${mkPathSafeName name}";


     

       
110

       
111

       
 

       
          InaccessiblePaths = [
+7 -8
nixos/tests/systemd-confinement/default.nix 
···

       
87

       
87

       
 

       
          assert os.getgid() == 0


     

       
88

       
88

       
 

       



     

       
89

       
89

       
 

       
          assert_permissions({


     

       
90

       

       
-

       
            'bin': Accessibility.WRITABLE,


     

       
91

       

       
-

       
            'nix': Accessibility.WRITABLE,


     

       
92

       

       
-

       
            'run': Accessibility.WRITABLE,


     

       

       
90

       
+

       
            'bin': Accessibility.READABLE,


     

       

       
91

       
+

       
            'nix': Accessibility.READABLE,


     

       

       
92

       
+

       
            'run': Accessibility.READABLE,


     

       
93

       
93

       
 

       
            ${lib.optionalString privateTmp "'tmp': Accessibility.STICKY,"}


     

       
94

       

       
-

       
            ${lib.optionalString privateTmp "'var': Accessibility.WRITABLE,"}


     

       

       
94

       
+

       
            ${lib.optionalString privateTmp "'var': Accessibility.READABLE,"}


     

       
95

       
95

       
 

       
            ${lib.optionalString privateTmp "'var/tmp': Accessibility.STICKY,"}


     

       
96

       
96

       
 

       
          })


     

       
97

       
97

       
 

       
        '' else ''


     
···

       
120

       
120

       
 

       
          assert os.getgid() == 0


     

       
121

       
121

       
 

       



     

       
122

       
122

       
 

       
          assert_permissions({


     

       
123

       

       
-

       
            'bin': Accessibility.WRITABLE,


     

       
124

       

       
-

       
            'nix': Accessibility.WRITABLE,


     

       

       
123

       
+

       
            'bin': Accessibility.READABLE,


     

       

       
124

       
+

       
            'nix': Accessibility.READABLE,


     

       
125

       
125

       
 

       
            ${lib.optionalString privateTmp "'tmp': Accessibility.STICKY,"}


     

       
126

       
126

       
 

       
            'run': Accessibility.WRITABLE,


     

       
127

       
127

       
 

       



     
···

       
129

       
129

       
 

       
            'sys': Accessibility.SPECIAL,


     

       
130

       
130

       
 

       
            'dev': Accessibility.WRITABLE,


     

       
131

       
131

       
 

       



     

       
132

       

       
-

       
            ${lib.optionalString privateTmp "'var': Accessibility.WRITABLE,"}


     

       

       
132

       
+

       
            ${lib.optionalString privateTmp "'var': Accessibility.READABLE,"}


     

       
133

       
133

       
 

       
            ${lib.optionalString privateTmp "'var/tmp': Accessibility.STICKY,"}


     

       
134

       
134

       
 

       
          })


     

       
135

       
135

       
 

       
        '' else ''


     
···

       
144

       
144

       
 

       



     

       
145

       
145

       
 

       
            'proc': Accessibility.SPECIAL,


     

       
146

       
146

       
 

       
            'sys': Accessibility.SPECIAL,


     

       
147

       

       
-

       



     

       
148

       
147

       
 

       
            'dev': Accessibility.SPECIAL,


     

       
149

       
148

       
 

       
            'dev/shm': Accessibility.STICKY,


     

       
150

       
149

       
 

       
            'dev/mqueue': Accessibility.STICKY,