commit 1289c91409a041e0e8a307d40607a24f09ad5d15 · pyrox.dev/nixpkgs

+13 -6

nixos/modules/services/web-apps/echoip.nix

···

       75
       75
        
               );

     

       76
       76
        
       

     

       77
       77
        
               # Hardening

     

       78
       78
       +
               AmbientCapabilities = "";

     

       78
       79
        
               CapabilityBoundingSet = [ "" ];

     

       79
       79
       -
               DeviceAllow = [ "" ];

     

       80
       80
       +
               DevicePolicy = "closed";

     

       80
       81
        
               LockPersonality = true;

     

       82
       82
       +
               MemoryDenyWriteExecute = true;

     

       83
       83
       +
               NoNewPrivileges = true;

     

       81
       84
        
               PrivateDevices = true;

     

       82
       85
        
               PrivateTmp = true;

     

       83
       86
        
               PrivateUsers = true;

     
···

       91
       94
        
               ProtectKernelTunables = true;

     

       92
       95
        
               ProtectProc = "invisible";

     

       93
       96
        
               ProtectSystem = "strict";

     

       94
       94
       -
               RestrictAddressFamilies = [

     

       95
       95
       -
                 "AF_INET"

     

       96
       96
       -
                 "AF_INET6"

     

       97
       97
       -
                 "AF_UNIX"

     

       98
       98
       -
               ];

     

       97
       97
       +
               RemoveIPC = true;

     

       98
       98
       +
               RestrictAddressFamilies = [ "AF_INET AF_INET6 AF_UNIX" ];

     

       99
       99
        
               RestrictNamespaces = true;

     

       100
       100
        
               RestrictRealtime = true;

     

       101
       101
        
               RestrictSUIDSGID = true;

     

       102
       102
        
               SystemCallArchitectures = "native";

     

       103
       103
       +
               SystemCallFilter = [

     

       104
       104
       +
                 "@system-service"

     

       105
       105
       +
                 "~@privileged"

     

       106
       106
       +
                 "~@resources"

     

       107
       107
       +
                 "setrlimit"

     

       108
       108
       +
               ];

     

       109
       109
       +
               UMask = "0077";

     

       103
       110
        
             };

     

       104
       111
        
           };

     

       105
       112

+1 -1

nixos/tests/all-tests.nix

···

       353
       353
        
         early-mount-options = handleTest ./early-mount-options.nix {};

     

       354
       354
        
         ec2-config = (handleTestOn ["x86_64-linux"] ./ec2.nix {}).boot-ec2-config or {};

     

       355
       355
        
         ec2-nixops = (handleTestOn ["x86_64-linux"] ./ec2.nix {}).boot-ec2-nixops or {};

     

       356
       356
       -
         echoip = handleTest ./echoip.nix {};

     

       356
       356
       +
         echoip = runTest ./echoip.nix;

     

       357
       357
        
         ecryptfs = handleTest ./ecryptfs.nix {};

     

       358
       358
        
         fscrypt = handleTest ./fscrypt.nix {};

     

       359
       359
        
         fastnetmon-advanced = runTest ./fastnetmon-advanced.nix;

+23 -24

nixos/tests/echoip.nix

···

       1
       1
       -
       import ./make-test-python.nix (

     

       2
       2
       -
         { lib, ... }:

     

       3
       3
       -
         {

     

       4
       4
       -
           name = "echoip";

     

       5
       5
       -
           meta.maintainers = with lib.maintainers; [ defelo ];

     

       1
       1
       +
       { lib, ... }:

     

       6
       2
        
       

     

       7
       7
       -
           nodes.machine = {

     

       8
       8
       -
             services.echoip = {

     

       9
       9
       -
               enable = true;

     

       10
       10
       -
               virtualHost = "echoip.local";

     

       11
       11
       -
             };

     

       3
       3
       +
       {

     

       4
       4
       +
         name = "echoip";

     

       5
       5
       +
         meta.maintainers = with lib.maintainers; [ defelo ];

     

       12
       6
        
       

     

       13
       13
       -
             networking.hosts = {

     

       14
       14
       -
               "127.0.0.1" = [ "echoip.local" ];

     

       15
       15
       -
               "::1" = [ "echoip.local" ];

     

       16
       16
       -
             };

     

       7
       7
       +
         nodes.machine = {

     

       8
       8
       +
           services.echoip = {

     

       9
       9
       +
             enable = true;

     

       10
       10
       +
             virtualHost = "echoip.local";

     

       11
       11
       +
           };

     

       12
       12
       +
       

     

       13
       13
       +
           networking.hosts = {

     

       14
       14
       +
             "127.0.0.1" = [ "echoip.local" ];

     

       15
       15
       +
             "::1" = [ "echoip.local" ];

     

       17
       16
        
           };

     

       17
       17
       +
         };

     

       18
       18
        
       

     

       19
       19
       -
           testScript = ''

     

       20
       20
       -
             machine.wait_for_unit("echoip.service")

     

       21
       21
       -
             machine.wait_for_open_port(8080)

     

       19
       19
       +
         testScript = ''

     

       20
       20
       +
           machine.wait_for_unit("echoip.service")

     

       21
       21
       +
           machine.wait_for_open_port(8080)

     

       22
       22
        
       

     

       23
       23
       -
             resp = machine.succeed("curl -4 http://echoip.local/ip")

     

       24
       24
       -
             assert resp.strip() == "127.0.0.1"

     

       25
       25
       -
             resp = machine.succeed("curl -6 http://echoip.local/ip")

     

       26
       26
       -
             assert resp.strip() == "::1"

     

       27
       27
       -
           '';

     

       28
       28
       -
         }

     

       29
       29
       -
       )

     

       23
       23
       +
           resp = machine.succeed("curl -4 http://echoip.local/ip")

     

       24
       24
       +
           assert resp.strip() == "127.0.0.1"

     

       25
       25
       +
           resp = machine.succeed("curl -6 http://echoip.local/ip")

     

       26
       26
       +
           assert resp.strip() == "::1"

     

       27
       27
       +
         '';

     

       28
       28
       +
       }