···

       
63
       
 
       
      } // removeAttrs config [ "confinement" "serviceConfig" ];

     

       
64
       
 
       
    };

     

       
65
       
 
       


     

       
66
       
-
       
  in {

     

       
67
       
-
       
    imports = lib.imap1 mkTestStep [

     

       
68
       
-
       
      { description = "chroot-only confinement";

     

       
69
       
-
       
        config.confinement.mode = "chroot-only";

     

       
70
       
-
       
        testScript = ''

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
71
       
 
       
          assert_permissions({

     

       
72
       
 
       
            'bin': Accessibility.WRITABLE,

     

       
73
       
 
       
            'nix': Accessibility.WRITABLE,

     

       
74
       
 
       
            'run': Accessibility.WRITABLE,

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
75
       
 
       
          })

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
76
       
 
       


     

       
77
       
-
       
          assert os.getuid() == 0

     

       
78
       
-
       
          os.chown('/bin', 65534, 0)

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
79
       
 
       
        '';

     

       
80
       
 
       
      }

     

       
81
       
-
       
      { description = "full confinement with APIVFS";

     

       
82
       
-
       
        testScript = ''

     

       
83
       
-
       
          Path('/etc').rmdir()

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
84
       
 
       


     

       
85
       
 
       
          assert_permissions({

     

       
86
       
 
       
            'bin': Accessibility.WRITABLE,

     

       
87
       
 
       
            'nix': Accessibility.WRITABLE,

     

       
88
       
-
       
            'tmp': Accessibility.WRITABLE,

     

       
89
       
 
       
            'run': Accessibility.WRITABLE,

     

       
90
       
 
       


     

       
91
       
 
       
            'proc': Accessibility.SPECIAL,

     

       
92
       
 
       
            'sys': Accessibility.SPECIAL,

     

       
93
       
 
       
            'dev': Accessibility.WRITABLE,

     

       
94
       
-
       
          })

     

       
95
       
 
       


     

       
96
       
-
       
          bin_gid = Path('/bin').stat().st_gid

     

       
97
       
-
       
          with pytest.raises(OSError) as excinfo:

     

       
98
       
-
       
            os.chown('/bin', 65534, bin_gid)

     

       
99
       
-
       
          assert excinfo.value.errno == errno.EINVAL

     

       
100
       
-
       


     

       
101
       
-
       
          assert os.getuid() == 0

     

       
102
       
-
       
          os.chown('/bin', 0, 0)

     

       
103
       
-
       
        '';

     

       
104
       
-
       
      }

     

       
105
       
-
       
      { description = "check existence of bind-mounted /etc";

     

       
106
       
-
       
        config.serviceConfig.BindReadOnlyPaths = [ "/etc" ];

     

       
107
       
-
       
        testScript = ''

     

       
108
       
-
       
          assert Path('/etc/passwd').read_text()

     

       
109
       
-
       
        '';

     

       
110
       
-
       
      }

     

       
111
       
-
       
      { description = "check if User/Group really runs as non-root";

     

       
112
       
-
       
        config.serviceConfig.User = "chroot-testuser";

     

       
113
       
-
       
        config.serviceConfig.Group = "chroot-testgroup";

     

       
114
       
-
       
        testScript = ''

     

       
115
       
-
       
          assert list(Path('/dev').iterdir())

     

       
116
       
-
       


     

       
117
       
 
       
          assert os.getuid() != 0

     

       
118
       
 
       
          assert os.getgid() != 0

     

       
119
       
 
       


     

       
120
       
-
       
          with pytest.raises(PermissionError):

     

       
121
       
-
       
            Path('/bin/test').touch()

     

       
122
       
-
       
        '';

     

       
123
       
-
       
      }

     

       
124
       
-
       
      { description = "check if DynamicUser is working in full-apivfs mode";

     

       
125
       
-
       
        config.confinement.mode = "full-apivfs";

     

       
126
       
-
       
        config.serviceConfig.DynamicUser = true;

     

       
127
       
-
       
        testScript = ''

     

       
128
       
 
       
          assert_permissions({

     

       
129
       
 
       
            'bin': Accessibility.READABLE,

     

       
130
       
 
       
            'nix': Accessibility.READABLE,

     

       
131
       
-
       
            'tmp': Accessibility.WRITABLE,

     

       
132
       
 
       
            'run': Accessibility.STICKY,

     

       
133
       
 
       


     

       
134
       
 
       
            'proc': Accessibility.SPECIAL,

     
···

       
138
       
 
       
            'dev/shm': Accessibility.STICKY,

     

       
139
       
 
       
            'dev/mqueue': Accessibility.STICKY,

     

       
140
       
 
       


     

       
141
       
-
       
            'var': Accessibility.READABLE,

     

       
142
       
-
       
            'var/tmp': Accessibility.WRITABLE,

     

       
143
       
 
       
          })

     

       
144
       
-
       


     

       
145
       
-
       
          assert os.getuid() != 0

     

       
146
       
-
       
          assert os.getgid() != 0

     

       
147
       
-
       


     

       
148
       
-
       
          with pytest.raises(OSError) as excinfo:

     

       
149
       
-
       
            Path('/bin/test').touch()

     

       
150
       
-
       
          assert excinfo.value.errno == errno.EROFS

     

       
151
       
-
       


     

       
152
       
-
       
          with pytest.raises(OSError) as excinfo:

     

       
153
       
-
       
            Path('/etc/test').touch()

     

       
154
       
-
       
          assert excinfo.value.errno == errno.EROFS

     

       
155
       
 
       
        '';

     

       
156
       
 
       
      }

     

       
157
       
-
       
      { description = "check if DynamicUser and PrivateTmp=false are working in full-apivfs mode";

     

       
158
       
-
       
        config.confinement.mode = "full-apivfs";

     

       
159
       
-
       
        config.serviceConfig.DynamicUser = true;

     

       
160
       
-
       
        config.serviceConfig.PrivateTmp = false;

     

       
161
       
-
       
        testScript = ''

     

       
162
       
-
       
          assert_permissions({

     

       
163
       
-
       
            'bin': Accessibility.READABLE,

     

       
164
       
-
       
            'nix': Accessibility.READABLE,

     

       
165
       
-
       
            'run': Accessibility.STICKY,

     

       
166
       
-
       


     

       
167
       
-
       
            'proc': Accessibility.SPECIAL,

     

       
168
       
-
       
            'sys': Accessibility.SPECIAL,

     

       
169
       
-
       


     

       
170
       
-
       
            'dev': Accessibility.SPECIAL,

     

       
171
       
-
       
            'dev/shm': Accessibility.STICKY,

     

       
172
       
-
       
            'dev/mqueue': Accessibility.STICKY,

     

       
173
       
-
       
          })

     

       
174
       
-
       


     

       
175
       
-
       
          assert os.getuid() != 0

     

       
176
       
-
       
          assert os.getgid() != 0

     

       
177
       
-
       


     

       
178
       
-
       
          with pytest.raises(OSError) as excinfo:

     

       
179
       
-
       
            Path('/bin/test').touch()

     

       
180
       
-
       
          assert excinfo.value.errno == errno.EROFS

     

       
181
       
-
       


     

       
182
       
-
       
          with pytest.raises(OSError) as excinfo:

     

       
183
       
-
       
            Path('/etc/test').touch()

     

       
184
       
-
       
          assert excinfo.value.errno == errno.EROFS

     

       
185
       
-
       
        '';

     

       
186
       
-
       
      }

     

       
187
       
-
       
      { description = "check if DynamicUser is working in chroot-only mode";

     

       
188
       
-
       
        config.confinement.mode = "chroot-only";

     

       
189
       
-
       
        config.serviceConfig.DynamicUser = true;

     

       
190
       
-
       
        testScript = ''

     

       
191
       
-
       
          assert_permissions({

     

       
192
       
-
       
            'bin': Accessibility.READABLE,

     

       
193
       
-
       
            'nix': Accessibility.READABLE,

     

       
194
       
-
       
            'run': Accessibility.READABLE,

     

       
195
       
-
       
          })

     

       
196
       
 
       


     

       
197
       
-
       
          assert os.getuid() != 0

     

       
198
       
-
       
          assert os.getgid() != 0

     

       
199
       
-
       


     

       
200
       
-
       
          with pytest.raises(OSError) as excinfo:

     

       
201
       
-
       
            Path('/bin/test').touch()

     

       
202
       
-
       
          assert excinfo.value.errno == errno.EROFS

     

       
203
       
-
       
        '';

     

       
204
       
-
       
      }

     

       
205
       
-
       
      { description = "check if DynamicUser and PrivateTmp=true are working in chroot-only mode";

     

       
206
       
-
       
        config.confinement.mode = "chroot-only";

     

       
207
       
-
       
        config.serviceConfig.DynamicUser = true;

     

       
208
       
-
       
        config.serviceConfig.PrivateTmp = true;

     

       
209
       
 
       
        testScript = ''

     

       
210
       
-
       
          assert_permissions({

     

       
211
       
-
       
            'bin': Accessibility.READABLE,

     

       
212
       
-
       
            'nix': Accessibility.READABLE,

     

       
213
       
-
       
            'run': Accessibility.READABLE,

     

       
214
       
-
       
            'tmp': Accessibility.WRITABLE,

     

       
215
       
-
       


     

       
216
       
-
       
            'var': Accessibility.READABLE,

     

       
217
       
-
       
            'var/tmp': Accessibility.WRITABLE,

     

       
218
       
-
       
          })

     

       
219
       
-
       


     

       
220
       
-
       
          assert os.getuid() != 0

     

       
221
       
-
       
          assert os.getgid() != 0

     

       
222
       
-
       


     

       
223
       
-
       
          with pytest.raises(OSError) as excinfo:

     

       
224
       
-
       
            Path('/bin/test').touch()

     

       
225
       
-
       
          assert excinfo.value.errno == errno.EROFS

     

       
226
       
 
       
        '';

     

       
227
       
 
       
      }

     

       
228
       
 
       
      (let

     
···

       
233
       
 
       
        description = "check if symlinks are properly bind-mounted";

     

       
234
       
 
       
        config.confinement.packages = lib.singleton symlink;

     

       
235
       
 
       
        testScript = ''

     

       
236
       
-
       
          Path('/etc').rmdir()

     

       
237
       
 
       
          assert Path('${symlink}').read_text() == 'got me'

     

       
238
       
 
       
        '';

     

       
239
       
 
       
      })

     
···

       
318
       
 
       
          assert excinfo.value.errno == errno.ELOOP

     

       
319
       
 
       
        '';

     

       
320
       
 
       
      }

     

       
321
       
-
       
    ];

     

       
322
       
 
       


     

       
323
       
 
       
    config.users.groups.chroot-testgroup = {};

     

       
324
       
 
       
    config.users.users.chroot-testuser = {

     

···

       
63
       
 
       
      } // removeAttrs config [ "confinement" "serviceConfig" ];

     

       
64
       
 
       
    };

     

       
65
       
 
       


     

       
66
       
+
       
    parametrisedTests = lib.concatMap ({ user, privateTmp }: let

     

       
67
       
+
       
      withTmp = if privateTmp then "with PrivateTmp" else "without PrivateTmp";

     

       
68
       
+
       


     

       
69
       
+
       
      serviceConfig = if user == "static-user" then {

     

       
70
       
+
       
        User = "chroot-testuser";

     

       
71
       
+
       
        Group = "chroot-testgroup";

     

       
72
       
+
       
      } else if user == "dynamic-user" then {

     

       
73
       
+
       
        DynamicUser = true;

     

       
74
       
+
       
      } else {};

     

       
75
       
+
       


     

       
76
       
+
       
    in [

     

       
77
       
+
       
      { description = "${user}, chroot-only confinement ${withTmp}";

     

       
78
       
+
       
        config = {

     

       
79
       
+
       
          confinement.mode = "chroot-only";

     

       
80
       
+
       
          # Only set if privateTmp is true to ensure that the default is false.

     

       
81
       
+
       
          serviceConfig = serviceConfig // lib.optionalAttrs privateTmp {

     

       
82
       
+
       
            PrivateTmp = true;

     

       
83
       
+
       
          };

     

       
84
       
+
       
        };

     

       
85
       
+
       
        testScript = if user == "root" then ''

     

       
86
       
+
       
          assert os.getuid() == 0

     

       
87
       
+
       
          assert os.getgid() == 0

     

       
88
       
+
       


     

       
89
       
 
       
          assert_permissions({

     

       
90
       
 
       
            'bin': Accessibility.WRITABLE,

     

       
91
       
 
       
            'nix': Accessibility.WRITABLE,

     

       
92
       
 
       
            'run': Accessibility.WRITABLE,

     

       
93
       
+
       
            ${lib.optionalString privateTmp "'tmp': Accessibility.STICKY,"}

     

       
94
       
+
       
            ${lib.optionalString privateTmp "'var': Accessibility.WRITABLE,"}

     

       
95
       
+
       
            ${lib.optionalString privateTmp "'var/tmp': Accessibility.STICKY,"}

     

       
96
       
 
       
          })

     

       
97
       
+
       
        '' else ''

     

       
98
       
+
       
          assert os.getuid() != 0

     

       
99
       
+
       
          assert os.getgid() != 0

     

       
100
       
 
       


     

       
101
       
+
       
          assert_permissions({

     

       
102
       
+
       
            'bin': Accessibility.READABLE,

     

       
103
       
+
       
            'nix': Accessibility.READABLE,

     

       
104
       
+
       
            'run': Accessibility.READABLE,

     

       
105
       
+
       
            ${lib.optionalString privateTmp "'tmp': Accessibility.STICKY,"}

     

       
106
       
+
       
            ${lib.optionalString privateTmp "'var': Accessibility.READABLE,"}

     

       
107
       
+
       
            ${lib.optionalString privateTmp "'var/tmp': Accessibility.STICKY,"}

     

       
108
       
+
       
          })

     

       
109
       
 
       
        '';

     

       
110
       
 
       
      }

     

       
111
       
+
       
      { description = "${user}, full APIVFS confinement ${withTmp}";

     

       
112
       
+
       
        config = {

     

       
113
       
+
       
          # Only set if privateTmp is false to ensure that the default is true.

     

       
114
       
+
       
          serviceConfig = serviceConfig // lib.optionalAttrs (!privateTmp) {

     

       
115
       
+
       
            PrivateTmp = false;

     

       
116
       
+
       
          };

     

       
117
       
+
       
        };

     

       
118
       
+
       
        testScript = if user == "root" then ''

     

       
119
       
+
       
          assert os.getuid() == 0

     

       
120
       
+
       
          assert os.getgid() == 0

     

       
121
       
 
       


     

       
122
       
 
       
          assert_permissions({

     

       
123
       
 
       
            'bin': Accessibility.WRITABLE,

     

       
124
       
 
       
            'nix': Accessibility.WRITABLE,

     

       
125
       
+
       
            ${lib.optionalString privateTmp "'tmp': Accessibility.STICKY,"}

     

       
126
       
 
       
            'run': Accessibility.WRITABLE,

     

       
127
       
 
       


     

       
128
       
 
       
            'proc': Accessibility.SPECIAL,

     

       
129
       
 
       
            'sys': Accessibility.SPECIAL,

     

       
130
       
 
       
            'dev': Accessibility.WRITABLE,

     

       
0
       
 
       

     

       
131
       
 
       


     

       
132
       
+
       
            ${lib.optionalString privateTmp "'var': Accessibility.WRITABLE,"}

     

       
133
       
+
       
            ${lib.optionalString privateTmp "'var/tmp': Accessibility.STICKY,"}

     

       
134
       
+
       
          })

     

       
135
       
+
       
        '' else ''

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
136
       
 
       
          assert os.getuid() != 0

     

       
137
       
 
       
          assert os.getgid() != 0

     

       
138
       
 
       


     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
139
       
 
       
          assert_permissions({

     

       
140
       
 
       
            'bin': Accessibility.READABLE,

     

       
141
       
 
       
            'nix': Accessibility.READABLE,

     

       
142
       
+
       
            ${lib.optionalString privateTmp "'tmp': Accessibility.STICKY,"}

     

       
143
       
 
       
            'run': Accessibility.STICKY,

     

       
144
       
 
       


     

       
145
       
 
       
            'proc': Accessibility.SPECIAL,

     
···

       
149
       
 
       
            'dev/shm': Accessibility.STICKY,

     

       
150
       
 
       
            'dev/mqueue': Accessibility.STICKY,

     

       
151
       
 
       


     

       
152
       
+
       
            ${lib.optionalString privateTmp "'var': Accessibility.READABLE,"}

     

       
153
       
+
       
            ${lib.optionalString privateTmp "'var/tmp': Accessibility.STICKY,"}

     

       
154
       
 
       
          })

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
155
       
 
       
        '';

     

       
156
       
 
       
      }

     

       
157
       
+
       
    ]) (lib.cartesianProductOfSets {

     

       
158
       
+
       
      user = [ "root" "dynamic-user" "static-user" ];

     

       
159
       
+
       
      privateTmp = [ true false ];

     

       
160
       
+
       
    });

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
161
       
 
       


     

       
162
       
+
       
  in {

     

       
163
       
+
       
    imports = lib.imap1 mkTestStep (parametrisedTests ++ [

     

       
164
       
+
       
      { description = "existence of bind-mounted /etc";

     

       
165
       
+
       
        config.serviceConfig.BindReadOnlyPaths = [ "/etc" ];

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
166
       
 
       
        testScript = ''

     

       
167
       
+
       
          assert Path('/etc/passwd').read_text()

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
168
       
 
       
        '';

     

       
169
       
 
       
      }

     

       
170
       
 
       
      (let

     
···

       
175
       
 
       
        description = "check if symlinks are properly bind-mounted";

     

       
176
       
 
       
        config.confinement.packages = lib.singleton symlink;

     

       
177
       
 
       
        testScript = ''

     

       
0
       
 
       

     

       
178
       
 
       
          assert Path('${symlink}').read_text() == 'got me'

     

       
179
       
 
       
        '';

     

       
180
       
 
       
      })

     
···

       
259
       
 
       
          assert excinfo.value.errno == errno.ELOOP

     

       
260
       
 
       
        '';

     

       
261
       
 
       
      }

     

       
262
       
+
       
    ]);

     

       
263
       
 
       


     

       
264
       
 
       
    config.users.groups.chroot-testgroup = {};

     

       
265
       
 
       
    config.users.users.chroot-testuser = {