pyrox.dev / nixpkgs
lol
fork atom

nixos/tests/chromium: Check new userns sandbox.

Since Chromium version 42, we have a new user namespaces sandbox in the
upstream project. It's more integrated so the chrome://sandbox page
reports it as "Namespace Sandbox" instead of SUID sandbox, which we were
re-using (or abusing?) in our patch.

So if either "SUID Sandbox" or "Namespace Sandbox" reports with "Yes",
it's fine on our side.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>

aszlig 9de4cadd c92dbffe

options
unified split
Changed files
+1 -1
nixos
tests
chromium.nix
+1 -1
nixos/tests/chromium.nix 
···

       
154

       
154

       
 

       



     

       
155

       
155

       
 

       
          my $clipboard = $machine->succeed("${pkgs.xclip}/bin/xclip -o");


     

       
156

       
156

       
 

       
          die "sandbox not working properly: $clipboard"


     

       
157

       

       
-

       
          unless $clipboard =~ /suid sandbox.*yes/mi


     

       

       
157

       
+

       
          unless $clipboard =~ /(?:suid|namespace) sandbox.*yes/mi


     

       
158

       
158

       
 

       
              && $clipboard =~ /pid namespaces.*yes/mi


     

       
159

       
159

       
 

       
              && $clipboard =~ /network namespaces.*yes/mi


     

       
160

       
160

       
 

       
              && $clipboard =~ /seccomp.*sandbox.*yes/mi;