commit c2a75a80418a452a1d05a9b5f0fd4f6c9308696a · pyrox.dev/nixpkgs

+5 -2

nixos/lib/test-driver/test-driver.py

···

       424
       424
        
                       output += out

     

       425
       425
        
               return output

     

       426
       426
        
       

     

       427
       427
       -
           def fail(self, *commands: str) -> None:

     

       427
       427
       +
           def fail(self, *commands: str) -> str:

     

       428
       428
        
               """Execute each command and check that it fails."""

     

       429
       429
       +
               output = ""

     

       429
       430
        
               for command in commands:

     

       430
       431
        
                   with self.nested("must fail: {}".format(command)):

     

       431
       431
       -
                       status, output = self.execute(command)

     

       432
       432
       +
                       (status, out) = self.execute(command)

     

       432
       433
        
                       if status == 0:

     

       433
       434
        
                           raise Exception(

     

       434
       435
        
                               "command `{}` unexpectedly succeeded".format(command)

     

       435
       436
        
                           )

     

       437
       437
       +
                       output += out

     

       438
       438
       +
               return output

     

       436
       439
        
       

     

       437
       440
        
           def wait_until_succeeds(self, command: str) -> str:

     

       438
       441
        
               """Wait until a command returns success and return its output.

+58 -54

nixos/tests/hardened.nix

···

       1
       1
       -
       import ./make-test.nix ({ pkgs, latestKernel ? false, ... } : {

     

       1
       1
       +
       import ./make-test-python.nix ({ pkgs, latestKernel ? false, ... } : {

     

       2
       2
        
         name = "hardened";

     

       3
       3
        
         meta = with pkgs.stdenv.lib.maintainers; {

     

       4
       4
        
           maintainers = [ joachifm ];

     
···

       47
       47
        
             };

     

       48
       48
        
           in

     

       49
       49
        
           ''

     

       50
       50
       -
             $machine->waitForUnit("multi-user.target");

     

       50
       50
       +
             machine.wait_for_unit("multi-user.target")

     

       51
       51
        
       

     

       52
       52
       -
             subtest "apparmor-loaded", sub {

     

       53
       53
       -
                 $machine->succeed("systemctl status apparmor.service");

     

       54
       54
       -
             };

     

       52
       52
       +
       

     

       53
       53
       +
             with subtest("AppArmor profiles are loaded"):

     

       54
       54
       +
                 machine.succeed("systemctl status apparmor.service")

     

       55
       55
       +
       

     

       55
       56
        
       

     

       56
       57
        
             # AppArmor securityfs

     

       57
       57
       -
             subtest "apparmor-securityfs", sub {

     

       58
       58
       -
                 $machine->succeed("mountpoint -q /sys/kernel/security");

     

       59
       59
       -
                 $machine->succeed("cat /sys/kernel/security/apparmor/profiles");

     

       60
       60
       -
             };

     

       58
       58
       +
             with subtest("AppArmor securityfs is mounted"):

     

       59
       59
       +
                 machine.succeed("mountpoint -q /sys/kernel/security")

     

       60
       60
       +
                 machine.succeed("cat /sys/kernel/security/apparmor/profiles")

     

       61
       61
       +
       

     

       61
       62
        
       

     

       62
       63
        
             # Test loading out-of-tree modules

     

       63
       63
       -
             subtest "extra-module-packages", sub {

     

       64
       64
       -
                 $machine->succeed("grep -Fq wireguard /proc/modules");

     

       65
       65
       -
             };

     

       64
       64
       +
             with subtest("Out-of-tree modules can be loaded"):

     

       65
       65
       +
                 machine.succeed("grep -Fq wireguard /proc/modules")

     

       66
       66
       +
       

     

       66
       67
        
       

     

       67
       68
        
             # Test hidepid

     

       68
       68
       -
             subtest "hidepid", sub {

     

       69
       69
       -
                 $machine->succeed("grep -Fq hidepid=2 /proc/mounts");

     

       69
       69
       +
             with subtest("hidepid=2 option is applied and works"):

     

       70
       70
       +
                 machine.succeed("grep -Fq hidepid=2 /proc/mounts")

     

       70
       71
        
                 # cannot use pgrep -u here, it segfaults when access to process info is denied

     

       71
       71
       -
                 $machine->succeed("[ `su - sybil -c 'ps --no-headers --user root | wc -l'` = 0 ]");

     

       72
       72
       -
                 $machine->succeed("[ `su - alice -c 'ps --no-headers --user root | wc -l'` != 0 ]");

     

       73
       73
       -
             };

     

       72
       72
       +
                 machine.succeed("[ `su - sybil -c 'ps --no-headers --user root | wc -l'` = 0 ]")

     

       73
       73
       +
                 machine.succeed("[ `su - alice -c 'ps --no-headers --user root | wc -l'` != 0 ]")

     

       74
       74
       +
       

     

       74
       75
        
       

     

       75
       76
        
             # Test kernel module hardening

     

       76
       76
       -
             subtest "lock-modules", sub {

     

       77
       77
       +
             with subtest("No more kernel modules can be loaded"):

     

       77
       78
        
                 # note: this better a be module we normally wouldn't load ...

     

       78
       78
       -
                 $machine->fail("modprobe dccp");

     

       79
       79
       -
             };

     

       79
       79
       +
                 machine.fail("modprobe dccp")

     

       80
       80
       +
       

     

       80
       81
        
       

     

       81
       82
        
             # Test userns

     

       82
       82
       -
             subtest "userns", sub {

     

       83
       83
       -
                 $machine->succeed("unshare --user true");

     

       84
       84
       -
                 $machine->fail("su -l alice -c 'unshare --user true'");

     

       85
       85
       -
             };

     

       83
       83
       +
             with subtest("User namespaces are restricted"):

     

       84
       84
       +
                 machine.succeed("unshare --user true")

     

       85
       85
       +
                 machine.fail("su -l alice -c 'unshare --user true'")

     

       86
       86
       +
       

     

       86
       87
        
       

     

       87
       88
        
             # Test dmesg restriction

     

       88
       88
       -
             subtest "dmesg", sub {

     

       89
       89
       -
                 $machine->fail("su -l alice -c dmesg");

     

       90
       90
       -
             };

     

       89
       89
       +
             with subtest("Regular users cannot access dmesg"):

     

       90
       90
       +
                 machine.fail("su -l alice -c dmesg")

     

       91
       91
       +
       

     

       91
       92
        
       

     

       92
       93
        
             # Test access to kcore

     

       93
       93
       -
             subtest "kcore", sub {

     

       94
       94
       -
                 $machine->fail("cat /proc/kcore");

     

       95
       95
       -
             };

     

       94
       94
       +
             with subtest("Kcore is inaccessible as root"):

     

       95
       95
       +
                 machine.fail("cat /proc/kcore")

     

       96
       96
       +
       

     

       96
       97
        
       

     

       97
       98
        
             # Test deferred mount

     

       98
       98
       -
             subtest "mount", sub {

     

       99
       99
       -
               $machine->fail("mountpoint -q /efi"); # was deferred

     

       100
       100
       -
               $machine->execute("mkdir -p /efi");

     

       101
       101
       -
               $machine->succeed("mount /dev/disk/by-label/EFISYS /efi");

     

       102
       102
       -
               $machine->succeed("mountpoint -q /efi"); # now mounted

     

       103
       103
       -
             };

     

       99
       99
       +
             with subtest("Deferred mounts work"):

     

       100
       100
       +
                 machine.fail("mountpoint -q /efi")  # was deferred

     

       101
       101
       +
                 machine.execute("mkdir -p /efi")

     

       102
       102
       +
                 machine.succeed("mount /dev/disk/by-label/EFISYS /efi")

     

       103
       103
       +
                 machine.succeed("mountpoint -q /efi")  # now mounted

     

       104
       104
       +
       

     

       104
       105
        
       

     

       105
       106
        
             # Test Nix dæmon usage

     

       106
       106
       -
             subtest "nix-daemon", sub {

     

       107
       107
       -
               $machine->fail("su -l nobody -s /bin/sh -c 'nix ping-store'");

     

       108
       108
       -
               $machine->succeed("su -l alice -c 'nix ping-store'") =~ "OK";

     

       109
       109
       -
             };

     

       107
       107
       +
             with subtest("nix-daemon cannot be used by all users"):

     

       108
       108
       +
                 machine.fail("su -l nobody -s /bin/sh -c 'nix ping-store'")

     

       109
       109
       +
                 machine.succeed("su -l alice -c 'nix ping-store'")

     

       110
       110
       +
       

     

       110
       111
        
       

     

       111
       112
        
             # Test kernel image protection

     

       112
       112
       -
             subtest "kernelimage", sub {

     

       113
       113
       -
               $machine->fail("systemctl hibernate");

     

       114
       114
       -
               $machine->fail("systemctl kexec");

     

       115
       115
       -
             };

     

       113
       113
       +
             with subtest("The kernel image is protected"):

     

       114
       114
       +
                 machine.fail("systemctl hibernate")

     

       115
       115
       +
                 machine.fail("systemctl kexec")

     

       116
       116
       +
       

     

       116
       117
        
       

     

       117
       118
        
             # Test hardened memory allocator

     

       118
       118
       -
             sub runMallocTestProg {

     

       119
       119
       -
                 my ($progName, $errorText) = @_;

     

       120
       120
       -
                 my $text = "fatal allocator error: " . $errorText;

     

       121
       121
       -
                 $machine->fail("${hardened-malloc-tests}/bin/" . $progName) =~ $text;

     

       122
       122
       -
             };

     

       119
       119
       +
             def runMallocTestProg(prog_name, error_text):

     

       120
       120
       +
                 text = "fatal allocator error: " + error_text

     

       121
       121
       +
                 if not text in machine.fail(

     

       122
       122
       +
                     "${hardened-malloc-tests}/bin/"

     

       123
       123
       +
                     + prog_name

     

       124
       124
       +
                     + " 2>&1"

     

       125
       125
       +
                 ):

     

       126
       126
       +
                     raise Exception("Hardened malloc does not work for {}".format(error_text))

     

       123
       127
        
       

     

       124
       124
       -
             subtest "hardenedmalloc", sub {

     

       125
       125
       -
               runMallocTestProg("double_free_large", "invalid free");

     

       126
       126
       -
               runMallocTestProg("unaligned_free_small", "invalid unaligned free");

     

       127
       127
       -
               runMallocTestProg("write_after_free_small", "detected write after free");

     

       128
       128
       -
             };

     

       128
       128
       +
       

     

       129
       129
       +
             with subtest("The hardened memory allocator works"):

     

       130
       130
       +
                 runMallocTestProg("double_free_large", "invalid free")

     

       131
       131
       +
                 runMallocTestProg("unaligned_free_small", "invalid unaligned free")

     

       132
       132
       +
                 runMallocTestProg("write_after_free_small", "detected write after free")

     

       129
       133
        
           '';

     

       130
       134
        
       })