commit db05ce5ef75ef1c5496ccfafbb80cd8fa2c3e818 · pyrox.dev/nixpkgs

+71 -59

nixos/tests/apparmor.nix

···

       1
       -
       import ./make-test-python.nix ({ pkgs, lib, ... } : {

     

       2
       -
         name = "apparmor";

     

       3
       -
         meta.maintainers = with lib.maintainers; [ julm grimmauld ];

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       4
        
       

     

       5
       -
         nodes.machine =

     

       6
       -
           { lib, pkgs, config, ... }:

     

       7
       -
           {

     

       8
       -
             security.apparmor.enable = lib.mkDefault true;

     

       9
       -
           };

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       10
        
       

     

       11
       -
         testScript =

     

       12
       -
           ''

     

       13
        
             machine.wait_for_unit("multi-user.target")

     

       14
        
       

     

       15
        
             with subtest("AppArmor profiles are loaded"):

     
···

       28
        
             with subtest("apparmorRulesFromClosure"):

     

       29
        
                 machine.succeed(

     

       30
        
                     "${pkgs.diffutils}/bin/diff -u ${pkgs.writeText "expected.rules" ''

     

       31
       -
                         mr ${pkgs.bash}/lib/**.so*,

     

       32
       -
                         r ${pkgs.bash},

     

       33
       -
                         r ${pkgs.bash}/etc/**,

     

       34
       -
                         r ${pkgs.bash}/lib/**,

     

       35
       -
                         r ${pkgs.bash}/share/**,

     

       36
       -
                         x ${pkgs.bash}/foo/**,

     

       37
       -
                         mr ${pkgs.glibc}/lib/**.so*,

     

       38
       -
                         r ${pkgs.glibc},

     

       39
       -
                         r ${pkgs.glibc}/etc/**,

     

       40
       -
                         r ${pkgs.glibc}/lib/**,

     

       41
       -
                         r ${pkgs.glibc}/share/**,

     

       42
       -
                         x ${pkgs.glibc}/foo/**,

     

       43
       -
                         mr ${pkgs.libcap}/lib/**.so*,

     

       44
       -
                         r ${pkgs.libcap},

     

       45
       -
                         r ${pkgs.libcap}/etc/**,

     

       46
       -
                         r ${pkgs.libcap}/lib/**,

     

       47
       -
                         r ${pkgs.libcap}/share/**,

     

       48
       -
                         x ${pkgs.libcap}/foo/**,

     

       49
       -
                         mr ${pkgs.libcap.lib}/lib/**.so*,

     

       50
       -
                         r ${pkgs.libcap.lib},

     

       51
       -
                         r ${pkgs.libcap.lib}/etc/**,

     

       52
       -
                         r ${pkgs.libcap.lib}/lib/**,

     

       53
       -
                         r ${pkgs.libcap.lib}/share/**,

     

       54
       -
                         x ${pkgs.libcap.lib}/foo/**,

     

       55
       -
                         mr ${pkgs.libidn2.out}/lib/**.so*,

     

       56
       -
                         r ${pkgs.libidn2.out},

     

       57
       -
                         r ${pkgs.libidn2.out}/etc/**,

     

       58
       -
                         r ${pkgs.libidn2.out}/lib/**,

     

       59
       -
                         r ${pkgs.libidn2.out}/share/**,

     

       60
       -
                         x ${pkgs.libidn2.out}/foo/**,

     

       61
       -
                         mr ${pkgs.libunistring}/lib/**.so*,

     

       62
       -
                         r ${pkgs.libunistring},

     

       63
       -
                         r ${pkgs.libunistring}/etc/**,

     

       64
       -
                         r ${pkgs.libunistring}/lib/**,

     

       65
       -
                         r ${pkgs.libunistring}/share/**,

     

       66
       -
                         x ${pkgs.libunistring}/foo/**,

     

       67
       -
                         mr ${pkgs.glibc.libgcc}/lib/**.so*,

     

       68
       -
                         r ${pkgs.glibc.libgcc},

     

       69
       -
                         r ${pkgs.glibc.libgcc}/etc/**,

     

       70
       -
                         r ${pkgs.glibc.libgcc}/lib/**,

     

       71
       -
                         r ${pkgs.glibc.libgcc}/share/**,

     

       72
       -
                         x ${pkgs.glibc.libgcc}/foo/**,

     

       73
       -
                     ''} ${pkgs.runCommand "actual.rules" { preferLocalBuild = true; } ''

     

       0
        
       
     

       74
        
                         ${pkgs.gnused}/bin/sed -e 's:^[^ ]* ${builtins.storeDir}/[^,/-]*-\([^/,]*\):\1 \0:' ${

     

       75
       -
                             pkgs.apparmorRulesFromClosure {

     

       76
       -
                               name = "ping";

     

       77
       -
                               additionalRules = ["x $path/foo/**"];

     

       78
       -
                             } [ pkgs.libcap ]

     

       79
        
                         } |

     

       80
        
                         ${pkgs.coreutils}/bin/sort -n -k1 |

     

       81
        
                         ${pkgs.gnused}/bin/sed -e 's:^[^ ]* ::' >$out

     

       82
       -
                     ''}"

     

       0
        
       
     

       83
        
                 )

     

       84
        
           '';

     

       85
       -
       })

     

       0

···

       1
       +
       import ./make-test-python.nix (

     

       2
       +
         { pkgs, lib, ... }:

     

       3
       +
         {

     

       4
       +
           name = "apparmor";

     

       5
       +
           meta.maintainers = with lib.maintainers; [

     

       6
       +
             julm

     

       7
       +
             grimmauld

     

       8
       +
           ];

     

       9
        
       

     

       10
       +
           nodes.machine =

     

       11
       +
             {

     

       12
       +
               lib,

     

       13
       +
               pkgs,

     

       14
       +
               config,

     

       15
       +
               ...

     

       16
       +
             }:

     

       17
       +
             {

     

       18
       +
               security.apparmor.enable = lib.mkDefault true;

     

       19
       +
             };

     

       20
        
       

     

       21
       +
           testScript = ''

     

       0
        
       
     

       22
        
             machine.wait_for_unit("multi-user.target")

     

       23
        
       

     

       24
        
             with subtest("AppArmor profiles are loaded"):

     
···

       37
        
             with subtest("apparmorRulesFromClosure"):

     

       38
        
                 machine.succeed(

     

       39
        
                     "${pkgs.diffutils}/bin/diff -u ${pkgs.writeText "expected.rules" ''

     

       40
       +
                       mr ${pkgs.bash}/lib/**.so*,

     

       41
       +
                       r ${pkgs.bash},

     

       42
       +
                       r ${pkgs.bash}/etc/**,

     

       43
       +
                       r ${pkgs.bash}/lib/**,

     

       44
       +
                       r ${pkgs.bash}/share/**,

     

       45
       +
                       x ${pkgs.bash}/foo/**,

     

       46
       +
                       mr ${pkgs.glibc}/lib/**.so*,

     

       47
       +
                       r ${pkgs.glibc},

     

       48
       +
                       r ${pkgs.glibc}/etc/**,

     

       49
       +
                       r ${pkgs.glibc}/lib/**,

     

       50
       +
                       r ${pkgs.glibc}/share/**,

     

       51
       +
                       x ${pkgs.glibc}/foo/**,

     

       52
       +
                       mr ${pkgs.libcap}/lib/**.so*,

     

       53
       +
                       r ${pkgs.libcap},

     

       54
       +
                       r ${pkgs.libcap}/etc/**,

     

       55
       +
                       r ${pkgs.libcap}/lib/**,

     

       56
       +
                       r ${pkgs.libcap}/share/**,

     

       57
       +
                       x ${pkgs.libcap}/foo/**,

     

       58
       +
                       mr ${pkgs.libcap.lib}/lib/**.so*,

     

       59
       +
                       r ${pkgs.libcap.lib},

     

       60
       +
                       r ${pkgs.libcap.lib}/etc/**,

     

       61
       +
                       r ${pkgs.libcap.lib}/lib/**,

     

       62
       +
                       r ${pkgs.libcap.lib}/share/**,

     

       63
       +
                       x ${pkgs.libcap.lib}/foo/**,

     

       64
       +
                       mr ${pkgs.libidn2.out}/lib/**.so*,

     

       65
       +
                       r ${pkgs.libidn2.out},

     

       66
       +
                       r ${pkgs.libidn2.out}/etc/**,

     

       67
       +
                       r ${pkgs.libidn2.out}/lib/**,

     

       68
       +
                       r ${pkgs.libidn2.out}/share/**,

     

       69
       +
                       x ${pkgs.libidn2.out}/foo/**,

     

       70
       +
                       mr ${pkgs.libunistring}/lib/**.so*,

     

       71
       +
                       r ${pkgs.libunistring},

     

       72
       +
                       r ${pkgs.libunistring}/etc/**,

     

       73
       +
                       r ${pkgs.libunistring}/lib/**,

     

       74
       +
                       r ${pkgs.libunistring}/share/**,

     

       75
       +
                       x ${pkgs.libunistring}/foo/**,

     

       76
       +
                       mr ${pkgs.glibc.libgcc}/lib/**.so*,

     

       77
       +
                       r ${pkgs.glibc.libgcc},

     

       78
       +
                       r ${pkgs.glibc.libgcc}/etc/**,

     

       79
       +
                       r ${pkgs.glibc.libgcc}/lib/**,

     

       80
       +
                       r ${pkgs.glibc.libgcc}/share/**,

     

       81
       +
                       x ${pkgs.glibc.libgcc}/foo/**,

     

       82
       +
                     ''} ${

     

       83
       +
                       pkgs.runCommand "actual.rules" { preferLocalBuild = true; } ''

     

       84
        
                         ${pkgs.gnused}/bin/sed -e 's:^[^ ]* ${builtins.storeDir}/[^,/-]*-\([^/,]*\):\1 \0:' ${

     

       85
       +
                           pkgs.apparmorRulesFromClosure {

     

       86
       +
                             name = "ping";

     

       87
       +
                             additionalRules = [ "x $path/foo/**" ];

     

       88
       +
                           } [ pkgs.libcap ]

     

       89
        
                         } |

     

       90
        
                         ${pkgs.coreutils}/bin/sort -n -k1 |

     

       91
        
                         ${pkgs.gnused}/bin/sed -e 's:^[^ ]* ::' >$out

     

       92
       +
                       ''

     

       93
       +
                     }"

     

       94
        
                 )

     

       95
        
           '';

     

       96
       +
         }

     

       97
       +
       )