commit dc03bcda57ccd7dd738722635d73e7e4b7997dd9 · pyrox.dev/nixpkgs

nixos/tests/all-tests.nix

···

       691
        
         wmderland = handleTest ./wmderland.nix {};

     

       692
        
         wpa_supplicant = handleTest ./wpa_supplicant.nix {};

     

       693
        
         wordpress = handleTest ./wordpress.nix {};

     

       0
        
       
     

       694
        
         writefreely = handleTest ./web-apps/writefreely.nix {};

     

       695
        
         xandikos = handleTest ./xandikos.nix {};

     

       696
        
         xautolock = handleTest ./xautolock.nix {};

···

       691
        
         wmderland = handleTest ./wmderland.nix {};

     

       692
        
         wpa_supplicant = handleTest ./wpa_supplicant.nix {};

     

       693
        
         wordpress = handleTest ./wordpress.nix {};

     

       694
       +
         wrappers = handleTest ./wrappers.nix {};

     

       695
        
         writefreely = handleTest ./web-apps/writefreely.nix {};

     

       696
        
         xandikos = handleTest ./xandikos.nix {};

     

       697
        
         xautolock = handleTest ./xautolock.nix {};

+79

nixos/tests/wrappers.nix

···

       1
       +
       import ./make-test-python.nix ({ pkgs, ... }:

     

       2
       +
       let

     

       3
       +
         userUid = 1000;

     

       4
       +
         usersGid = 100;

     

       5
       +
         busybox = pkgs : pkgs.busybox.override {

     

       6
       +
           # Without this, the busybox binary drops euid to ruid for most applets, including id.

     

       7
       +
           # See https://bugs.busybox.net/show_bug.cgi?id=15101

     

       8
       +
           extraConfig = "CONFIG_FEATURE_SUID n";

     

       9
       +
         };

     

       10
       +
       in

     

       11
       +
       {

     

       12
       +
         name = "wrappers";

     

       13
       +
       

     

       14
       +
         nodes.machine = { config, pkgs, ... }: {

     

       15
       +
           ids.gids.users = usersGid;

     

       16
       +
       

     

       17
       +
           users.users = {

     

       18
       +
             regular = {

     

       19
       +
               uid = userUid;

     

       20
       +
               isNormalUser = true;

     

       21
       +
             };

     

       22
       +
           };

     

       23
       +
       

     

       24
       +
           security.wrappers = {

     

       25
       +
             suidRoot = {

     

       26
       +
               owner = "root";

     

       27
       +
               group = "root";

     

       28
       +
               setuid = true;

     

       29
       +
               source = "${busybox pkgs}/bin/busybox";

     

       30
       +
               program = "suid_root_busybox";

     

       31
       +
             };

     

       32
       +
             sgidRoot = {

     

       33
       +
               owner = "root";

     

       34
       +
               group = "root";

     

       35
       +
               setgid = true;

     

       36
       +
               source = "${busybox pkgs}/bin/busybox";

     

       37
       +
               program = "sgid_root_busybox";

     

       38
       +
             };

     

       39
       +
             withChown = {

     

       40
       +
               owner = "root";

     

       41
       +
               group = "root";

     

       42
       +
               source = "${pkgs.libcap}/bin/capsh";

     

       43
       +
               program = "capsh_with_chown";

     

       44
       +
               capabilities = "cap_chown+ep";

     

       45
       +
             };

     

       46
       +
           };

     

       47
       +
         };

     

       48
       +
       

     

       49
       +
         testScript =

     

       50
       +
           ''

     

       51
       +
             def cmd_as_regular(cmd):

     

       52
       +
               return "su -l regular -c '{0}'".format(cmd)

     

       53
       +
       

     

       54
       +
             def test_as_regular(cmd, expected):

     

       55
       +
               out = machine.succeed(cmd_as_regular(cmd)).strip()

     

       56
       +
               assert out == expected, "Expected {0} to output {1}, but got {2}".format(cmd, expected, out)

     

       57
       +
       

     

       58
       +
             test_as_regular('${busybox pkgs}/bin/busybox id -u', '${toString userUid}')

     

       59
       +
             test_as_regular('${busybox pkgs}/bin/busybox id -ru', '${toString userUid}')

     

       60
       +
             test_as_regular('${busybox pkgs}/bin/busybox id -g', '${toString usersGid}')

     

       61
       +
             test_as_regular('${busybox pkgs}/bin/busybox id -rg', '${toString usersGid}')

     

       62
       +
       

     

       63
       +
             test_as_regular('/run/wrappers/bin/suid_root_busybox id -u', '0')

     

       64
       +
             test_as_regular('/run/wrappers/bin/suid_root_busybox id -ru', '${toString userUid}')

     

       65
       +
             test_as_regular('/run/wrappers/bin/suid_root_busybox id -g', '${toString usersGid}')

     

       66
       +
             test_as_regular('/run/wrappers/bin/suid_root_busybox id -rg', '${toString usersGid}')

     

       67
       +
       

     

       68
       +
             test_as_regular('/run/wrappers/bin/sgid_root_busybox id -u', '${toString userUid}')

     

       69
       +
             test_as_regular('/run/wrappers/bin/sgid_root_busybox id -ru', '${toString userUid}')

     

       70
       +
             test_as_regular('/run/wrappers/bin/sgid_root_busybox id -g', '0')

     

       71
       +
             test_as_regular('/run/wrappers/bin/sgid_root_busybox id -rg', '${toString usersGid}')

     

       72
       +
       

     

       73
       +
             # We are only testing the permitted set, because it's easiest to look at with capsh.

     

       74
       +
             machine.fail(cmd_as_regular('${pkgs.libcap}/bin/capsh --has-p=CAP_CHOWN'))

     

       75
       +
             machine.fail(cmd_as_regular('${pkgs.libcap}/bin/capsh --has-p=CAP_SYS_ADMIN'))

     

       76
       +
             machine.succeed(cmd_as_regular('/run/wrappers/bin/capsh_with_chown --has-p=CAP_CHOWN'))

     

       77
       +
             machine.fail(cmd_as_regular('/run/wrappers/bin/capsh_with_chown --has-p=CAP_SYS_ADMIN'))

     

       78
       +
           '';

     

       79
       +
       })