movefasta/nixpkgs
0
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-07-13 13:40:28 +03:00
Code Activity

nixos/echoip: improve systemd hardening (#387466)

Browse source
This commit is contained in:
Sandro 2025-03-19 19:00:27 +01:00 • committed by GitHub
commit 1289c91409
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 37 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

19
nixos/modules/services/web-apps/echoip.nix
View file

@ -75,9 +75,12 @@ in
);
# Hardening
AmbientCapabilities = "";
CapabilityBoundingSet = [ "" ];
DeviceAllow = [ "" ];
DevicePolicy = "closed";
LockPersonality = true;
MemoryDenyWriteExecute = true;
NoNewPrivileges = true;
PrivateDevices = true;
PrivateTmp = true;
PrivateUsers = true;
@ -91,15 +94,19 @@ in
ProtectKernelTunables = true;
ProtectProc = "invisible";
ProtectSystem = "strict";
RestrictAddressFamilies = [
"AF_INET"
"AF_INET6"
"AF_UNIX"
];
RemoveIPC = true;
RestrictAddressFamilies = [ "AF_INET AF_INET6 AF_UNIX" ];
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
SystemCallFilter = [
"@system-service"
"~@privileged"
"~@resources"
"setrlimit"
];
UMask = "0077";
};
};

2
nixos/tests/all-tests.nix
View file

@ -353,7 +353,7 @@ in {
early-mount-options = handleTest ./early-mount-options.nix {};
ec2-config = (handleTestOn ["x86_64-linux"] ./ec2.nix {}).boot-ec2-config or {};
ec2-nixops = (handleTestOn ["x86_64-linux"] ./ec2.nix {}).boot-ec2-nixops or {};
echoip = handleTest ./echoip.nix {};
echoip = runTest ./echoip.nix;
ecryptfs = handleTest ./ecryptfs.nix {};
fscrypt = handleTest ./fscrypt.nix {};
fastnetmon-advanced = runTest ./fastnetmon-advanced.nix;

47
nixos/tests/echoip.nix
View file

@ -1,29 +1,28 @@
import ./make-test-python.nix (
{ lib, ... }:
{
name = "echoip";
meta.maintainers = with lib.maintainers; [ defelo ];
{ lib, ... }:
nodes.machine = {
services.echoip = {
enable = true;
virtualHost = "echoip.local";
};
{
name = "echoip";
meta.maintainers = with lib.maintainers; [ defelo ];
networking.hosts = {
"127.0.0.1" = [ "echoip.local" ];
"::1" = [ "echoip.local" ];
};
nodes.machine = {
services.echoip = {
enable = true;
virtualHost = "echoip.local";
};
testScript = ''
machine.wait_for_unit("echoip.service")
machine.wait_for_open_port(8080)
networking.hosts = {
"127.0.0.1" = [ "echoip.local" ];
"::1" = [ "echoip.local" ];
};
};
resp = machine.succeed("curl -4 http://echoip.local/ip")
assert resp.strip() == "127.0.0.1"
resp = machine.succeed("curl -6 http://echoip.local/ip")
assert resp.strip() == "::1"
'';
}
)
testScript = ''
machine.wait_for_unit("echoip.service")
machine.wait_for_open_port(8080)
resp = machine.succeed("curl -4 http://echoip.local/ip")
assert resp.strip() == "127.0.0.1"
resp = machine.succeed("curl -6 http://echoip.local/ip")
assert resp.strip() == "::1"
'';
}