Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

nixos/usbguard: rework #93702

Merged
merged 1 commit into from Aug 11, 2020
Merged

nixos/usbguard: rework #93702

merged 1 commit into from Aug 11, 2020

Conversation

tnias
Copy link
Contributor

@tnias tnias commented Jul 23, 2020

Override the read only restriction for the preStart script, otherwise
directories in /var/{lib,log} can not be created.

Motivation for this change

Fresh usbguard setup with default settings fails to start.

Things done
  • fixed issue
  • tested on my machine
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Ensured that relevant documentation is up to date
  • Fits CONTRIBUTING.md.

@tnias
Copy link
Contributor Author

tnias commented Jul 23, 2020

cc @ivan @dtzWill @flokli

@flokli
Copy link
Contributor

flokli commented Jul 23, 2020

Instead of doing this in the preStart script, can we use the StateDirectory= directory to set up these folders, similar to how it's done since https://github.com/NixOS/nixpkgs/pull/93001/files#diff-c485e98c40325e0a3863c8d2de2901a0R167 for gitolite?

If that folder deviates from the default, we don't really know how to set up the file system structure towards this anyways (mount points in between, etc.) - so providing a simple state directory initialization via StateDirectory for the default case, and leaving more complex things up to the user seems preferrable.

Also, cc @aanderse as the author of that original PR.

@flokli
Copy link
Contributor

flokli commented Jul 23, 2020

Ah, and LogsDIrectory= for the auditFilePath - if we can't redirect it to just be put to the systemd journal, which would even be preferrable.

@tnias
Copy link
Contributor Author

tnias commented Jul 23, 2020

I am in favour of using StateDirectory and logging to journal. In that case the some of the options for custom directory paths should be dropped. I will create a patch.

@flokli
Copy link
Contributor

flokli commented Jul 23, 2020

Thanks!

@tnias
Copy link
Contributor Author

tnias commented Jul 24, 2020

I could not figure out how to get the audit logs some other way than to write them to file. The normal usbguard logs are already written to the journal. If the audit logs should still land in the linux audit system, I would need help with that, as I did not yet figure out how to get it working (especially on NixOS something with audit/auditd seems boken or unintuitive).

As for dropping the options: Is hardcoding the defaults and removing the options a proper way to deprecate them? Where do I put deprecation notices?

@aanderse
Copy link
Member

@tnias if you're not hard coding paths how about something like this?
@flokli is this along the lines of what you were thinking?

@flokli
Copy link
Contributor

flokli commented Jul 27, 2020

I'd even be find with dropping the options, as now proposed in this PR tbh.

@aanderse
Copy link
Member

@flokli I would also support hard coding the paths so we could drop the options, if everyone else agrees 👍

@tnias tnias changed the title nixos/usbguard: fix preStart script nixos/usbguard: rework Jul 29, 2020
@tnias
Copy link
Contributor Author

tnias commented Jul 29, 2020

If I set AuditFilePath=/var/log/usbguard/usbguard-audit.log an audit log gets written to the specified file and the journal. If I do not specify a file path, there are no more audit logs in the journal.
With AuditFIlePath=/dev/null the journal audit logs are still there and we can drop the file in /var/log.

Also some of the options were dropped and text reworked.

@flokli flokli requested a review from aanderse July 29, 2020 14:14
aanderse
aanderse requested changes Jul 29, 2020
View reviewed changes
Copy link
Member

@aanderse aanderse left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The code looks good. Just a few things around "user education".

nixos/modules/services/security/usbguard.nix
daemonConfFile = pkgs.writeText "usbguard-daemon-conf" daemonConf;

in
{

###### interface
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
###### interface
imports = [
(mkRemovedOptionModule [ "services" "usbguard" "ruleFile" ] "<explanation here>")
(mkRemovedOptionModule [ "services" "usbgaurd" "IPCAccessControlFiles" ] "<explanation here>")
(mkRemovedOptionModule [ "services" "usbgaurd" "auditFilePath" ] "<explanation here>")
];
###### interface

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm... further to this we will need an entry in the release notes as this is a breaking change.

nixos/modules/services/security/usbguard.nix Outdated
contents of this option will be written into the nix-store it will be
read-only.
The USBGuard daemon will load this to load the policy rule set.
Persistent modification it via IPC interface won't work, since
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Typo? Missing a word?

nixos/modules/services/security/usbguard.nix
<literal>ruleFile</literal> option.
'';
};

rules = mkOption {
type = types.nullOr types.lines;
default = null;
example = ''
allow with-interface equals { 08:*:* }
'';
description = ''
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I find this description to be a little bit confusing, and I know what you are trying to do. Maybe we can reword this to simplify the intention of nixos managed rules which are immutable vs user managed "dynamic" rules via IPC.

@aanderse
Copy link
Member

aanderse commented Aug 3, 2020

ping @tnias

@tnias
Copy link
Contributor Author

tnias commented Aug 5, 2020

@aanderse Like this?

aanderse
aanderse approved these changes Aug 5, 2020
View reviewed changes
Copy link
Member

@aanderse aanderse left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍 I'll defer to @flokli for final review and merge.
Thanks @tnias 🎉

@tnias
Copy link
Contributor Author

tnias commented Aug 5, 2020

Nice. I squashed the commits.

@flokli
Copy link
Contributor

flokli commented Aug 6, 2020

This needs another rebase unfortunately.

@tnias
Copy link
Contributor Author

tnias commented Aug 7, 2020

@flokli I squashed them into one. Anything else?

@flokli
Copy link
Contributor

flokli commented Aug 8, 2020

Did you rebase it onto latest master? GitHub says there's conflicts.

@tnias
nixos/usbguard: rework
ffd18cc 
Use StateDirectory to create necessary directories and hardcode some
paths. Also drop file based audit logs, they can be found in the
journal. And add module option deprecation messages.
@tnias
Copy link
Contributor Author

tnias commented Aug 8, 2020

Okay, this time I actually rebased against the upstream master 😆

@flokli flokli merged commit 921da91 into NixOS:master Aug 11, 2020
@flokli
Copy link
Contributor

flokli commented Aug 11, 2020

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@aanderse aanderse aanderse approved these changes

Assignees
No one assigned
Labels
6.topic: nixos 8.has: changelog 8.has: documentation 8.has: module (update) 10.rebuild-darwin: 0 10.rebuild-linux: 1-10 10.rebuild-linux: 1
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
3 participants
@tnias @flokli @aanderse