Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: NixOS/nixpkgs
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: f00bc13ad7c3
Choose a base ref
...
head repository: NixOS/nixpkgs
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: 6a7f02d89deb
Choose a head ref
  • 2 commits
  • 2 files changed
  • 1 contributor

Commits on Nov 24, 2018

  1. nixos/tests/hardened: fix build by disabling nix.useSandbox

    @joachifm
    joachifm committed Nov 24, 2018
    Copy the full SHA
    62623b6 View commit details

  2. nixos/hardened: restrict access to nix daemon

    @joachifm
    joachifm committed Nov 24, 2018
    Copy the full SHA
    6a7f02d View commit details
Showing with 9 additions and 0 deletions.
  1. +2 −0 nixos/modules/profiles/hardened.nix
  2. +7 −0 nixos/tests/hardened.nix
2 changes: 2 additions & 0 deletions nixos/modules/profiles/hardened.nix
View file
Original file line number Diff line number Diff line change
@@ -12,6 +12,8 @@ with lib;

boot.kernelPackages = mkDefault pkgs.linuxPackages_hardened;

nix.allowedUsers = mkDefault [ "@users" ];

security.hideProcessInformation = mkDefault true;

security.lockKernelModules = mkDefault true;
7 changes: 7 additions & 0 deletions nixos/tests/hardened.nix
View file
Original file line number Diff line number Diff line change
@@ -10,6 +10,7 @@ import ./make-test.nix ({ pkgs, ...} : {
{ users.users.alice = { isNormalUser = true; extraGroups = [ "proc" ]; };
users.users.sybil = { isNormalUser = true; group = "wheel"; };
imports = [ ../modules/profiles/hardened.nix ];
nix.useSandbox = false;
virtualisation.emptyDiskImages = [ 4096 ];
boot.initrd.postDeviceCommands = ''
${pkgs.dosfstools}/bin/mkfs.vfat -n EFISYS /dev/vdb
@@ -63,5 +64,11 @@ import ./make-test.nix ({ pkgs, ...} : {
$machine->succeed("mount /dev/disk/by-label/EFISYS /efi");
$machine->succeed("mountpoint -q /efi"); # now mounted
};
# Test Nix dæmon usage
subtest "nix-daemon", sub {
$machine->fail("su -l nobody -s /bin/sh -c 'nix ping-store'");
$machine->succeed("su -l alice -c 'nix ping-store'") =~ "OK";
};
'';
})