mirror of
https://github.com/NixOS/nixpkgs.git
synced 2024-11-18 19:51:17 +00:00
ffa83edf4a
This test exercises the linux_hardened kernel along with the various hardening features (enabled via the hardened profile). Move hidepid test from misc, so that misc can go back to testing a vanilla configuration.
32 lines
973 B
Nix
32 lines
973 B
Nix
import ./make-test.nix ({ pkgs, ...} : {
|
|
name = "hardened";
|
|
meta = with pkgs.stdenv.lib.maintainers; {
|
|
maintainers = [ joachifm ];
|
|
};
|
|
|
|
machine =
|
|
{ config, lib, pkgs, ... }:
|
|
with lib;
|
|
{ users.users.alice = { isNormalUser = true; extraGroups = [ "proc" ]; };
|
|
users.users.sybil = { isNormalUser = true; group = "wheel"; };
|
|
imports = [ ../modules/profiles/hardened.nix ];
|
|
};
|
|
|
|
testScript =
|
|
''
|
|
# Test hidepid
|
|
subtest "hidepid", sub {
|
|
$machine->succeed("grep -Fq hidepid=2 /proc/mounts");
|
|
$machine->succeed("[ `su - sybil -c 'pgrep -c -u root'` = 0 ]");
|
|
$machine->succeed("[ `su - alice -c 'pgrep -c -u root'` != 0 ]");
|
|
};
|
|
|
|
# Test kernel module hardening
|
|
subtest "lock-modules", sub {
|
|
$machine->waitForUnit("multi-user.target");
|
|
# note: this better a be module we normally wouldn't load ...
|
|
$machine->fail("modprobe dccp");
|
|
};
|
|
'';
|
|
})
|