public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #95924 from helsinki-systems/port/hardened-test

Browse Source 
nixos/hardened: Port test to Python and fix it
This commit is contained in:
Florian Klink 2020-08-23 10:06:44 +02:00 committed by GitHub
commit c2a75a8041
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 63 additions and 56 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
nixos/lib/test-driver/test-driver.py
View File

@ -424,15 +424,18 @@ class Machine:
output += out output += out
return output return output
def fail(self, *commands: str) -> None: def fail(self, *commands: str) -> str:
"""Execute each command and check that it fails.""" """Execute each command and check that it fails."""
output = ""
for command in commands: for command in commands:
with self.nested("must fail: {}".format(command)): with self.nested("must fail: {}".format(command)):
status, output = self.execute(command) (status, out) = self.execute(command)
if status == 0: if status == 0:
raise Exception( raise Exception(
"command `{}` unexpectedly succeeded".format(command) "command `{}` unexpectedly succeeded".format(command)
) )
output += out
return output
def wait_until_succeeds(self, command: str) -> str: def wait_until_succeeds(self, command: str) -> str:
"""Wait until a command returns success and return its output. """Wait until a command returns success and return its output.

112
nixos/tests/hardened.nix
View File

@ -1,4 +1,4 @@
import ./make-test.nix ({ pkgs, latestKernel ? false, ... } : { import ./make-test-python.nix ({ pkgs, latestKernel ? false, ... } : {
name = "hardened"; name = "hardened";
meta = with pkgs.stdenv.lib.maintainers; { meta = with pkgs.stdenv.lib.maintainers; {
maintainers = [ joachifm ]; maintainers = [ joachifm ];
@ -47,84 +47,88 @@ import ./make-test.nix ({ pkgs, latestKernel ? false, ... } : {
}; };
in in
'' ''
$machine->waitForUnit("multi-user.target"); machine.wait_for_unit("multi-user.target")
with subtest("AppArmor profiles are loaded"):
machine.succeed("systemctl status apparmor.service")
subtest "apparmor-loaded", sub {
$machine->succeed("systemctl status apparmor.service");
};
# AppArmor securityfs # AppArmor securityfs
subtest "apparmor-securityfs", sub { with subtest("AppArmor securityfs is mounted"):
$machine->succeed("mountpoint -q /sys/kernel/security"); machine.succeed("mountpoint -q /sys/kernel/security")
$machine->succeed("cat /sys/kernel/security/apparmor/profiles"); machine.succeed("cat /sys/kernel/security/apparmor/profiles")
};
# Test loading out-of-tree modules # Test loading out-of-tree modules
subtest "extra-module-packages", sub { with subtest("Out-of-tree modules can be loaded"):
$machine->succeed("grep -Fq wireguard /proc/modules"); machine.succeed("grep -Fq wireguard /proc/modules")
};
# Test hidepid # Test hidepid
subtest "hidepid", sub { with subtest("hidepid=2 option is applied and works"):
$machine->succeed("grep -Fq hidepid=2 /proc/mounts"); machine.succeed("grep -Fq hidepid=2 /proc/mounts")
# cannot use pgrep -u here, it segfaults when access to process info is denied # cannot use pgrep -u here, it segfaults when access to process info is denied
$machine->succeed("[ `su - sybil -c 'ps --no-headers --user root | wc -l'` = 0 ]"); machine.succeed("[ `su - sybil -c 'ps --no-headers --user root | wc -l'` = 0 ]")
$machine->succeed("[ `su - alice -c 'ps --no-headers --user root | wc -l'` != 0 ]"); machine.succeed("[ `su - alice -c 'ps --no-headers --user root | wc -l'` != 0 ]")
};
# Test kernel module hardening # Test kernel module hardening
subtest "lock-modules", sub { with subtest("No more kernel modules can be loaded"):
# note: this better a be module we normally wouldn't load ... # note: this better a be module we normally wouldn't load ...
$machine->fail("modprobe dccp"); machine.fail("modprobe dccp")
};
# Test userns # Test userns
subtest "userns", sub { with subtest("User namespaces are restricted"):
$machine->succeed("unshare --user true"); machine.succeed("unshare --user true")
$machine->fail("su -l alice -c 'unshare --user true'"); machine.fail("su -l alice -c 'unshare --user true'")
};
# Test dmesg restriction # Test dmesg restriction
subtest "dmesg", sub { with subtest("Regular users cannot access dmesg"):
$machine->fail("su -l alice -c dmesg"); machine.fail("su -l alice -c dmesg")
};
# Test access to kcore # Test access to kcore
subtest "kcore", sub { with subtest("Kcore is inaccessible as root"):
$machine->fail("cat /proc/kcore"); machine.fail("cat /proc/kcore")
};
# Test deferred mount # Test deferred mount
subtest "mount", sub { with subtest("Deferred mounts work"):
$machine->fail("mountpoint -q /efi"); # was deferred machine.fail("mountpoint -q /efi") # was deferred
$machine->execute("mkdir -p /efi"); machine.execute("mkdir -p /efi")
$machine->succeed("mount /dev/disk/by-label/EFISYS /efi"); machine.succeed("mount /dev/disk/by-label/EFISYS /efi")
$machine->succeed("mountpoint -q /efi"); # now mounted machine.succeed("mountpoint -q /efi") # now mounted
};
# Test Nix dæmon usage # Test Nix dæmon usage
subtest "nix-daemon", sub { with subtest("nix-daemon cannot be used by all users"):
$machine->fail("su -l nobody -s /bin/sh -c 'nix ping-store'"); machine.fail("su -l nobody -s /bin/sh -c 'nix ping-store'")
$machine->succeed("su -l alice -c 'nix ping-store'") =~ "OK"; machine.succeed("su -l alice -c 'nix ping-store'")
};
# Test kernel image protection # Test kernel image protection
subtest "kernelimage", sub { with subtest("The kernel image is protected"):
$machine->fail("systemctl hibernate"); machine.fail("systemctl hibernate")
$machine->fail("systemctl kexec"); machine.fail("systemctl kexec")
};
# Test hardened memory allocator # Test hardened memory allocator
sub runMallocTestProg { def runMallocTestProg(prog_name, error_text):
my ($progName, $errorText) = @_; text = "fatal allocator error: " + error_text
my $text = "fatal allocator error: " . $errorText; if not text in machine.fail(
$machine->fail("${hardened-malloc-tests}/bin/" . $progName) =~ $text; "${hardened-malloc-tests}/bin/"
}; + prog_name
+ " 2>&1"
):
raise Exception("Hardened malloc does not work for {}".format(error_text))
subtest "hardenedmalloc", sub {
runMallocTestProg("double_free_large", "invalid free"); with subtest("The hardened memory allocator works"):
runMallocTestProg("unaligned_free_small", "invalid unaligned free"); runMallocTestProg("double_free_large", "invalid free")
runMallocTestProg("write_after_free_small", "detected write after free"); runMallocTestProg("unaligned_free_small", "invalid unaligned free")
}; runMallocTestProg("write_after_free_small", "detected write after free")
''; '';
}) })