From 7980523e007c066495b010897f9cf240453e0ad1 Mon Sep 17 00:00:00 2001 From: Joachim Fasting Date: Tue, 30 Aug 2016 19:20:08 +0200 Subject: [PATCH 1/7] unbound service: convenient handling of local forward addresses do-not-query-localhost defaults to yes; with this patch, unbound is configured to query localhost if any of the forward addresses are local. --- nixos/modules/services/networking/unbound.nix | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/nixos/modules/services/networking/unbound.nix b/nixos/modules/services/networking/unbound.nix index ed0744c44cc..603c7f8fb10 100644 --- a/nixos/modules/services/networking/unbound.nix +++ b/nixos/modules/services/networking/unbound.nix @@ -12,9 +12,17 @@ let interfaces = concatMapStrings (x: " interface: ${x}\n") cfg.interfaces; - forward = optionalString (length cfg.forwardAddresses != 0) - "forward-zone:\n name: .\n" + - concatMapStrings (x: " forward-addr: ${x}\n") cfg.forwardAddresses; + isLocalAddress = x: substring 0 9 x == "127.0.0.1"; + + forward = + optionalString (any isLocalAddress cfg.forwardAddresses) '' + do-not-query-localhost: no + '' + + optionalString (cfg.forwardAddresses != []) '' + forward-zone: + name: . + '' + + concatMapStringsSep "\n" (x: " forward-addr: ${x}") cfg.forwardAddresses; rootTrustAnchorFile = "${stateDir}/root.key"; From 52432ee63d9ab57d9dba7d9ce738d3964b2314a6 Mon Sep 17 00:00:00 2001 From: Joachim Fasting Date: Tue, 30 Aug 2016 19:22:53 +0200 Subject: [PATCH 2/7] unbound service: non-blocking random in chroot /dev/random is an exhaustible resource. Presumably, unbound will not be used to generate long-term encryption keys and so allowing it to use /dev/random only increases the risk of entropy exhaustion for no benefit. --- nixos/modules/services/networking/unbound.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/services/networking/unbound.nix b/nixos/modules/services/networking/unbound.nix index 603c7f8fb10..4326a413795 100644 --- a/nixos/modules/services/networking/unbound.nix +++ b/nixos/modules/services/networking/unbound.nix @@ -115,7 +115,7 @@ in chown unbound ${stateDir} ${rootTrustAnchorFile} ''} touch ${stateDir}/dev/random - ${pkgs.utillinux}/bin/mount --bind -n /dev/random ${stateDir}/dev/random + ${pkgs.utillinux}/bin/mount --bind -n /dev/urandom ${stateDir}/dev/random ''; serviceConfig = { From 0759e77dfd1d9272a2a26390b5a2cb8fb80efc3c Mon Sep 17 00:00:00 2001 From: Joachim Fasting Date: Thu, 1 Sep 2016 18:47:40 +0200 Subject: [PATCH 3/7] unbound service: add reference to man:unbound.conf(8) --- nixos/modules/services/networking/unbound.nix | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/nixos/modules/services/networking/unbound.nix b/nixos/modules/services/networking/unbound.nix index 4326a413795..304996c6326 100644 --- a/nixos/modules/services/networking/unbound.nix +++ b/nixos/modules/services/networking/unbound.nix @@ -80,7 +80,11 @@ in extraConfig = mkOption { default = ""; type = types.str; - description = "Extra lines of unbound config."; + description = '' + Extra unbound config. See + unbound.conf8 + . + ''; }; }; From 39f5182a30cd9eec3ce5bbf30fd1d5ae04126d89 Mon Sep 17 00:00:00 2001 From: Joachim Fasting Date: Thu, 1 Sep 2016 18:48:13 +0200 Subject: [PATCH 4/7] unbound service: use auto-generated uid 1. The preStart script ensures consistent ownership, even if the unbound user's uid has changed 2. The unbound daemon does not generate data that needs to be private to it, so it would not matter that a different service would end up owning its data (as long as unbound remains enabled, it should reclaim ownership soon enough anyway). Thus, there's no clear benefit to allocate a dedicated uid for the unbound service. This releases uid/gid 48. Also, because the preStart script creates the data directory, there's no need to specify a homedir or ask for its creation. --- nixos/modules/services/networking/unbound.nix | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/nixos/modules/services/networking/unbound.nix b/nixos/modules/services/networking/unbound.nix index 304996c6326..c7a4eb6060c 100644 --- a/nixos/modules/services/networking/unbound.nix +++ b/nixos/modules/services/networking/unbound.nix @@ -96,12 +96,9 @@ in environment.systemPackages = [ pkgs.unbound ]; - users.extraUsers = singleton { - name = "unbound"; - uid = config.ids.uids.unbound; + users.users.unbound = { description = "unbound daemon user"; - home = stateDir; - createHome = true; + isSystemUser = true; }; systemd.services.unbound = { From 5dc60051fa7f6e79781c146ae61c0dd8f92e7e10 Mon Sep 17 00:00:00 2001 From: Joachim Fasting Date: Thu, 1 Sep 2016 18:53:06 +0200 Subject: [PATCH 5/7] unbound service: some pre-chroot isolation While entering the chroot should provide the same amount of isolation, the preStart script will run with full root privileges and so would benefit from some isolation as well (in particular due to unbound-anchor, which can perform network I/O). --- nixos/modules/services/networking/unbound.nix | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/nixos/modules/services/networking/unbound.nix b/nixos/modules/services/networking/unbound.nix index c7a4eb6060c..828b8e17556 100644 --- a/nixos/modules/services/networking/unbound.nix +++ b/nixos/modules/services/networking/unbound.nix @@ -122,6 +122,10 @@ in serviceConfig = { ExecStart = "${pkgs.unbound}/bin/unbound -d -c ${stateDir}/unbound.conf"; ExecStopPost="${pkgs.utillinux}/bin/umount ${stateDir}/dev/random"; + + ProtectSystem = true; + ProtectHome = true; + PrivateDevices = true; }; }; From bf538515b7d668f9522b1db7d07ffe087f9d8a7f Mon Sep 17 00:00:00 2001 From: Joachim Fasting Date: Thu, 1 Sep 2016 18:56:43 +0200 Subject: [PATCH 6/7] nixos/ids: remove static unbound uid --- nixos/modules/misc/ids.nix | 2 -- 1 file changed, 2 deletions(-) diff --git a/nixos/modules/misc/ids.nix b/nixos/modules/misc/ids.nix index e3134910594..716885985b8 100644 --- a/nixos/modules/misc/ids.nix +++ b/nixos/modules/misc/ids.nix @@ -74,7 +74,6 @@ rtkit = 45; dovecot2 = 46; dovenull2 = 47; - unbound = 48; prayer = 49; mpd = 50; clamav = 51; @@ -331,7 +330,6 @@ #rtkit = 45; # unused dovecot2 = 46; #dovenull = 47; # unused - #unbound = 48; # unused prayer = 49; mpd = 50; clamav = 51; From 22d6c97855b99e770855474f394cd4a3192d98d9 Mon Sep 17 00:00:00 2001 From: Joachim Fasting Date: Fri, 16 Sep 2016 09:47:36 +0200 Subject: [PATCH 7/7] unbound service: extend isLocalAddress to handle ipv6 --- nixos/modules/services/networking/unbound.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/services/networking/unbound.nix b/nixos/modules/services/networking/unbound.nix index 828b8e17556..6375ebee320 100644 --- a/nixos/modules/services/networking/unbound.nix +++ b/nixos/modules/services/networking/unbound.nix @@ -12,7 +12,7 @@ let interfaces = concatMapStrings (x: " interface: ${x}\n") cfg.interfaces; - isLocalAddress = x: substring 0 9 x == "127.0.0.1"; + isLocalAddress = x: substring 0 3 x == "::1" || substring 0 9 x == "127.0.0.1"; forward = optionalString (any isLocalAddress cfg.forwardAddresses) ''