diff options
author | Joachim Fasting <joachifm@fastmail.fm> | 2016-04-09 20:22:16 +0200 |
---|---|---|
committer | Joachim Fasting <joachifm@fastmail.fm> | 2016-04-10 12:27:06 +0200 |
commit | cef2814a4f0530f6e020badc56dd808a96422a66 (patch) | |
tree | 6455422d43255cb6ac78ca343940516277425828 /nixos/tests/misc.nix | |
parent | 496a36980540390ac47e59310b3d73d516a531a2 (diff) |
nixos: add optional process information hiding
This module adds an option `security.hideProcessInformation` that, when enabled, restricts access to process information such as command-line arguments to the process owner. The module adds a static group "proc" whose members are exempt from process information hiding. Ideally, this feature would be implemented by simply adding the appropriate mount options to `fileSystems."/proc".fsOptions`, but this was found to not work in vmtests. To ensure that process information hiding is enforced, we use a systemd service unit that remounts `/proc` after `systemd-remount-fs.service` has completed. To verify the correctness of the feature, simple tests were added to nixos/tests/misc: the test ensures that unprivileged users cannot see process information owned by another user, while members of "proc" CAN. Thanks to @abbradar for feedback and suggestions.
Diffstat (limited to 'nixos/tests/misc.nix')
-rw-r--r-- | nixos/tests/misc.nix | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/nixos/tests/misc.nix b/nixos/tests/misc.nix index b926a62194b45..cd4086cb8f62c 100644 --- a/nixos/tests/misc.nix +++ b/nixos/tests/misc.nix @@ -25,6 +25,8 @@ import ./make-test.nix ({ pkgs, ...} : { }; users.users.sybil = { isNormalUser = true; group = "wheel"; }; security.sudo = { enable = true; wheelNeedsPassword = false; }; + security.hideProcessInformation = true; + users.users.alice = { isNormalUser = true; extraGroups = [ "proc" ]; }; }; testScript = @@ -117,5 +119,12 @@ import ./make-test.nix ({ pkgs, ...} : { subtest "sudo", sub { $machine->succeed("su - sybil -c 'sudo true'"); }; + + # Test hidepid + subtest "hidepid", sub { + $machine->succeed("grep -Fq hidepid=2 /etc/mtab"); + $machine->succeed("[ `su - sybil -c 'pgrep -c -u root'` = 0 ]"); + $machine->succeed("[ `su - alice -c 'pgrep -c -u root'` != 0 ]"); + }; ''; }) |