| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
|
|
nixos/testing: fix markdown link in enableOCR description
|
|
nixos/binfmt: added assertion to prevent emulation of current system
|
|
|
|
Remove myself from some packages I no longer use
|
|
nixos/display.managers: use cfg where possible
|
|
nixos/bcg: fix usage without environment files
|
|
This is required for some Kindles (e.g. Kindle Paperwhite 7th Gen),
and printers (e.g. Brother MFC-J4440DW).
OpenWRT typically adds "wpa_key_mgmt = WPA-PSK", per https://github.com/openwrt/openwrt/blob/3f28c422ba7ca06efd41686fd2f9e664f7e8a12e/package/network/config/wifi-scripts/files/lib/netifd/hostapd.sh#L44-L71
|
|
squash-reworded from #284844
|
|
nixos/borgbackup: add an option to ignore warnings
|
|
WilliButz/systemd-initrd/fix-aarch64-modprobe-test
|
|
pgvecto-rs: mark as broken in pg12 and pg13
|
|
|
|
nixos/greetd: add option to make greetd not stop Plymouth early
|
|
|
|
|
|
ydotool: refactor ; nixos/ydotool: init module & nixosTest
|
|
|
|
nixos/switch-to-configuration: add new implementation
|
|
doc: Fix nixos download page links
|
|
nixos/devpi-server: init
|
|
nixos/garage: drop replication_mode setting
|
|
Those two links are currently broken, update them to point to the
up-to-date nixos download page.
|
|
|
|
Co-authored-by: Cosima Neidahl <opna2608@protonmail.com>
|
|
Co-authored-by: Cosima Neidahl <opna2608@protonmail.com>
|
|
Signed-off-by: Christina Sørensen <christina@cafkafk.com>
|
|
nixos/oauth2-proxy: fix invalid comparison between list and attrset
|
|
|
|
|
|
|
|
thermald: fixed handling of an external config
|
|
nixos/caddy: don't set ExecReload if enableReload is disabled
|
|
Upstream (accidentally) broke support for postgresql 12 and 13 on
v0.2.1 by changing the signature of the `from_datum` function[^1].
This went unnoticed since the release branch `0.2` did not have CI.
Furthermore, they are removing support for these versions of postgresql
on v0.3.0[^2].
[^1]: https://github.com/tensorchord/pgvecto.rs/commit/97e861d51d5a5a8c314a6657e02d445a1edcaa30
[^2]: https://github.com/tensorchord/pgvecto.rs/issues/343
|
|
This fails my NixOS configuration:
```
error: attribute 'lib' missing
at /nix/store/ninrqc3pblnmqgh489cbr9rq5pijcpd6-nixpkgs-src/nixos/modules/programs/zsh/zsh-syntax-highlighting.nix:90:7:
89| programs.zsh.interactiveShellInit =
90| lib.lib.mkAfter (lib.concatStringsSep "\n" ([
| ^
91| "source ${pkgs.zsh-syntax-highlighting}/share/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh"
```
|
|
nixos/miniflux: use systemd notify and watchdog
|
|
|
|
nixos/fish: Fix more lib references
|
|
|
|
nixos/smokeping: use nginx instead of thttpd
|
|
|
|
One of the module that already supports the systemd-confinement module
is public-inbox. However with the changes to support DynamicUser and
ProtectSystem, the module will now fail at runtime if confinement is
enabled (it's optional and you'll need to override it via another
module).
The reason is that the RootDirectory is set to /var/empty in the
public-inbox module, which doesn't work well with the InaccessiblePaths
directive we now use to support DynamicUser/ProtectSystem.
To make this issue more visible, I decided to just change the priority
of the RootDirectory option definiton the default override priority so
that whenever another different option is defined, we'll get a conflict
at evaluation time.
Signed-off-by: aszlig <aszlig@nix.build>
|
|
Our more thorough parametrised tests uncovered that with the changes for
supporting DynamicUser, we now have the situation that for static users
the root directory within the confined environment is now writable for
the user in question.
This is obviously not what we want and I'd consider that a regression.
However while discussing this with @ju1m and my suggestion being to
set TemporaryFileSystem to "/" (as we had previously), they had an even
better idea[1]:
> The goal is to deny write access to / to non-root users,
>
> * TemporaryFileSystem=/ gives us that through the ownership of / by
> root (instead of the service's user inherited from
> RuntimeDirectory=).
> * ProtectSystem=strict gives us that by mounting / read-only (while
> keeping its ownership to the service's user).
>
> To avoid the incompatibilities of TemporaryFileSystem=/ mentioned
> above, I suggest to mount / read-only in all cases with
> ReadOnlyPaths = [ "+/" ]:
>
> ...
>
> I guess this would require at least two changes to the current tests:
>
> 1. to no longer expect root to be able to write to some paths (like
> /bin) (at least not without first remounting / in read-write
> mode).
> 2. to no longer expect non-root users to fail to write to certain
> paths with a "permission denied" error code, but with a
> "read-only file system" error code.
I like the solution with ReadOnlyPaths even more because it further
reduces the attack surface if the user is root. In chroot-only mode this
is especially useful, since if there are no other bind-mounted paths
involved in the unit configuration, the whole file system within the
confined environment is read-only.
[1]: https://github.com/NixOS/nixpkgs/pull/289593#discussion_r1586794215
Signed-off-by: aszlig <aszlig@nix.build>
|
|
This is to make sure that we test all of the DynamicUser/User/Group and
PrivateTmp options in a uniform way. The reason why we need to do this
is because we recently introduced support for the DynamicUser option and
since there are some corner cases where we might end up with more
elevated privileges (eg. writable directories in some cases), we want to
make sure that the environment is as restrictive as with a static
User/Group assignment.
I also removed various checks that try to os.chown(), since with our new
recursive checker those are redundant.
Signed-off-by: aszlig <aszlig@nix.build>
|
|
So far the architecture for the tests was that we would use a systemd
socket unit using the Accept option to start a small shell process where
we can pipe commands into by connecting to the socket created by the
socket unit.
This is unnecessary since we can directly use the code snippets from the
individual subtests and systemd will take care of checking the return
code in case we get any assertions[^1].
Another advantage of this is that tests now run in parallel, so we can
do rather expensive things such as looking in /nix to see whether
anything is writable.
The new assert_permissions() function is the main driver behind this and
allows for a more fine-grained way to check whether we got the right
permissions whilst also ignoring irrelevant things such as read-only
empty directories.
Our previous approach also just did a read-only check, which might be
fine in full-apivfs mode where the attack surface already is large, but
in chroot-only mode we really want to make sure nothing is every
writable.
A downside of the new approach is that currently the unit names are
numbered via lib.imap1, which makes it annoying to track its definition.
[^1]: Speaking of assertions, I wrapped the code to be run with pytest's
assertion rewriting, so that we get more useful AssertionErrors.
Signed-off-by: aszlig <aszlig@nix.build>
|
|
When experimenting on ways how to refactor the test, I wrote a
significant enough amount of Python to warrant a dedicated Python file.
This commit is mainly to prepare for that and make it easier to track
renames.
Signed-off-by: aszlig <aszlig@nix.build>
|
|
The reason why I originally used the "description" attribute was that it
can be easily used to parametrise the tests so that we can specify
common constraints and apply it across a number of different
configurations.
When porting the tests to Python, the description attribute was replaced
by inlining it into the Python code, most probably because it was easier
to do in bulk since using Nix to generate the subtest parts would be
very complicated to do since we also had to please Black (a Python code
formatter that we no longer use in test scripts).
Since we now also want to support DynamicUser in systemd-confinement,
the need to parametrise the tests became apparent again because it's now
easier to refactor our subtests to run both with *and* without
DynamicUser set to true.
Signed-off-by: aszlig <aszlig@nix.build>
|
|
See https://discourse.nixos.org/t/hardening-systemd-services/17147/14
|
|
nixos: remove historical maintainership of modules by eelco
|
|
nixos/radvd: add debugLevel option
|
