Martin Weinelt
@@ -173,7 +173,7 @@ in {
|
||||
apfs = runTest ./apfs.nix;
|
||||
appliance-repart-image = runTest ./appliance-repart-image.nix;
|
||||
appliance-repart-image-verity-store = runTest ./appliance-repart-image-verity-store.nix;
|
||||
apparmor = handleTest ./apparmor {};
|
||||
apparmor = runTest ./apparmor;
|
||||
archi = handleTest ./archi.nix {};
|
||||
aria2 = handleTest ./aria2.nix {};
|
||||
armagetronad = handleTest ./armagetronad.nix {};
|
||||
|
||||
+111
-115
@@ -1,130 +1,126 @@
|
||||
import ../make-test-python.nix (
|
||||
{ pkgs, lib, ... }:
|
||||
let
|
||||
helloProfileContents = ''
|
||||
abi <abi/4.0>,
|
||||
include <tunables/global>
|
||||
profile hello ${lib.getExe pkgs.hello} {
|
||||
include <abstractions/base>
|
||||
}
|
||||
'';
|
||||
in
|
||||
{
|
||||
name = "apparmor";
|
||||
meta.maintainers = with lib.maintainers; [
|
||||
julm
|
||||
grimmauld
|
||||
];
|
||||
{ pkgs, lib, ... }:
|
||||
let
|
||||
helloProfileContents = ''
|
||||
abi <abi/4.0>,
|
||||
include <tunables/global>
|
||||
profile hello ${lib.getExe pkgs.hello} {
|
||||
include <abstractions/base>
|
||||
}
|
||||
'';
|
||||
in
|
||||
{
|
||||
name = "apparmor";
|
||||
meta.maintainers = with lib.maintainers; [
|
||||
julm
|
||||
grimmauld
|
||||
];
|
||||
|
||||
nodes.machine =
|
||||
{
|
||||
lib,
|
||||
pkgs,
|
||||
config,
|
||||
...
|
||||
}:
|
||||
{
|
||||
security.apparmor = {
|
||||
enable = lib.mkDefault true;
|
||||
nodes.machine =
|
||||
{
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
{
|
||||
security.apparmor = {
|
||||
enable = lib.mkDefault true;
|
||||
|
||||
policies.hello = {
|
||||
# test profile enforce and content definition
|
||||
state = "enforce";
|
||||
profile = helloProfileContents;
|
||||
};
|
||||
policies.hello = {
|
||||
# test profile enforce and content definition
|
||||
state = "enforce";
|
||||
profile = helloProfileContents;
|
||||
};
|
||||
|
||||
policies.sl = {
|
||||
# test profile complain and path definition
|
||||
state = "complain";
|
||||
path = ./sl_profile;
|
||||
};
|
||||
policies.sl = {
|
||||
# test profile complain and path definition
|
||||
state = "complain";
|
||||
path = ./sl_profile;
|
||||
};
|
||||
|
||||
policies.hexdump = {
|
||||
# test profile complain and path definition
|
||||
state = "enforce";
|
||||
profile = ''
|
||||
abi <abi/4.0>,
|
||||
include <tunables/global>
|
||||
profile hexdump /nix/store/*/bin/hexdump {
|
||||
include <abstractions/base>
|
||||
deny /tmp/** r,
|
||||
}
|
||||
'';
|
||||
};
|
||||
|
||||
includes."abstractions/base" = ''
|
||||
/nix/store/*/bin/** mr,
|
||||
/nix/store/*/lib/** mr,
|
||||
/nix/store/** r,
|
||||
policies.hexdump = {
|
||||
# test profile complain and path definition
|
||||
state = "enforce";
|
||||
profile = ''
|
||||
abi <abi/4.0>,
|
||||
include <tunables/global>
|
||||
profile hexdump /nix/store/*/bin/hexdump {
|
||||
include <abstractions/base>
|
||||
deny /tmp/** r,
|
||||
}
|
||||
'';
|
||||
};
|
||||
|
||||
includes."abstractions/base" = ''
|
||||
/nix/store/*/bin/** mr,
|
||||
/nix/store/*/lib/** mr,
|
||||
/nix/store/** r,
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
testScript =
|
||||
let
|
||||
inherit (lib) getExe getExe';
|
||||
in
|
||||
''
|
||||
machine.wait_for_unit("multi-user.target")
|
||||
testScript =
|
||||
let
|
||||
inherit (lib) getExe getExe';
|
||||
in
|
||||
''
|
||||
machine.wait_for_unit("multi-user.target")
|
||||
|
||||
with subtest("AppArmor profiles are loaded"):
|
||||
machine.succeed("systemctl status apparmor.service")
|
||||
with subtest("AppArmor profiles are loaded"):
|
||||
machine.succeed("systemctl status apparmor.service")
|
||||
|
||||
# AppArmor securityfs
|
||||
with subtest("AppArmor securityfs is mounted"):
|
||||
machine.succeed("mountpoint -q /sys/kernel/security")
|
||||
machine.succeed("cat /sys/kernel/security/apparmor/profiles")
|
||||
# AppArmor securityfs
|
||||
with subtest("AppArmor securityfs is mounted"):
|
||||
machine.succeed("mountpoint -q /sys/kernel/security")
|
||||
machine.succeed("cat /sys/kernel/security/apparmor/profiles")
|
||||
|
||||
# Test apparmorRulesFromClosure by:
|
||||
# 1. Prepending a string of the relevant packages' name and version on each line.
|
||||
# 2. Sorting according to those strings.
|
||||
# 3. Removing those prepended strings.
|
||||
# 4. Using `diff` against the expected output.
|
||||
with subtest("apparmorRulesFromClosure"):
|
||||
machine.succeed(
|
||||
"${getExe' pkgs.diffutils "diff"} -u ${
|
||||
pkgs.writeText "expected.rules" (import ./makeExpectedPolicies.nix { inherit pkgs; })
|
||||
} ${
|
||||
pkgs.runCommand "actual.rules" { preferLocalBuild = true; } ''
|
||||
${getExe pkgs.gnused} -e 's:^[^ ]* ${builtins.storeDir}/[^,/-]*-\([^/,]*\):\1 \0:' ${
|
||||
pkgs.apparmorRulesFromClosure {
|
||||
name = "ping";
|
||||
additionalRules = [ "x $path/foo/**" ];
|
||||
} [ pkgs.libcap ]
|
||||
} |
|
||||
${getExe' pkgs.coreutils "sort"} -n -k1 |
|
||||
${getExe pkgs.gnused} -e 's:^[^ ]* ::' >$out
|
||||
''
|
||||
}"
|
||||
)
|
||||
# Test apparmorRulesFromClosure by:
|
||||
# 1. Prepending a string of the relevant packages' name and version on each line.
|
||||
# 2. Sorting according to those strings.
|
||||
# 3. Removing those prepended strings.
|
||||
# 4. Using `diff` against the expected output.
|
||||
with subtest("apparmorRulesFromClosure"):
|
||||
machine.succeed(
|
||||
"${getExe' pkgs.diffutils "diff"} -u ${
|
||||
pkgs.writeText "expected.rules" (import ./makeExpectedPolicies.nix { inherit pkgs; })
|
||||
} ${
|
||||
pkgs.runCommand "actual.rules" { preferLocalBuild = true; } ''
|
||||
${getExe pkgs.gnused} -e 's:^[^ ]* ${builtins.storeDir}/[^,/-]*-\([^/,]*\):\1 \0:' ${
|
||||
pkgs.apparmorRulesFromClosure {
|
||||
name = "ping";
|
||||
additionalRules = [ "x $path/foo/**" ];
|
||||
} [ pkgs.libcap ]
|
||||
} |
|
||||
${getExe' pkgs.coreutils "sort"} -n -k1 |
|
||||
${getExe pkgs.gnused} -e 's:^[^ ]* ::' >$out
|
||||
''
|
||||
}"
|
||||
)
|
||||
|
||||
# Test apparmor profile states by using `diff` against `aa-status`
|
||||
with subtest("apparmorProfileStates"):
|
||||
machine.succeed("${getExe' pkgs.diffutils "diff"} -u \
|
||||
<(${getExe' pkgs.apparmor-bin-utils "aa-status"} --json | ${getExe pkgs.jq} --sort-keys . ) \
|
||||
<(${getExe pkgs.jq} --sort-keys . ${
|
||||
pkgs.writers.writeJSON "expectedStates.json" {
|
||||
version = "2";
|
||||
processes = { };
|
||||
profiles = {
|
||||
hexdump = "enforce";
|
||||
hello = "enforce";
|
||||
sl = "complain";
|
||||
};
|
||||
}
|
||||
})")
|
||||
# Test apparmor profile states by using `diff` against `aa-status`
|
||||
with subtest("apparmorProfileStates"):
|
||||
machine.succeed("${getExe' pkgs.diffutils "diff"} -u \
|
||||
<(${getExe' pkgs.apparmor-bin-utils "aa-status"} --json | ${getExe pkgs.jq} --sort-keys . ) \
|
||||
<(${getExe pkgs.jq} --sort-keys . ${
|
||||
pkgs.writers.writeJSON "expectedStates.json" {
|
||||
version = "2";
|
||||
processes = { };
|
||||
profiles = {
|
||||
hexdump = "enforce";
|
||||
hello = "enforce";
|
||||
sl = "complain";
|
||||
};
|
||||
}
|
||||
})")
|
||||
|
||||
# Test apparmor profile files in /etc/apparmor.d/<name> to be either a correct symlink (sl) or have the right file contents (hello)
|
||||
with subtest("apparmorProfileTargets"):
|
||||
machine.succeed("${getExe' pkgs.diffutils "diff"} -u <(${getExe pkgs.file} /etc/static/apparmor.d/sl) ${pkgs.writeText "expected.link" ''
|
||||
/etc/static/apparmor.d/sl: symbolic link to ${./sl_profile}
|
||||
''}")
|
||||
machine.succeed("${getExe' pkgs.diffutils "diff"} -u /etc/static/apparmor.d/hello ${pkgs.writeText "expected.content" helloProfileContents}")
|
||||
# Test apparmor profile files in /etc/apparmor.d/<name> to be either a correct symlink (sl) or have the right file contents (hello)
|
||||
with subtest("apparmorProfileTargets"):
|
||||
machine.succeed("${getExe' pkgs.diffutils "diff"} -u <(${getExe pkgs.file} /etc/static/apparmor.d/sl) ${pkgs.writeText "expected.link" ''
|
||||
/etc/static/apparmor.d/sl: symbolic link to ${./sl_profile}
|
||||
''}")
|
||||
machine.succeed("${getExe' pkgs.diffutils "diff"} -u /etc/static/apparmor.d/hello ${pkgs.writeText "expected.content" helloProfileContents}")
|
||||
|
||||
|
||||
with subtest("apparmorProfileEnforce"):
|
||||
machine.succeed("${getExe pkgs.hello} 1> /tmp/test-file")
|
||||
machine.fail("${lib.getExe' pkgs.util-linux "hexdump"} /tmp/test-file") # no access to /tmp/test-file granted by apparmor
|
||||
'';
|
||||
}
|
||||
)
|
||||
with subtest("apparmorProfileEnforce"):
|
||||
machine.succeed("${getExe pkgs.hello} 1> /tmp/test-file")
|
||||
machine.fail("${lib.getExe' pkgs.util-linux "hexdump"} /tmp/test-file") # no access to /tmp/test-file granted by apparmor
|
||||
'';
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user