From f0d605d58830dc9f2887580c007e9a00453f3cfe Mon Sep 17 00:00:00 2001 From: Grimmauld Date: Wed, 3 Jun 2026 18:17:08 +0200 Subject: [PATCH 1/5] nixos/tests/opensnitch: adopt --- nixos/tests/opensnitch.nix | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/nixos/tests/opensnitch.nix b/nixos/tests/opensnitch.nix index cde4ae6efc17..2694e0f9b641 100644 --- a/nixos/tests/opensnitch.nix +++ b/nixos/tests/opensnitch.nix @@ -11,7 +11,10 @@ in name = "opensnitch"; meta = with pkgs.lib.maintainers; { - maintainers = [ onny ]; + maintainers = [ + onny + grimmauld + ]; }; nodes = { From 26c9cea779e28bebb5bb624d16fc79168aa6cfd7 Mon Sep 17 00:00:00 2001 From: Grimmauld Date: Wed, 3 Jun 2026 18:44:02 +0200 Subject: [PATCH 2/5] nixos/tests/opensnitch: skip broken ebpf test on aarch64 --- nixos/tests/opensnitch.nix | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/nixos/tests/opensnitch.nix b/nixos/tests/opensnitch.nix index 2694e0f9b641..d2af561c36f4 100644 --- a/nixos/tests/opensnitch.nix +++ b/nixos/tests/opensnitch.nix @@ -1,11 +1,14 @@ { pkgs, lib, ... }: let + # opensnitch ebpf seems to handle non-x86 syscalls incorrectly + test_ebpf = pkgs.stdenv.hostPlatform.isx86; + monitorMethods = [ - "ebpf" "proc" "ftrace" "audit" - ]; + ] + ++ lib.optional test_ebpf "ebpf"; in { name = "opensnitch"; @@ -97,7 +100,7 @@ in client_allowed_${m}.succeed("curl http://server") '') monitorMethods ) - + '' + + lib.optionalString test_ebpf '' # make sure the kernel modules were actually properly loaded client_blocked_ebpf.succeed(r"journalctl -u opensnitchd --grep '\[eBPF\] module loaded: /nix/store/.*/etc/opensnitchd/opensnitch\.o'") client_blocked_ebpf.succeed(r"journalctl -u opensnitchd --grep '\[eBPF\] module loaded: /nix/store/.*/etc/opensnitchd/opensnitch-procs\.o'") From fe171cb3a8dc1c7da6c73c0b872f902ff32252c7 Mon Sep 17 00:00:00 2001 From: Grimmauld Date: Wed, 3 Jun 2026 18:59:14 +0200 Subject: [PATCH 3/5] nixos/opensnitch: define /etc/opensnitchd entries via environment.etc --- nixos/modules/services/security/opensnitch.nix | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/nixos/modules/services/security/opensnitch.nix b/nixos/modules/services/security/opensnitch.nix index bffe17a948d1..c0d76e83afff 100644 --- a/nixos/modules/services/security/opensnitch.nix +++ b/nixos/modules/services/security/opensnitch.nix @@ -207,11 +207,13 @@ in }; tmpfiles.rules = [ "d ${cfg.settings.Rules.Path} 0750 root root - -" - "L+ /etc/opensnitchd/network_aliases.json - - - - ${cfg.package}/etc/opensnitchd/network_aliases.json" - "L+ /etc/opensnitchd/system-fw.json - - - - ${cfg.package}/etc/opensnitchd/system-fw.json" ]; }; + environment.etc."opensnitchd/network_aliases.json".source = + "${cfg.package}/etc/opensnitchd/network_aliases.json"; + environment.etc."opensnitchd/system-fw.json".source = + "${cfg.package}/etc/opensnitchd/system-fw.json"; }; meta.maintainers = with lib.maintainers; [ From 61ab732ed5fe6b85d88240642669c10f6702b245 Mon Sep 17 00:00:00 2001 From: Grimmauld Date: Wed, 3 Jun 2026 20:28:45 +0200 Subject: [PATCH 4/5] nixos/opensnitch: make rules path and state directory match --- .../modules/services/security/opensnitch.nix | 23 +++++++++++++++---- 1 file changed, 18 insertions(+), 5 deletions(-) diff --git a/nixos/modules/services/security/opensnitch.nix b/nixos/modules/services/security/opensnitch.nix index c0d76e83afff..35eeef1d0443 100644 --- a/nixos/modules/services/security/opensnitch.nix +++ b/nixos/modules/services/security/opensnitch.nix @@ -13,6 +13,7 @@ let file = pkgs.writeText "rule" (builtins.toJSON cfg); } ); + stateDir = lib.strings.match "/var/lib/([^/]+)/.+" cfg.settings.Rules.Path; in { options = { @@ -139,7 +140,10 @@ in }; Rules.Path = lib.mkOption { - type = lib.types.path; + type = lib.types.pathWith { + inStore = false; + absolute = true; + }; default = "/var/lib/opensnitch/rules"; description = '' Path to the directory where firewall rules can be found and will @@ -158,6 +162,12 @@ in }; config = lib.mkIf cfg.enable { + assertions = [ + { + assertion = stateDir != null; + message = "`config.services.opensnitch.settings.Rules.Path` must be a sub-directory of /var/lib/, currently is ${cfg.settings.Rules.Path}"; + } + ]; security.auditd = lib.mkIf (cfg.settings.ProcMonitorMethod == "audit") { enable = true; @@ -174,8 +184,14 @@ in "" "${lib.getExe' cfg.package "opensnitchd"} --config-file ${cfg.configFile}" ]; + StateDirectory = builtins.head stateDir; # match produces a list. Null case covered by assertion. }; - preStart = lib.mkIf (cfg.rules != { }) ( + preStart = '' + # assert rules directory exists before service starts + # will be in StateDirectory due to assertion + mkdir -p ${cfg.settings.Rules.Path} + '' + + lib.optionalString (cfg.rules != { }) ( let rules = lib.flip lib.mapAttrsToList predefinedRules ( file: content: { @@ -205,9 +221,6 @@ in '' ); }; - tmpfiles.rules = [ - "d ${cfg.settings.Rules.Path} 0750 root root - -" - ]; }; environment.etc."opensnitchd/network_aliases.json".source = From 3214367796ab0c847db641a372038c28ea82da1d Mon Sep 17 00:00:00 2001 From: Grimmauld Date: Wed, 10 Jun 2026 13:38:01 +0200 Subject: [PATCH 5/5] nixos/opensnitch: default to nftables firewall backend iptables backend is currently broken for unknown reasons. `nftables` backend works for iptables firewall too, if built with nftablesCompat = true (our default). --- nixos/modules/services/security/opensnitch.nix | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/nixos/modules/services/security/opensnitch.nix b/nixos/modules/services/security/opensnitch.nix index 35eeef1d0443..0631d0a1863b 100644 --- a/nixos/modules/services/security/opensnitch.nix +++ b/nixos/modules/services/security/opensnitch.nix @@ -106,10 +106,9 @@ in "iptables" "nftables" ]; - default = if config.networking.nftables.enable then "nftables" else "iptables"; - defaultText = lib.literalExpression ''if config.networking.nftables.enable then "nftables" else "iptables"''; + default = "nftables"; description = '' - Which firewall backend to use. + Which firewall backend to use. `nftables` ruleset can be used for `iptables` firewall too, if `iptables` is built with nftables compatibility. ''; }; Ebpf.ModulesPath = lib.mkOption {