From 384293bbbb59b8af9ad24c50bb108d792c6ca38f Mon Sep 17 00:00:00 2001
From: Henri Menke <henri@henrimenke.de>
Date: Mon, 21 Nov 2022 13:21:44 +0100
Subject: [PATCH 1/2] nixos/alps: fixes for service hardening

---
 nixos/modules/services/web-apps/alps.nix | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/nixos/modules/services/web-apps/alps.nix b/nixos/modules/services/web-apps/alps.nix
index 4681739af4ab..1a58df2da1d2 100644
--- a/nixos/modules/services/web-apps/alps.nix
+++ b/nixos/modules/services/web-apps/alps.nix
@@ -98,11 +98,11 @@ in {
 
       serviceConfig = {
         ExecStart = "${cfg.package}/bin/alps ${escapeShellArgs cfg.args}";
+        AmbientCapabilities = "";
+        CapabilityBoundingSet = "";
         DynamicUser = true;
-        ## This is desirable but would restrict bindIP to 127.0.0.1
-        #IPAddressAllow = "localhost";
-        #IPAddressDeny = "any";
         LockPersonality = true;
+        MemoryDenyWriteExecute = true;
         NoNewPrivileges = true;
         PrivateDevices = true;
         PrivateIPC = true;
@@ -122,8 +122,10 @@ in {
         RestrictNamespaces = true;
         RestrictRealtime = true;
         RestrictSUIDSGID = true;
+        SocketBindAllow = cfg.port;
+        SocketBindDeny = "any";
         SystemCallArchitectures = "native";
-        SystemCallFilter = [ "@system-service @resources" "~@privileged @obsolete" ];
+        SystemCallFilter = [ "@system-service" "~@privileged @obsolete" ];
       };
     };
   };

From d02af66091e3233af01a2d6184ca5b47f7d7e726 Mon Sep 17 00:00:00 2001
From: Henri Menke <henri@henrimenke.de>
Date: Tue, 22 Nov 2022 20:50:28 +0100
Subject: [PATCH 2/2] nixos/alps: fix for Hydra failure

https://hydra.nixos.org/build/199758163
---
 nixos/tests/alps.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/nixos/tests/alps.nix b/nixos/tests/alps.nix
index 8d7814117df1..3c30be1c1887 100644
--- a/nixos/tests/alps.nix
+++ b/nixos/tests/alps.nix
@@ -90,7 +90,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
     };
   };
 
-  testScript = ''
+  testScript = { nodes, ... }: ''
     server.start()
     server.wait_for_unit("postfix.service")
     server.wait_for_unit("dovecot2.service")
@@ -99,6 +99,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
 
     client.start()
     client.wait_for_unit("alps.service")
+    client.wait_for_open_port(${toString nodes.client.config.services.alps.port})
     client.succeed("test-alps-login")
   '';
 })