From ad603b16de0a867412a3fc58d51e71a6a0f4fdaa Mon Sep 17 00:00:00 2001
From: "Burfeind, Jan-Niklas" <jan-niklas.burfeind@sennheiser.com>
Date: Mon, 2 Mar 2026 11:52:16 +0100
Subject: [PATCH] nixosTests.labgrid: Add systemd hardening test

to prevent unnoticed degradation.

The limit '11' matches the current exposure level '1.1'.
---
 nixos/tests/labgrid.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/nixos/tests/labgrid.nix b/nixos/tests/labgrid.nix
index d92639fefa4b..1b405dc0c51c 100644
--- a/nixos/tests/labgrid.nix
+++ b/nixos/tests/labgrid.nix
@@ -57,5 +57,10 @@
           coordinator.wait_for_open_port(20408)
           out = client.succeed("labgrid-client places")
           assert_contains(out, "testplace")
+
+      with subtest("Check systemd hardening does not degrade unnoticed"):
+          exact_threshold = 11
+          out = coordinator.fail(f"systemd-analyze security labgrid-coordinator.service --threshold={exact_threshold-1}")
+          out = coordinator.succeed(f"systemd-analyze security labgrid-coordinator.service --threshold={exact_threshold}")
     '';
 }