From 70c96f0e02dcfdc559da4bc699c751d9fb1b2dab Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Tue, 24 Nov 2020 21:54:33 +0100 Subject: [PATCH 1/3] babeld: add patch to skip per interface rp_filter setup This is in preparation to run babeld as DynamicUser and was submitted upstream in https://github.com/jech/babeld/pull/68 and will be part of the 1.10 release. --- pkgs/tools/networking/babeld/default.nix | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/pkgs/tools/networking/babeld/default.nix b/pkgs/tools/networking/babeld/default.nix index a889821c9475..5c7b26ced05d 100644 --- a/pkgs/tools/networking/babeld/default.nix +++ b/pkgs/tools/networking/babeld/default.nix @@ -1,4 +1,4 @@ -{ lib, stdenv, fetchurl, nixosTests }: +{ lib, stdenv, fetchurl, fetchpatch, nixosTests }: stdenv.mkDerivation rec { pname = "babeld"; @@ -9,6 +9,14 @@ stdenv.mkDerivation rec { sha256 = "01vzhrspnm4sy9ggaz9n3bfl5hy3qlynr218j3mdcddzm3h00kqm"; }; + patches = [ + (fetchpatch { + # Skip kernel_setup_interface when `skip-kernel-setup` is enabled. + url = "https://github.com/jech/babeld/commit/f9698a5616842467ad08a5f9ed3d6fcfa2dd2898.patch"; + sha256 = "00kj2jxsfq0pjk5wrkslyvkww57makxlwa4fd82g7g9hrgahpqwr"; + }) + ]; + preBuild = '' makeFlags="PREFIX=$out ETCDIR=$out/etc" ''; From e8988f7a30ba6e4a55c06673a8b672b75bb25d76 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Tue, 24 Nov 2020 22:41:21 +0100 Subject: [PATCH 2/3] nixos/babeld: run as DynamicUser MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The last bits to prevent babeld from running unprivileged was its kernel_setup_interface routine, that wants to set per interface rp_filter. This behaviour has been disabled in a patch that has been submitted upstream at https://github.com/jech/babeld/pull/68 and reuses the skip-kernel-setup config option. → Overall exposure level for babeld.service: 1.7 OK 🙂 --- nixos/doc/manual/release-notes/rl-2105.xml | 7 +++++++ nixos/modules/services/networking/babeld.nix | 16 ++++++++++++++-- 2 files changed, 21 insertions(+), 2 deletions(-) diff --git a/nixos/doc/manual/release-notes/rl-2105.xml b/nixos/doc/manual/release-notes/rl-2105.xml index e0552c25a856..5fbef88c4a5c 100644 --- a/nixos/doc/manual/release-notes/rl-2105.xml +++ b/nixos/doc/manual/release-notes/rl-2105.xml @@ -680,6 +680,13 @@ environment.systemPackages = [ All CUDA toolkit versions prior to CUDA 10 have been removed. + + + The babeld service is now being run as an unprivileged user. To achieve that the module configures + skip-kernel-setup true and takes care of setting forwarding and rp_filter sysctls by itself as well + as for each interface in services.babeld.interfaces. + + diff --git a/nixos/modules/services/networking/babeld.nix b/nixos/modules/services/networking/babeld.nix index e16e56121c4c..97dca002a007 100644 --- a/nixos/modules/services/networking/babeld.nix +++ b/nixos/modules/services/networking/babeld.nix @@ -19,7 +19,10 @@ let "interface ${name} ${paramsString interface}\n"; configFile = with cfg; pkgs.writeText "babeld.conf" ( - (optionalString (cfg.interfaceDefaults != null) '' + '' + skip-kernel-setup true + '' + + (optionalString (cfg.interfaceDefaults != null) '' default ${paramsString cfg.interfaceDefaults} '') + (concatMapStrings interfaceConfig (attrNames cfg.interfaces)) @@ -84,13 +87,22 @@ in config = mkIf config.services.babeld.enable { + boot.kernel.sysctl = { + "net.ipv6.conf.all.forwarding" = 1; + "net.ipv6.conf.all.accept_redirects" = 0; + "net.ipv4.conf.all.forwarding" = 1; + "net.ipv4.conf.all.rp_filter" = 0; + } // lib.mapAttrs' (ifname: _: lib.nameValuePair "net.ipv4.conf.${ifname}.rp_filter" (lib.mkDefault 0)) config.services.babeld.interfaces; + systemd.services.babeld = { description = "Babel routing daemon"; after = [ "network.target" ]; wantedBy = [ "multi-user.target" ]; serviceConfig = { ExecStart = "${pkgs.babeld}/bin/babeld -c ${configFile} -I /run/babeld/babeld.pid -S /var/lib/babeld/state"; + AmbientCapabilities = [ "CAP_NET_ADMIN" ]; CapabilityBoundingSet = [ "CAP_NET_ADMIN" ]; + DynamicUser = true; IPAddressAllow = [ "fe80::/64" "ff00::/8" "::1/128" "127.0.0.0/8" ]; IPAddressDeny = "any"; LockPersonality = true; @@ -98,7 +110,7 @@ in MemoryDenyWriteExecute = true; ProtectSystem = "strict"; ProtectClock = true; - ProtectKernelTunables = false; # Couldn't write sysctl: Read-only file system + ProtectKernelTunables = true; ProtectKernelModules = true; ProtectKernelLogs = true; ProtectControlGroups = true; From ceb26b53d817cd60218dc95e00192c20ff0bea54 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Tue, 24 Nov 2020 22:45:40 +0100 Subject: [PATCH 3/3] nixos/tests/babeld: drop forwarding sysctls They are now set as part of the babeld module. --- nixos/tests/babeld.nix | 6 ------ 1 file changed, 6 deletions(-) diff --git a/nixos/tests/babeld.nix b/nixos/tests/babeld.nix index 5817ea4ce142..d4df6f86d089 100644 --- a/nixos/tests/babeld.nix +++ b/nixos/tests/babeld.nix @@ -25,9 +25,6 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : { { virtualisation.vlans = [ 10 20 ]; - boot.kernel.sysctl."net.ipv4.conf.all.forwarding" = 1; - boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = 1; - networking = { useDHCP = false; firewall.enable = false; @@ -74,9 +71,6 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : { { virtualisation.vlans = [ 20 30 ]; - boot.kernel.sysctl."net.ipv4.conf.all.forwarding" = 1; - boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = 1; - networking = { useDHCP = false; firewall.enable = false;