From bbb68bef2ec341626449af3fd985d42ac5968c8f Mon Sep 17 00:00:00 2001 From: Julien Moutinho Date: Fri, 24 Jan 2025 11:27:27 +0100 Subject: [PATCH] nixos/public-inbox: test confinement --- nixos/tests/public-inbox.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/nixos/tests/public-inbox.nix b/nixos/tests/public-inbox.nix index 9da906e57ae2..9a19fa8e6fa0 100644 --- a/nixos/tests/public-inbox.nix +++ b/nixos/tests/public-inbox.nix @@ -183,6 +183,12 @@ import ./make-test-python.nix ( testScript = '' start_all() + # The threshold and/or hardening may have to be changed with new features/checks + with subtest("systemd hardening thresholds"): + print(machine.succeed("systemd-analyze security public-inbox-httpd.service --threshold=5 --no-pager")) + print(machine.succeed("systemd-analyze security public-inbox-imapd.service --threshold=5 --no-pager")) + print(machine.succeed("systemd-analyze security public-inbox-nntpd.service --threshold=4 --no-pager")) + machine.wait_for_unit("multi-user.target") machine.wait_for_unit("public-inbox-init.service")