From ec3661ed7ace0effe7193e97d6c99f275b4340d3 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Thu, 26 Dec 2024 18:33:25 +0100
Subject: [PATCH 1/2] nixos/opensnitch: fix eval on non-ebpf ProcMonitorMethod

---
 nixos/modules/services/security/opensnitch.nix | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/nixos/modules/services/security/opensnitch.nix b/nixos/modules/services/security/opensnitch.nix
index 97700987025d..c56501c98a5f 100644
--- a/nixos/modules/services/security/opensnitch.nix
+++ b/nixos/modules/services/security/opensnitch.nix
@@ -150,7 +150,7 @@ in
             };
 
             Ebpf.ModulesPath = lib.mkOption {
-              type = lib.types.path;
+              type = lib.types.nullOr lib.types.path;
               default =
                 if cfg.settings.ProcMonitorMethod == "ebpf" then
                   "${config.boot.kernelPackages.opensnitch-ebpf}/etc/opensnitchd"
@@ -202,10 +202,16 @@ in
       services.opensnitchd = {
         wantedBy = [ "multi-user.target" ];
         serviceConfig = {
-          ExecStart = [
-            ""
-            "${pkgs.opensnitch}/bin/opensnitchd --config-file ${format.generate "default-config.json" cfg.settings}"
-          ];
+          ExecStart =
+            let
+              preparedSettings = removeAttrs cfg.settings (
+                lib.optional (cfg.settings.ProcMonitorMethod != "ebpf") "Ebpf"
+              );
+            in
+            [
+              ""
+              "${pkgs.opensnitch}/bin/opensnitchd --config-file ${format.generate "default-config.json" preparedSettings}"
+            ];
         };
         preStart = lib.mkIf (cfg.rules != { }) (
           let

From d14a2126152231bfe77fad807eb11fbc044f6d93 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Thu, 26 Dec 2024 22:04:37 +0100
Subject: [PATCH 2/2] nixos/tests/opensnitch: test all possible values for
 ProcMonitorMethod

---
 nixos/tests/opensnitch.nix | 107 +++++++++++++++++++++----------------
 1 file changed, 62 insertions(+), 45 deletions(-)

diff --git a/nixos/tests/opensnitch.nix b/nixos/tests/opensnitch.nix
index 4781cc485dbe..dbb536e9a769 100644
--- a/nixos/tests/opensnitch.nix
+++ b/nixos/tests/opensnitch.nix
@@ -1,5 +1,13 @@
 import ./make-test-python.nix (
-  { pkgs, ... }:
+  { pkgs, lib, ... }:
+  let
+    monitorMethods = [
+      "ebpf"
+      "proc"
+      "ftrace"
+      "audit"
+    ];
+  in
   {
     name = "opensnitch";
 
@@ -7,10 +15,9 @@ import ./make-test-python.nix (
       maintainers = [ onny ];
     };
 
-    nodes = {
-      server =
-        { ... }:
-        {
+    nodes =
+      {
+        server = {
           networking.firewall.allowedTCPPorts = [ 80 ];
           services.caddy = {
             enable = true;
@@ -19,50 +26,60 @@ import ./make-test-python.nix (
             '';
           };
         };
-
-      clientBlocked =
-        { ... }:
-        {
-          services.opensnitch = {
-            enable = true;
-            settings.DefaultAction = "deny";
-          };
-        };
-
-      clientAllowed =
-        { ... }:
-        {
-          services.opensnitch = {
-            enable = true;
-            settings.DefaultAction = "deny";
-            rules = {
-              curl = {
-                name = "curl";
-                enabled = true;
-                action = "allow";
-                duration = "always";
-                operator = {
-                  type = "simple";
-                  sensitive = false;
-                  operand = "process.path";
-                  data = "${pkgs.curl}/bin/curl";
+      }
+      // (lib.listToAttrs (
+        map (
+          m:
+          lib.nameValuePair "client_blocked_${m}" {
+            services.opensnitch = {
+              enable = true;
+              settings.DefaultAction = "deny";
+              settings.ProcMonitorMethod = m;
+            };
+          }
+        ) monitorMethods
+      ))
+      // (lib.listToAttrs (
+        map (
+          m:
+          lib.nameValuePair "client_allowed_${m}" {
+            services.opensnitch = {
+              enable = true;
+              settings.DefaultAction = "deny";
+              settings.ProcMonitorMethod = m;
+              rules = {
+                curl = {
+                  name = "curl";
+                  enabled = true;
+                  action = "allow";
+                  duration = "always";
+                  operator = {
+                    type = "simple";
+                    sensitive = false;
+                    operand = "process.path";
+                    data = "${pkgs.curl}/bin/curl";
+                  };
                 };
               };
             };
-          };
-        };
-    };
+          }
+        ) monitorMethods
+      ));
 
-    testScript = ''
-      start_all()
-      server.wait_for_unit("caddy.service")
-      server.wait_for_open_port(80)
+    testScript =
+      ''
+        start_all()
+        server.wait_for_unit("caddy.service")
+        server.wait_for_open_port(80)
+      ''
+      + lib.concatLines (
+        map (m: ''
+          client_blocked_${m}.wait_for_unit("opensnitchd.service")
+          client_blocked_${m}.fail("curl http://server")
 
-      clientBlocked.wait_for_unit("opensnitchd.service")
-      clientBlocked.fail("curl http://server")
-
-      clientAllowed.wait_for_unit("opensnitchd.service")
-      clientAllowed.succeed("curl http://server")
-    '';
+          client_allowed_${m}.wait_for_unit("opensnitchd.service")
+          client_allowed_${m}.succeed("curl http://server")
+        '') monitorMethods
+      );
   }
 )