gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/postgresql: create infrastructure for relaxing systemd hardening

Browse Source 
By matching on the package names of the plugins passed into the package
we can relax the systemd unit hardening as needed.
This commit is contained in:
Martin Weinelt
2024-11-10 17:08:59 +01:00
committed by Maximilian Bosch
parent 223a6c6ed0
commit d370af0785
2 changed files with 45 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

43
nixos/modules/services/databases/postgresql.nix
View File

@@ -2,6 +2,7 @@
let let
inherit (lib) inherit (lib)
any
attrValues attrValues
concatMapStrings concatMapStrings
concatStringsSep concatStringsSep
@@ -9,6 +10,7 @@ let
elem elem
escapeShellArgs escapeShellArgs
filterAttrs filterAttrs
getName
isString isString
literalExpression literalExpression
mapAttrs mapAttrs
@@ -30,19 +32,19 @@ let
cfg = config.services.postgresql; cfg = config.services.postgresql;
postgresql = # ensure that
let # services.postgresql = {
# ensure that # enableJIT = true;
# services.postgresql = { # package = pkgs.postgresql_<major>;
# enableJIT = true; # };
# package = pkgs.postgresql_<major>; # works.
# }; basePackage = if cfg.enableJIT
# works. then cfg.package.withJIT
base = if cfg.enableJIT then cfg.package.withJIT else cfg.package.withoutJIT; else cfg.package.withoutJIT;
in
if cfg.extensions == [] postgresql = if cfg.extensions == []
then base then basePackage
else base.withPackages cfg.extensions; else basePackage.withPackages cfg.extensions;
toStr = value: toStr = value:
if true == value then "yes" if true == value then "yes"
@@ -59,6 +61,9 @@ let
''; '';
groupAccessAvailable = versionAtLeast postgresql.version "11.0"; groupAccessAvailable = versionAtLeast postgresql.version "11.0";
extensionNames = map getName postgresql.installedExtensions;
extensionInstalled = extension: elem extension extensionNames;
in in
{ {
@@ -630,7 +635,7 @@ in
PrivateTmp = true; PrivateTmp = true;
ProtectHome = true; ProtectHome = true;
ProtectSystem = "strict"; ProtectSystem = "strict";
MemoryDenyWriteExecute = lib.mkDefault (cfg.settings.jit == "off"); MemoryDenyWriteExecute = lib.mkDefault (cfg.settings.jit == "off" && (!any extensionInstalled [ "plv8" ]));
NoNewPrivileges = true; NoNewPrivileges = true;
LockPersonality = true; LockPersonality = true;
PrivateDevices = true; PrivateDevices = true;
@@ -654,10 +659,12 @@ in
RestrictRealtime = true; RestrictRealtime = true;
RestrictSUIDSGID = true; RestrictSUIDSGID = true;
SystemCallArchitectures = "native"; SystemCallArchitectures = "native";
SystemCallFilter = [ SystemCallFilter =
"@system-service" [
"~@privileged @resources" "@system-service"
]; "~@privileged @resources"
]
++ lib.optionals (any extensionInstalled [ "plv8" ]) [ "@pkey" ];
UMask = if groupAccessAvailable then "0027" else "0077"; UMask = if groupAccessAvailable then "0027" else "0077";
} }
(mkIf (cfg.dataDir != "/var/lib/postgresql") { (mkIf (cfg.dataDir != "/var/lib/postgresql") {

32
pkgs/servers/sql/postgresql/generic.nix
View File

@@ -323,25 +323,33 @@ let
}; };
}); });
postgresqlWithPackages = { postgresql, buildEnv }: f: buildEnv { postgresqlWithPackages = { postgresql, buildEnv }: f: let
installedExtensions = f postgresql.pkgs;
in buildEnv {
name = "${postgresql.pname}-and-plugins-${postgresql.version}"; name = "${postgresql.pname}-and-plugins-${postgresql.version}";
paths = f postgresql.pkgs ++ [ paths = installedExtensions ++ [
postgresql postgresql
postgresql.man # in case user installs this into environment postgresql.man # in case user installs this into environment
]; ];
pathsToLink = ["/"]; pathsToLink = ["/"];
passthru.version = postgresql.version; passthru = {
passthru.psqlSchema = postgresql.psqlSchema; inherit installedExtensions;
passthru.withJIT = postgresqlWithPackages { inherit (postgresql)
inherit buildEnv; psqlSchema
postgresql = postgresql.withJIT; version
} f; ;
passthru.withoutJIT = postgresqlWithPackages {
inherit buildEnv; withJIT = postgresqlWithPackages {
postgresql = postgresql.withoutJIT; inherit buildEnv;
} f; postgresql = postgresql.withJIT;
} f;
withoutJIT = postgresqlWithPackages {
inherit buildEnv;
postgresql = postgresql.withoutJIT;
} f;
};
}; };
in in