gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

shh: init at 2025.4.12

Browse Source 
History:
  - shh: init at 2023.12.16 by @erdnaxe in #289715
  - shh: re-init at 2025.3.13 by @kuflierl
  - shh: fix PATH issues for strace execution in NixOS by @kuflierl
    Patched source code to also add strace into systemd service path when PATH env is defined in systemd service
    Cleaned up nix-specific test disables
    added nativeInputs
  - minor package.nix changes by @Aleksanaa
  - shh: update 2025.3.13 -> 2025.4.12 by @kuflierl

Update pkgs/by-name/sh/shh/package.nix

Co-authored-by: Aleksana <alexander.huang.y@gmail.com>
This commit is contained in:
Alexandre Iooss
2025-04-22 10:23:37 +08:00
committed by aleksana
co-authored by Aleksana
parent 257843149a
commit fdeb7deaf9
3 changed files with 342 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkgs/by-name/sh/shh/fix_run_checks.patch
+201
View File
@@ -0,0 +1,201 @@
commit 070bf216bacf6ce1b473f2819a017d1be29716d0
Author: kuflierl <41301536+kuflierl@users.noreply.github.com>
Date: Sun Apr 13 19:56:58 2025 +0200
add support for nix-build-system for tests
diff --git a/Cargo.toml b/Cargo.toml
index eba0ef8..9153f00 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -58,6 +58,7 @@ default = []
as-root = [] # for tests only
gen-man-pages = ["dep:clap_mangen"]
nightly = [] # for benchmarks only
+nix-build-env = [] # perform checks in a way compatable with nix build
[lints.rust]
# https://doc.rust-lang.org/rustc/lints/listing/allowed-by-default.html
diff --git a/src/systemd/resolver.rs b/src/systemd/resolver.rs
index e2abbb7..1151592 100644
--- a/src/systemd/resolver.rs
+++ b/src/systemd/resolver.rs
@@ -637,17 +637,14 @@ mod tests {
let OptionValue::List(opt_list) = &candidates[0].value else {
panic!();
};
- assert!(opt_list.values.contains(&"/boot".to_owned()));
+ // information gathering
+ // eprint!("{}\n", &candidates[0].to_string());
assert!(opt_list.values.contains(&"/dev".to_owned()));
assert!(opt_list.values.contains(&"/etc".to_owned()));
- assert!(opt_list.values.contains(&"/home".to_owned()));
- assert!(opt_list.values.contains(&"/root".to_owned()));
- assert!(opt_list.values.contains(&"/sys".to_owned()));
+ assert!(opt_list.values.contains(&"/nix".to_owned()));
+ assert!(opt_list.values.contains(&"/bin".to_owned()));
+ assert!(opt_list.values.contains(&"/build".to_owned()));
assert!(opt_list.values.contains(&"/tmp".to_owned()));
- assert!(opt_list.values.contains(&"/usr".to_owned()));
- assert!(opt_list.values.contains(&"/var".to_owned()));
- assert!(!opt_list.values.contains(&"/proc".to_owned()));
- assert!(!opt_list.values.contains(&"/run".to_owned()));
let actions = vec![ProgramAction::Read("/var/data".into())];
let candidates = resolve(&opts, &actions, &hardening_opts);
diff --git a/tests/options.rs b/tests/options.rs
index 835ee14..cac55e5 100644
--- a/tests/options.rs
+++ b/tests/options.rs
@@ -24,7 +24,7 @@ fn run_true() {
.assert()
.success()
.stdout(predicate::str::contains("ProtectSystem=strict\n").count(1))
- .stdout(if Uid::effective().is_root() {
+ .stdout(if Uid::effective().is_root() || !env::current_exe().unwrap().starts_with("/home") {
BoxPredicate::new(predicate::str::contains("ProtectHome=true\n").count(1))
} else {
BoxPredicate::new(predicate::str::contains("ProtectHome=").not())
@@ -50,7 +50,7 @@ fn run_true() {
.stdout(predicate::str::contains("LockPersonality=true\n").count(1))
.stdout(predicate::str::contains("RestrictRealtime=true\n").count(1))
.stdout(predicate::str::contains("ProtectClock=true\n").count(1))
- .stdout(predicate::str::contains("SystemCallFilter=~@aio:EPERM @chown:EPERM @clock:EPERM @cpu-emulation:EPERM @debug:EPERM @io-event:EPERM @ipc:EPERM @keyring:EPERM @memlock:EPERM @module:EPERM @mount:EPERM @network-io:EPERM @obsolete:EPERM @pkey:EPERM @privileged:EPERM @process:EPERM @raw-io:EPERM @reboot:EPERM @resources:EPERM @sandbox:EPERM @setuid:EPERM @signal:EPERM @swap:EPERM @sync:EPERM @timer:EPERM\n").count(1))
+ .stdout(predicate::str::contains("SystemCallFilter=~@aio:EPERM @chown:EPERM @clock:EPERM @cpu-emulation:EPERM @debug:EPERM @io-event:EPERM @ipc:EPERM @keyring:EPERM @memlock:EPERM @module:EPERM @mount:EPERM @network-io:EPERM @obsolete:EPERM @pkey:EPERM @privileged:EPERM @raw-io:EPERM @reboot:EPERM @resources:EPERM @sandbox:EPERM @setuid:EPERM @signal:EPERM @swap:EPERM @sync:EPERM @timer:EPERM\n").count(1))
.stdout(predicate::str::contains("CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_BPF CAP_CHOWN CAP_MKNOD CAP_NET_RAW CAP_PERFMON CAP_SYS_BOOT CAP_SYS_CHROOT CAP_SYS_MODULE CAP_SYS_NICE CAP_SYS_PACCT CAP_SYS_PTRACE CAP_SYS_TIME CAP_SYS_TTY_CONFIG CAP_SYSLOG CAP_WAKE_ALARM\n").count(1));
}
@@ -97,7 +97,7 @@ fn run_ls_dev() {
.assert()
.success()
.stdout(predicate::str::contains("ProtectSystem=strict\n").count(1))
- .stdout(if Uid::effective().is_root() {
+ .stdout(if Uid::effective().is_root() || !env::current_exe().unwrap().starts_with("/home") {
BoxPredicate::new(predicate::str::contains("ProtectHome=true\n").count(1))
} else {
BoxPredicate::new(predicate::str::contains("ProtectHome=").not())
@@ -130,12 +130,12 @@ fn run_ls_dev() {
fn run_ls_proc() {
Command::cargo_bin("shh")
.unwrap()
- .args(["run", "--", "busybox", "ls", "/proc/1/"])
+ .args(["run", "--", "ls", "/proc/1/"])
.unwrap()
.assert()
.success()
.stdout(predicate::str::contains("ProtectSystem=strict\n").count(1))
- .stdout(if Uid::effective().is_root() {
+ .stdout(if Uid::effective().is_root() || !env::current_exe().unwrap().starts_with("/home") {
BoxPredicate::new(predicate::str::contains("ProtectHome=true\n").count(1))
} else {
BoxPredicate::new(predicate::str::contains("ProtectHome=").not())
@@ -166,7 +166,7 @@ fn run_ls_proc() {
.assert()
.success()
.stdout(predicate::str::contains("ProtectSystem=strict\n").count(1))
- .stdout(if Uid::effective().is_root() {
+ .stdout(if Uid::effective().is_root() || !env::current_exe().unwrap().starts_with("/home") {
BoxPredicate::new(predicate::str::contains("ProtectHome=true\n").count(1))
} else {
BoxPredicate::new(predicate::str::contains("ProtectHome=").not())
@@ -188,7 +188,7 @@ fn run_ls_proc() {
.stdout(predicate::str::contains("LockPersonality=true\n").count(1))
.stdout(predicate::str::contains("RestrictRealtime=true\n").count(1))
.stdout(predicate::str::contains("ProtectClock=true\n").count(1))
- .stdout(predicate::str::contains("SystemCallFilter=~@aio:EPERM @chown:EPERM @clock:EPERM @cpu-emulation:EPERM @debug:EPERM @io-event:EPERM @ipc:EPERM @keyring:EPERM @memlock:EPERM @module:EPERM @mount:EPERM @network-io:EPERM @obsolete:EPERM @pkey:EPERM @privileged:EPERM @process:EPERM @raw-io:EPERM @reboot:EPERM @resources:EPERM @sandbox:EPERM @setuid:EPERM @signal:EPERM @swap:EPERM @sync:EPERM @timer:EPERM\n").count(1))
+ .stdout(predicate::str::contains("SystemCallFilter=~@aio:EPERM @chown:EPERM @clock:EPERM @cpu-emulation:EPERM @debug:EPERM @io-event:EPERM @ipc:EPERM @keyring:EPERM @memlock:EPERM @module:EPERM @mount:EPERM @network-io:EPERM @obsolete:EPERM @pkey:EPERM @privileged:EPERM @raw-io:EPERM @reboot:EPERM @resources:EPERM @sandbox:EPERM @setuid:EPERM @signal:EPERM @swap:EPERM @sync:EPERM @timer:EPERM\n").count(1))
.stdout(predicate::str::contains("CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_BPF CAP_CHOWN CAP_MKNOD CAP_NET_RAW CAP_PERFMON CAP_SYS_BOOT CAP_SYS_CHROOT CAP_SYS_MODULE CAP_SYS_NICE CAP_SYS_PACCT CAP_SYS_PTRACE CAP_SYS_TIME CAP_SYS_TTY_CONFIG CAP_SYSLOG CAP_WAKE_ALARM\n").count(1));
}
@@ -201,7 +201,7 @@ fn run_read_kallsyms() {
.assert()
.success()
.stdout(predicate::str::contains("ProtectSystem=strict\n").count(1))
- .stdout(if Uid::effective().is_root() {
+ .stdout(if Uid::effective().is_root() || !env::current_exe().unwrap().starts_with("/home") {
BoxPredicate::new(predicate::str::contains("ProtectHome=true\n").count(1))
} else {
BoxPredicate::new(predicate::str::contains("ProtectHome=").not())
@@ -227,11 +227,12 @@ fn run_read_kallsyms() {
.stdout(predicate::str::contains("LockPersonality=true\n").count(1))
.stdout(predicate::str::contains("RestrictRealtime=true\n").count(1))
.stdout(predicate::str::contains("ProtectClock=true\n").count(1))
- .stdout(predicate::str::contains("SystemCallFilter=~@aio:EPERM @chown:EPERM @clock:EPERM @cpu-emulation:EPERM @debug:EPERM @io-event:EPERM @ipc:EPERM @keyring:EPERM @memlock:EPERM @module:EPERM @mount:EPERM @network-io:EPERM @obsolete:EPERM @pkey:EPERM @privileged:EPERM @process:EPERM @raw-io:EPERM @reboot:EPERM @resources:EPERM @sandbox:EPERM @setuid:EPERM @signal:EPERM @swap:EPERM @sync:EPERM @timer:EPERM\n").count(1))
+ .stdout(predicate::str::contains("SystemCallFilter=~@aio:EPERM @chown:EPERM @clock:EPERM @cpu-emulation:EPERM @debug:EPERM @io-event:EPERM @ipc:EPERM @keyring:EPERM @memlock:EPERM @module:EPERM @mount:EPERM @network-io:EPERM @obsolete:EPERM @pkey:EPERM @privileged:EPERM @raw-io:EPERM @reboot:EPERM @resources:EPERM @sandbox:EPERM @setuid:EPERM @signal:EPERM @swap:EPERM @sync:EPERM @timer:EPERM\n").count(1))
.stdout(predicate::str::contains("CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_BPF CAP_CHOWN CAP_MKNOD CAP_NET_RAW CAP_PERFMON CAP_SYS_BOOT CAP_SYS_CHROOT CAP_SYS_MODULE CAP_SYS_NICE CAP_SYS_PACCT CAP_SYS_PTRACE CAP_SYS_TIME CAP_SYS_TTY_CONFIG CAP_SYSLOG CAP_WAKE_ALARM\n").count(1));
}
#[test]
+#[cfg_attr(feature = "nix-build-env", ignore)]
fn run_ls_modules() {
Command::cargo_bin("shh")
.unwrap()
@@ -240,7 +241,7 @@ fn run_ls_modules() {
.assert()
.success()
.stdout(predicate::str::contains("ProtectSystem=strict\n").count(1))
- .stdout(if Uid::effective().is_root() {
+ .stdout(if Uid::effective().is_root() || !env::current_exe().unwrap().starts_with("/home") {
BoxPredicate::new(predicate::str::contains("ProtectHome=true\n").count(1))
} else {
BoxPredicate::new(predicate::str::contains("ProtectHome=").not())
@@ -304,7 +305,7 @@ fn run_dmesg() {
}
#[test]
-#[cfg_attr(feature = "as-root", ignore)]
+#[cfg_attr(any(feature = "nix-build-env", feature = "as-root"), ignore)]
fn run_systemctl() {
assert!(!Uid::effective().is_root());
@@ -344,6 +345,7 @@ fn run_systemctl() {
.stdout(predicate::str::contains("CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_BPF CAP_CHOWN CAP_MKNOD CAP_NET_RAW CAP_PERFMON CAP_SYS_BOOT CAP_SYS_CHROOT CAP_SYS_MODULE CAP_SYS_NICE CAP_SYS_PACCT CAP_SYS_PTRACE CAP_SYS_TIME CAP_SYS_TTY_CONFIG CAP_SYSLOG CAP_WAKE_ALARM\n").count(1));
}
+// patched due to nix build isolation
#[test]
fn run_ss() {
Command::cargo_bin("shh")
@@ -353,7 +355,7 @@ fn run_ss() {
.assert()
.success()
.stdout(predicate::str::contains("ProtectSystem=strict\n").count(1))
- .stdout(if Uid::effective().is_root() {
+ .stdout(if Uid::effective().is_root() || !env::current_exe().unwrap().starts_with("/home") {
BoxPredicate::new(predicate::str::contains("ProtectHome=true\n").count(1))
} else {
BoxPredicate::new(predicate::str::contains("ProtectHome=").not())
@@ -369,7 +371,7 @@ fn run_ss() {
.stdout(predicate::str::contains("ProtectKernelModules=true\n").count(1))
.stdout(predicate::str::contains("ProtectKernelLogs=true\n").count(1))
.stdout(predicate::str::contains("ProtectControlGroups=true\n").count(1))
- .stdout(predicate::str::contains("ProtectProc=").not())
+ //.stdout(predicate::str::contains("ProtectProc=").not())
.stdout(predicate::str::contains("MemoryDenyWriteExecute=true\n").count(1))
.stdout(predicate::str::contains("RestrictAddressFamilies=AF_NETLINK AF_UNIX\n").count(1).or(predicate::str::contains("RestrictAddressFamilies=AF_NETLINK\n").count(1)))
.stdout(predicate::str::contains("SocketBindDeny=ipv4:tcp\n").count(1))
@@ -379,7 +381,7 @@ fn run_ss() {
.stdout(predicate::str::contains("LockPersonality=true\n").count(1))
.stdout(predicate::str::contains("RestrictRealtime=true\n").count(1))
.stdout(predicate::str::contains("ProtectClock=true\n").count(1))
- .stdout(predicate::str::contains("SystemCallFilter=~@aio:EPERM @chown:EPERM @clock:EPERM @cpu-emulation:EPERM @debug:EPERM @io-event:EPERM @ipc:EPERM @keyring:EPERM @memlock:EPERM @module:EPERM @mount:EPERM @obsolete:EPERM @pkey:EPERM @privileged:EPERM @raw-io:EPERM @reboot:EPERM @resources:EPERM @sandbox:EPERM @setuid:EPERM @signal:EPERM @swap:EPERM @sync:EPERM @timer:EPERM\n").count(1))
+ .stdout(predicate::str::contains("SystemCallFilter=~@aio:EPERM @chown:EPERM @clock:EPERM @cpu-emulation:EPERM @debug:EPERM @io-event:EPERM @ipc:EPERM @keyring:EPERM @memlock:EPERM @module:EPERM @mount:EPERM @obsolete:EPERM @pkey:EPERM @privileged:EPERM @process:EPERM @raw-io:EPERM @reboot:EPERM @resources:EPERM @sandbox:EPERM @setuid:EPERM @signal:EPERM @swap:EPERM @sync:EPERM @timer:EPERM\n").count(1))
.stdout(predicate::str::contains("CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_BPF CAP_CHOWN CAP_MKNOD CAP_NET_RAW CAP_PERFMON CAP_SYS_BOOT CAP_SYS_CHROOT CAP_SYS_MODULE CAP_SYS_NICE CAP_SYS_PACCT CAP_SYS_PTRACE CAP_SYS_TIME CAP_SYS_TTY_CONFIG CAP_SYSLOG CAP_WAKE_ALARM\n").count(1));
}
@@ -741,6 +743,7 @@ fn run_mknod() {
}
#[test]
+#[cfg_attr(feature = "nix-build-env", ignore)] // no raw socket cap in nix build
fn run_ping_4() {
Command::cargo_bin("shh")
.unwrap()
@@ -759,6 +762,7 @@ fn run_ping_4() {
}
#[test]
+#[cfg_attr(feature = "nix-build-env", ignore)] // no raw socket cap in nix build
fn run_ping_6() {
Command::cargo_bin("shh")
.unwrap()
pkgs/by-name/sh/shh/package.nix
+58
View File
@@ -0,0 +1,58 @@
{
lib,
rustPlatform,
fetchFromGitHub,
python3,
strace,
systemd,
iproute2,
}:
rustPlatform.buildRustPackage rec {
pname = "shh";
version = "2025.4.12";
src = fetchFromGitHub {
owner = "desbma";
repo = "shh";
tag = "v${version}";
hash = "sha256-+JWz0ya6gi8pPERnpAcQIe7zZUzWGxha+9/gizMVtEw=";
};
cargoHash = "sha256-TdP+1sb1GEFM57z+rc+gqhoWQhPAXzvMt/FCWf3wpr8=";
patches = [
./fix_run_checks.patch
./pr13-profile-path-fix-strace.patch
];
# buildFeatures = [ /*"gen-man-pages"*/ ];
checkFeatures = [ "nix-build-env" ];
buildInputs = [
strace
systemd
];
nativeCheckInputs = [
strace
systemd
python3
iproute2
];
# RUST_BACKTRACE = 1;
meta = {
description = "Automatic systemd service hardening guided by strace profiling";
homepage = "https://github.com/desbma/shh";
license = lib.licenses.gpl3Only;
platforms = lib.platforms.linux;
mainProgram = "shh";
maintainers = with lib.maintainers; [
erdnaxe
kuflierl
];
};
}
pkgs/by-name/sh/shh/pr13-profile-path-fix-strace.patch
+83
View File
@@ -0,0 +1,83 @@
commit 4d2c1556d769695770c95a982e0dcda4d70eee57
Author: kuflierl <41301536+kuflierl@users.noreply.github.com>
Date: Sun Apr 13 19:57:50 2025 +0200
service.rs: profile path fix for strace
Enable path env fixing when path env doesn't have strace to unbreak tool on unique systems and units.
This fixes handling on non FHS operating systems and systemd units that define their own PATH that doesn't include strace.
diff --git a/src/systemd/service.rs b/src/systemd/service.rs
index 908fdf0..e9294cf 100644
--- a/src/systemd/service.rs
+++ b/src/systemd/service.rs
@@ -7,6 +7,7 @@ use std::{
ops::RangeInclusive,
path::{Path, PathBuf},
process::{Command, Stdio},
+ ffi::OsString,
};
use anyhow::Context as _;
@@ -99,6 +100,41 @@ impl Service {
)
}
+ // A function for locating the parent directory i.e. PATH of an executable
+ fn resolve_exec_path<P>(exe_name: &P, path_env: OsString) -> Option<PathBuf>
+ where P: AsRef<Path> + ?Sized,
+ {
+ env::split_paths(&path_env).filter_map(|dir| {
+ let full_path = dir.join(&exe_name);
+ if full_path.is_file() {
+ Some(dir)
+ } else {
+ None
+ }
+ }).next()
+ }
+
+ // determine PATH env used for unit
+ pub(crate) fn get_exec_path(config_paths: &Vec<&Path>) -> anyhow::Result<String> {
+ let old_path_env_option = Self::config_vals("Environment", &config_paths)?
+ .into_iter().filter(|x| x.starts_with("\"PATH=")).last().map(|x| x.trim_matches('\"').get(5..).unwrap().to_owned());
+ Ok(match old_path_env_option {
+ Some(path_env) => {
+ log::info!("Found hard coded PATH environment in unit: {path_env}");
+ path_env
+ },
+ None => {
+ let output = Command::new("systemd-path").arg("search-binaries-default").output()?;
+ if !output.status.success() {
+ anyhow::bail!("systemd-path invocation failed with code {:?}", output.status);
+ }
+ let default_systemd_path = output.stdout.lines().next().ok_or_else(|| anyhow::anyhow!("Unable to get global systemd default PATH"))??;
+ log::info!("Could not find hard coded PATH environment in unit, using systemd default: {default_systemd_path}");
+ default_systemd_path
+ }
+ })
+ }
+
/// Get systemd "exposure level" for the service (0-100).
/// 100 means extremely exposed (no hardening), 0 means so sandboxed it can't do much.
/// Although this is a very crude heuristic, below 40-50 is generally good.
@@ -170,6 +206,20 @@ impl Service {
writeln!(fragment_file, "KillMode=control-group")?;
writeln!(fragment_file, "StandardOutput=journal")?;
+ // Modifying Env Path for strace availability if needed
+ let old_path_env = Self::get_exec_path(&config_paths)?;
+ match Self::resolve_exec_path("strace", (&old_path_env).into()) {
+ Some(_) => log::info!("Found strace in previous path, no correction needed"),
+ None => {
+ let path_with_strace = Self::resolve_exec_path("strace", env::var_os("PATH").unwrap()).unwrap();
+ log::info!("Found strace from local PATH in {}, inserting it into unit config!", path_with_strace.display());
+ let mut paths = env::split_paths(&old_path_env).collect::<Vec<_>>();
+ paths.push(path_with_strace);
+ let new_path = env::join_paths(paths)?;
+ writeln!(fragment_file, "Environment=\"PATH={}\"", new_path.to_str().unwrap())?;
+ },
+ }
+
// Profile data dir
let mut rng = rand::rng();
let profile_data_dir = PathBuf::from(format!(