gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
625,551 Commits 9 Branches 0 Tags
51d3f3475c2fb35f0d9682ea600066b1cea459c6
Commit Graph
625551 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
aszlig 51d3f3475c nixos/tests/confinement: Run test probes in Python 
So far the architecture for the tests was that we would use a systemd
socket unit using the Accept option to start a small shell process where
we can pipe commands into by connecting to the socket created by the
socket unit.

This is unnecessary since we can directly use the code snippets from the
individual subtests and systemd will take care of checking the return
code in case we get any assertions[^1].

Another advantage of this is that tests now run in parallel, so we can
do rather expensive things such as looking in /nix to see whether
anything is writable.

The new assert_permissions() function is the main driver behind this and
allows for a more fine-grained way to check whether we got the right
permissions whilst also ignoring irrelevant things such as read-only
empty directories.

Our previous approach also just did a read-only check, which might be
fine in full-apivfs mode where the attack surface already is large, but
in chroot-only mode we really want to make sure nothing is every
writable.

A downside of the new approach is that currently the unit names are
numbered via lib.imap1, which makes it annoying to track its definition.

[^1]: Speaking of assertions, I wrapped the code to be run with pytest's
      assertion rewriting, so that we get more useful AssertionErrors.

Signed-off-by: aszlig <aszlig@nix.build>
 2024-05-13 00:40:36 +02:00
aszlig f7d026b431 nixos/tests/confinement: Move to dedicated dir 
When experimenting on ways how to refactor the test, I wrote a
significant enough amount of Python to warrant a dedicated Python file.

This commit is mainly to prepare for that and make it easier to track
renames.

Signed-off-by: aszlig <aszlig@nix.build>
 2024-05-13 00:40:34 +02:00
aszlig ba31b3753e nixos/tests/confinement: Re-add description attr 
The reason why I originally used the "description" attribute was that it
can be easily used to parametrise the tests so that we can specify
common constraints and apply it across a number of different
configurations.

When porting the tests to Python, the description attribute was replaced
by inlining it into the Python code, most probably because it was easier
to do in bulk since using Nix to generate the subtest parts would be
very complicated to do since we also had to please Black (a Python code
formatter that we no longer use in test scripts).

Since we now also want to support DynamicUser in systemd-confinement,
the need to parametrise the tests became apparent again because it's now
easier to refactor our subtests to run both with *and* without
DynamicUser set to true.

Signed-off-by: aszlig <aszlig@nix.build>
 2024-05-13 00:40:32 +02:00
Julien Moutinhoandaszlig 0a5542c766 nixos/systemd-confinement: support ProtectSystem=/DynamicUser= 
See https://discourse.nixos.org/t/hardening-systemd-services/17147/14
 2024-05-13 00:40:25 +02:00
Franz PletzandGitHub 0d793f31de Merge pull request #311123 from drawbu/fix-http-parser 2024-05-13 00:37:30 +02:00
Franz PletzandGitHub 70d4cc383a Merge pull request #311154 from TomaSajt/pynac 2024-05-13 00:31:48 +02:00
Franz PletzandGitHub 4fce84a169 Merge pull request #295759 from iynaix/bump-webdataset 2024-05-13 00:30:07 +02:00
Franz PletzandGitHub 6e8d6c46bb Merge pull request #310648 from WilliButz/rename/mm-tools 2024-05-13 00:29:03 +02:00
Martin WeineltandGitHub 7b32ae4b70 Merge pull request #307702 from mweinelt/openvino-2024.1.0 
openvino: 2024.0.0 -> 2024.1.0
 2024-05-13 00:24:31 +02:00
nicooandGitHub 928a3ffb9b Merge #310779: fix ark-pixel-font build 2024-05-12 22:24:23 +00:00
Franz PletzandGitHub ece972dcfd Merge pull request #310532 from kiike/pr/mpg321 2024-05-13 00:23:34 +02:00
Anderson TorresandGitHub 776fc4d63e live555: 2024.04.19 -> 2024.05.05 (#311081) 2024-05-12 22:18:41 +00:00
toastalandGitHub 22e6798099 prosody: bump community modules to d3a72777f149 (#311078) 2024-05-12 22:17:12 +00:00
nixpkgs-merge-bot[bot]andGitHub 0d7de02dab Merge pull request #311034 from r-ryantm/auto-update/ryujinx 
ryujinx: 1.1.1281 -> 1.1.1298
 2024-05-12 22:12:28 +00:00
Weijia WangandGitHub f8cd185b51 Merge pull request #309941 from leona-ya/zhf-cornice 
python3Packages.cornice: fix build and enable tests
 2024-05-13 00:07:51 +02:00
Weijia WangandGitHub 4b9a67d8b8 Merge pull request #311147 from RaghavSood/openethereum/remove 
openethereum: remove
 2024-05-13 00:04:01 +02:00
Weijia WangandGitHub 836306cd7b Merge pull request #311162 from jemand771/fix-python3-chai 
python312Packages.chai: fix python 3.12 build
 2024-05-13 00:02:40 +02:00
Aaron JhengandGitHub debbba4aeb vsce: 2.26.0 -> 2.26.1 (#311071) 2024-05-12 22:00:02 +00:00
TomoandGitHub d8acb61cbe python3Packages.hikari-lightbulb: init at 2.3.5 (#310981) 2024-05-12 21:58:23 +00:00
Jan van EsdonkGitHubJan van Esdonk
 		77b969d2f3 slumber: 1.1.0 -> 1.2.1 (#310994) 
Co-authored-by: Jan van Esdonk <jan+dev@vanesdonk.de>
 2024-05-12 21:57:02 +00:00
Gutyina GergőandGitHub 8509fd4fdb lua-language-server: 3.8.3 -> 3.9.0 (#310908) 2024-05-12 21:55:19 +00:00
Emery HemingwayandGitHub 375146c3a1 alephone: 1.7.1 -> 1.8 (#310862) 2024-05-12 21:50:50 +00:00
Cheng ShaoandGitHub 0aebbee388 HentaiAtHome: 1.6.2 -> 1.6.3 (#311044) 2024-05-12 21:49:23 +00:00
chewblackaandGitHub 00363566e3 docfd: 5.1.0 -> 6.0.0 (#311043) 2024-05-12 21:48:17 +00:00
Priyanshu TripathiandGitHub 42768e4590 atlauncher: 3.4.36.3 -> 3.4.36.4 (#311019) 2024-05-12 21:41:35 +00:00
Karl FischerandGitHub b2646e2b04 vsh: 0.12.2 -> 0.13.0 (#311016) 2024-05-12 21:41:01 +00:00
nicooandGitHub 581aee47b0 Merge #311014: Fix woob 
Closes #310635
 2024-05-12 21:39:10 +00:00
Weijia WangandGitHub 68c9699130 Merge pull request #311108 from 3JlOy-PYCCKUi/anilibria-winmaclinux 
anilibria-winmaclinux: 1.2.16.2 -> 1.2.17
 2024-05-12 23:38:40 +02:00
éclairevoyantandGitHub 98312fb367 Merge pull request #309592 from LamprosPitsillos/init-matugen 
matugen: init at 2.2.0
 2024-05-12 21:34:19 +00:00
éclairevoyant b8e3cf06ee ark-pixel-font: 2024.04.05 -> 2024.05.12 2024-05-12 17:17:00 -04:00
Pol DellaieraandGitHub 7257e9980e Merge pull request #311050 from r-ryantm/auto-update/extremetuxracer 
extremetuxracer: 0.8.3 -> 0.8.4
 2024-05-12 23:04:30 +02:00
Pol DellaieraandGitHub cdf2a8e3bc Merge pull request #311053 from r-ryantm/auto-update/python311Packages.gdown 
python311Packages.gdown: 5.1.0 -> 5.2.0
 2024-05-12 23:04:12 +02:00
Pol DellaieraandGitHub 6c1e15a8a0 Merge pull request #311065 from r-ryantm/auto-update/novops 
novops: 0.14.0 -> 0.15.0
 2024-05-12 23:04:03 +02:00
Pol DellaieraandGitHub 34a91b1bfe Merge pull request #311067 from r-ryantm/auto-update/pipe-viewer 
pipe-viewer: 0.5.0 -> 0.5.1
 2024-05-12 23:03:54 +02:00
Doron BeharandGitHub a894e58cd0 Merge pull request #311092 from r-ryantm/auto-update/url-parser 
url-parser: 2.0.3 -> 2.0.4
 2024-05-12 23:56:19 +03:00
Jade LovelaceandGitHub 553dab119b Merge pull request #311158 from lf-/jade/remove-outdated-maintainership 
nixos: remove historical maintainership of modules by eelco
 2024-05-12 13:26:25 -07:00
Franz PletzandGitHub ef26d99b37 Merge pull request #310873 from ivan/radvd-debuglevel 
nixos/radvd: add debugLevel option
 2024-05-12 22:23:24 +02:00
Pol DellaieraandGitHub 378c5c67ed Merge pull request #310348 from ehmry/nginx-validateConfigFile 
nixos/nginx: add validateConfigFile option
 2024-05-12 21:58:59 +02:00
José Romildo MalaquiasandGitHub 88a9731a52 Merge pull request #311077 from romildo/upd.lxqt-openssh-askpass 
lxqt.lxqt-openssh-askpass: 2.0.0 -> 2.0.1
 2024-05-12 16:58:26 -03:00
Yaya b91ac4c903 electron-source.electron_30: 30.0.2 -> 30.0.3 
- Changelog: https://github.com/electron/electron/releases/tag/v30.0.3
- Diff: https://github.com/electron/electron/compare/refs/tags/v30.0.2...v30.0.3
 2024-05-12 21:57:24 +02:00
Yaya ca3b579b8a electron-source.electron_29: 29.3.2 -> 29.3.3 
- Changelog: https://github.com/electron/electron/releases/tag/v29.3.3
- Diff: https://github.com/electron/electron/compare/refs/tags/v29.3.2...v29.3.3
- Fixes CVE-2024-3914
- Fixes CVE-2024-4558
 2024-05-12 21:57:24 +02:00
Yaya d189975761 electron_30-bin: 30.0.2 -> 30.0.3 
- Changelog: https://github.com/electron/electron/releases/tag/v30.0.3
- Diff: https://github.com/electron/electron/compare/refs/tags/v30.0.2...v30.0.3
 2024-05-12 21:57:24 +02:00
Yaya dd6f51c6f0 electron_29-bin: 29.3.2 -> 29.3.3 
- Changelog: https://github.com/electron/electron/releases/tag/v29.3.3
- Diff: https://github.com/electron/electron/compare/refs/tags/v29.3.2...v29.3.3
- Fixes CVE-2024-3914
- Fixes CVE-2024-4558
 2024-05-12 21:57:24 +02:00
Willy b11a9b32ca python312Packages.chai: fix python 3.12 build 
assertXYZ methods with the "s" suffix were removed in python 3.12, patch until fixed upstream
 2024-05-12 21:53:13 +02:00
Pol DellaieraandGitHub 9a005b76bc Merge pull request #310966 from r-ryantm/auto-update/git-cliff 
git-cliff: 2.2.1 -> 2.2.2
 2024-05-12 21:52:35 +02:00
Weijia WangandGitHub 4433bbfd2a Merge pull request #304773 from acid-bong/no-libs 
treewide: remove file-wide `with lib;` uses in nixos/modules/programs
 2024-05-12 21:52:15 +02:00
Pol DellaieraandGitHub 7047535b1c Merge pull request #310997 from annaleeleaves/tkdiff-update 
tkdiff: 5.6 -> 5.7
 2024-05-12 21:52:07 +02:00
Pol DellaieraandGitHub 1975585d10 Merge pull request #311000 from r-ryantm/auto-update/aide 
aide: 0.18.7 -> 0.18.8
 2024-05-12 21:51:46 +02:00
Martin WeineltandGitHub ccd7733a80 Merge pull request #311153 from uvNikita/hass/waste_collection_schedule 
home-assistant-custom-components.waste_collection_schedule: 1.44.0 -> 1.48.0
 2024-05-12 21:51:27 +02:00
Pol DellaieraandGitHub 6d30070d95 Merge pull request #311100 from jrick/libressl_3_9_2 
libressl: 3.9.1 -> 3.9.2
 2024-05-12 21:50:39 +02:00