2021-09-22 09:06:17 +00:00
|
|
|
import ./make-test-python.nix ({ pkgs, ... } : {
|
2017-04-30 06:38:47 +00:00
|
|
|
name = "hardened";
|
2021-01-10 19:08:30 +00:00
|
|
|
meta = with pkgs.lib.maintainers; {
|
2017-04-30 06:38:47 +00:00
|
|
|
maintainers = [ joachifm ];
|
|
|
|
};
|
|
|
|
|
2022-03-20 23:15:30 +00:00
|
|
|
nodes.machine =
|
2019-01-06 12:17:38 +00:00
|
|
|
{ lib, pkgs, config, ... }:
|
2017-04-30 06:38:47 +00:00
|
|
|
with lib;
|
|
|
|
{ users.users.alice = { isNormalUser = true; extraGroups = [ "proc" ]; };
|
|
|
|
users.users.sybil = { isNormalUser = true; group = "wheel"; };
|
|
|
|
imports = [ ../modules/profiles/hardened.nix ];
|
2019-09-18 13:34:56 +00:00
|
|
|
environment.memoryAllocator.provider = "graphene-hardened";
|
2021-11-19 22:36:26 +00:00
|
|
|
nix.settings.sandbox = false;
|
2022-07-08 16:48:51 +00:00
|
|
|
nixpkgs.overlays = [
|
|
|
|
(final: super: {
|
|
|
|
dhcpcd = super.dhcpcd.override { enablePrivSep = false; };
|
|
|
|
})
|
|
|
|
];
|
2017-09-22 21:20:42 +00:00
|
|
|
virtualisation.emptyDiskImages = [ 4096 ];
|
|
|
|
boot.initrd.postDeviceCommands = ''
|
|
|
|
${pkgs.dosfstools}/bin/mkfs.vfat -n EFISYS /dev/vdb
|
|
|
|
'';
|
2021-02-14 11:23:50 +00:00
|
|
|
virtualisation.fileSystems = {
|
2017-09-22 21:20:42 +00:00
|
|
|
"/efi" = {
|
|
|
|
device = "/dev/disk/by-label/EFISYS";
|
|
|
|
fsType = "vfat";
|
|
|
|
options = [ "noauto" ];
|
|
|
|
};
|
|
|
|
};
|
2020-04-04 23:29:24 +00:00
|
|
|
boot.extraModulePackages =
|
|
|
|
optional (versionOlder config.boot.kernelPackages.kernel.version "5.6")
|
|
|
|
config.boot.kernelPackages.wireguard;
|
2019-01-06 12:17:38 +00:00
|
|
|
boot.kernelModules = [ "wireguard" ];
|
2017-04-30 06:38:47 +00:00
|
|
|
};
|
|
|
|
|
|
|
|
testScript =
|
2019-04-23 20:24:16 +00:00
|
|
|
let
|
2021-08-11 21:35:27 +00:00
|
|
|
hardened-malloc-tests = pkgs.graphene-hardened-malloc.ld-preload-tests;
|
2019-04-23 20:24:16 +00:00
|
|
|
in
|
2017-04-30 06:38:47 +00:00
|
|
|
''
|
2020-08-21 19:29:11 +00:00
|
|
|
machine.wait_for_unit("multi-user.target")
|
|
|
|
|
|
|
|
|
|
|
|
with subtest("AppArmor profiles are loaded"):
|
|
|
|
machine.succeed("systemctl status apparmor.service")
|
2018-05-19 06:42:15 +00:00
|
|
|
|
2019-05-11 16:20:41 +00:00
|
|
|
|
|
|
|
# AppArmor securityfs
|
2020-08-21 19:29:11 +00:00
|
|
|
with subtest("AppArmor securityfs is mounted"):
|
|
|
|
machine.succeed("mountpoint -q /sys/kernel/security")
|
|
|
|
machine.succeed("cat /sys/kernel/security/apparmor/profiles")
|
|
|
|
|
2019-05-11 16:20:41 +00:00
|
|
|
|
2019-01-06 12:17:38 +00:00
|
|
|
# Test loading out-of-tree modules
|
2020-08-21 19:29:11 +00:00
|
|
|
with subtest("Out-of-tree modules can be loaded"):
|
|
|
|
machine.succeed("grep -Fq wireguard /proc/modules")
|
|
|
|
|
2019-01-06 12:17:38 +00:00
|
|
|
|
2017-04-30 06:38:47 +00:00
|
|
|
# Test kernel module hardening
|
2020-08-21 19:29:11 +00:00
|
|
|
with subtest("No more kernel modules can be loaded"):
|
2017-04-30 06:38:47 +00:00
|
|
|
# note: this better a be module we normally wouldn't load ...
|
2021-09-19 10:02:24 +00:00
|
|
|
machine.wait_for_unit("disable-kernel-module-loading.service")
|
2020-08-21 19:29:11 +00:00
|
|
|
machine.fail("modprobe dccp")
|
|
|
|
|
2017-04-30 12:41:56 +00:00
|
|
|
|
|
|
|
# Test userns
|
2020-08-21 19:29:11 +00:00
|
|
|
with subtest("User namespaces are restricted"):
|
|
|
|
machine.succeed("unshare --user true")
|
|
|
|
machine.fail("su -l alice -c 'unshare --user true'")
|
|
|
|
|
2017-09-16 09:46:26 +00:00
|
|
|
|
|
|
|
# Test dmesg restriction
|
2020-08-21 19:29:11 +00:00
|
|
|
with subtest("Regular users cannot access dmesg"):
|
|
|
|
machine.fail("su -l alice -c dmesg")
|
|
|
|
|
2017-09-16 09:46:26 +00:00
|
|
|
|
|
|
|
# Test access to kcore
|
2020-08-21 19:29:11 +00:00
|
|
|
with subtest("Kcore is inaccessible as root"):
|
|
|
|
machine.fail("cat /proc/kcore")
|
|
|
|
|
2017-09-22 21:20:42 +00:00
|
|
|
|
|
|
|
# Test deferred mount
|
2020-08-21 19:29:11 +00:00
|
|
|
with subtest("Deferred mounts work"):
|
|
|
|
machine.fail("mountpoint -q /efi") # was deferred
|
|
|
|
machine.execute("mkdir -p /efi")
|
|
|
|
machine.succeed("mount /dev/disk/by-label/EFISYS /efi")
|
|
|
|
machine.succeed("mountpoint -q /efi") # now mounted
|
|
|
|
|
2018-11-24 14:13:03 +00:00
|
|
|
|
|
|
|
# Test Nix dæmon usage
|
2020-08-21 19:29:11 +00:00
|
|
|
with subtest("nix-daemon cannot be used by all users"):
|
|
|
|
machine.fail("su -l nobody -s /bin/sh -c 'nix ping-store'")
|
|
|
|
machine.succeed("su -l alice -c 'nix ping-store'")
|
|
|
|
|
2018-12-16 09:37:36 +00:00
|
|
|
|
|
|
|
# Test kernel image protection
|
2020-08-21 19:29:11 +00:00
|
|
|
with subtest("The kernel image is protected"):
|
|
|
|
machine.fail("systemctl hibernate")
|
|
|
|
machine.fail("systemctl kexec")
|
2019-04-23 20:24:16 +00:00
|
|
|
|
|
|
|
|
2020-08-21 19:29:11 +00:00
|
|
|
with subtest("The hardened memory allocator works"):
|
2021-08-11 21:35:27 +00:00
|
|
|
machine.succeed("${hardened-malloc-tests}/bin/run-tests")
|
2017-04-30 06:38:47 +00:00
|
|
|
'';
|
|
|
|
})
|