nixos/opensnitch: Add support for EPBF process monitor

Co-authored-by: Slime90
This commit is contained in:
Jonas Heinrich 2023-05-03 10:43:17 +02:00 committed by Yt
parent 821e188af5
commit c5f4a46036
5 changed files with 76 additions and 6 deletions

View file

@ -174,6 +174,8 @@
- `services.fail2ban.jails` can now be configured with attribute sets defining settings and filters instead of lines. The stringed options `daemonConfig` and `extraSettings` have respectively been replaced by `daemonSettings` and `jails.DEFAULT.settings` which use attribute sets.
- The application firewall `opensnitch` now uses the process monitor method eBPF as default as recommended by upstream. The method can be changed with the setting [services.opensnitch.settings.ProcMonitorMethod](#opt-services.opensnitch.settings.ProcMonitorMethod).
- The module [services.ankisyncd](#opt-services.ankisyncd.package) has been switched to [anki-sync-server-rs](https://github.com/ankicommunity/anki-sync-server-rs) from the old python version, which was difficult to update, had not been updated in a while, and did not support recent versions of anki.
Unfortunately all servers supporting new clients (newer version of anki-sync-server, anki's built in sync server and this new rust package) do not support the older sync protocol that was used in the old server, so such old clients will also need updating and in particular the anki package in nixpkgs is also being updated in this release.
The module update takes care of the new config syntax and the data itself (user login and cards) are compatible, so users of the module will be able to just log in again after updating both client and server without any extra action.

View file

@ -147,7 +147,7 @@ in {
config = mkIf cfg.enable {
# pkg.opensnitch is referred to elsewhere in the module so we don't need to worry about it being garbage collected
services.opensnitch.settings = mapAttrs (_: v: mkDefault v) (builtins.fromJSON (builtins.unsafeDiscardStringContext (builtins.readFile "${pkgs.opensnitch}/etc/default-config.json")));
services.opensnitch.settings = mapAttrs (_: v: mkDefault v) (builtins.fromJSON (builtins.unsafeDiscardStringContext (builtins.readFile "${pkgs.opensnitch}/etc/opensnitchd/default-config.json")));
systemd = {
packages = [ pkgs.opensnitch ];
@ -171,9 +171,19 @@ in {
${concatMapStrings ({ file, local }: ''
ln -sf '${file}' "${local}"
'') rules}
if [ ! -f /etc/opensnitch-system-fw.json ]; then
cp "${pkgs.opensnitch}/etc/opensnitchd/system-fw.json" "/etc/opensnitchd/system-fw.json"
fi
'');
environment.etc."opensnitchd/default-config.json".source = format.generate "default-config.json" cfg.settings;
environment.etc = mkMerge [ ({
"opensnitchd/default-config.json".source = format.generate "default-config.json" cfg.settings;
}) (mkIf (cfg.settings.ProcMonitorMethod == "ebpf") {
"opensnitchd/opensnitch.o".source = "${config.boot.kernelPackages.opensnitch-ebpf}/etc/opensnitchd/opensnitch.o";
"opensnitchd/opensnitch-dns.o".source = "${config.boot.kernelPackages.opensnitch-ebpf}/etc/opensnitchd/opensnitch-dns.o";
"opensnitchd/opensnitch-procs.o".source = "${config.boot.kernelPackages.opensnitch-ebpf}/etc/opensnitchd/opensnitch-procs.o";
})];
};
}

View file

@ -0,0 +1,58 @@
{ lib
, kernel
, stdenv
, clang-tools
, llvmPackages
, elfutils
, flex
, bison
, bc
, opensnitch
}:
stdenv.mkDerivation rec {
pname = "opensnitch_ebpf";
version = "${opensnitch.version}-${kernel.version}";
inherit (opensnitch) src;
sourceRoot = "source/ebpf_prog";
nativeBuildInputs = with llvmPackages; [
bc
bison
clang
clang-tools
elfutils
flex
libllvm
];
# We set -fno-stack-protector here to work around a clang regression.
# This is fine - bpf programs do not use stack protectors
# https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=opensnitch-ebpf-module&id=984b952a784eb701f691dd9f2d45dfeb8d15053b
env.NIX_CFLAGS_COMPILE = "-fno-stack-protector";
env.KERNEL_DIR="${kernel.dev}/lib/modules/${kernel.modDirVersion}/source";
env.KERNEL_HEADERS="${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
extraConfig =''
CONFIG_UPROBE_EVENTS=y
'';
installPhase = ''
runHook preInstall
for file in opensnitch*.o; do
install -Dm644 "$file" "$out/etc/opensnitchd/$file"
done
runHook postInstall
'';
meta = with lib; {
description = "eBPF process monitor module for OpenSnitch";
homepage = "https://github.com/evilsocket/opensnitch";
license = licenses.gpl3Only;
maintainers = with maintainers; [ onny ];
platforms = platforms.linux;
};
}

View file

@ -56,10 +56,8 @@ buildGoModule rec {
mv $GOPATH/bin/daemon $GOPATH/bin/opensnitchd
mkdir -p $out/etc/opensnitchd $out/lib/systemd/system
cp system-fw.json $out/etc/opensnitchd/
substitute default-config.json $out/etc/default-config.json \
--replace "/var/log/opensnitchd.log" "/dev/stdout" \
--replace "iptables" "nftables" \
--replace "ebpf" "proc"
substitute default-config.json $out/etc/opensnitchd/default-config.json \
--replace "/var/log/opensnitchd.log" "/dev/stdout"
substitute opensnitchd.service $out/lib/systemd/system/opensnitchd.service \
--replace "/usr/local/bin/opensnitchd" "$out/bin/opensnitchd" \
--replace "/etc/opensnitchd/rules" "/var/lib/opensnitch/rules" \

View file

@ -450,6 +450,8 @@ in {
# Current stable release; don't backport release updates!
openafs = openafs_1_8;
opensnitch-ebpf = if lib.versionAtLeast kernel.version "5.10" then callPackage ../os-specific/linux/opensnitch-ebpf { } else null;
facetimehd = callPackage ../os-specific/linux/facetimehd { };
tuxedo-keyboard = if lib.versionAtLeast kernel.version "4.14" then callPackage ../os-specific/linux/tuxedo-keyboard { } else null;