libstore/build: always enable seccomp filtering and no-new-privileges

Seccomp filtering and the no-new-privileges functionality improve the security
of the sandbox, and have been enabled by default for a long time. In
https://git.lix.systems/lix-project/lix/issues/265 it was decided that they
should be enabled unconditionally. Accordingly, remove the allow-new-privileges
(which had weird behavior anyway) and filter-syscall settings, and force the
security features on. Syscall filtering can still be enabled at build time to
support building on architectures libseccomp doesn't support.

Change-Id: Iedbfa18d720ae557dee07a24f69b2520f30119cb

6 files changed, 50 insertions, 24 deletions

diff --git a/tests/nixos/default.nix b/tests/nixos/default.nix
index 354413a7c..5e8bc69ce 100644
--- a/tests/nixos/default.nix
+++ b/tests/nixos/default.nix
@@ -184,7 +184,9 @@ in
 
   symlinkResolvconf = runNixOSTestFor "x86_64-linux" ./symlink-resolvconf.nix;
 
-  rootInSandbox = runNixOSTestFor "x86_64-linux" ./root-in-sandbox;
+  noNewPrivilegesInSandbox = runNixOSTestFor "x86_64-linux" ./no-new-privileges/sandbox.nix;
+
+  noNewPrivilegesOutsideSandbox = runNixOSTestFor "x86_64-linux" ./no-new-privileges/no-sandbox.nix;
 
   broken-userns = runNixOSTestFor "x86_64-linux" ./broken-userns.nix;
 
diff --git a/tests/nixos/no-new-privileges/no-sandbox.nix b/tests/nixos/no-new-privileges/no-sandbox.nix
new file mode 100644
index 000000000..d952a6862
--- /dev/null
+++ b/tests/nixos/no-new-privileges/no-sandbox.nix
@@ -0,0 +1,21 @@
+let
+  inherit (import ../util.nix) mkNixBuildTest;
+in
+mkNixBuildTest {
+  name = "no-new-privileges-outside-sandbox";
+  extraMachineConfig =
+    { pkgs, ... }:
+    {
+      security.wrappers.ohno = {
+        owner = "root";
+        group = "root";
+        capabilities = "cap_sys_nice=eip";
+        source = "${pkgs.libcap}/bin/getpcaps";
+      };
+      nix.settings = {
+        extra-sandbox-paths = [ "/run/wrappers/bin/ohno" ];
+        sandbox = false;
+      };
+    };
+  expressionFile = ./package.nix;
+}
diff --git a/tests/nixos/no-new-privileges/package.nix b/tests/nixos/no-new-privileges/package.nix
new file mode 100644
index 000000000..55c96bc2e
--- /dev/null
+++ b/tests/nixos/no-new-privileges/package.nix
@@ -0,0 +1,8 @@
+{ runCommand, libcap }:
+runCommand "cant-get-capabilities" { nativeBuildInputs = [ libcap.out ]; } ''
+  if [ "$(/run/wrappers/bin/ohno 2>&1)" != "failed to inherit capabilities: Operation not permitted" ]; then
+    echo "Oh no! We gained capabilities!"
+    exit 1
+  fi
+  touch $out
+''
diff --git a/tests/nixos/no-new-privileges/sandbox.nix b/tests/nixos/no-new-privileges/sandbox.nix
new file mode 100644
index 000000000..e2475555e
--- /dev/null
+++ b/tests/nixos/no-new-privileges/sandbox.nix
@@ -0,0 +1,18 @@
+let
+  inherit (import ../util.nix) mkNixBuildTest;
+in
+mkNixBuildTest {
+  name = "no-new-privileges-in-sandbox";
+  extraMachineConfig =
+    { pkgs, ... }:
+    {
+      security.wrappers.ohno = {
+        owner = "root";
+        group = "root";
+        capabilities = "cap_sys_nice=eip";
+        source = "${pkgs.libcap}/bin/getpcaps";
+      };
+      nix.settings.extra-sandbox-paths = [ "/run/wrappers/bin/ohno" ];
+    };
+  expressionFile = ./package.nix;
+}
diff --git a/tests/nixos/root-in-sandbox/default.nix b/tests/nixos/root-in-sandbox/default.nix
deleted file mode 100644
index 110d83f86..000000000
--- a/tests/nixos/root-in-sandbox/default.nix
+++ /dev/null
@@ -1,15 +0,0 @@
-let
-  inherit (import ../util.nix) mkNixBuildTest;
-in mkNixBuildTest {
-  name = "root-in-sandbox";
-  extraMachineConfig = { pkgs, ... }: {
-    security.wrappers.ohno = {
-      owner = "root";
-      group = "root";
-      setuid = true;
-      source = "${pkgs.coreutils}/bin/whoami";
-    };
-    nix.settings.extra-sandbox-paths = ["/run/wrappers/bin"];
-  };
-  expressionFile = ./package.nix;
-}
diff --git a/tests/nixos/root-in-sandbox/package.nix b/tests/nixos/root-in-sandbox/package.nix
deleted file mode 100644
index a1069160c..000000000
--- a/tests/nixos/root-in-sandbox/package.nix
+++ /dev/null
@@ -1,8 +0,0 @@
-{ runCommand }:
-runCommand "cant-get-root-in-sandbox" {} ''
-  if /run/wrappers/bin/ohno; then
-    echo "Oh no! We're root in the sandbox!"
-    exit 1
-  fi
-  touch $out
-''