From f047e4357b4f7ad66c2e476506bf35cab82e441e Mon Sep 17 00:00:00 2001
From: Alois Wohlschlager <alois1@gmx-topmail.de>
Date: Wed, 8 May 2024 19:15:00 +0200
Subject: libstore/build: always enable seccomp filtering and no-new-privileges

Seccomp filtering and the no-new-privileges functionality improve the security
of the sandbox, and have been enabled by default for a long time. In
https://git.lix.systems/lix-project/lix/issues/265 it was decided that they
should be enabled unconditionally. Accordingly, remove the allow-new-privileges
(which had weird behavior anyway) and filter-syscall settings, and force the
security features on. Syscall filtering can still be enabled at build time to
support building on architectures libseccomp doesn't support.

Change-Id: Iedbfa18d720ae557dee07a24f69b2520f30119cb
---
 tests/nixos/no-new-privileges/no-sandbox.nix | 21 +++++++++++++++++++++
 tests/nixos/no-new-privileges/package.nix    |  8 ++++++++
 tests/nixos/no-new-privileges/sandbox.nix    | 18 ++++++++++++++++++
 3 files changed, 47 insertions(+)
 create mode 100644 tests/nixos/no-new-privileges/no-sandbox.nix
 create mode 100644 tests/nixos/no-new-privileges/package.nix
 create mode 100644 tests/nixos/no-new-privileges/sandbox.nix

(limited to 'tests/nixos/no-new-privileges')

diff --git a/tests/nixos/no-new-privileges/no-sandbox.nix b/tests/nixos/no-new-privileges/no-sandbox.nix
new file mode 100644
index 000000000..d952a6862
--- /dev/null
+++ b/tests/nixos/no-new-privileges/no-sandbox.nix
@@ -0,0 +1,21 @@
+let
+  inherit (import ../util.nix) mkNixBuildTest;
+in
+mkNixBuildTest {
+  name = "no-new-privileges-outside-sandbox";
+  extraMachineConfig =
+    { pkgs, ... }:
+    {
+      security.wrappers.ohno = {
+        owner = "root";
+        group = "root";
+        capabilities = "cap_sys_nice=eip";
+        source = "${pkgs.libcap}/bin/getpcaps";
+      };
+      nix.settings = {
+        extra-sandbox-paths = [ "/run/wrappers/bin/ohno" ];
+        sandbox = false;
+      };
+    };
+  expressionFile = ./package.nix;
+}
diff --git a/tests/nixos/no-new-privileges/package.nix b/tests/nixos/no-new-privileges/package.nix
new file mode 100644
index 000000000..55c96bc2e
--- /dev/null
+++ b/tests/nixos/no-new-privileges/package.nix
@@ -0,0 +1,8 @@
+{ runCommand, libcap }:
+runCommand "cant-get-capabilities" { nativeBuildInputs = [ libcap.out ]; } ''
+  if [ "$(/run/wrappers/bin/ohno 2>&1)" != "failed to inherit capabilities: Operation not permitted" ]; then
+    echo "Oh no! We gained capabilities!"
+    exit 1
+  fi
+  touch $out
+''
diff --git a/tests/nixos/no-new-privileges/sandbox.nix b/tests/nixos/no-new-privileges/sandbox.nix
new file mode 100644
index 000000000..e2475555e
--- /dev/null
+++ b/tests/nixos/no-new-privileges/sandbox.nix
@@ -0,0 +1,18 @@
+let
+  inherit (import ../util.nix) mkNixBuildTest;
+in
+mkNixBuildTest {
+  name = "no-new-privileges-in-sandbox";
+  extraMachineConfig =
+    { pkgs, ... }:
+    {
+      security.wrappers.ohno = {
+        owner = "root";
+        group = "root";
+        capabilities = "cap_sys_nice=eip";
+        source = "${pkgs.libcap}/bin/getpcaps";
+      };
+      nix.settings.extra-sandbox-paths = [ "/run/wrappers/bin/ohno" ];
+    };
+  expressionFile = ./package.nix;
+}
-- 
cgit v1.2.3