colin/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/tests/hardened: fix test (#40745)

Browse Source 
failed because `pgrep -u` segfaults when accesss to proc info
is denied on a hardened system.
This commit is contained in:
xeji 2018-05-19 08:42:15 +02:00 committed by Robert Schütz
parent 93a5152c82
commit 301072dc27
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
nixos/tests/hardened.nix
View File

@ -25,16 +25,18 @@ import ./make-test.nix ({ pkgs, ...} : {
testScript =
''
$machine->waitForUnit("multi-user.target");
# Test hidepid
subtest "hidepid", sub {
$machine->succeed("grep -Fq hidepid=2 /proc/mounts");
$machine->succeed("[ `su - sybil -c 'pgrep -c -u root'` = 0 ]");
$machine->succeed("[ `su - alice -c 'pgrep -c -u root'` != 0 ]");
# cannot use pgrep -u here, it segfaults when access to process info is denied
$machine->succeed("[ `su - sybil -c 'ps --no-headers --user root | wc -l'` = 0 ]");
$machine->succeed("[ `su - alice -c 'ps --no-headers --user root | wc -l'` != 0 ]");
};
# Test kernel module hardening
subtest "lock-modules", sub {
$machine->waitForUnit("multi-user.target");
# note: this better a be module we normally wouldn't load ...
$machine->fail("modprobe dccp");
};