···108 if [ -n "$__ETC_ZSHENV_SOURCED" ]; then return; fi
109 export __ETC_ZSHENV_SOURCED=1
11000111 ${cfge.shellInit}
112113 ${cfg.shellInit}
···126 # Only execute this file once per shell.
127 if [ -n "$__ETC_ZPROFILE_SOURCED" ]; then return; fi
128 __ETC_ZPROFILE_SOURCED=1
129-130- ${config.system.build.setEnvironment.text}
131132 ${cfge.loginShellInit}
133
···108 if [ -n "$__ETC_ZSHENV_SOURCED" ]; then return; fi
109 export __ETC_ZSHENV_SOURCED=1
110111+ ${config.system.build.setEnvironment.text}
112+113 ${cfge.shellInit}
114115 ${cfg.shellInit}
···128 # Only execute this file once per shell.
129 if [ -n "$__ETC_ZPROFILE_SOURCED" ]; then return; fi
130 __ETC_ZPROFILE_SOURCED=1
00131132 ${cfge.loginShellInit}
133
+5-3
nixos/tests/hardened.nix
···2526 testScript =
27 ''
0028 # Test hidepid
29 subtest "hidepid", sub {
30 $machine->succeed("grep -Fq hidepid=2 /proc/mounts");
31- $machine->succeed("[ `su - sybil -c 'pgrep -c -u root'` = 0 ]");
32- $machine->succeed("[ `su - alice -c 'pgrep -c -u root'` != 0 ]");
033 };
3435 # Test kernel module hardening
36 subtest "lock-modules", sub {
37- $machine->waitForUnit("multi-user.target");
38 # note: this better a be module we normally wouldn't load ...
39 $machine->fail("modprobe dccp");
40 };
···2526 testScript =
27 ''
28+ $machine->waitForUnit("multi-user.target");
29+30 # Test hidepid
31 subtest "hidepid", sub {
32 $machine->succeed("grep -Fq hidepid=2 /proc/mounts");
33+ # cannot use pgrep -u here, it segfaults when access to process info is denied
34+ $machine->succeed("[ `su - sybil -c 'ps --no-headers --user root | wc -l'` = 0 ]");
35+ $machine->succeed("[ `su - alice -c 'ps --no-headers --user root | wc -l'` != 0 ]");
36 };
3738 # Test kernel module hardening
39 subtest "lock-modules", sub {
040 # note: this better a be module we normally wouldn't load ...
41 $machine->fail("modprobe dccp");
42 };
···24 meta = with stdenv.lib; {
25 description = "A fast replacement for PGAdmin";
26 longDescription = ''
27- At the heart of Postage is a modern, fast, event-based C-binary, built in
28- the style of NGINX and Node.js. This heart makes Postage as fast as any
29- PostgreSQL interface can hope to be.
030 '';
31 homepage = https://github.com/pgManage/pgManage;
32 license = licenses.postgresql;
···24 meta = with stdenv.lib; {
25 description = "A fast replacement for PGAdmin";
26 longDescription = ''
27+ At the heart of pgManage is a modern, fast, event-based C-binary, built in
28+ the style of NGINX and Node.js. This heart makes pgManage as fast as any
29+ PostgreSQL interface can hope to be. (Note: pgManage replaces Postage,
30+ which is no longer maintained.)
31 '';
32 homepage = https://github.com/pgManage/pgManage;
33 license = licenses.postgresql;