tjh.dev
nixpkgs mirror (for testing)
github.com/NixOS/nixpkgs
nix
1commit 58bdfa7ef92ba07dc41a07aeef6d790ecd8f888c
2Author: kuflierl <41301536+kuflierl@users.noreply.github.com>
3Date: Sat May 3 21:02:26 2025 +0200
4
5 fix(tests): add support for nix-build-system for tests
6
7diff --git a/src/systemd/resolver.rs b/src/systemd/resolver.rs
8index e2abbb7..1151592 100644
9--- a/src/systemd/resolver.rs
10+++ b/src/systemd/resolver.rs
11@@ -637,17 +637,14 @@ mod tests {
12 let OptionValue::List(opt_list) = &candidates[0].value else {
13 panic!();
14 };
15- assert!(opt_list.values.contains(&"/boot".to_owned()));
16+ // information gathering
17+ // eprint!("{}\n", &candidates[0].to_string());
18 assert!(opt_list.values.contains(&"/dev".to_owned()));
19 assert!(opt_list.values.contains(&"/etc".to_owned()));
20- assert!(opt_list.values.contains(&"/home".to_owned()));
21- assert!(opt_list.values.contains(&"/root".to_owned()));
22- assert!(opt_list.values.contains(&"/sys".to_owned()));
23+ assert!(opt_list.values.contains(&"/nix".to_owned()));
24+ assert!(opt_list.values.contains(&"/bin".to_owned()));
25+ assert!(opt_list.values.contains(&"/build".to_owned()));
26 assert!(opt_list.values.contains(&"/tmp".to_owned()));
27- assert!(opt_list.values.contains(&"/usr".to_owned()));
28- assert!(opt_list.values.contains(&"/var".to_owned()));
29- assert!(!opt_list.values.contains(&"/proc".to_owned()));
30- assert!(!opt_list.values.contains(&"/run".to_owned()));
31
32 let actions = vec![ProgramAction::Read("/var/data".into())];
33 let candidates = resolve(&opts, &actions, &hardening_opts);
34diff --git a/tests/options.rs b/tests/options.rs
35index 835ee14..a9c9973 100644
36--- a/tests/options.rs
37+++ b/tests/options.rs
38@@ -24,7 +24,7 @@ fn run_true() {
39 .assert()
40 .success()
41 .stdout(predicate::str::contains("ProtectSystem=strict\n").count(1))
42- .stdout(if Uid::effective().is_root() {
43+ .stdout(if Uid::effective().is_root() || !env::current_exe().unwrap().starts_with("/home") {
44 BoxPredicate::new(predicate::str::contains("ProtectHome=true\n").count(1))
45 } else {
46 BoxPredicate::new(predicate::str::contains("ProtectHome=").not())
47@@ -50,7 +50,7 @@ fn run_true() {
48 .stdout(predicate::str::contains("LockPersonality=true\n").count(1))
49 .stdout(predicate::str::contains("RestrictRealtime=true\n").count(1))
50 .stdout(predicate::str::contains("ProtectClock=true\n").count(1))
51- .stdout(predicate::str::contains("SystemCallFilter=~@aio:EPERM @chown:EPERM @clock:EPERM @cpu-emulation:EPERM @debug:EPERM @io-event:EPERM @ipc:EPERM @keyring:EPERM @memlock:EPERM @module:EPERM @mount:EPERM @network-io:EPERM @obsolete:EPERM @pkey:EPERM @privileged:EPERM @process:EPERM @raw-io:EPERM @reboot:EPERM @resources:EPERM @sandbox:EPERM @setuid:EPERM @signal:EPERM @swap:EPERM @sync:EPERM @timer:EPERM\n").count(1))
52+ .stdout(predicate::str::contains("SystemCallFilter=~@aio:EPERM @chown:EPERM @clock:EPERM @cpu-emulation:EPERM @debug:EPERM @io-event:EPERM @ipc:EPERM @keyring:EPERM @memlock:EPERM @module:EPERM @mount:EPERM @network-io:EPERM @obsolete:EPERM @pkey:EPERM @privileged:EPERM @raw-io:EPERM @reboot:EPERM @resources:EPERM @sandbox:EPERM @setuid:EPERM @signal:EPERM @swap:EPERM @sync:EPERM @timer:EPERM\n").count(1))
53 .stdout(predicate::str::contains("CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_BPF CAP_CHOWN CAP_MKNOD CAP_NET_RAW CAP_PERFMON CAP_SYS_BOOT CAP_SYS_CHROOT CAP_SYS_MODULE CAP_SYS_NICE CAP_SYS_PACCT CAP_SYS_PTRACE CAP_SYS_TIME CAP_SYS_TTY_CONFIG CAP_SYSLOG CAP_WAKE_ALARM\n").count(1));
54 }
55
56@@ -97,7 +97,7 @@ fn run_ls_dev() {
57 .assert()
58 .success()
59 .stdout(predicate::str::contains("ProtectSystem=strict\n").count(1))
60- .stdout(if Uid::effective().is_root() {
61+ .stdout(if Uid::effective().is_root() || !env::current_exe().unwrap().starts_with("/home") {
62 BoxPredicate::new(predicate::str::contains("ProtectHome=true\n").count(1))
63 } else {
64 BoxPredicate::new(predicate::str::contains("ProtectHome=").not())
65@@ -130,12 +130,12 @@ fn run_ls_dev() {
66 fn run_ls_proc() {
67 Command::cargo_bin("shh")
68 .unwrap()
69- .args(["run", "--", "busybox", "ls", "/proc/1/"])
70+ .args(["run", "--", "ls", "/proc/1/"])
71 .unwrap()
72 .assert()
73 .success()
74 .stdout(predicate::str::contains("ProtectSystem=strict\n").count(1))
75- .stdout(if Uid::effective().is_root() {
76+ .stdout(if Uid::effective().is_root() || !env::current_exe().unwrap().starts_with("/home") {
77 BoxPredicate::new(predicate::str::contains("ProtectHome=true\n").count(1))
78 } else {
79 BoxPredicate::new(predicate::str::contains("ProtectHome=").not())
80@@ -166,7 +166,7 @@ fn run_ls_proc() {
81 .assert()
82 .success()
83 .stdout(predicate::str::contains("ProtectSystem=strict\n").count(1))
84- .stdout(if Uid::effective().is_root() {
85+ .stdout(if Uid::effective().is_root() || !env::current_exe().unwrap().starts_with("/home") {
86 BoxPredicate::new(predicate::str::contains("ProtectHome=true\n").count(1))
87 } else {
88 BoxPredicate::new(predicate::str::contains("ProtectHome=").not())
89@@ -188,7 +188,7 @@ fn run_ls_proc() {
90 .stdout(predicate::str::contains("LockPersonality=true\n").count(1))
91 .stdout(predicate::str::contains("RestrictRealtime=true\n").count(1))
92 .stdout(predicate::str::contains("ProtectClock=true\n").count(1))
93- .stdout(predicate::str::contains("SystemCallFilter=~@aio:EPERM @chown:EPERM @clock:EPERM @cpu-emulation:EPERM @debug:EPERM @io-event:EPERM @ipc:EPERM @keyring:EPERM @memlock:EPERM @module:EPERM @mount:EPERM @network-io:EPERM @obsolete:EPERM @pkey:EPERM @privileged:EPERM @process:EPERM @raw-io:EPERM @reboot:EPERM @resources:EPERM @sandbox:EPERM @setuid:EPERM @signal:EPERM @swap:EPERM @sync:EPERM @timer:EPERM\n").count(1))
94+ .stdout(predicate::str::contains("SystemCallFilter=~@aio:EPERM @chown:EPERM @clock:EPERM @cpu-emulation:EPERM @debug:EPERM @io-event:EPERM @ipc:EPERM @keyring:EPERM @memlock:EPERM @module:EPERM @mount:EPERM @network-io:EPERM @obsolete:EPERM @pkey:EPERM @privileged:EPERM @raw-io:EPERM @reboot:EPERM @resources:EPERM @sandbox:EPERM @setuid:EPERM @signal:EPERM @swap:EPERM @sync:EPERM @timer:EPERM\n").count(1))
95 .stdout(predicate::str::contains("CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_BPF CAP_CHOWN CAP_MKNOD CAP_NET_RAW CAP_PERFMON CAP_SYS_BOOT CAP_SYS_CHROOT CAP_SYS_MODULE CAP_SYS_NICE CAP_SYS_PACCT CAP_SYS_PTRACE CAP_SYS_TIME CAP_SYS_TTY_CONFIG CAP_SYSLOG CAP_WAKE_ALARM\n").count(1));
96 }
97
98@@ -201,7 +201,7 @@ fn run_read_kallsyms() {
99 .assert()
100 .success()
101 .stdout(predicate::str::contains("ProtectSystem=strict\n").count(1))
102- .stdout(if Uid::effective().is_root() {
103+ .stdout(if Uid::effective().is_root() || !env::current_exe().unwrap().starts_with("/home") {
104 BoxPredicate::new(predicate::str::contains("ProtectHome=true\n").count(1))
105 } else {
106 BoxPredicate::new(predicate::str::contains("ProtectHome=").not())
107@@ -227,7 +227,7 @@ fn run_read_kallsyms() {
108 .stdout(predicate::str::contains("LockPersonality=true\n").count(1))
109 .stdout(predicate::str::contains("RestrictRealtime=true\n").count(1))
110 .stdout(predicate::str::contains("ProtectClock=true\n").count(1))
111- .stdout(predicate::str::contains("SystemCallFilter=~@aio:EPERM @chown:EPERM @clock:EPERM @cpu-emulation:EPERM @debug:EPERM @io-event:EPERM @ipc:EPERM @keyring:EPERM @memlock:EPERM @module:EPERM @mount:EPERM @network-io:EPERM @obsolete:EPERM @pkey:EPERM @privileged:EPERM @process:EPERM @raw-io:EPERM @reboot:EPERM @resources:EPERM @sandbox:EPERM @setuid:EPERM @signal:EPERM @swap:EPERM @sync:EPERM @timer:EPERM\n").count(1))
112+ .stdout(predicate::str::contains("SystemCallFilter=~@aio:EPERM @chown:EPERM @clock:EPERM @cpu-emulation:EPERM @debug:EPERM @io-event:EPERM @ipc:EPERM @keyring:EPERM @memlock:EPERM @module:EPERM @mount:EPERM @network-io:EPERM @obsolete:EPERM @pkey:EPERM @privileged:EPERM @raw-io:EPERM @reboot:EPERM @resources:EPERM @sandbox:EPERM @setuid:EPERM @signal:EPERM @swap:EPERM @sync:EPERM @timer:EPERM\n").count(1))
113 .stdout(predicate::str::contains("CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_BPF CAP_CHOWN CAP_MKNOD CAP_NET_RAW CAP_PERFMON CAP_SYS_BOOT CAP_SYS_CHROOT CAP_SYS_MODULE CAP_SYS_NICE CAP_SYS_PACCT CAP_SYS_PTRACE CAP_SYS_TIME CAP_SYS_TTY_CONFIG CAP_SYSLOG CAP_WAKE_ALARM\n").count(1));
114 }
115
116@@ -344,6 +344,7 @@ fn run_systemctl() {
117 .stdout(predicate::str::contains("CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_BPF CAP_CHOWN CAP_MKNOD CAP_NET_RAW CAP_PERFMON CAP_SYS_BOOT CAP_SYS_CHROOT CAP_SYS_MODULE CAP_SYS_NICE CAP_SYS_PACCT CAP_SYS_PTRACE CAP_SYS_TIME CAP_SYS_TTY_CONFIG CAP_SYSLOG CAP_WAKE_ALARM\n").count(1));
118 }
119
120+// patched due to nix build isolation
121 #[test]
122 fn run_ss() {
123 Command::cargo_bin("shh")
124@@ -353,7 +354,7 @@ fn run_ss() {
125 .assert()
126 .success()
127 .stdout(predicate::str::contains("ProtectSystem=strict\n").count(1))
128- .stdout(if Uid::effective().is_root() {
129+ .stdout(if Uid::effective().is_root() || !env::current_exe().unwrap().starts_with("/home") {
130 BoxPredicate::new(predicate::str::contains("ProtectHome=true\n").count(1))
131 } else {
132 BoxPredicate::new(predicate::str::contains("ProtectHome=").not())
133@@ -369,7 +370,7 @@ fn run_ss() {
134 .stdout(predicate::str::contains("ProtectKernelModules=true\n").count(1))
135 .stdout(predicate::str::contains("ProtectKernelLogs=true\n").count(1))
136 .stdout(predicate::str::contains("ProtectControlGroups=true\n").count(1))
137- .stdout(predicate::str::contains("ProtectProc=").not())
138+ //.stdout(predicate::str::contains("ProtectProc=").not())
139 .stdout(predicate::str::contains("MemoryDenyWriteExecute=true\n").count(1))
140 .stdout(predicate::str::contains("RestrictAddressFamilies=AF_NETLINK AF_UNIX\n").count(1).or(predicate::str::contains("RestrictAddressFamilies=AF_NETLINK\n").count(1)))
141 .stdout(predicate::str::contains("SocketBindDeny=ipv4:tcp\n").count(1))
142@@ -379,7 +380,7 @@ fn run_ss() {
143 .stdout(predicate::str::contains("LockPersonality=true\n").count(1))
144 .stdout(predicate::str::contains("RestrictRealtime=true\n").count(1))
145 .stdout(predicate::str::contains("ProtectClock=true\n").count(1))
146- .stdout(predicate::str::contains("SystemCallFilter=~@aio:EPERM @chown:EPERM @clock:EPERM @cpu-emulation:EPERM @debug:EPERM @io-event:EPERM @ipc:EPERM @keyring:EPERM @memlock:EPERM @module:EPERM @mount:EPERM @obsolete:EPERM @pkey:EPERM @privileged:EPERM @raw-io:EPERM @reboot:EPERM @resources:EPERM @sandbox:EPERM @setuid:EPERM @signal:EPERM @swap:EPERM @sync:EPERM @timer:EPERM\n").count(1))
147+ .stdout(predicate::str::contains("SystemCallFilter=~@aio:EPERM @chown:EPERM @clock:EPERM @cpu-emulation:EPERM @debug:EPERM @io-event:EPERM @ipc:EPERM @keyring:EPERM @memlock:EPERM @module:EPERM @mount:EPERM @obsolete:EPERM @pkey:EPERM @privileged:EPERM @process:EPERM @raw-io:EPERM @reboot:EPERM @resources:EPERM @sandbox:EPERM @setuid:EPERM @signal:EPERM @swap:EPERM @sync:EPERM @timer:EPERM\n").count(1))
148 .stdout(predicate::str::contains("CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_BPF CAP_CHOWN CAP_MKNOD CAP_NET_RAW CAP_PERFMON CAP_SYS_BOOT CAP_SYS_CHROOT CAP_SYS_MODULE CAP_SYS_NICE CAP_SYS_PACCT CAP_SYS_PTRACE CAP_SYS_TIME CAP_SYS_TTY_CONFIG CAP_SYSLOG CAP_WAKE_ALARM\n").count(1));
149 }
150