diff options
author | Jörg Thalheim <Mic92@users.noreply.github.com> | 2020-05-13 10:34:02 +0100 |
---|---|---|
committer | GitHub <noreply@github.com> | 2020-05-13 10:34:02 +0100 |
commit | 6c437ef1bb71268feaf0878c93ffda8522a11704 (patch) | |
tree | cbee6f4189efcc1e8beefbc065b08ec05222f880 /nixos/tests | |
parent | 42c85f251da799548a9d0f445b981ee22733d68c (diff) | |
parent | 94391fce1d5c4580482271c2b49ecffdef38b017 (diff) | |
download | nixlib-6c437ef1bb71268feaf0878c93ffda8522a11704.tar nixlib-6c437ef1bb71268feaf0878c93ffda8522a11704.tar.gz nixlib-6c437ef1bb71268feaf0878c93ffda8522a11704.tar.bz2 nixlib-6c437ef1bb71268feaf0878c93ffda8522a11704.tar.lz nixlib-6c437ef1bb71268feaf0878c93ffda8522a11704.tar.xz nixlib-6c437ef1bb71268feaf0878c93ffda8522a11704.tar.zst nixlib-6c437ef1bb71268feaf0878c93ffda8522a11704.zip |
Merge pull request #85567 from Izorkin/nginx-sandbox
Diffstat (limited to 'nixos/tests')
-rw-r--r-- | nixos/tests/all-tests.nix | 1 | ||||
-rw-r--r-- | nixos/tests/nginx-pubhtml.nix | 1 | ||||
-rw-r--r-- | nixos/tests/nginx-sandbox.nix | 66 |
3 files changed, 68 insertions, 0 deletions
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index 4190f70eeee9..f3e90f9bfa70 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -225,6 +225,7 @@ in nginx = handleTest ./nginx.nix {}; nginx-etag = handleTest ./nginx-etag.nix {}; nginx-pubhtml = handleTest ./nginx-pubhtml.nix {}; + nginx-sandbox = handleTestOn ["x86_64-linux"] ./nginx-sandbox.nix {}; nginx-sso = handleTest ./nginx-sso.nix {}; nix-ssh-serve = handleTest ./nix-ssh-serve.nix {}; nixos-generate-config = handleTest ./nixos-generate-config.nix {}; diff --git a/nixos/tests/nginx-pubhtml.nix b/nixos/tests/nginx-pubhtml.nix index 432913cb42d2..6e1e605628e9 100644 --- a/nixos/tests/nginx-pubhtml.nix +++ b/nixos/tests/nginx-pubhtml.nix @@ -2,6 +2,7 @@ import ./make-test-python.nix { name = "nginx-pubhtml"; machine = { pkgs, ... }: { + systemd.services.nginx.serviceConfig.ProtectHome = "read-only"; services.nginx.enable = true; services.nginx.virtualHosts.localhost = { locations."~ ^/\\~([a-z0-9_]+)(/.*)?$".alias = "/home/$1/public_html$2"; diff --git a/nixos/tests/nginx-sandbox.nix b/nixos/tests/nginx-sandbox.nix new file mode 100644 index 000000000000..bc9d3ba8add7 --- /dev/null +++ b/nixos/tests/nginx-sandbox.nix @@ -0,0 +1,66 @@ +import ./make-test-python.nix ({ pkgs, ... }: { + name = "nginx-sandbox"; + meta = with pkgs.stdenv.lib.maintainers; { + maintainers = [ izorkin ]; + }; + + # This test checks the creation and reading of a file in sandbox mode. Used simple lua script. + + machine = { pkgs, ... }: { + nixpkgs.overlays = [ + (self: super: { + nginx-lua = super.nginx.override { + modules = [ + pkgs.nginxModules.lua + ]; + }; + }) + ]; + services.nginx.enable = true; + services.nginx.package = pkgs.nginx-lua; + services.nginx.enableSandbox = true; + services.nginx.virtualHosts.localhost = { + extraConfig = '' + location /test1-write { + content_by_lua_block { + local create = os.execute('${pkgs.coreutils}/bin/mkdir /tmp/test1-read') + local create = os.execute('${pkgs.coreutils}/bin/touch /tmp/test1-read/foo.txt') + local echo = os.execute('${pkgs.coreutils}/bin/echo worked > /tmp/test1-read/foo.txt') + } + } + location /test1-read { + root /tmp; + } + location /test2-write { + content_by_lua_block { + local create = os.execute('${pkgs.coreutils}/bin/mkdir /var/web/test2-read') + local create = os.execute('${pkgs.coreutils}/bin/touch /var/web/test2-read/bar.txt') + local echo = os.execute('${pkgs.coreutils}/bin/echo error-worked > /var/web/test2-read/bar.txt') + } + } + location /test2-read { + root /var/web; + } + ''; + }; + users.users.foo.isNormalUser = true; + }; + + testScript = '' + machine.wait_for_unit("nginx") + machine.wait_for_open_port(80) + + # Checking write in temporary folder + machine.succeed("$(curl -vvv http://localhost/test1-write)") + machine.succeed('test "$(curl -fvvv http://localhost/test1-read/foo.txt)" = worked') + + # Checking write in protected folder. In sandbox mode for the nginx service, the folder /var/web is mounted + # in read-only mode. + machine.succeed("mkdir -p /var/web") + machine.succeed("chown nginx:nginx /var/web") + machine.succeed("$(curl -vvv http://localhost/test2-write)") + assert "404 Not Found" in machine.succeed( + "curl -vvv -s http://localhost/test2-read/bar.txt" + ) + ''; +}) |