diff options
author | aszlig <aszlig@nix.build> | 2019-03-14 19:48:20 +0100 |
---|---|---|
committer | aszlig <aszlig@nix.build> | 2019-03-14 20:04:33 +0100 |
commit | 9e9af4f9c076f382bc40821551beaeb68ca071cd (patch) | |
tree | a2a2856ee745daea272fa4792da5ffc938ee4ba0 /nixos/tests | |
parent | 46f7dd436f4b10d9c6cdde737d4da3ffce8e88be (diff) | |
download | nixlib-9e9af4f9c076f382bc40821551beaeb68ca071cd.tar nixlib-9e9af4f9c076f382bc40821551beaeb68ca071cd.tar.gz nixlib-9e9af4f9c076f382bc40821551beaeb68ca071cd.tar.bz2 nixlib-9e9af4f9c076f382bc40821551beaeb68ca071cd.tar.lz nixlib-9e9af4f9c076f382bc40821551beaeb68ca071cd.tar.xz nixlib-9e9af4f9c076f382bc40821551beaeb68ca071cd.tar.zst nixlib-9e9af4f9c076f382bc40821551beaeb68ca071cd.zip |
nixos/confinement: Allow to include the full unit
From @edolstra at [1]: BTW we probably should take the closure of the whole unit rather than just the exec commands, to handle things like Environment variables. With this commit, there is now a "fullUnit" option, which can be enabled to include the full closure of the service unit into the chroot. However, I did not enable this by default, because I do disagree here and *especially* things like environment variables or environment files shouldn't be in the closure of the chroot. For example if you have something like: { pkgs, ... }: { systemd.services.foobar = { serviceConfig.EnvironmentFile = ${pkgs.writeText "secrets" '' user=admin password=abcdefg ''; }; } We really do not want the *file* to end up in the chroot, but rather just the environment variables to be exported. Another thing is that this makes it less predictable what actually will end up in the chroot, because we have a "globalEnvironment" option that will get merged in as well, so users adding stuff to that option will also make it available in confined units. I also added a big fat warning about that in the description of the fullUnit option. [1]: https://github.com/NixOS/nixpkgs/pull/57519#issuecomment-472855704 Signed-off-by: aszlig <aszlig@nix.build>
Diffstat (limited to 'nixos/tests')
-rw-r--r-- | nixos/tests/systemd-confinement.nix | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/nixos/tests/systemd-confinement.nix b/nixos/tests/systemd-confinement.nix index 63cb074d7ca1..b7b10fb36aac 100644 --- a/nixos/tests/systemd-confinement.nix +++ b/nixos/tests/systemd-confinement.nix @@ -132,6 +132,19 @@ import ./make-test.nix { ); ''; } + { description = "check if only Exec* dependencies are included"; + config.environment.FOOBAR = pkgs.writeText "foobar" "eek\n"; + testScript = '' + $machine->succeed('test "$(chroot-exec \'cat "$FOOBAR"\')" != eek'); + ''; + } + { description = "check if all unit dependencies are included"; + config.environment.FOOBAR = pkgs.writeText "foobar" "eek\n"; + config.confinement.fullUnit = true; + testScript = '' + $machine->succeed('test "$(chroot-exec \'cat "$FOOBAR"\')" = eek'); + ''; + } ]; options.__testSteps = lib.mkOption { |