diff options
| author | Emily <vcs@emily.moe> | 2020-04-05 00:29:24 +0100 |
|---|---|---|
| committer | Emily <vcs@emily.moe> | 2020-04-17 16:13:39 +0100 |
| commit | fe031d07f82fe87c3f258daf9085040d9ff9e49f (patch) | |
| tree | ef04b270efbdc6f4f9c3c513500d5c245b1fdb1d /nixos/tests | |
| parent | b0d5032ee4a1cee1fb9e521326114350ad414573 (diff) | |
| download | nixlib-fe031d07f82fe87c3f258daf9085040d9ff9e49f.tar nixlib-fe031d07f82fe87c3f258daf9085040d9ff9e49f.tar.gz nixlib-fe031d07f82fe87c3f258daf9085040d9ff9e49f.tar.bz2 nixlib-fe031d07f82fe87c3f258daf9085040d9ff9e49f.tar.lz nixlib-fe031d07f82fe87c3f258daf9085040d9ff9e49f.tar.xz nixlib-fe031d07f82fe87c3f258daf9085040d9ff9e49f.tar.zst nixlib-fe031d07f82fe87c3f258daf9085040d9ff9e49f.zip | |
nixos/tests/hardened: add latestKernel argument
Diffstat (limited to 'nixos/tests')
| -rw-r--r-- | nixos/tests/all-tests.nix | 1 | ||||
| -rw-r--r-- | nixos/tests/hardened.nix | 8 |
2 files changed, 7 insertions, 2 deletions
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index 5adfd6afd6a7..e52eb0d54824 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -160,6 +160,7 @@ in # kubernetes.e2e should eventually replace kubernetes.rbac when it works #kubernetes.e2e = handleTestOn ["x86_64-linux"] ./kubernetes/e2e.nix {}; kubernetes.rbac = handleTestOn ["x86_64-linux"] ./kubernetes/rbac.nix {}; + latestKernel.hardened = handleTest ./hardened.nix { latestKernel = true; }; latestKernel.login = handleTest ./login.nix { latestKernel = true; }; ldap = handleTest ./ldap.nix {}; leaps = handleTest ./leaps.nix {}; diff --git a/nixos/tests/hardened.nix b/nixos/tests/hardened.nix index 21bc9308aaa3..5ed0dfcf9ab8 100644 --- a/nixos/tests/hardened.nix +++ b/nixos/tests/hardened.nix @@ -1,4 +1,4 @@ -import ./make-test.nix ({ pkgs, ...} : { +import ./make-test.nix ({ pkgs, latestKernel ? false, ... } : { name = "hardened"; meta = with pkgs.stdenv.lib.maintainers; { maintainers = [ joachifm ]; @@ -10,6 +10,8 @@ import ./make-test.nix ({ pkgs, ...} : { { users.users.alice = { isNormalUser = true; extraGroups = [ "proc" ]; }; users.users.sybil = { isNormalUser = true; group = "wheel"; }; imports = [ ../modules/profiles/hardened.nix ]; + boot.kernelPackages = + lib.mkIf latestKernel pkgs.linuxPackages_latest_hardened; environment.memoryAllocator.provider = "graphene-hardened"; nix.useSandbox = false; virtualisation.emptyDiskImages = [ 4096 ]; @@ -23,7 +25,9 @@ import ./make-test.nix ({ pkgs, ...} : { options = [ "noauto" ]; }; }; - boot.extraModulePackages = [ config.boot.kernelPackages.wireguard ]; + boot.extraModulePackages = + optional (versionOlder config.boot.kernelPackages.kernel.version "5.6") + config.boot.kernelPackages.wireguard; boot.kernelModules = [ "wireguard" ]; }; |