From af6d0095f7f3eecc59223da6141ceb88b1a3e0a0 Mon Sep 17 00:00:00 2001 From: Izorkin Date: Mon, 20 Apr 2020 20:12:31 +0300 Subject: nixos/tests: fix nginx-pubhtml test --- nixos/tests/nginx-pubhtml.nix | 1 + 1 file changed, 1 insertion(+) (limited to 'nixos/tests') diff --git a/nixos/tests/nginx-pubhtml.nix b/nixos/tests/nginx-pubhtml.nix index 432913cb42d2..6e1e605628e9 100644 --- a/nixos/tests/nginx-pubhtml.nix +++ b/nixos/tests/nginx-pubhtml.nix @@ -2,6 +2,7 @@ import ./make-test-python.nix { name = "nginx-pubhtml"; machine = { pkgs, ... }: { + systemd.services.nginx.serviceConfig.ProtectHome = "read-only"; services.nginx.enable = true; services.nginx.virtualHosts.localhost = { locations."~ ^/\\~([a-z0-9_]+)(/.*)?$".alias = "/home/$1/public_html$2"; -- cgit 1.4.1 From c7106610f14f0620f79758fe1d62cbbb8e989c84 Mon Sep 17 00:00:00 2001 From: Izorkin Date: Thu, 23 Apr 2020 22:00:27 +0300 Subject: nixos/tests: add nginx-sandbox test --- nixos/tests/all-tests.nix | 1 + nixos/tests/nginx-sandbox.nix | 65 +++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 66 insertions(+) create mode 100644 nixos/tests/nginx-sandbox.nix (limited to 'nixos/tests') diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index 5a0c9d1afae1..045f2f3846d4 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -225,6 +225,7 @@ in nginx = handleTest ./nginx.nix {}; nginx-etag = handleTest ./nginx-etag.nix {}; nginx-pubhtml = handleTest ./nginx-pubhtml.nix {}; + nginx-sandbox = handleTestOn ["x86_64-linux"] ./nginx-sandbox.nix {}; nginx-sso = handleTest ./nginx-sso.nix {}; nix-ssh-serve = handleTest ./nix-ssh-serve.nix {}; nixos-generate-config = handleTest ./nixos-generate-config.nix {}; diff --git a/nixos/tests/nginx-sandbox.nix b/nixos/tests/nginx-sandbox.nix new file mode 100644 index 000000000000..514318c9456c --- /dev/null +++ b/nixos/tests/nginx-sandbox.nix @@ -0,0 +1,65 @@ +import ./make-test-python.nix ({ pkgs, ... }: { + name = "nginx-sandbox"; + meta = with pkgs.stdenv.lib.maintainers; { + maintainers = [ izorkin ]; + }; + + # This test checks the creation and reading of a file in sandbox mode. Used simple lua script. + + machine = { pkgs, ... }: { + nixpkgs.overlays = [ + (self: super: { + nginx-lua = super.nginx.override { + modules = [ + pkgs.nginxModules.lua + ]; + }; + }) + ]; + services.nginx.enable = true; + services.nginx.package = pkgs.nginx-lua; + services.nginx.virtualHosts.localhost = { + extraConfig = '' + location /test1-write { + content_by_lua_block { + local create = os.execute('${pkgs.coreutils}/bin/mkdir /tmp/test1-read') + local create = os.execute('${pkgs.coreutils}/bin/touch /tmp/test1-read/foo.txt') + local echo = os.execute('${pkgs.coreutils}/bin/echo worked > /tmp/test1-read/foo.txt') + } + } + location /test1-read { + root /tmp; + } + location /test2-write { + content_by_lua_block { + local create = os.execute('${pkgs.coreutils}/bin/mkdir /var/web/test2-read') + local create = os.execute('${pkgs.coreutils}/bin/touch /var/web/test2-read/bar.txt') + local echo = os.execute('${pkgs.coreutils}/bin/echo error-worked > /var/web/test2-read/bar.txt') + } + } + location /test2-read { + root /var/web; + } + ''; + }; + users.users.foo.isNormalUser = true; + }; + + testScript = '' + machine.wait_for_unit("nginx") + machine.wait_for_open_port(80) + + # Checking write in temporary folder + machine.succeed("$(curl -vvv http://localhost/test1-write)") + machine.succeed('test "$(curl -fvvv http://localhost/test1-read/foo.txt)" = worked') + + # Checking write in protected folder. In sandbox mode for the nginx service, the folder /var/web is mounted + # in read-only mode. + machine.succeed("mkdir -p /var/web") + machine.succeed("chown nginx:nginx /var/web") + machine.succeed("$(curl -vvv http://localhost/test2-write)") + assert "404 Not Found" in machine.succeed( + "curl -vvv -s http://localhost/test2-read/bar.txt" + ) + ''; +}) -- cgit 1.4.1 From 94391fce1d5c4580482271c2b49ecffdef38b017 Mon Sep 17 00:00:00 2001 From: Izorkin Date: Tue, 12 May 2020 15:02:57 +0300 Subject: nixos/nginx: add option enableSandbox --- nixos/doc/manual/release-notes/rl-2009.xml | 4 ++-- nixos/modules/services/web-servers/nginx/default.nix | 9 +++++++++ nixos/tests/nginx-sandbox.nix | 1 + 3 files changed, 12 insertions(+), 2 deletions(-) (limited to 'nixos/tests') diff --git a/nixos/doc/manual/release-notes/rl-2009.xml b/nixos/doc/manual/release-notes/rl-2009.xml index 71edc7f0f009..5b1d04e4bc16 100644 --- a/nixos/doc/manual/release-notes/rl-2009.xml +++ b/nixos/doc/manual/release-notes/rl-2009.xml @@ -237,8 +237,8 @@ php.override { - Nginx web server is now started with additional sandbox/hardening options. By default, write access to - services.nginx.stateDir is allowed. To allow writing to other folders, + Add option services.nginx.enableSandbox to starting Nginx web server with additional sandbox/hardening options. + By default, write access to services.nginx.stateDir is allowed. To allow writing to other folders, use systemd.services.nginx.serviceConfig.ReadWritePaths systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www" ]; diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix index 75fe1df506b3..312d2b0a21a7 100644 --- a/nixos/modules/services/web-servers/nginx/default.nix +++ b/nixos/modules/services/web-servers/nginx/default.nix @@ -463,6 +463,14 @@ in ''; }; + enableSandbox = mkOption { + default = false; + type = types.bool; + description = '' + Starting Nginx web server with additional sandbox/hardening options. + ''; + }; + user = mkOption { type = types.str; default = "nginx"; @@ -713,6 +721,7 @@ in CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" "CAP_SYS_RESOURCE" ]; # Security NoNewPrivileges = true; + } // optionalAttrs cfg.enableSandbox { # Sandboxing ProtectSystem = "strict"; ProtectHome = mkDefault true; diff --git a/nixos/tests/nginx-sandbox.nix b/nixos/tests/nginx-sandbox.nix index 514318c9456c..bc9d3ba8add7 100644 --- a/nixos/tests/nginx-sandbox.nix +++ b/nixos/tests/nginx-sandbox.nix @@ -18,6 +18,7 @@ import ./make-test-python.nix ({ pkgs, ... }: { ]; services.nginx.enable = true; services.nginx.package = pkgs.nginx-lua; + services.nginx.enableSandbox = true; services.nginx.virtualHosts.localhost = { extraConfig = '' location /test1-write { -- cgit 1.4.1