nathan/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2026-09-18 05:39:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

nixos/systemd-confinement: fix with PrivateTmp=disconnected

Browse Source
This commit is contained in:
Marie Ramlow
2026-09-06 18:48:00 +02:00
parent a990b08b20
commit 601b5f603e
2 changed files with 28 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
nixos/modules/security/systemd-confinement.nix
View File

@@ -236,7 +236,8 @@ in
# If DynamicUser= is enabled, PrivateTmp=true is implied (and cannot be turned off).
# so disable them unless PrivateTmp=true is explicitely set.
${lib.optionalString (!cfg.serviceConfig.PrivateTmp) ''
# We're explicitely comparing to `false` here, because PrivateTmp can also be "disconnected".
${lib.optionalString (cfg.serviceConfig.PrivateTmp == false) ''
echo "InaccessiblePaths=-+/tmp" >> "$serviceFile"
echo "InaccessiblePaths=-+/var/tmp" >> "$serviceFile"
''}

41
nixos/tests/systemd-confinement/default.nix
View File

@@ -94,7 +94,17 @@ import ../make-test-python.nix {
(
{ user, privateTmp }:
let
withTmp = if privateTmp then "with PrivateTmp" else "without PrivateTmp";
isPrivateTmp = lib.elem privateTmp [
true
"disconnected"
];
withTmp =
if privateTmp == true then
"with PrivateTmp=true"
else if privateTmp == "disconnected" then
"with PrivateTmp=disconnected"
else
"without PrivateTmp";
serviceConfig =
if user == "static-user" then
@@ -118,7 +128,7 @@ import ../make-test-python.nix {
# Only set if privateTmp is true to ensure that the default is false.
serviceConfig =
serviceConfig
// lib.optionalAttrs privateTmp {
// lib.optionalAttrs isPrivateTmp {
PrivateTmp = true;
};
};
@@ -132,9 +142,9 @@ import ../make-test-python.nix {
'bin': Accessibility.READABLE,
'nix': Accessibility.READABLE,
'run': Accessibility.READABLE,
${lib.optionalString privateTmp "'tmp': Accessibility.STICKY,"}
${lib.optionalString privateTmp "'var': Accessibility.READABLE,"}
${lib.optionalString privateTmp "'var/tmp': Accessibility.STICKY,"}
${lib.optionalString isPrivateTmp "'tmp': Accessibility.STICKY,"}
${lib.optionalString isPrivateTmp "'var': Accessibility.READABLE,"}
${lib.optionalString isPrivateTmp "'var/tmp': Accessibility.STICKY,"}
})
''
else
@@ -146,9 +156,9 @@ import ../make-test-python.nix {
'bin': Accessibility.READABLE,
'nix': Accessibility.READABLE,
'run': Accessibility.READABLE,
${lib.optionalString privateTmp "'tmp': Accessibility.STICKY,"}
${lib.optionalString privateTmp "'var': Accessibility.READABLE,"}
${lib.optionalString privateTmp "'var/tmp': Accessibility.STICKY,"}
${lib.optionalString isPrivateTmp "'tmp': Accessibility.STICKY,"}
${lib.optionalString isPrivateTmp "'var': Accessibility.READABLE,"}
${lib.optionalString isPrivateTmp "'var/tmp': Accessibility.STICKY,"}
})
'';
}
@@ -158,7 +168,7 @@ import ../make-test-python.nix {
# Only set if privateTmp is false to ensure that the default is true.
serviceConfig =
serviceConfig
// lib.optionalAttrs (!privateTmp) {
// lib.optionalAttrs (!isPrivateTmp) {
PrivateTmp = false;
};
};
@@ -171,15 +181,15 @@ import ../make-test-python.nix {
assert_permissions({
'bin': Accessibility.READABLE,
'nix': Accessibility.READABLE,
${lib.optionalString privateTmp "'tmp': Accessibility.STICKY,"}
${lib.optionalString isPrivateTmp "'tmp': Accessibility.STICKY,"}
'run': Accessibility.WRITABLE,
'proc': Accessibility.SPECIAL,
'sys': Accessibility.SPECIAL,
'dev': Accessibility.WRITABLE,
${lib.optionalString privateTmp "'var': Accessibility.READABLE,"}
${lib.optionalString privateTmp "'var/tmp': Accessibility.STICKY,"}
${lib.optionalString isPrivateTmp "'var': Accessibility.READABLE,"}
${lib.optionalString isPrivateTmp "'var/tmp': Accessibility.STICKY,"}
})
''
else
@@ -190,7 +200,7 @@ import ../make-test-python.nix {
assert_permissions({
'bin': Accessibility.READABLE,
'nix': Accessibility.READABLE,
${lib.optionalString privateTmp "'tmp': Accessibility.STICKY,"}
${lib.optionalString isPrivateTmp "'tmp': Accessibility.STICKY,"}
'run': Accessibility.STICKY,
'proc': Accessibility.SPECIAL,
@@ -199,8 +209,8 @@ import ../make-test-python.nix {
'dev/shm': Accessibility.STICKY,
'dev/mqueue': Accessibility.STICKY,
${lib.optionalString privateTmp "'var': Accessibility.READABLE,"}
${lib.optionalString privateTmp "'var/tmp': Accessibility.STICKY,"}
${lib.optionalString isPrivateTmp "'var': Accessibility.READABLE,"}
${lib.optionalString isPrivateTmp "'var/tmp': Accessibility.STICKY,"}
})
'';
}
@@ -216,6 +226,7 @@ import ../make-test-python.nix {
privateTmp = [
true
false
"disconnected"
];
}
);