nixos/hidepid: drop the module as the hidepid mount option is broken

This has been in an unusable state since the switch to cgroups-v2.
See https://github.com/NixOS/nixpkgs/issues/73800 for details.
This commit is contained in:
Dominik Xaver Hörl
2021-02-21 13:51:37 +01:00
parent b8ec6cfdd4
commit 893d911b55
6 changed files with 5 additions and 73 deletions
-11
View File
@@ -65,17 +65,6 @@ import ./make-test-python.nix ({ pkgs, latestKernel ? false, ... } : {
machine.succeed("grep -Fq wireguard /proc/modules")
# Test hidepid
with subtest("hidepid=2 option is applied and works"):
# Linux >= 5.8 shows "invisible"
machine.succeed(
"grep -Fq hidepid=2 /proc/mounts || grep -Fq hidepid=invisible /proc/mounts"
)
# cannot use pgrep -u here, it segfaults when access to process info is denied
machine.succeed("[ `su - sybil -c 'ps --no-headers --user root | wc -l'` = 0 ]")
machine.succeed("[ `su - alice -c 'ps --no-headers --user root | wc -l'` != 0 ]")
# Test kernel module hardening
with subtest("No more kernel modules can be loaded"):
# note: this better a be module we normally wouldn't load ...