public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #111635 from xaverdh/hide-pid-broken

Browse Source 
nixos/hidepid: remove module, it's broken
This commit is contained in:
Florian Klink
2021-02-23 00:20:29 +01:00
committed by GitHub
parent 7b9655158e f7fce2c52f
commit f3af2df658
7 changed files with 11 additions and 73 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nixos/tests/hardened.nix
-11
View File
@@ -65,17 +65,6 @@ import ./make-test-python.nix ({ pkgs, latestKernel ? false, ... } : {
machine.succeed("grep -Fq wireguard /proc/modules")
# Test hidepid
with subtest("hidepid=2 option is applied and works"):
# Linux >= 5.8 shows "invisible"
machine.succeed(
"grep -Fq hidepid=2 /proc/mounts || grep -Fq hidepid=invisible /proc/mounts"
)
# cannot use pgrep -u here, it segfaults when access to process info is denied
machine.succeed("[ `su - sybil -c 'ps --no-headers --user root | wc -l'` = 0 ]")
machine.succeed("[ `su - alice -c 'ps --no-headers --user root | wc -l'` != 0 ]")
# Test kernel module hardening
with subtest("No more kernel modules can be loaded"):
# note: this better a be module we normally wouldn't load ...