swendel/nixpkgs
1
0
Fork 0
mirror of https://github.com/SebastianWendel/nixpkgs.git synced 2024-09-22 13:29:00 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #104812 from mweinelt/babeld-unprivileged

Browse source 
babeld: run unprivileged
This commit is contained in:
Graham Christensen 2021-04-24 20:45:38 -04:00 committed by GitHub
parent 9839cda8dc ceb26b53d8
commit bae96b50ab
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
4 changed files with 30 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
nixos/doc/manual/release-notes/rl-2105.xml
View file

@ -680,6 +680,13 @@ environment.systemPackages = [
All CUDA toolkit versions prior to CUDA 10 have been removed.
</para>
</listitem>
<listitem>
<para>
The <package>babeld</package> service is now being run as an unprivileged user. To achieve that the module configures
<literal>skip-kernel-setup true</literal> and takes care of setting forwarding and rp_filter sysctls by itself as well
as for each interface in <varname>services.babeld.interfaces</varname>.
</para>
</listitem>
</itemizedlist>
</section>

16
nixos/modules/services/networking/babeld.nix
View file

@ -19,7 +19,10 @@ let
"interface ${name} ${paramsString interface}\n";
configFile = with cfg; pkgs.writeText "babeld.conf" (
(optionalString (cfg.interfaceDefaults != null) ''
''
skip-kernel-setup true
''
+ (optionalString (cfg.interfaceDefaults != null) ''
default ${paramsString cfg.interfaceDefaults}
'')
+ (concatMapStrings interfaceConfig (attrNames cfg.interfaces))
@ -84,13 +87,22 @@ in
config = mkIf config.services.babeld.enable {
boot.kernel.sysctl = {
"net.ipv6.conf.all.forwarding" = 1;
"net.ipv6.conf.all.accept_redirects" = 0;
"net.ipv4.conf.all.forwarding" = 1;
"net.ipv4.conf.all.rp_filter" = 0;
} // lib.mapAttrs' (ifname: _: lib.nameValuePair "net.ipv4.conf.${ifname}.rp_filter" (lib.mkDefault 0)) config.services.babeld.interfaces;
systemd.services.babeld = {
description = "Babel routing daemon";
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
ExecStart = "${pkgs.babeld}/bin/babeld -c ${configFile} -I /run/babeld/babeld.pid -S /var/lib/babeld/state";
AmbientCapabilities = [ "CAP_NET_ADMIN" ];
CapabilityBoundingSet = [ "CAP_NET_ADMIN" ];
DynamicUser = true;
IPAddressAllow = [ "fe80::/64" "ff00::/8" "::1/128" "127.0.0.0/8" ];
IPAddressDeny = "any";
LockPersonality = true;
@ -98,7 +110,7 @@ in
MemoryDenyWriteExecute = true;
ProtectSystem = "strict";
ProtectClock = true;
ProtectKernelTunables = false; # Couldn't write sysctl: Read-only file system
ProtectKernelTunables = true;
ProtectKernelModules = true;
ProtectKernelLogs = true;
ProtectControlGroups = true;

6
nixos/tests/babeld.nix
View file

@ -25,9 +25,6 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
{
virtualisation.vlans = [ 10 20 ];
boot.kernel.sysctl."net.ipv4.conf.all.forwarding" = 1;
boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = 1;
networking = {
useDHCP = false;
firewall.enable = false;
@ -74,9 +71,6 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
{
virtualisation.vlans = [ 20 30 ];
boot.kernel.sysctl."net.ipv4.conf.all.forwarding" = 1;
boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = 1;
networking = {
useDHCP = false;
firewall.enable = false;

10
pkgs/tools/networking/babeld/default.nix
View file

@ -1,4 +1,4 @@
{ lib, stdenv, fetchurl, nixosTests }:
{ lib, stdenv, fetchurl, fetchpatch, nixosTests }:
stdenv.mkDerivation rec {
pname = "babeld";
@ -9,6 +9,14 @@ stdenv.mkDerivation rec {
sha256 = "01vzhrspnm4sy9ggaz9n3bfl5hy3qlynr218j3mdcddzm3h00kqm";
};
patches = [
(fetchpatch {
# Skip kernel_setup_interface when `skip-kernel-setup` is enabled.
url = "https://github.com/jech/babeld/commit/f9698a5616842467ad08a5f9ed3d6fcfa2dd2898.patch";
sha256 = "00kj2jxsfq0pjk5wrkslyvkww57makxlwa4fd82g7g9hrgahpqwr";
})
];
preBuild = ''
makeFlags="PREFIX=$out ETCDIR=$out/etc"
'';