picnoir/nix-gh
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

release.nix: Add a test for sandboxing

Browse source 
Right now it only tests whether seccomp correctly forges the return
value of chown, but the long-term goal is to test the full sandboxing
functionality at some point in the future.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
This commit is contained in:
aszlig 2016-11-16 12:46:43 +01:00
parent b90a435332
commit 651a18dd24
No known key found for this signature in database
GPG key ID: 1DE8E48E57DB5436
2 changed files with 57 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
release.nix
View file

@ -200,6 +200,10 @@ let
nix = build.x86_64-linux; system = "x86_64-linux";
});
tests.sandbox = (import ./tests/sandbox.nix rec {
nix = build.x86_64-linux; system = "x86_64-linux";
});
tests.binaryTarball =
with import <nixpkgs> { system = "x86_64-linux"; };
vmTools.runInLinuxImage (runCommand "nix-binary-tarball-test"

53
tests/sandbox.nix Normal file
View file

@ -0,0 +1,53 @@
# Test Nix builder sandbox.
{ system, nix }:
with import <nixpkgs/nixos/lib/testing.nix> { inherit system; };
let
mkUtils = pkgs: pkgs.buildEnv {
name = "sandbox-utils";
paths = [ pkgs.coreutils pkgs.utillinux pkgs.bash ];
pathsToLink = [ "/bin" "/sbin" ];
};
utils32 = mkUtils pkgs.pkgsi686Linux;
utils64 = mkUtils pkgs;
sandboxTestScript = pkgs.writeText "sandbox-testscript.sh" ''
[ $(id -u) -eq 0 ]
touch foo
chown 1024:1024 foo
touch "$out"
'';
testExpr = arch: pkgs.writeText "sandbox-test.nix" ''
let
utils = builtins.storePath
${if arch == "i686-linux" then utils32 else utils64};
in derivation {
name = "sandbox-test";
system = "${arch}";
builder = "''${utils}/bin/bash";
args = ["-e" ${sandboxTestScript}];
PATH = "''${utils}/bin";
}
'';
in makeTest {
name = "nix-sandbox";
machine = { pkgs, ... }: {
nix.package = nix;
nix.useSandbox = true;
nix.binaryCaches = [];
virtualisation.writableStore = true;
virtualisation.pathsInNixDB = [ utils32 utils64 ];
};
testScript = ''
$machine->waitForUnit("multi-user.target");
$machine->succeed("nix-build ${testExpr "x86_64-linux"}");
$machine->succeed("nix-build ${testExpr "i686-linux"}");
'';
}