From 1bd7260adb4233816cc33ef6e7da667aee1c0a79 Mon Sep 17 00:00:00 2001 From: rnhmjoj Date: Sun, 19 Sep 2021 12:02:24 +0200 Subject: [PATCH] nixos/lock-kernel-modules: reorder before/after Moving the service before multi-user.target (so the `hardened` test continue to work the way it did before) can result in locking the kernel too early. It's better to lock it a bit later and changing the test to wait specifically for the disable-kernel-module-loading.service. --- nixos/modules/security/lock-kernel-modules.nix | 2 +- nixos/tests/hardened.nix | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/nixos/modules/security/lock-kernel-modules.nix b/nixos/modules/security/lock-kernel-modules.nix index 3c4cc69e0e3d..065587bc286e 100644 --- a/nixos/modules/security/lock-kernel-modules.nix +++ b/nixos/modules/security/lock-kernel-modules.nix @@ -35,10 +35,10 @@ with lib; wants = [ "systemd-udevd.service" ]; wantedBy = [ config.systemd.defaultUnit ]; - before = [ config.systemd.defaultUnit ]; after = [ "firewall.service" "systemd-modules-load.service" + config.systemd.defaultUnit ]; unitConfig.ConditionPathIsReadWrite = "/proc/sys/kernel"; diff --git a/nixos/tests/hardened.nix b/nixos/tests/hardened.nix index a0b629086b5a..b76ae83a3287 100644 --- a/nixos/tests/hardened.nix +++ b/nixos/tests/hardened.nix @@ -57,6 +57,7 @@ import ./make-test-python.nix ({ pkgs, latestKernel ? false, ... } : { # Test kernel module hardening with subtest("No more kernel modules can be loaded"): # note: this better a be module we normally wouldn't load ... + machine.wait_for_unit("disable-kernel-module-loading.service") machine.fail("modprobe dccp")