b1ed5ff · typeable/nixpkgs

git.iko.soy/typeable/nixpkgs

Merge pull request #93293 from tnias/nixos_rspamd_20200716

commitb1ed5ffeabde33ba7e30981cd0ac8d0a9c69e1a1 authorJörg Thalheim <Mic92@users.noreply.github.com> dateTue 1 Dec 2020, 13:10 (6 years ago) parent63cf5d0 3b6ef96

2 files changed+70−32

compare with master

unifiedsplit

nixos/modules/services/mail/rspamd.nix+38−6 nixos/tests/rspamd.nix+32−26

nixos/modules/services/mail/rspamd.nix+38−6

@@ -371,6 +371,9 @@ in

371371 };

372372 services.postfix.config = mkIf cfg.postfix.enable cfg.postfix.config;

373373

374+ systemd.services.postfix.serviceConfig.SupplementaryGroups =

375+ mkIf cfg.postfix.enable [ postfixCfg.group ];

376+

374377 # Allow users to run 'rspamc' and 'rspamadm'.

375378 environment.systemPackages = [ pkgs.rspamd ];

376379

@@ -394,16 +397,45 @@ in

394397 restartTriggers = [ rspamdDir ];

395398

396399 serviceConfig = {

397− ExecStart = "${pkgs.rspamd}/bin/rspamd ${optionalString cfg.debug "-d"} --user=${cfg.user} --group=${cfg.group} --pid=/run/rspamd.pid -c /etc/rspamd/rspamd.conf -f";

400+ ExecStart = "${pkgs.rspamd}/bin/rspamd ${optionalString cfg.debug "-d"} -c /etc/rspamd/rspamd.conf -f";

398401 Restart = "always";

402+

403+ User = "${cfg.user}";

404+ Group = "${cfg.group}";

405+ SupplementaryGroups = mkIf cfg.postfix.enable [ postfixCfg.group ];

406+

399407 RuntimeDirectory = "rspamd";

408+ RuntimeDirectoryMode = "0755";

409+ StateDirectory = "rspamd";

410+ StateDirectoryMode = "0700";

411+

412+ AmbientCapabilities = [];

413+ CapabilityBoundingSet = [];

414+ DevicePolicy = "closed";

415+ LockPersonality = true;

416+ NoNewPrivileges = true;

417+ PrivateDevices = true;

418+ PrivateMounts = true;

400419 PrivateTmp = true;

420+ # we need to chown socket to rspamd-milter

421+ PrivateUsers = !cfg.postfix.enable;

422+ ProtectClock = true;

423+ ProtectControlGroups = true;

424+ ProtectHome = true;

425+ ProtectHostname = true;

426+ ProtectKernelLogs = true;

427+ ProtectKernelModules = true;

428+ ProtectKernelTunables = true;

429+ ProtectSystem = "strict";

430+ RemoveIPC = true;

431+ RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];

432+ RestrictNamespaces = true;

433+ RestrictRealtime = true;

434+ RestrictSUIDSGID = true;

435+ SystemCallArchitectures = "native";

436+ SystemCallFilter = "@system-service";

437+ UMask = "0077";

401438 };

402−

403− preStart = ''

404− ${pkgs.coreutils}/bin/mkdir -p /var/lib/rspamd

405− ${pkgs.coreutils}/bin/chown ${cfg.user}:${cfg.group} /var/lib/rspamd

406− '';

407439 };

408440 };

409441 imports = [

nixos/tests/rspamd.nix+32−26

@@ -13,10 +13,12 @@ let

1313 machine.succeed("id rspamd >/dev/null")

1414 '';

1515 checkSocket = socket: user: group: mode: ''

16− machine.succeed("ls ${socket} >/dev/null")

17− machine.succeed('[[ "$(stat -c %U ${socket})" == "${user}" ]]')

18− machine.succeed('[[ "$(stat -c %G ${socket})" == "${group}" ]]')

19− machine.succeed('[[ "$(stat -c %a ${socket})" == "${mode}" ]]')

16+ machine.succeed(

17+ "ls ${socket} >/dev/null",

18+ '[[ "$(stat -c %U ${socket})" == "${user}" ]]',

19+ '[[ "$(stat -c %G ${socket})" == "${group}" ]]',

20+ '[[ "$(stat -c %a ${socket})" == "${mode}" ]]',

21+ )

2022 '';

2123 simple = name: enableIPv6: makeTest {

2224 name = "rspamd-${name}";

@@ -54,33 +56,35 @@ in

5456 services.rspamd = {

5557 enable = true;

5658 workers.normal.bindSockets = [{

57− socket = "/run/rspamd.sock";

59+ socket = "/run/rspamd/rspamd.sock";

5860 mode = "0600";

59− owner = "root";

60− group = "root";

61+ owner = "rspamd";

62+ group = "rspamd";

6163 }];

6264 workers.controller.bindSockets = [{

63− socket = "/run/rspamd-worker.sock";

65+ socket = "/run/rspamd/rspamd-worker.sock";

6466 mode = "0666";

65− owner = "root";

66− group = "root";

67+ owner = "rspamd";

68+ group = "rspamd";

6769 }];

6870 };

6971 };

7072

7173 testScript = ''

7274 ${initMachine}

73− machine.wait_for_file("/run/rspamd.sock")

74− ${checkSocket "/run/rspamd.sock" "root" "root" "600" }

75− ${checkSocket "/run/rspamd-worker.sock" "root" "root" "666" }

75+ machine.wait_for_file("/run/rspamd/rspamd.sock")

76+ ${checkSocket "/run/rspamd/rspamd.sock" "rspamd" "rspamd" "600" }

77+ ${checkSocket "/run/rspamd/rspamd-worker.sock" "rspamd" "rspamd" "666" }

7678 machine.log(machine.succeed("cat /etc/rspamd/rspamd.conf"))

7779 machine.log(

7880 machine.succeed("grep 'CONFDIR/worker-controller.inc' /etc/rspamd/rspamd.conf")

7981 )

8082 machine.log(machine.succeed("grep 'CONFDIR/worker-normal.inc' /etc/rspamd/rspamd.conf"))

81− machine.log(machine.succeed("rspamc -h /run/rspamd-worker.sock stat"))

83+ machine.log(machine.succeed("rspamc -h /run/rspamd/rspamd-worker.sock stat"))

8284 machine.log(

83− machine.succeed("curl --unix-socket /run/rspamd-worker.sock http://localhost/ping")

85+ machine.succeed(

86+ "curl --unix-socket /run/rspamd/rspamd-worker.sock http://localhost/ping"

87+ )

8488 )

8589 '';

8690 };

@@ -91,16 +95,16 @@ in

9195 services.rspamd = {

9296 enable = true;

9397 workers.normal.bindSockets = [{

94− socket = "/run/rspamd.sock";

98+ socket = "/run/rspamd/rspamd.sock";

9599 mode = "0600";

96− owner = "root";

97− group = "root";

100+ owner = "rspamd";

101+ group = "rspamd";

98102 }];

99103 workers.controller.bindSockets = [{

100− socket = "/run/rspamd-worker.sock";

104+ socket = "/run/rspamd/rspamd-worker.sock";

101105 mode = "0666";

102− owner = "root";

103− group = "root";

106+ owner = "rspamd";

107+ group = "rspamd";

104108 }];

105109 workers.controller2 = {

106110 type = "controller";

@@ -116,9 +120,9 @@ in

116120

117121 testScript = ''

118122 ${initMachine}

119− machine.wait_for_file("/run/rspamd.sock")

120− ${checkSocket "/run/rspamd.sock" "root" "root" "600" }

121− ${checkSocket "/run/rspamd-worker.sock" "root" "root" "666" }

123+ machine.wait_for_file("/run/rspamd/rspamd.sock")

124+ ${checkSocket "/run/rspamd/rspamd.sock" "rspamd" "rspamd" "600" }

125+ ${checkSocket "/run/rspamd/rspamd-worker.sock" "rspamd" "rspamd" "666" }

122126 machine.log(machine.succeed("cat /etc/rspamd/rspamd.conf"))

123127 machine.log(

124128 machine.succeed("grep 'CONFDIR/worker-controller.inc' /etc/rspamd/rspamd.conf")

@@ -137,9 +141,11 @@ in

137141 machine.wait_until_succeeds(

138142 "journalctl -u rspamd | grep -i 'starting controller process' >&2"

139143 )

140− machine.log(machine.succeed("rspamc -h /run/rspamd-worker.sock stat"))

144+ machine.log(machine.succeed("rspamc -h /run/rspamd/rspamd-worker.sock stat"))

141145 machine.log(

142− machine.succeed("curl --unix-socket /run/rspamd-worker.sock http://localhost/ping")

146+ machine.succeed(

147+ "curl --unix-socket /run/rspamd/rspamd-worker.sock http://localhost/ping"

148+ )

143149 )

144150 machine.log(machine.succeed("curl http://localhost:11335/ping"))

145151 '';