From 628354c686e5ea5bb997ca9d387c68d62f89e787 Mon Sep 17 00:00:00 2001 From: Izorkin Date: Mon, 13 Apr 2020 16:57:47 +0300 Subject: [PATCH 1/6] nixos/nginx: enable sandboxing --- .../services/web-servers/nginx/default.nix | 20 +++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix index 1e9cda7e478..16c56dc745f 100644 --- a/nixos/modules/services/web-servers/nginx/default.nix +++ b/nixos/modules/services/web-servers/nginx/default.nix @@ -710,6 +710,26 @@ in LogsDirectoryMode = "0750"; # Capabilities AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" "CAP_SYS_RESOURCE" ]; + CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" "CAP_SYS_RESOURCE" ]; + # Security + NoNewPrivileges = true; + # Sandboxing + ProtectSystem = "strict"; + ProtectHome = mkDefault true; + PrivateTmp = true; + PrivateDevices = true; + ProtectHostname = true; + ProtectKernelTunables = true; + ProtectKernelModules = true; + ProtectControlGroups = true; + RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ]; + LockPersonality = true; + MemoryDenyWriteExecute = mkDefault true; + RestrictRealtime = true; + RestrictSUIDSGID = true; + PrivateMounts = true; + # System Call Filtering + SystemCallArchitectures = "native"; }; }; From 97a0928ccb730eda7feec4d6ea515e149a933366 Mon Sep 17 00:00:00 2001 From: Izorkin Date: Sun, 19 Apr 2020 18:18:37 +0300 Subject: [PATCH 2/6] nixos/nginx: add release notes --- nixos/doc/manual/release-notes/rl-2009.xml | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/nixos/doc/manual/release-notes/rl-2009.xml b/nixos/doc/manual/release-notes/rl-2009.xml index ede7bed609d..71edc7f0f00 100644 --- a/nixos/doc/manual/release-notes/rl-2009.xml +++ b/nixos/doc/manual/release-notes/rl-2009.xml @@ -235,7 +235,16 @@ php.override { Be aware that backwards state migrations are not supported by Deluge. - + + + Nginx web server is now started with additional sandbox/hardening options. By default, write access to + services.nginx.stateDir is allowed. To allow writing to other folders, + use systemd.services.nginx.serviceConfig.ReadWritePaths + +systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www" ]; + + + The NixOS options nesting.clone and From af6d0095f7f3eecc59223da6141ceb88b1a3e0a0 Mon Sep 17 00:00:00 2001 From: Izorkin Date: Mon, 20 Apr 2020 20:12:31 +0300 Subject: [PATCH 3/6] nixos/tests: fix nginx-pubhtml test --- nixos/tests/nginx-pubhtml.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/nixos/tests/nginx-pubhtml.nix b/nixos/tests/nginx-pubhtml.nix index 432913cb42d..6e1e605628e 100644 --- a/nixos/tests/nginx-pubhtml.nix +++ b/nixos/tests/nginx-pubhtml.nix @@ -2,6 +2,7 @@ import ./make-test-python.nix { name = "nginx-pubhtml"; machine = { pkgs, ... }: { + systemd.services.nginx.serviceConfig.ProtectHome = "read-only"; services.nginx.enable = true; services.nginx.virtualHosts.localhost = { locations."~ ^/\\~([a-z0-9_]+)(/.*)?$".alias = "/home/$1/public_html$2"; From c7106610f14f0620f79758fe1d62cbbb8e989c84 Mon Sep 17 00:00:00 2001 From: Izorkin Date: Thu, 23 Apr 2020 22:00:27 +0300 Subject: [PATCH 4/6] nixos/tests: add nginx-sandbox test --- nixos/tests/all-tests.nix | 1 + nixos/tests/nginx-sandbox.nix | 65 +++++++++++++++++++++++++++++++++++ 2 files changed, 66 insertions(+) create mode 100644 nixos/tests/nginx-sandbox.nix diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index 5a0c9d1afae..045f2f3846d 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -225,6 +225,7 @@ in nginx = handleTest ./nginx.nix {}; nginx-etag = handleTest ./nginx-etag.nix {}; nginx-pubhtml = handleTest ./nginx-pubhtml.nix {}; + nginx-sandbox = handleTestOn ["x86_64-linux"] ./nginx-sandbox.nix {}; nginx-sso = handleTest ./nginx-sso.nix {}; nix-ssh-serve = handleTest ./nix-ssh-serve.nix {}; nixos-generate-config = handleTest ./nixos-generate-config.nix {}; diff --git a/nixos/tests/nginx-sandbox.nix b/nixos/tests/nginx-sandbox.nix new file mode 100644 index 00000000000..514318c9456 --- /dev/null +++ b/nixos/tests/nginx-sandbox.nix @@ -0,0 +1,65 @@ +import ./make-test-python.nix ({ pkgs, ... }: { + name = "nginx-sandbox"; + meta = with pkgs.stdenv.lib.maintainers; { + maintainers = [ izorkin ]; + }; + + # This test checks the creation and reading of a file in sandbox mode. Used simple lua script. + + machine = { pkgs, ... }: { + nixpkgs.overlays = [ + (self: super: { + nginx-lua = super.nginx.override { + modules = [ + pkgs.nginxModules.lua + ]; + }; + }) + ]; + services.nginx.enable = true; + services.nginx.package = pkgs.nginx-lua; + services.nginx.virtualHosts.localhost = { + extraConfig = '' + location /test1-write { + content_by_lua_block { + local create = os.execute('${pkgs.coreutils}/bin/mkdir /tmp/test1-read') + local create = os.execute('${pkgs.coreutils}/bin/touch /tmp/test1-read/foo.txt') + local echo = os.execute('${pkgs.coreutils}/bin/echo worked > /tmp/test1-read/foo.txt') + } + } + location /test1-read { + root /tmp; + } + location /test2-write { + content_by_lua_block { + local create = os.execute('${pkgs.coreutils}/bin/mkdir /var/web/test2-read') + local create = os.execute('${pkgs.coreutils}/bin/touch /var/web/test2-read/bar.txt') + local echo = os.execute('${pkgs.coreutils}/bin/echo error-worked > /var/web/test2-read/bar.txt') + } + } + location /test2-read { + root /var/web; + } + ''; + }; + users.users.foo.isNormalUser = true; + }; + + testScript = '' + machine.wait_for_unit("nginx") + machine.wait_for_open_port(80) + + # Checking write in temporary folder + machine.succeed("$(curl -vvv http://localhost/test1-write)") + machine.succeed('test "$(curl -fvvv http://localhost/test1-read/foo.txt)" = worked') + + # Checking write in protected folder. In sandbox mode for the nginx service, the folder /var/web is mounted + # in read-only mode. + machine.succeed("mkdir -p /var/web") + machine.succeed("chown nginx:nginx /var/web") + machine.succeed("$(curl -vvv http://localhost/test2-write)") + assert "404 Not Found" in machine.succeed( + "curl -vvv -s http://localhost/test2-read/bar.txt" + ) + ''; +}) From aa12fb8adb312943a0ce8a059ce47733249eb5fe Mon Sep 17 00:00:00 2001 From: Izorkin Date: Mon, 11 May 2020 14:29:16 +0300 Subject: [PATCH 5/6] nginxModules: add option allowMemoryWriteExecute The allowMemoryWriteExecute option is required to checking enabled nginxModules and disable the nginx sandbox mode MemoryDenyWriteExecute. --- nixos/modules/services/web-servers/nginx/default.nix | 2 +- pkgs/servers/http/nginx/modules.nix | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix index 16c56dc745f..75fe1df506b 100644 --- a/nixos/modules/services/web-servers/nginx/default.nix +++ b/nixos/modules/services/web-servers/nginx/default.nix @@ -724,7 +724,7 @@ in ProtectControlGroups = true; RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ]; LockPersonality = true; - MemoryDenyWriteExecute = mkDefault true; + MemoryDenyWriteExecute = !(builtins.any (mod: (mod.allowMemoryWriteExecute or false)) pkgs.nginx.modules); RestrictRealtime = true; RestrictSUIDSGID = true; PrivateMounts = true; diff --git a/pkgs/servers/http/nginx/modules.nix b/pkgs/servers/http/nginx/modules.nix index 16782966944..1111990435a 100644 --- a/pkgs/servers/http/nginx/modules.nix +++ b/pkgs/servers/http/nginx/modules.nix @@ -140,6 +140,7 @@ in export LUAJIT_LIB="${pkgs.luajit}/lib" export LUAJIT_INC="${pkgs.luajit}/include/luajit-2.0" ''; + allowMemoryWriteExecute = true; }; lua-upstream = { @@ -150,6 +151,7 @@ in sha256 = "1gqccg8airli3i9103zv1zfwbjm27h235qjabfbfqk503rjamkpk"; }; inputs = [ pkgs.luajit ]; + allowMemoryWriteExecute = true; }; modsecurity = { @@ -246,6 +248,7 @@ in in { src = ngx_pagespeed; inputs = [ pkgs.zlib pkgs.libuuid ]; # psol deps + allowMemoryWriteExecute = true; }; pam = { From 94391fce1d5c4580482271c2b49ecffdef38b017 Mon Sep 17 00:00:00 2001 From: Izorkin Date: Tue, 12 May 2020 15:02:57 +0300 Subject: [PATCH 6/6] nixos/nginx: add option enableSandbox --- nixos/doc/manual/release-notes/rl-2009.xml | 4 ++-- nixos/modules/services/web-servers/nginx/default.nix | 9 +++++++++ nixos/tests/nginx-sandbox.nix | 1 + 3 files changed, 12 insertions(+), 2 deletions(-) diff --git a/nixos/doc/manual/release-notes/rl-2009.xml b/nixos/doc/manual/release-notes/rl-2009.xml index 71edc7f0f00..5b1d04e4bc1 100644 --- a/nixos/doc/manual/release-notes/rl-2009.xml +++ b/nixos/doc/manual/release-notes/rl-2009.xml @@ -237,8 +237,8 @@ php.override { - Nginx web server is now started with additional sandbox/hardening options. By default, write access to - services.nginx.stateDir is allowed. To allow writing to other folders, + Add option services.nginx.enableSandbox to starting Nginx web server with additional sandbox/hardening options. + By default, write access to services.nginx.stateDir is allowed. To allow writing to other folders, use systemd.services.nginx.serviceConfig.ReadWritePaths systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www" ]; diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix index 75fe1df506b..312d2b0a21a 100644 --- a/nixos/modules/services/web-servers/nginx/default.nix +++ b/nixos/modules/services/web-servers/nginx/default.nix @@ -463,6 +463,14 @@ in ''; }; + enableSandbox = mkOption { + default = false; + type = types.bool; + description = '' + Starting Nginx web server with additional sandbox/hardening options. + ''; + }; + user = mkOption { type = types.str; default = "nginx"; @@ -713,6 +721,7 @@ in CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" "CAP_SYS_RESOURCE" ]; # Security NoNewPrivileges = true; + } // optionalAttrs cfg.enableSandbox { # Sandboxing ProtectSystem = "strict"; ProtectHome = mkDefault true; diff --git a/nixos/tests/nginx-sandbox.nix b/nixos/tests/nginx-sandbox.nix index 514318c9456..bc9d3ba8add 100644 --- a/nixos/tests/nginx-sandbox.nix +++ b/nixos/tests/nginx-sandbox.nix @@ -18,6 +18,7 @@ import ./make-test-python.nix ({ pkgs, ... }: { ]; services.nginx.enable = true; services.nginx.package = pkgs.nginx-lua; + services.nginx.enableSandbox = true; services.nginx.virtualHosts.localhost = { extraConfig = '' location /test1-write {