From a4193dba8fca54fe6cfd9a6c70430c3df249a4b0 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Thu, 9 May 2024 16:09:01 +0200 Subject: [PATCH 1/6] nixos/pretix: fix state directory mode The state directory contains static files that need to be accessible by a webserver, but homeMode defaults to 0750 and switching the generation will always force the homeMode, thereby breaking access to the assets. Instead, fully rely on systemd to provide the StateDirectory with the correct mode. --- nixos/modules/services/web-apps/pretix.nix | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/nixos/modules/services/web-apps/pretix.nix b/nixos/modules/services/web-apps/pretix.nix index 22ee9769aa92..0e8e4cac6782 100644 --- a/nixos/modules/services/web-apps/pretix.nix +++ b/nixos/modules/services/web-apps/pretix.nix @@ -569,11 +569,9 @@ in }; users = { - groups."${cfg.group}" = {}; - users."${cfg.user}" = { + groups.${cfg.group} = {}; + users.${cfg.user} = { isSystemUser = true; - createHome = true; - home = cfg.settings.pretix.datadir; inherit (cfg) group; }; }; From b4b316561944d9916be8c40bcd70a7dc672ca067 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Thu, 9 May 2024 16:13:13 +0200 Subject: [PATCH 2/6] nixos/pretalx: fix state directory mode The state directory contains static files that need to be accessible by a webserver, but homeMode defaults to 0750 and switching the generation will always force the homeMode, thereby breaking access to the assets. Instead, fully rely on systemd to provide the StateDirectory with the correct mode. --- nixos/modules/services/web-apps/pretalx.nix | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/nixos/modules/services/web-apps/pretalx.nix b/nixos/modules/services/web-apps/pretalx.nix index b062a8b7eeea..e0ce6e72e1b5 100644 --- a/nixos/modules/services/web-apps/pretalx.nix +++ b/nixos/modules/services/web-apps/pretalx.nix @@ -329,7 +329,11 @@ in serviceConfig = { User = "pretalx"; Group = "pretalx"; - StateDirectory = [ "pretalx" "pretalx/media" ]; + StateDirectory = [ + "pretalx" + "pretalx/media" + ]; + StateDirectoryMode = "0750"; LogsDirectory = "pretalx"; WorkingDirectory = cfg.settings.filesystem.data; SupplementaryGroups = [ "redis-pretalx" ]; @@ -403,11 +407,9 @@ in }; users = { - groups."${cfg.group}" = {}; - users."${cfg.user}" = { + groups.${cfg.group} = {}; + users.${cfg.user} = { isSystemUser = true; - createHome = true; - home = cfg.settings.filesystem.data; inherit (cfg) group; }; }; From 82f2cc74894c7e330464351e2f6ef596f49b833e Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Thu, 9 May 2024 17:24:43 +0200 Subject: [PATCH 3/6] nixos/pretalx: set up hardening --- nixos/modules/services/web-apps/pretalx.nix | 35 +++++++++++++++++++++ 1 file changed, 35 insertions(+) diff --git a/nixos/modules/services/web-apps/pretalx.nix b/nixos/modules/services/web-apps/pretalx.nix index e0ce6e72e1b5..ee1236391d81 100644 --- a/nixos/modules/services/web-apps/pretalx.nix +++ b/nixos/modules/services/web-apps/pretalx.nix @@ -337,6 +337,39 @@ in LogsDirectory = "pretalx"; WorkingDirectory = cfg.settings.filesystem.data; SupplementaryGroups = [ "redis-pretalx" ]; + AmbientCapabilities = ""; + CapabilityBoundingSet = [ "" ]; + DevicePolicy = "closed"; + LockPersonality = true; + MemoryDenyWriteExecute = true; + NoNewPrivileges = true; + PrivateDevices = true; + PrivateTmp = true; + ProcSubset = "pid"; + ProtectControlGroups = true; + ProtectHome = true; + ProtectHostname = true; + ProtectKernelLogs = true; + ProtectKernelModules = true; + ProtectKernelTunables = true; + ProtectProc = "invisible"; + ProtectSystem = "strict"; + RemoveIPC = true; + RestrictAddressFamilies = [ + "AF_INET" + "AF_INET6" + "AF_UNIX" + ]; + RestrictNamespaces = true; + RestrictRealtime = true; + RestrictSUIDSGID = true; + SystemCallArchitectures = "native"; + SystemCallFilter = [ + "@system-service" + "~@privileged" + "@chown" + ]; + UMask = "0027"; }; }; in { @@ -399,6 +432,8 @@ in wantedBy = [ "multi-user.target" ]; serviceConfig.ExecStart = "${lib.getExe' pythonEnv "celery"} -A pretalx.celery_app worker ${cfg.celery.extraArgs}"; }); + + nginx.serviceConfig.SupplementaryGroups = lib.mkIf cfg.nginx.enable [ "pretalx" ]; }; systemd.sockets.pretalx-web.socketConfig = { From e2ccc754aca06b4d12e6f3d70845cda36133b0c5 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Thu, 9 May 2024 17:24:58 +0200 Subject: [PATCH 4/6] nixos/tests/pretalx: test cli wrapper and print systemd unit security --- nixos/tests/web-apps/pretalx.nix | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/nixos/tests/web-apps/pretalx.nix b/nixos/tests/web-apps/pretalx.nix index a226639b076b..76e261b2207e 100644 --- a/nixos/tests/web-apps/pretalx.nix +++ b/nixos/tests/web-apps/pretalx.nix @@ -27,5 +27,9 @@ pretalx.wait_for_unit("pretalx-worker.service") pretalx.wait_until_succeeds("curl -q --fail http://talks.local/orga/") + + pretalx.succeed("pretalx-manage --help") + + pretalx.log(pretalx.succeed("systemd-analyze security pretalx-web.service")) ''; } From 9afcf733f3ba0dc84dfea3bc012c2779da8bd222 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Thu, 9 May 2024 17:25:59 +0200 Subject: [PATCH 5/6] nixos/pretix: update hardening - Transition from world-readable to group-readable UMask - Remove world permissions from state directory --- nixos/modules/services/web-apps/pretix.nix | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/nixos/modules/services/web-apps/pretix.nix b/nixos/modules/services/web-apps/pretix.nix index 0e8e4cac6782..498face7456d 100644 --- a/nixos/modules/services/web-apps/pretix.nix +++ b/nixos/modules/services/web-apps/pretix.nix @@ -468,7 +468,7 @@ in StateDirectory = [ "pretix" ]; - StateDirectoryMode = "0755"; + StateDirectoryMode = "0750"; CacheDirectory = "pretix"; LogsDirectory = "pretix"; WorkingDirectory = cfg.settings.pretix.datadir; @@ -507,7 +507,7 @@ in "~@privileged" "@chown" ]; - UMask = "0022"; + UMask = "0027"; }; }; in { @@ -561,6 +561,8 @@ in wantedBy = [ "multi-user.target" ]; serviceConfig.ExecStart = "${getExe' pythonEnv "celery"} -A pretix.celery_app worker ${cfg.celery.extraArgs}"; }; + + nginx.serviceConfig.SupplementaryGroups = mkIf cfg.nginx.enable [ "pretix" ]; }; systemd.sockets.pretix-web.socketConfig = { From 622af635bb4e1c65b39bba4a0cbcb0334edb4952 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Thu, 9 May 2024 17:59:33 +0200 Subject: [PATCH 6/6] pretalx: adopt and set up code ownership --- .github/CODEOWNERS | 3 +++ nixos/modules/services/web-apps/pretalx.nix | 2 +- pkgs/by-name/pr/pretalx/package.nix | 2 +- 3 files changed, 5 insertions(+), 2 deletions(-) diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 3d45e69971b1..71176023cc74 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -345,8 +345,11 @@ pkgs/development/tools/continuous-integration/buildbot @Mic92 @zowoq # Pretix pkgs/by-name/pr/pretix/ @mweinelt +pkgs/by-name/pr/pretalx/ @mweinelt nixos/modules/services/web-apps/pretix.nix @mweinelt +nixos/modules/services/web-apps/pretalx.nix @mweinelt nixos/tests/web-apps/pretix.nix @mweinelt +nixos/tests/web-apps/pretalx.nix @mweinelt # incus/lxc/lxd nixos/maintainers/scripts/lxd/ @adamcstephens diff --git a/nixos/modules/services/web-apps/pretalx.nix b/nixos/modules/services/web-apps/pretalx.nix index ee1236391d81..d0b1512f77c5 100644 --- a/nixos/modules/services/web-apps/pretalx.nix +++ b/nixos/modules/services/web-apps/pretalx.nix @@ -24,7 +24,7 @@ in { meta = with lib; { - maintainers = teams.c3d2.members; + maintainers = with maintainers; [ hexa] ++ teams.c3d2.members; }; options.services.pretalx = { diff --git a/pkgs/by-name/pr/pretalx/package.nix b/pkgs/by-name/pr/pretalx/package.nix index 266beb9364ba..78b2f8d4df0b 100644 --- a/pkgs/by-name/pr/pretalx/package.nix +++ b/pkgs/by-name/pr/pretalx/package.nix @@ -42,7 +42,7 @@ let homepage = "https://github.com/pretalx/pretalx"; changelog = "https://docs.pretalx.org/en/latest/changelog.html"; license = licenses.asl20; - maintainers = teams.c3d2.members; + maintainers = with maintainers; [ hexa] ++ teams.c3d2.members; platforms = platforms.linux; };