ca0120a4bc
So far, we have been building Systemd without `BPF_FRAMEWORK`. As a
result, some Systemd features like `RestrictNetworkInterfaces=` cannot
work. To make things worse, Systemd doesn't even complain when using a
feature which requires `+BPF_FRAMEWORK`; yet, the option has no effect:
# systemctl --version | grep -o "\-BPF_FRAMEWORK"
-BPF_FRAMEWORK
# systemd-run -t -p RestrictNetworkInterfaces="lo" ping -c 1 8.8.8.8
This commit enables `BPF_FRAMEWORK` by default. This is in line with
other distros (e.g., Fedora). Also note that BPF does not support stack
protector: https://lkml.org/lkml/2020/2/21/1000. To that end, I added a
small `CFLAGS` patch to the BPF building to keep using stack protector
as a default.
I also added an appropriate NixOS test.
42 lines
1.2 KiB
Nix
42 lines
1.2 KiB
Nix
import ./make-test-python.nix ({ lib, ... }: {
|
|
name = "systemd-bpf";
|
|
meta = with lib.maintainers; {
|
|
maintainers = [ veehaitch ];
|
|
};
|
|
nodes = {
|
|
node1 = {
|
|
virtualisation.vlans = [ 1 ];
|
|
networking = {
|
|
useNetworkd = true;
|
|
useDHCP = false;
|
|
firewall.enable = false;
|
|
interfaces.eth1.ipv4.addresses = [
|
|
{ address = "192.168.1.1"; prefixLength = 24; }
|
|
];
|
|
};
|
|
};
|
|
|
|
node2 = {
|
|
virtualisation.vlans = [ 1 ];
|
|
networking = {
|
|
useNetworkd = true;
|
|
useDHCP = false;
|
|
firewall.enable = false;
|
|
interfaces.eth1.ipv4.addresses = [
|
|
{ address = "192.168.1.2"; prefixLength = 24; }
|
|
];
|
|
};
|
|
};
|
|
};
|
|
|
|
testScript = ''
|
|
start_all()
|
|
node1.wait_for_unit("systemd-networkd-wait-online.service")
|
|
node2.wait_for_unit("systemd-networkd-wait-online.service")
|
|
|
|
with subtest("test RestrictNetworkInterfaces= works"):
|
|
node1.succeed("ping -c 5 192.168.1.2")
|
|
node1.succeed("systemd-run -t -p RestrictNetworkInterfaces='eth1' ping -c 5 192.168.1.2")
|
|
node1.fail("systemd-run -t -p RestrictNetworkInterfaces='lo' ping -c 5 192.168.1.2")
|
|
'';
|
|
})
|