nixpkgs/nixos
Martin Weinelt 24adc01e2e
nixos/home-assistant: allow netlink sockets and /proc/net inspection
Since v2021.5.0 home-assistant uses the ifaddr library in the zeroconf
component to enumerate network interfaces via netlink. Since discovery
is all over the place lets allow AF_NETLINK unconditionally.

It also relies on pyroute2 now, which additionally tries to access files
in /proc/net, so we relax ProtectProc a bit by default as well.

This leaves us with these options unsecured:

✗ PrivateNetwork=                                             Service has access to the host's network                                                                 0.5
✗ RestrictAddressFamilies=~AF_(INET|INET6)                    Service may allocate Internet sockets                                                                    0.3
✗ DeviceAllow=                                                Service has a device ACL with some special devices                                                       0.1
✗ IPAddressDeny=                                              Service does not define an IP address allow list                                                         0.2
✗ PrivateDevices=                                             Service potentially has access to hardware devices                                                       0.2
✗ PrivateUsers=                                               Service has access to other users                                                                        0.2
✗ SystemCallFilter=~@resources                                System call allow list defined for service, and @resources is included (e.g. ioprio_set is allowed)      0.2
✗ RestrictAddressFamilies=~AF_NETLINK                         Service may allocate netlink sockets                                                                     0.1
✗ RootDirectory=/RootImage=                                   Service runs within the host's root directory                                                            0.1
✗ SupplementaryGroups=                                        Service runs with supplementary groups                                                                   0.1
✗ RestrictAddressFamilies=~AF_UNIX                            Service may allocate local sockets                                                                       0.1
✗ ProcSubset=                                                 Service has full access to non-process /proc files (/proc subset=)                                       0.1

→ Overall exposure level for home-assistant.service: 1.6 OK 🙂
2021-05-06 16:55:53 +02:00
..
doc formats.ini: Introduce listToValue argument (#121613) 2021-05-04 09:49:25 +02:00
lib nixos/test-driver: Allow interactive testing on Wayland-only setups 2021-05-04 16:23:02 +02:00
maintainers amazonImage: make statically sized again 2021-05-01 02:19:42 +00:00
modules nixos/home-assistant: allow netlink sockets and /proc/net inspection 2021-05-06 16:55:53 +02:00
tests Merge pull request #121437 from primeos/nixos-tests-sway 2021-05-05 13:52:51 +02:00
COPYING
default.nix nixos: fix "nixos-rebuild build-vm-with-bootloader" for EFI systems 2021-01-08 19:36:10 +01:00
README treewide: use https for nixos.org and hydra.nixos.org 2020-05-03 22:14:21 -07:00
release-combined.nix Revert "release-combined.tested: Temporarily remove the Chromium test" 2021-01-24 15:27:49 +01:00
release-small.nix Merge pull request #104322 from grahamc/amazon-image 2020-11-19 18:45:07 -05:00
release.nix nixos/release: add amazonImageAutomaticSize 2021-05-01 02:43:45 +00:00

*** NixOS ***

NixOS is a Linux distribution based on the purely functional package
management system Nix.  More information can be found at
https://nixos.org/nixos and in the manual in doc/manual.