From efa8fc2b0a5e94fd22e26c31c82b643d2352e92a Mon Sep 17 00:00:00 2001 From: Eelco Dolstra Date: Thu, 15 Jan 2015 18:36:38 +0100 Subject: [PATCH] Paranoia --- nixos/modules/system/boot/stage-2-init.sh | 1 + nixos/modules/virtualisation/ec2-data.nix | 2 +- nixos/modules/virtualisation/google-compute-image.nix | 2 +- nixos/tests/installer.nix | 3 +++ 4 files changed, 6 insertions(+), 2 deletions(-) diff --git a/nixos/modules/system/boot/stage-2-init.sh b/nixos/modules/system/boot/stage-2-init.sh index 3762bda94a5c..356a440b17ac 100644 --- a/nixos/modules/system/boot/stage-2-init.sh +++ b/nixos/modules/system/boot/stage-2-init.sh @@ -91,6 +91,7 @@ mkdir -m 01777 -p /tmp mkdir -m 0755 -p /var /var/log /var/lib /var/db mkdir -m 0755 -p /nix/var mkdir -m 0700 -p /root +chmod 0700 /root mkdir -m 0755 -p /bin # for the /bin/sh symlink mkdir -m 0755 -p /home mkdir -m 0755 -p /etc/nixos diff --git a/nixos/modules/virtualisation/ec2-data.nix b/nixos/modules/virtualisation/ec2-data.nix index 93a83a3e42af..15114b1e76ac 100644 --- a/nixos/modules/virtualisation/ec2-data.nix +++ b/nixos/modules/virtualisation/ec2-data.nix @@ -44,7 +44,7 @@ with lib; # into the image (a Nova feature). if ! [ -e /root/.ssh/authorized_keys ]; then echo "obtaining SSH key..." - mkdir -p /root/.ssh + mkdir -m 0700 -p /root/.ssh $wget http://169.254.169.254/1.0/meta-data/public-keys/0/openssh-key > /root/key.pub if [ $? -eq 0 -a -e /root/key.pub ]; then if ! grep -q -f /root/key.pub /root/.ssh/authorized_keys; then diff --git a/nixos/modules/virtualisation/google-compute-image.nix b/nixos/modules/virtualisation/google-compute-image.nix index 41c7dd62f3ed..4d493b3896f2 100644 --- a/nixos/modules/virtualisation/google-compute-image.nix +++ b/nixos/modules/virtualisation/google-compute-image.nix @@ -139,7 +139,7 @@ in # Don't download the SSH key if it has already been downloaded if ! [ -e /root/.ssh/authorized_keys ]; then echo "obtaining SSH key..." - mkdir -p /root/.ssh + mkdir -m 0700 -p /root/.ssh ${wget} -O /root/authorized-keys-metadata http://metadata/0.1/meta-data/authorized-keys if [ $? -eq 0 -a -e /root/authorized-keys-metadata ]; then cat /root/authorized-keys-metadata | cut -d: -f2- > /root/key.pub diff --git a/nixos/tests/installer.nix b/nixos/tests/installer.nix index 641ff924e14e..af9e6365a9fe 100644 --- a/nixos/tests/installer.nix +++ b/nixos/tests/installer.nix @@ -190,6 +190,9 @@ let $machine->succeed("test -e /boot/grub"); + # Check whether /root has correct permissions. + $machine->succeed("stat -c '%a' /root") =~ /700/ or die; + # Did the swap device get activated? # uncomment once https://bugs.freedesktop.org/show_bug.cgi?id=86930 is resolved #$machine->waitForUnit("swap.target");