Repository navigation
Conversation
![nixpkgs-ci[bot]](https://avatars.githubusercontent.com/u/487568?s=60&v=4){kind=small}
There was a problem hiding this comment.
Thanks for contributing to the documentation.
Follow the documentation style guide, especially:
- Show, don’t tell. Start with a minimal working example. Explain after the code.
- Avoid meta-commentary. Don’t write "This section explains how to…".
- Use present tense, imperative mood, and active voice. For example: "Run the command," not "The user should run the following command."
- Avoid vague references like "this" when the referent is unclear. Write "This command creates a folder," not "This will create a folder."
- Be direct. Avoid "should", "might", "typically", and "usually".
- Cut filler words like "simply", "just", "easily", and "basically". Use "to" instead of "in order to".
For larger changes, such as adding or removing whole sections, ask the NixOS documentation team for review.
Drop hedging language ("should", "some notes on") flagged by the
nixpkgs docs style guide bot on NixOS#568291.
Assisted-by: Claude Code (Sonnet 5, claude-sonnet-5)
762bc76 to
bee82b2
Compare
nixpkgs-ci
Bot
added
10.rebuild-linux: 1-10
|
This pull request has been mentioned on NixOS Discourse. There might be relevant details there: https://discourse.nixos.org/t/prs-ready-for-review/3032/7658 |
|
cc @andersonjoseph, would appreciate a review. |
✅
|
|
This PR touches many things and should not be one big commit. |
bee82b2 to
7ab6926
Compare
thank you. I have splitted this into 6 commits per logical unit |
✅
|
Run cli/fileshare/norduser tests recursively, and run the daemon test suite with an explicit skip list for tests requiring network access, root/CAP_NET_ADMIN, or network state the sandbox does not provide. Join the skip patterns into one quoted regex. Splitting shell string fragments across indented lines left a trailing empty alternative in the first argument, unintentionally skipping all daemon tests. Co-authored-by: different-error <[email protected]> Assisted-by: Claude Code (Sonnet 5, claude-sonnet-5) Assisted-by: OpenCode (GPT-6.1 Sol, openai/gpt-6.1-sol)
Previously relied on them being loaded some other way. Co-authored-by: different-error <[email protected]> Assisted-by: Claude Code (Sonnet 5, claude-sonnet-5)
UNIX stream sockets do not need execute bits. Use 0660 instead of 0770 to retain read/write access for the owner and group. Both modes already deny access to other users. Co-authored-by: different-error <[email protected]> Assisted-by: Claude Code (Sonnet 5, claude-sonnet-5) Assisted-by: OpenCode (GPT-6.1 Sol, openai/gpt-6.1-sol)
Headless/non-graphical sessions were failing to get it started. Co-authored-by: different-error <[email protected]> Assisted-by: Claude Code (Sonnet 5, claude-sonnet-5)
Add ProtectSystem = "strict", RestrictNamespaces, RestrictAddressFamilies, NoNewPrivileges, ProtectControlGroups, DeviceAllow to nordvpnd's unit, and convert AmbientCapabilities/ CapabilityBoundingSet to list form. Keep the reverse-path filtering advice in the documentation: these sandboxing changes do not replace the firewall configuration. Co-authored-by: different-error <[email protected]> Assisted-by: Claude Code (Sonnet 5, claude-sonnet-5) Assisted-by: OpenCode (GPT-6.1 Sol, openai/gpt-6.1-sol)
Assert the exact capability bitmask on the running nordvpnd process (/proc/<pid>/status), verify polkit rules, kernel modules, TUN device access via the service's cgroup, and runtime/state directory ownership+permissions across all four user/group config combinations. Also cover norduserd startup through a lingering user manager without a graphical session, and check that the user can query nordvpn status. Co-authored-by: different-error <[email protected]> Assisted-by: Claude Code (Sonnet 5, claude-sonnet-5) Assisted-by: OpenCode (GPT-6.1 Sol, openai/gpt-6.1-sol)
7ab6926 to
65b1b87
Compare
✅
|
ofborg
Bot
added
the
6.topic: cross-compilation
|
Closing in favor of #547437 — different-error's account is back and they've rebased/revived the original PR this was adapted from. Same change, original author, already has live QA from andersonjoseph. |
Related: original hardening proposal #547437 and meshnet PR #564752.
Tighten
nordvpnd's systemd sandboxing and fix startup and socket-mode issues that predate the meshnet work. The changes are adapted fromdifferent-error's patch, credited viaCo-authored-by; they have been unable to update the original proposal directly due to a disputed account suspension.Changes
tunandwireguardkernel modules instead of relying on another service to load them.ProtectSystem=strict,RestrictNamespaces,RestrictAddressFamilies,NoNewPrivileges,ProtectControlGroups, and an explicit TUNDeviceAllow. Convert capability settings to list form while retaining onlyCAP_NET_ADMIN.nordvpnd.socketfrom0770to0660: UNIX stream sockets need read/write access, not execute bits. Both modes already deny access to other users.norduserdthroughdefault.targetinstead ofgraphical-session.target, so it also starts in non-graphical user sessions.nixosTests.nordvpnto verify process ownership, exact capability bitmasks, polkit rules, loaded kernel modules, TUN device access through the service cgroup, and directory ownership/modes across all four user/group combinations. Add a headless scenario using a lingering user manager without a graphical session.The documentation retains the reverse-path filtering configuration: systemd sandboxing does not replace that firewall setting. This PR remains independent of the meshnet PR.
How to test
Enable
services.nordvpn.enable = true;, add the testing user to thenordvpngroup, and setnetworking.firewall.checkReversePath = "loose";when using the firewall. Build against this PR with:Check
nordvpn statusand inspectsystemctl show nordvpnd.service. A real NordVPN account is required to exercise a VPN connection.AI disclosure
Originally prepared with Claude Code (Claude Sonnet 5 /
claude-sonnet-5), then reviewed and revised with OpenCode using GPT-6.1 Sol (openai/gpt-6.1-sol). AI assistance covered code and test changes, review, commit messages, and this description. Build and VM checks and live-test commands were executed through OpenCode; I performed the privileged activation and restoration of test configurations on my hardware. Relevant commits carryAssisted-by:trailers, anddifferent-error's work retainsCo-authored-by:attribution.Things done
./result/bin/.nixpkgs-reviewon this PR. See nixpkgs-review usage.passthru.tests.Testing performed locally
nordvpn.clionx86_64-linux; the Go test suite passes. Confirmed the daemon tests now execute after fixing the skip regex, includingdaemonanddaemon/dns. The only test indaemon/routes/ifgroupremains excluded because it requires privileged network changes.nixosTests.nordvpn: all six scenarios pass, covering the disabled module, four user/group combinations, and headless startup. In the headless scenario,norduserdis active while the user'sgraphical-session.targetis inactive, andnordvpn statussucceeds as that user.--fail-on-changeon the changed files: zero changes.git diff --checkpasses.x86_64-linuxNixOS 26.05 host with only the NordVPN module/package replaced. Confirmed the sandbox settings, socket mode0660, runtime/state directory mode0750, and active daemons without restarts./proc/<pid>/status: effective, permitted, bounding, inheritable, and ambient capability sets are exactlyCAP_NET_ADMIN(0x1000), withNoNewPrivs=1and seccomp enabled./etc/hosts.The previous nixpkgs-review report built the earlier HEAD on
x86_64-linuxandaarch64-linux. This revision was tested locally onx86_64-linux; I have not runnixpkgs-reviewmyself.