Commit c9ea864d authored by Will Fancher's avatar Will Fancher
Browse files

nixos/shutdown: Create /run/initramfs with mode 0700

parent 93b98639

nixos/modules/system/boot/systemd/shutdown.nix

+1 −0
Original line number Diff line number Diff line
@@ -52,6 +52,7 @@ in 
        what = "tmpfs";

        where = "/run/initramfs";

        type = "tmpfs";

        options = "mode=0700";

      }

    ];

nixos/tests/systemd-shutdown.nix

+8 −0
Original line number Diff line number Diff line
@@ -23,6 +23,8 @@ import ./make-test-python.nix ( 
    };



    testScript = ''

      # Check that 'generate-shutdown-ramfs.service' is started

      # automatically and that 'systemd-shutdown' runs our script.

      machine.wait_for_unit("multi-user.target")

      # .shutdown() would wait for the machine to power off

      machine.succeed("systemctl poweroff")
@@ -31,6 +33,12 @@ import ./make-test-python.nix ( 
      machine.wait_for_console_text("${msg}")

      # Don't try to sync filesystems

      machine.wait_for_shutdown()



      # In a separate boot, start 'generate-shutdown-ramfs.service'

      # manually in order to check the permissions on '/run/initramfs'.

      machine.systemctl("start generate-shutdown-ramfs.service")

      stat = machine.succeed("stat --printf=%a:%u:%g /run/initramfs")

      assert stat == "700:0:0", f"Improper permissions on /run/initramfs: {stat}"

    '';

  }

)