Erik Arvstedt
588a0b2405
security: enable full systemd-status for group 'proc'
...
Previously, systemd-status was broken for all users except root.
Use a 'default' deny policy, which is overridden for group 'proc'.
Add operator to group 'proc'.
Also, remove redundant XML boilerplate.
2020-08-20 13:12:06 +02:00
Erik Arvstedt
96ea2e671c
security: simplify and fix dbus configuration
...
Previously, due to the dependency on a helper service, this dbus config
was initially inactive after system boot, allowing for unrestricted use
of the problematic dbus call.
This also broke the accompanying VM test on faster systems.
Remove 'allow' policy for root because it's a no-op:
1. It's overridden by the 'mandatory' deny policy.
2. Root can use all dbus calls anyways, regardless of policy settings.
Also, add some comments.
2020-08-20 13:12:06 +02:00
Erik Arvstedt
343e026030
rename dbus.nix -> security.nix
...
This file has a broader scope than just configuring dbus.
2020-08-20 13:12:06 +02:00
Erik Arvstedt
7367446761
test: rename assert_matches_exactly -> assert_full_match
...
More precise, needed in a later commit.
2020-08-20 13:12:05 +02:00
Jonas Nick
dd78d2b2a1
Add --dry-run option to push-release script
2020-08-18 08:36:19 +00:00
Jonas Nick
72000b4a99
Merge #200 : backups: add module
...
22c3fd52e1e4fb7a52de22c3fd52e1
2020-08-04 15:38:44 +00:00
nixbitcoin
22c3fd52e1
backups: add feature test
2020-08-04 15:25:39 +00:00
nixbitcoin
e4fb7a52de
backups: add module
2020-08-04 15:25:37 +00:00
Jonas Nick
62f83a71b8
Merge #218 : Fix typos
...
df89ceed39df89ceed39
2020-08-04 15:13:09 +00:00
Jonas Nick
3f53d7da40
Merge #217 : Concurrent LN
...
e650df30d546e15ee9ccac96fd59db3ed564ea06716e98789c43da15557dd99ccc8445e650df30d5
2020-08-04 15:10:07 +00:00
nixbitcoin
e650df30d5
bitcoind: bump rpcthread count
2020-08-04 14:46:57 +00:00
nixbitcoin
46e15ee9cc
tests: make lnd & clightning tests run concurrently
2020-08-04 14:07:12 +00:00
nixbitcoin
ac96fd59db
assertions: make lnd.enable depend on !clightning.enable or port != 9735
2020-08-04 14:07:10 +00:00
nixbitcoin
3ed564ea06
lnd: make listen IP address only
2020-08-04 14:07:08 +00:00
nixbitcoin
716e98789c
lnd: add listenPort option
2020-08-04 14:07:06 +00:00
nixbitcoin
43da15557d
clightning: refactor bind-addr to be IP address only
...
With typecheck
2020-08-04 14:07:02 +00:00
practicalswift
df89ceed39
Fix typos
2020-08-04 13:32:06 +00:00
nixbitcoin
d99ccc8445
clightning: add bindport option
2020-08-04 12:42:57 +00:00
Jonas Nick
b6179639fe
Merge #215 : Improve abstraction in test scenarios
...
4ece2da8db5c0170c6b85fa0602a186f9349b0a43d2b366156e13c532dbf4ece2da8db
2020-08-04 12:42:16 +00:00
Jonas Nick
4ece2da8db
tests: move nginx check in scenarios lib
2020-08-04 12:17:47 +00:00
Jonas Nick
5c0170c6b8
tests: add post-clightning extra tests to scenarios
2020-08-04 12:17:47 +00:00
Jonas Nick
5fa0602a18
tests: add extra_tests argument to scenario lib run_tests()
2020-08-04 12:17:47 +00:00
Jonas Nick
6f9349b0a4
tests: create run_tests() function in the scenario lib
2020-08-02 21:20:51 +00:00
Jonas Nick
3d2b366156
tests: move common code in tests to lib
2020-08-02 21:12:45 +00:00
Jonas Nick
e13c532dbf
tests: move common code of scenarios python scripts to the top
2020-08-02 20:59:11 +00:00
Jonas Nick
0baeb2acce
Merge #209 : Lightning loop
...
e9204946d4491d83a6588f3588b13f1bb801ad7be9204946d4
2020-07-28 20:02:12 +00:00
Jonas Nick
9e453bab86
Merge #202 : RPC Whitelist
...
5086fc323421c0fb440d1bf45a95475a978a28365086fc3234
2020-07-28 17:38:07 +00:00
nixbitcoin
e9204946d4
lightning-loop: add tests
2020-07-28 15:55:54 +00:00
nixbitcoin
491d83a658
lightning-loop: add module
2020-07-28 15:55:52 +00:00
nixbitcoin
8f3588b13f
lnd: higher attempt limit for less-powerful machines
...
Opening main database sometimes takes longer than 50 ExecStartPost
restPort connection attempts.
2020-07-28 15:55:50 +00:00
nixbitcoin
1bb801ad7b
lightning-loop: add pkg
2020-07-28 15:55:48 +00:00
nixbitcoin
5086fc3234
bitcoin: drive-by prune fix
2020-07-28 14:32:54 +00:00
nixbitcoin
21c0fb440d
rpcwhitelist: add feature test
2020-07-28 14:32:52 +00:00
nixbitcoin
1bf45a9547
bitcoind: add rpcwhitelist feature
...
Default behavior for rpc whitelisting is set to 0, which means that
rpcwhitelisting is only enforced for rpc users for whom an `rpcwhitelist`
exists.
2020-07-28 14:32:50 +00:00
nixbitcoin
5a978a2836
bitcoind: switch from rpcpassword to rpcauth
...
Includes bitcoind's `share/rpcauth` to convert apg generated passwords
into salted HMAC-SHA-256 hashed passwords.
2020-07-28 14:32:47 +00:00
Jonas Nick
272b8568e7
Merge #213 : Fix systemd leak
...
6a8e29e0160248e6493f6a8e29e016
2020-07-28 12:58:07 +00:00
nixbitcoin
6a8e29e016
tests: add dbus-hardening and hideProcessInformation
2020-07-28 11:37:16 +00:00
nixbitcoin
0248e6493f
systemd: lock down systemctl status
...
Mitigates a security issue that allows unprivileged users to read other
unprivileged user's processes' credentials from CGroup using `systemctl
status`.
2020-07-28 11:28:09 +00:00
Jonas Nick
6e694890eb
Merge #203 : Remove electrs tls
...
63654123124dbc348921
2020-07-21 15:04:22 +00:00
nixbitcoin
6365412312
test-script: remove nginx tls proxy test
2020-07-21 13:58:32 +00:00
nixbitcoin
4dbc348921
electrs: remove TLSProxy
...
https://github.com/spesmilo/electrum/issues/5278 was resolved
2020-07-21 13:41:03 +00:00
Jonas Nick
6856b8cb42
Merge #210 : bitcoind: postStart wait until bitcoind can receive rpc calls
...
02853067a102853067a1
2020-07-21 13:26:51 +00:00
nixbitcoin
02853067a1
bitcoind: postStart wait until bitcoind can receive rpc calls
2020-07-21 13:23:07 +00:00
Jonas Nick
aad0fe6e45
Merge #187 : Network Namespaces
...
681728294b43ce847e2b8783f38fba25adce29e5c542b92e55ef89607704582cb86d747369f0a7ecc4ab73d51fd6296acabac0b02ac93a672a416ede4b8ca52647c55296433df3d2aaa5d43c0c446547ae1230e13b65b5dab3d4515aae282575ca6f186ce5e07b91f74a7199a3da681728294b
2020-07-21 12:05:50 +00:00
nixbitcoin
681728294b
tests: run scenarios as multiple Travis jobs
2020-07-21 09:39:01 +00:00
nixbitcoin
43ce847e2b
tests: allow running integration tests with different configurations
2020-07-21 09:38:59 +00:00
nixbitcoin
8783f38fba
tests: add netns to testing framework
2020-07-21 09:38:57 +00:00
nixbitcoin
25adce29e5
secure-node: only mkHiddenServices if services are enabled
2020-07-21 09:38:55 +00:00
nixbitcoin
c542b92e55
nginx: add netns
...
- Adds nginx to netns-isolation.services
- Adds host option (defaults to localhost) as target of hidden service
2020-07-21 09:38:53 +00:00
nixbitcoin
ef89607704
recurring-donations: add netns
...
- Adds recurring-donations to netns-isolation.services
- Adds cfg.enforceTor to bring recurring-donations in line with other
services
- Removes torsocks dependency in favor of `curl --socks-hostname`
2020-07-21 09:38:51 +00:00
