feature: add NixOS integration tests via GitHub Actions#314
Conversation
NxOS users frequently report sandbox failures due to Nix's unique filesystem layout (/nix/store binaries, symlink chains, wrapper scripts). Add a dedicated CI workflow that installs Nix on ubuntu-latest and tests the nono binary against Nix-installed programs. Test suite covers: - Binary execution from /nix/store paths (#19) - Dynamic linker shared library loading via openat(dirfd) (#205, #262) - Wrapper script resolution to correct runtime (#287) - Symlink chain traversal through ~/.nix-profile (#76) - nix_runtime policy group validation The test suite auto-skips on non-Nix systems, so adding it to the main SUITES array is safe for existing macOS integration runs. Refs: #19, #76, #93, #205, #262, #287 Signed-off-by: Luke Hinds <lukehinds@gmail.com>
lukehinds
changed the title
lukehinds
changed the title
Signed-off-by: Luke Hinds <lukehinds@gmail.com>
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request introduces comprehensive integration tests for NixOS environments to address and prevent sandbox failures caused by Nix's unique filesystem structure. By adding a dedicated CI workflow, it ensures that the Highlights
Changelog
Ignored Files
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
The pull request introduces dedicated integration tests for NixOS, which is a significant improvement for ensuring nono's compatibility with Nix's unique filesystem layout. The new test_nix_paths.sh script covers important scenarios like binary execution from /nix/store, dynamic linker behavior, wrapper script resolution, and symlink chain traversal. The addition of require_nix and nix_realpath helpers in test_helpers.sh is also valuable. The new run_nix_integration_tests.sh provides a clear entry point for these specific tests. Overall, this is a well-structured and necessary addition to the test suite.
| local cmd="$1" | ||
| local path | ||
| path=$(command -v "$cmd" 2>/dev/null) || return 1 | ||
| readlink -f "$path" 2>/dev/null || realpath "$path" 2>/dev/null || echo "$path" |
There was a problem hiding this comment.
The nix_realpath function falls back to echo "$path" if readlink -f and realpath both fail. If the primary goal of nix_realpath is to resolve a command to its canonical /nix/store path, then failing to do so should probably be treated as an error. Returning the original path might lead to tests passing under false assumptions if nono is expected to interact with the canonical /nix/store path but receives a different, unresolved path.
| readlink -f "$path" 2>/dev/null || realpath "$path" 2>/dev/null || echo "$path" | |
| readlink -f "$path" 2>/dev/null || realpath "$path" 2>/dev/null || { echo "Error: Could not resolve real path for $cmd"; return 1; } |
| if [[ -L "$NIX_PROFILE" || -d "$NIX_PROFILE" ]]; then | ||
| # The profile itself should be listable | ||
| expect_success "list ~/.nix-profile/bin" \ | ||
| "$NONO_BIN" run --read /nix --read "$HOME/.nix-profile" --read "$HOME/.local/state" --allow "$TMPDIR" -- \ |
There was a problem hiding this comment.
The --read "$HOME/.local/state" argument seems specific to the python3 test case and might not be universally required for ~/.nix-profile access. To adhere to the principle of least privilege, consider if this read permission is strictly necessary for the ls command on ~/.nix-profile/bin or if it can be scoped more narrowly to only the python3 execution if needed.
* feat: ABI-aware Landlock capability system (#256, #306) Replace the hardcoded TARGET_ABI V5 constant with runtime ABI detection that probes V6 down to V1 using HardRequirement. The detected ABI is threaded through sandbox application so access flags are intersected with what the kernel actually supports, with tracing warnings when flags are dropped. This makes enforcement degradation explicit instead of relying on the landlock crate's silent BestEffort flag masking. apply_with_abi() uses HardRequirement for filesystem handle_access(), so passing a forged or stale ABI higher than the kernel supports will fail rather than silently dropping flags. Supersede the IoctlDev fix from #310 (hardcoded TTY path list) with stat()-based device detection: IoctlDev is granted only when the path is an actual char/block device or a directory under /dev, checked at rule-addition time. Remove /dev/pts from system_write_linux in policy.json — /dev/tty (the process's controlling terminal) is sufficient for the base policy. Programs needing PTY allocation can add /dev/pts in their specific profiles. Library changes: - Add DetectedAbi struct with feature query methods (has_refer, has_truncate, has_network, has_ioctl_dev, has_scoping) - Add detect_abi() probing V6..V1 with HardRequirement - Add apply_with_abi() with kernel-validated ABI - Add is_device_path() and is_device_directory() for selective IoctlDev grants - Remove IoctlDev from generic Write flags and #310's is_tty_device_path / access_to_landlock_for_capability - Update is_supported() and support_info() to use detect_abi() CLI changes: - Replace local probe_landlock_abi / probe_landlock_abi_candidate / select_highest_supported_landlock_abi / landlock_feature_lines with library detect_abi() and DetectedAbi - Add ABI info to banner output on Linux (version + features + degraded) - Direct mode uses apply_with_abi() with pre-detected ABI - Remove /dev/pts from system_write_linux base policy Closes #256 #306 Signed-off-by: Luke Hinds <lukehinds@gmail.com> * fix:rebased Landlock ABI follow-up resolving the remaining sandbox/linux merge state and keeping the ioctl narrowing intact. This preserves the ABI-aware enforcement changes, removes the broad /dev/pts write grant, and restores the test/build state expected by CI. Signed-off-by: Luke Hinds <lukehinds@gmail.com> * fix: remove stale imports Signed-off-by: Luke Hinds <lukehinds@gmail.com> --------- Signed-off-by: Luke Hinds <lukehinds@gmail.com>
Replace inline nono CLI invocation with the official nono-attest GitHub Action. This consolidates signing logic into a reusable, versioned action and reduces workflow complexity by 25 lines. Signed-off-by: Luke Hinds <lukehinds@gmail.com>
* fix: add uv paths to python_runtime group uv-installed tools and virtual python interpreters couldn't execute due to missing ~/.local/bin and ~/.local/share/uv in the group. Signed-off-by: Frank Denis <github@pureftpd.org> * fix: remove redundant ~/.local/bin from python_runtime, update docs --------- Signed-off-by: Frank Denis <github@pureftpd.org>
Replace the custom tap update job with mislav/bump-homebrew-formula-action to open PRs against Homebrew/homebrew-core on release. Remove brew tap instructions from README, CLI docs, and installation guide. Signed-off-by: Luke Hinds <lukehinds@gmail.com>
Adding pnpm paths to policy.json. This allows pnpm support for MacOS and Linux. Signed-off-by: Robbie Gore <67965823+wrgore@users.noreply.github.com>
Add a bypass mechanism so that specific domains skip the enterprise proxy and connect directly. Supports exact hostnames and `*.` wildcard suffixes (case-insensitive), configurable via CLI flag, environment variable (`NONO_EXTERNAL_PROXY_BYPASS`), or profile JSON. The bypass matcher is built once at startup in ProxyState and checked per-CONNECT before routing. Bypassed connections enforce strict session token validation and go through the standard host filter, preserving the same security guarantees as external-proxy mode. Signed-off-by: Luke Hinds <lukehinds@gmail.com>
Signed-off-by: Luke Hinds <lukehinds@gmail.com>
lukehinds
changed the title
…lution Signed-off-by: Luke Hinds <lukehinds@gmail.com>
* docs: add local Ollama inference setup section Includes changes done in PR nolabs-ai#735. Fixes nolabs-ai#314, nolabs-ai#385 Signed-off-by: Paritosh Dixit <paritoshd@nvidia.com> * docs: fix style and remove stale experimental gate Remove numbered section titles and colons from the Ollama setup section in spark-install.md per doc style guide. Remove the NEMOCLAW_EXPERIMENTAL=1 gate from inference-profiles.md — local providers are GA and the gate no longer exists in source. Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Paritosh Dixit <paritoshd@nvidia.com> --------- Signed-off-by: Paritosh Dixit <paritoshd@nvidia.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
4 participants
NxOS users frequently report sandbox failures due to Nix's unique filesystem layout (/nix/store binaries, symlink chains, wrapper scripts). Add a dedicated CI workflow that installs Nix on ubuntu-latest and tests the nono binary against Nix-installed programs.
Test suite covers:
The test suite auto-skips on non-Nix systems, so adding it to the main SUITES array is safe for existing macOS integration runs.
Refs: #19, #76, #93, #205, #262, #287