Skip to content

nginxModules: add option disableIPC#163208

Merged
SuperSandro2000 merged 1 commit intoNixOS:masterfrom
Izorkin:fix-modsecurity-nginx
Mar 8, 2022
Merged

nginxModules: add option disableIPC#163208
SuperSandro2000 merged 1 commit intoNixOS:masterfrom
Izorkin:fix-modsecurity-nginx

Conversation

@Izorkin
Copy link
Contributor

@Izorkin Izorkin commented Mar 7, 2022

Description of changes

Disable IPC SystemCallFilter when building nginx with modsecurity-nginx module.
Fixed this error:

nginx-pre-start[95721]: /nix/store/xc7wb1gkk7waa72q54y15irh6m2x9jr5-unit-script-nginx-pre-start/bin/nginx-pre-start: line 4: 95724 Bad system call (core dumped) /nix/store/4pckkyp5pdfp9gs59ch639m8r1csy1nr-nginx-1.21.5-quic/bin/nginx>
systemd[1]: nginx.service: Control process exited, code=exited, status=159/n/a
systemd[1]: nginx.service: Failed with result 'exit-code'.
systemd[1]: Failed to start Nginx Web Server.

Error occurs if modsecurity-crs rules are used.

cc @ajs124 @dasJ @Mic92 @SuperSandro2000 @misuzu @stigtsp

Things done
  • Built on platform(s)
    • x86_64-linux
    • aarch64-linux
    • x86_64-darwin
    • aarch64-darwin
  • For non-Linux: Is sandbox = true set in nix.conf? (See Nix manual)
  • Tested, as applicable:
  • Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
  • Tested basic functionality of all binary files (usually in ./result/bin/)
  • 22.05 Release Notes (or backporting 21.11 Release notes)
    • (Package updates) Added a release notes entry if the change is major or breaking
    • (Module updates) Added a release notes entry if the change is significant
    • (Module addition) Added a release notes entry if adding a new NixOS module
    • (Release notes changes) Ran nixos/doc/manual/md-to-db.sh to update generated release notes
  • Fits CONTRIBUTING.md.

@github-actions github-actions bot added 6.topic: nixos Issues or PRs affecting NixOS modules, or package usability issues specific to NixOS 8.has: module (update) This PR changes an existing module in `nixos/` labels Mar 7, 2022
@ofborg ofborg bot added 10.rebuild-darwin: 0 This PR does not cause any packages to rebuild on Darwin. 10.rebuild-linux: 1-10 This PR causes between 1 and 10 packages to rebuild on Linux. labels Mar 7, 2022
The disableIPC option is required to checking enabled nginxModules
and disable the SystemCallFilter IPC filter.
@Izorkin Izorkin force-pushed the fix-modsecurity-nginx branch from 0401a7f to b672e4d Compare March 8, 2022 11:37
@Izorkin
Copy link
Contributor Author

Izorkin commented Mar 8, 2022

Fixed PR.

@SuperSandro2000 SuperSandro2000 merged commit a879922 into NixOS:master Mar 8, 2022
@Izorkin Izorkin deleted the fix-modsecurity-nginx branch March 8, 2022 13:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

6.topic: nixos Issues or PRs affecting NixOS modules, or package usability issues specific to NixOS 8.has: module (update) This PR changes an existing module in `nixos/` 10.rebuild-darwin: 0 This PR does not cause any packages to rebuild on Darwin. 10.rebuild-linux: 1-10 This PR causes between 1 and 10 packages to rebuild on Linux.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

Comments