alioth/nixpkgs
3
0
Fork 0
forked from mirrors/nixpkgs
Code Releases Activity

nixos/tests: adopt newest TPM support in test infra

Browse source
This commit is contained in:
Raito Bezarius 2023-04-30 04:02:51 +02:00
parent 25872524f0
commit 83b131bb55
3 changed files with 23 additions and 116 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

59
nixos/tests/systemd-credentials-tpm2.nix
View file

@ -1,13 +1,4 @@
import ./make-test-python.nix ({ lib, pkgs, system, ... }:
let
tpmSocketPath = "/tmp/swtpm-sock";
tpmDeviceModels = {
x86_64-linux = "tpm-tis";
aarch64-linux = "tpm-tis-device";
};
in
import ./make-test-python.nix ({ lib, pkgs, ... }:
{
name = "systemd-credentials-tpm2";
@ -16,51 +7,11 @@ in
};
nodes.machine = { pkgs, ... }: {
virtualisation = {
qemu.options = [
"-chardev socket,id=chrtpm,path=${tpmSocketPath}"
"-tpmdev emulator,id=tpm_dev_0,chardev=chrtpm"
"-device ${tpmDeviceModels.${system}},tpmdev=tpm_dev_0"
];
};
boot.initrd.availableKernelModules = [ "tpm_tis" ];
virtualisation.tpm.enable = true;
environment.systemPackages = with pkgs; [ diffutils ];
};
testScript = ''
import subprocess
from tempfile import TemporaryDirectory
# From systemd-initrd-luks-tpm2.nix
class Tpm:
def __init__(self):
self.state_dir = TemporaryDirectory()
self.start()
def start(self):
self.proc = subprocess.Popen(["${pkgs.swtpm}/bin/swtpm",
"socket",
"--tpmstate", f"dir={self.state_dir.name}",
"--ctrl", "type=unixio,path=${tpmSocketPath}",
"--tpm2",
])
# Check whether starting swtpm failed
try:
exit_code = self.proc.wait(timeout=0.2)
if exit_code is not None and exit_code != 0:
raise Exception("failed to start swtpm")
except subprocess.TimeoutExpired:
pass
"""Check whether the swtpm process exited due to an error"""
def check(self):
exit_code = self.proc.poll()
if exit_code is not None and exit_code != 0:
raise Exception("swtpm process died")
CRED_NAME = "testkey"
CRED_RAW_FILE = f"/root/{CRED_NAME}"
CRED_FILE = f"/root/{CRED_NAME}.cred"
@ -85,12 +36,6 @@ in
machine.log("systemd-run finished successfully")
tpm = Tpm()
@polling_condition
def swtpm_running():
tpm.check()
machine.wait_for_unit("multi-user.target")
with subtest("Check whether TPM device exists"):

53
nixos/tests/systemd-cryptenroll.nix
View file

@ -8,47 +8,34 @@ import ./make-test-python.nix ({ pkgs, ... }: {
environment.systemPackages = [ pkgs.cryptsetup ];
virtualisation = {
emptyDiskImages = [ 512 ];
qemu.options = [
"-chardev socket,id=chrtpm,path=/tmp/swtpm-sock"
"-tpmdev emulator,id=tpm0,chardev=chrtpm"
"-device tpm-tis,tpmdev=tpm0"
];
tpm.enable = true;
};
};
testScript = ''
import subprocess
import tempfile
machine.start()
def start_swtpm(tpmstate):
subprocess.Popen(["${pkgs.swtpm}/bin/swtpm", "socket", "--tpmstate", "dir="+tpmstate, "--ctrl", "type=unixio,path=/tmp/swtpm-sock", "--log", "level=0", "--tpm2"])
# Verify the TPM device is available and accessible by systemd-cryptenroll
machine.succeed("test -e /dev/tpm0")
machine.succeed("test -e /dev/tpmrm0")
machine.succeed("systemd-cryptenroll --tpm2-device=list")
with tempfile.TemporaryDirectory() as tpmstate:
start_swtpm(tpmstate)
machine.start()
# Create LUKS partition
machine.succeed("echo -n lukspass | cryptsetup luksFormat -q /dev/vdb -")
# Enroll new LUKS key and bind it to Secure Boot state
# For more details on PASSWORD variable, check the following issue:
# https://github.com/systemd/systemd/issues/20955
machine.succeed("PASSWORD=lukspass systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=7 /dev/vdb")
# Add LUKS partition to /etc/crypttab to test auto unlock
machine.succeed("echo 'luks /dev/vdb - tpm2-device=auto' >> /etc/crypttab")
# Verify the TPM device is available and accessible by systemd-cryptenroll
machine.succeed("test -e /dev/tpm0")
machine.succeed("test -e /dev/tpmrm0")
machine.succeed("systemd-cryptenroll --tpm2-device=list")
machine.shutdown()
machine.start()
# Create LUKS partition
machine.succeed("echo -n lukspass | cryptsetup luksFormat -q /dev/vdb -")
# Enroll new LUKS key and bind it to Secure Boot state
# For more details on PASSWORD variable, check the following issue:
# https://github.com/systemd/systemd/issues/20955
machine.succeed("PASSWORD=lukspass systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=7 /dev/vdb")
# Add LUKS partition to /etc/crypttab to test auto unlock
machine.succeed("echo 'luks /dev/vdb - tpm2-device=auto' >> /etc/crypttab")
machine.shutdown()
start_swtpm(tpmstate)
machine.start()
# Test LUKS partition automatic unlock on boot
machine.wait_for_unit("systemd-cryptsetup@luks.service")
# Wipe TPM2 slot
machine.succeed("systemd-cryptenroll --wipe-slot=tpm2 /dev/vdb")
# Test LUKS partition automatic unlock on boot
machine.wait_for_unit("systemd-cryptsetup@luks.service")
# Wipe TPM2 slot
machine.succeed("systemd-cryptenroll --wipe-slot=tpm2 /dev/vdb")
'';
})

27
nixos/tests/systemd-initrd-luks-tpm2.nix
View file

@ -9,7 +9,7 @@ import ./make-test-python.nix ({ lib, pkgs, ... }: {
# Booting off the TPM2-encrypted device requires an available init script
mountHostNixStore = true;
useEFIBoot = true;
qemu.options = ["-chardev socket,id=chrtpm,path=/tmp/mytpm1/swtpm-sock -tpmdev emulator,id=tpm0,chardev=chrtpm -device tpm-tis,tpmdev=tpm0"];
tpm.enable = true;
};
boot.loader.systemd-boot.enable = true;
@ -33,29 +33,6 @@ import ./make-test-python.nix ({ lib, pkgs, ... }: {
};
testScript = ''
import subprocess
import os
import time
class Tpm:
def __init__(self):
os.mkdir("/tmp/mytpm1")
self.start()
def start(self):
self.proc = subprocess.Popen(["${pkgs.swtpm}/bin/swtpm", "socket", "--tpmstate", "dir=/tmp/mytpm1", "--ctrl", "type=unixio,path=/tmp/mytpm1/swtpm-sock", "--log", "level=20", "--tpm2"])
def wait_for_death_then_restart(self):
while self.proc.poll() is None:
print("waiting for tpm to die")
time.sleep(1)
assert self.proc.returncode == 0
self.start()
tpm = Tpm()
# Create encrypted volume
machine.wait_for_unit("multi-user.target")
machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -")
@ -66,8 +43,6 @@ import ./make-test-python.nix ({ lib, pkgs, ... }: {
machine.succeed("sync")
machine.crash()
tpm.wait_for_death_then_restart()
# Boot and decrypt the disk
machine.wait_for_unit("multi-user.target")
assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")