mirror of
https://github.com/NixOS/nixpkgs.git
synced 2024-09-11 15:08:33 +01:00
nixos/pam: add test for ZFS home dataset unlocking
This commit is contained in:
parent
87cbaf7ce3
commit
56e894b0b1
|
@ -564,6 +564,7 @@ in {
|
|||
pam-oath-login = handleTest ./pam/pam-oath-login.nix {};
|
||||
pam-u2f = handleTest ./pam/pam-u2f.nix {};
|
||||
pam-ussh = handleTest ./pam/pam-ussh.nix {};
|
||||
pam-zfs-key = handleTest ./pam/zfs-key.nix {};
|
||||
pass-secret-service = handleTest ./pass-secret-service.nix {};
|
||||
patroni = handleTestOn ["x86_64-linux"] ./patroni.nix {};
|
||||
pantalaimon = handleTest ./matrix/pantalaimon.nix {};
|
||||
|
|
83
nixos/tests/pam/zfs-key.nix
Normal file
83
nixos/tests/pam/zfs-key.nix
Normal file
|
@ -0,0 +1,83 @@
|
|||
import ../make-test-python.nix ({ ... }:
|
||||
|
||||
let
|
||||
userPassword = "password";
|
||||
mismatchPass = "mismatch";
|
||||
in
|
||||
{
|
||||
name = "pam-zfs-key";
|
||||
|
||||
nodes.machine =
|
||||
{ ... }: {
|
||||
boot.supportedFilesystems = [ "zfs" ];
|
||||
|
||||
networking.hostId = "12345678";
|
||||
|
||||
security.pam.zfs.enable = true;
|
||||
|
||||
users.users = {
|
||||
alice = {
|
||||
isNormalUser = true;
|
||||
password = userPassword;
|
||||
};
|
||||
bob = {
|
||||
isNormalUser = true;
|
||||
password = userPassword;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
testScript = { nodes, ... }:
|
||||
let
|
||||
homes = nodes.machine.security.pam.zfs.homes;
|
||||
pool = builtins.head (builtins.split "/" homes);
|
||||
in
|
||||
''
|
||||
machine.wait_for_unit("multi-user.target")
|
||||
machine.wait_until_succeeds("pgrep -f 'agetty.*tty1'")
|
||||
|
||||
with subtest("Create encrypted ZFS datasets"):
|
||||
machine.succeed("truncate -s 64M /testpool.img")
|
||||
machine.succeed("zpool create -O canmount=off '${pool}' /testpool.img")
|
||||
machine.succeed("zfs create -o canmount=off -p '${homes}'")
|
||||
machine.succeed("echo ${userPassword} | zfs create -o canmount=noauto -o encryption=on -o keyformat=passphrase '${homes}/alice'")
|
||||
machine.succeed("zfs unload-key '${homes}/alice'")
|
||||
machine.succeed("echo ${mismatchPass} | zfs create -o canmount=noauto -o encryption=on -o keyformat=passphrase '${homes}/bob'")
|
||||
machine.succeed("zfs unload-key '${homes}/bob'")
|
||||
|
||||
with subtest("Switch to tty2"):
|
||||
machine.fail("pgrep -f 'agetty.*tty2'")
|
||||
machine.send_key("alt-f2")
|
||||
machine.wait_until_succeeds("[ $(fgconsole) = 2 ]")
|
||||
machine.wait_for_unit("getty@tty2.service")
|
||||
machine.wait_until_succeeds("pgrep -f 'agetty.*tty2'")
|
||||
|
||||
with subtest("Log in as user with home locked by login password"):
|
||||
machine.wait_until_tty_matches("2", "login: ")
|
||||
machine.send_chars("alice\n")
|
||||
machine.wait_until_tty_matches("2", "login: alice")
|
||||
machine.wait_until_succeeds("pgrep login")
|
||||
machine.wait_until_tty_matches("2", "Password: ")
|
||||
machine.send_chars("${userPassword}\n")
|
||||
machine.wait_until_succeeds("pgrep -u alice bash")
|
||||
machine.succeed("mount | grep ${homes}/alice")
|
||||
|
||||
with subtest("Switch to tty3"):
|
||||
machine.fail("pgrep -f 'agetty.*tty3'")
|
||||
machine.send_key("alt-f3")
|
||||
machine.wait_until_succeeds("[ $(fgconsole) = 3 ]")
|
||||
machine.wait_for_unit("getty@tty3.service")
|
||||
machine.wait_until_succeeds("pgrep -f 'agetty.*tty3'")
|
||||
|
||||
with subtest("Log in as user with home locked by password different from login"):
|
||||
machine.wait_until_tty_matches("3", "login: ")
|
||||
machine.send_chars("bob\n")
|
||||
machine.wait_until_tty_matches("3", "login: bob")
|
||||
machine.wait_until_succeeds("pgrep login")
|
||||
machine.wait_until_tty_matches("3", "Password: ")
|
||||
machine.send_chars("${userPassword}\n")
|
||||
machine.wait_until_succeeds("pgrep -u bob bash")
|
||||
machine.fail("mount | grep ${homes}/bob")
|
||||
'';
|
||||
}
|
||||
)
|
Loading…
Reference in a new issue