mirror of
https://github.com/NixOS/nixpkgs.git
synced 2024-11-30 17:41:12 +00:00
b089c39a23
Since /run/keys is a ramfs, it is not paged out and a good place to copy secrets to. Test whether secrets with a path in /run/keys exist after initrd.
42 lines
1.3 KiB
Nix
42 lines
1.3 KiB
Nix
{ system ? builtins.currentSystem
|
|
, config ? {}
|
|
, pkgs ? import ../.. { inherit system config; }
|
|
, lib ? pkgs.lib
|
|
, testing ? import ../lib/testing-python.nix { inherit system pkgs; }
|
|
}:
|
|
let
|
|
secretInStore = pkgs.writeText "topsecret" "iamasecret";
|
|
testWithCompressor = compressor: testing.makeTest {
|
|
name = "initrd-secrets-${compressor}";
|
|
|
|
meta.maintainers = [ lib.maintainers.lheckemann ];
|
|
|
|
machine = { ... }: {
|
|
virtualisation.useBootLoader = true;
|
|
boot.initrd.secrets = {
|
|
"/test" = secretInStore;
|
|
|
|
# This should *not* need to be copied in postMountCommands
|
|
"/run/keys/test" = secretInStore;
|
|
};
|
|
boot.initrd.postMountCommands = ''
|
|
cp /test /mnt-root/secret-from-initramfs
|
|
'';
|
|
boot.initrd.compressor = compressor;
|
|
# zstd compression is only supported from 5.9 onwards. Remove when 5.10 becomes default.
|
|
boot.kernelPackages = pkgs.linuxPackages_latest;
|
|
};
|
|
|
|
testScript = ''
|
|
start_all()
|
|
machine.wait_for_unit("multi-user.target")
|
|
machine.succeed(
|
|
"cmp ${secretInStore} /secret-from-initramfs",
|
|
"cmp ${secretInStore} /run/keys/test",
|
|
)
|
|
'';
|
|
};
|
|
in lib.flip lib.genAttrs testWithCompressor [
|
|
"cat" "gzip" "bzip2" "xz" "lzma" "lzop" "pigz" "pixz" "zstd"
|
|
]
|