blob: 4f54c287e91a1279f6f56fb7b4d78e597af198e5 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
|
import ../make-test-python.nix ({ ... }:
let
userPassword = "password";
mismatchPass = "mismatch";
in
{
name = "pam-zfs-key";
nodes.machine =
{ ... }: {
boot.supportedFilesystems = [ "zfs" ];
networking.hostId = "12345678";
security.pam.zfs.enable = true;
users.users = {
alice = {
isNormalUser = true;
password = userPassword;
};
bob = {
isNormalUser = true;
password = userPassword;
};
};
};
testScript = { nodes, ... }:
let
homes = nodes.machine.security.pam.zfs.homes;
pool = builtins.head (builtins.split "/" homes);
in
''
machine.wait_for_unit("multi-user.target")
machine.wait_until_succeeds("pgrep -f 'agetty.*tty1'")
with subtest("Create encrypted ZFS datasets"):
machine.succeed("truncate -s 64M /testpool.img")
machine.succeed("zpool create -O canmount=off '${pool}' /testpool.img")
machine.succeed("zfs create -o canmount=off -p '${homes}'")
machine.succeed("echo ${userPassword} | zfs create -o canmount=noauto -o encryption=on -o keyformat=passphrase '${homes}/alice'")
machine.succeed("zfs unload-key '${homes}/alice'")
machine.succeed("echo ${mismatchPass} | zfs create -o canmount=noauto -o encryption=on -o keyformat=passphrase '${homes}/bob'")
machine.succeed("zfs unload-key '${homes}/bob'")
with subtest("Switch to tty2"):
machine.fail("pgrep -f 'agetty.*tty2'")
machine.send_key("alt-f2")
machine.wait_until_succeeds("[ $(fgconsole) = 2 ]")
machine.wait_for_unit("getty@tty2.service")
machine.wait_until_succeeds("pgrep -f 'agetty.*tty2'")
with subtest("Log in as user with home locked by login password"):
machine.wait_until_tty_matches("2", "login: ")
machine.send_chars("alice\n")
machine.wait_until_tty_matches("2", "login: alice")
machine.wait_until_succeeds("pgrep login")
machine.wait_until_tty_matches("2", "Password: ")
machine.send_chars("${userPassword}\n")
machine.wait_until_succeeds("pgrep -u alice bash")
machine.succeed("mount | grep ${homes}/alice")
with subtest("Switch to tty3"):
machine.fail("pgrep -f 'agetty.*tty3'")
machine.send_key("alt-f3")
machine.wait_until_succeeds("[ $(fgconsole) = 3 ]")
machine.wait_for_unit("getty@tty3.service")
machine.wait_until_succeeds("pgrep -f 'agetty.*tty3'")
with subtest("Log in as user with home locked by password different from login"):
machine.wait_until_tty_matches("3", "login: ")
machine.send_chars("bob\n")
machine.wait_until_tty_matches("3", "login: bob")
machine.wait_until_succeeds("pgrep login")
machine.wait_until_tty_matches("3", "Password: ")
machine.send_chars("${userPassword}\n")
machine.wait_until_succeeds("pgrep -u bob bash")
machine.fail("mount | grep ${homes}/bob")
'';
}
)
|