tests: Add "encrypted-home-os" installation test.
* gnu/tests/install.scm (%encrypted-home-os) (%encrypted-home-installation-script) (enter-luks-passphrase-for-home) (%test-encrypted-home-os): New variables.
This commit is contained in:
Ludovic Courtès
parent
dcb0e54a4f
commit
f239b9d788
@ -1,5 +1,5 @@
|
||||
;;; GNU Guix --- Functional package management for GNU
|
||||
;;; Copyright © 2016, 2017, 2018, 2019, 2020, 2021 Ludovic Courtès <ludo@gnu.org>
|
||||
;;; Copyright © 2016-2022 Ludovic Courtès <ludo@gnu.org>
|
||||
;;; Copyright © 2017, 2019, 2021 Tobias Geerinckx-Rice <me@tobias.gr>
|
||||
;;; Copyright © 2020 Mathieu Othacehe <m.othacehe@gmail.com>
|
||||
;;; Copyright © 2020 Danny Milosavljevic <dannym@scratchpost.org>
|
||||
@ -66,6 +66,7 @@
|
||||
%test-separate-home-os
|
||||
%test-raid-root-os
|
||||
%test-encrypted-root-os
|
||||
%test-encrypted-home-os
|
||||
%test-encrypted-root-not-boot-os
|
||||
%test-btrfs-root-os
|
||||
%test-btrfs-root-on-subvolume-os
|
||||
@ -921,6 +922,117 @@ reboot\n")
|
||||
(run-basic-test %lvm-separate-home-os
|
||||
`(,@command) "lvm-separate-home-os")))))
|
||||
|
||||
|
||||
;;;
|
||||
;;; LUKS-encrypted /home, unencrypted root.
|
||||
;;;
|
||||
|
||||
(define-os-with-source (%encrypted-home-os %encrypted-home-os-source)
|
||||
(use-modules (gnu) (gnu tests))
|
||||
|
||||
(operating-system
|
||||
(host-name "cipherhome")
|
||||
(timezone "Europe/Paris")
|
||||
(locale "en_US.utf8")
|
||||
|
||||
(bootloader (bootloader-configuration
|
||||
(bootloader grub-bootloader)
|
||||
(targets (list "/dev/vdb"))))
|
||||
|
||||
;; Note: Do not pass "console=ttyS0" so we can use our passphrase prompt
|
||||
;; detection logic in 'enter-luks-passphrase'.
|
||||
|
||||
(mapped-devices (list (mapped-device
|
||||
(source (uuid "12345678-1234-1234-1234-123456789abc"))
|
||||
(target "the-home-device")
|
||||
(type luks-device-mapping))))
|
||||
(file-systems (cons* (file-system
|
||||
(device (file-system-label "root-fs"))
|
||||
(mount-point "/")
|
||||
(type "ext4"))
|
||||
(file-system
|
||||
(device (file-system-label "home-fs"))
|
||||
(mount-point "/home")
|
||||
(type "ext4")
|
||||
(dependencies mapped-devices))
|
||||
%base-file-systems))
|
||||
(users %base-user-accounts)
|
||||
(services (cons (service marionette-service-type
|
||||
(marionette-configuration
|
||||
(imported-modules '((gnu services herd)
|
||||
(guix combinators)))))
|
||||
%base-services))))
|
||||
|
||||
(define %encrypted-home-installation-script
|
||||
(string-append "\
|
||||
. /etc/profile
|
||||
set -e -x
|
||||
guix --version
|
||||
|
||||
export GUIX_BUILD_OPTIONS=--no-grafts
|
||||
parted --script /dev/vdb mklabel gpt \\
|
||||
mkpart primary ext2 1M 3M \\
|
||||
mkpart primary ext2 3M 1.6G \\
|
||||
mkpart primary 1.6G 2.0G \\
|
||||
set 1 boot on \\
|
||||
set 1 bios_grub on
|
||||
|
||||
echo -n " %luks-passphrase " | \\
|
||||
cryptsetup luksFormat --uuid=12345678-1234-1234-1234-123456789abc -q /dev/vdb3 -
|
||||
echo -n " %luks-passphrase " | \\
|
||||
cryptsetup open --type luks --key-file - /dev/vdb3 the-home-device
|
||||
|
||||
mkfs.ext4 -L root-fs /dev/vdb2
|
||||
mkfs.ext4 -L home-fs /dev/mapper/the-home-device
|
||||
mount /dev/vdb2 /mnt
|
||||
mkdir /mnt/home
|
||||
mount /dev/mapper/the-home-device /mnt/home
|
||||
df -h /mnt /mnt/home
|
||||
herd start cow-store /mnt
|
||||
mkdir /mnt/etc
|
||||
cp /etc/target-config.scm /mnt/etc/config.scm
|
||||
guix system init /mnt/etc/config.scm /mnt --no-substitutes
|
||||
sync
|
||||
reboot\n"))
|
||||
|
||||
(define (enter-luks-passphrase-for-home marionette)
|
||||
"Return a gexp to be inserted in the basic system test running on MARIONETTE
|
||||
to enter the LUKS passphrase. Note that 'cryptsetup open' in this case is
|
||||
launched as a shepherd service."
|
||||
(let ((ocrad (file-append ocrad "/bin/ocrad")))
|
||||
#~(begin
|
||||
(define (passphrase-prompt? text)
|
||||
(string-contains (pk 'screen-text text) "Enter pass"))
|
||||
|
||||
(test-assert "enter LUKS passphrase for the shepherd service"
|
||||
(begin
|
||||
;; XXX: Here we use OCR as well but we could instead use QEMU
|
||||
;; '-serial stdio' and run it in an input pipe,
|
||||
(wait-for-screen-text #$marionette passphrase-prompt?
|
||||
#:ocrad #$ocrad
|
||||
#:timeout 120)
|
||||
(marionette-type #$(string-append %luks-passphrase "\n")
|
||||
#$marionette)
|
||||
|
||||
;; Take a screenshot for debugging purposes.
|
||||
(marionette-control (string-append "screendump " #$output
|
||||
"/shepherd-passphrase.ppm")
|
||||
#$marionette))))))
|
||||
|
||||
(define %test-encrypted-home-os
|
||||
(system-test
|
||||
(name "encrypted-home-os")
|
||||
(description
|
||||
"Test functionality of an OS installed with a LUKS /home partition")
|
||||
(value
|
||||
(mlet* %store-monad ((images (run-install %encrypted-home-os
|
||||
%encrypted-home-os-source
|
||||
#:script
|
||||
%encrypted-home-installation-script))
|
||||
(command (qemu-command* images)))
|
||||
(run-basic-test %encrypted-home-os command "encrypted-home-os"
|
||||
#:initialization enter-luks-passphrase-for-home)))))
|
||||
|
||||
|
||||
;;;
|
||||
;;; LUKS-encrypted root file system and /boot in a non-encrypted partition.
|
||||
|
||||
Loading…
Reference in New Issue
Block a user