nixos/tests/appliance-repart-image-verity-store.nix

   1 # similar to the appliance-repart-image test but with a dm-verity
   2 # protected nix store and tmpfs as rootfs
   3 { lib, ... }:
   4
   5 {
   6   name = "appliance-repart-image-verity-store";
   7
   8   meta.maintainers = with lib.maintainers; [
   9     nikstur
  10     willibutz
  11   ];
  12
  13   nodes.machine =
  14     {
  15       config,
  16       lib,
  17       pkgs,
  18       ...
  19     }:
  20     let
  21       inherit (config.image.repart.verityStore) partitionIds;
  22     in
  23     {
  24       imports = [ ../modules/image/repart.nix ];
  25
  26       virtualisation.fileSystems = lib.mkVMOverride {
  27         "/" = {
  28           fsType = "tmpfs";
  29           options = [ "mode=0755" ];
  30         };
  31
  32         "/usr" = {
  33           device = "/dev/mapper/usr";
  34           # explicitly mount it read-only otherwise systemd-remount-fs will fail
  35           options = [ "ro" ];
  36           fsType = config.image.repart.partitions.${partitionIds.store}.repartConfig.Format;
  37         };
  38
  39         # bind-mount the store
  40         "/nix/store" = {
  41           device = "/usr/nix/store";
  42           options = [ "bind" ];
  43         };
  44       };
  45
  46       image.repart = {
  47         verityStore = {
  48           enable = true;
  49           # by default the module works with systemd-boot, for simplicity this test directly boots the UKI
  50           ukiPath = "/EFI/BOOT/BOOT${lib.toUpper config.nixpkgs.hostPlatform.efiArch}.EFI";
  51         };
  52
  53         name = "appliance-verity-store-image";
  54
  55         partitions = {
  56           ${partitionIds.esp} = {
  57             # the UKI is injected into this partition by the verityStore module
  58             repartConfig = {
  59               Type = "esp";
  60               Format = "vfat";
  61               SizeMinBytes = if config.nixpkgs.hostPlatform.isx86_64 then "64M" else "96M";
  62             };
  63           };
  64           ${partitionIds.store-verity}.repartConfig = {
  65             Minimize = "best";
  66           };
  67           ${partitionIds.store}.repartConfig = {
  68             Minimize = "best";
  69           };
  70         };
  71       };
  72
  73       virtualisation = {
  74         directBoot.enable = false;
  75         mountHostNixStore = false;
  76         useEFIBoot = true;
  77       };
  78
  79       boot = {
  80         loader.grub.enable = false;
  81         initrd.systemd.enable = true;
  82       };
  83
  84       system.image = {
  85         id = "nixos-appliance";
  86         version = "1";
  87       };
  88
  89       # don't create /usr/bin/env
  90       # this would require some extra work on read-only /usr
  91       # and it is not a strict necessity
  92       system.activationScripts.usrbinenv = lib.mkForce "";
  93     };
  94
  95   testScript =
  96     { nodes, ... }: # python
  97     ''
  98       import os
  99       import subprocess
 100       import tempfile
 101
 102       tmp_disk_image = tempfile.NamedTemporaryFile()
 103
 104       subprocess.run([
 105         "${nodes.machine.virtualisation.qemu.package}/bin/qemu-img",
 106         "create",
 107         "-f",
 108         "qcow2",
 109         "-b",
 110         "${nodes.machine.system.build.finalImage}/${nodes.machine.image.repart.imageFile}",
 111         "-F",
 112         "raw",
 113         tmp_disk_image.name,
 114       ])
 115
 116       os.environ['NIX_DISK_IMAGE'] = tmp_disk_image.name
 117
 118       machine.wait_for_unit("default.target")
 119
 120       with subtest("Running with volatile root"):
 121         machine.succeed("findmnt --kernel --type tmpfs /")
 122
 123       with subtest("/nix/store is backed by dm-verity protected fs"):
 124         verity_info = machine.succeed("dmsetup info --target verity usr")
 125         assert "ACTIVE" in verity_info,f"unexpected verity info: {verity_info}"
 126
 127         backing_device = machine.succeed("df --output=source /nix/store | tail -n1").strip()
 128         assert "/dev/mapper/usr" == backing_device,"unexpected backing device: {backing_device}"
 129     '';
 130 }