nixos/tests/systemd-homed.nix

   1 import ./make-test-python.nix (
   2   { pkgs, lib, ... }:
   3   let
   4     password = "foobarfoo";
   5     newPass = "barfoobar";
   6   in
   7   {
   8     name = "systemd-homed";
   9     nodes.machine =
  10       { config, pkgs, ... }:
  11       {
  12         services.homed.enable = true;
  13
  14         users.users.test-normal-user = {
  15           extraGroups = [ "wheel" ];
  16           isNormalUser = true;
  17           initialPassword = password;
  18         };
  19       };
  20     testScript = ''
  21       def switchTTY(number):
  22         machine.send_key(f"alt-f{number}")
  23         machine.wait_until_succeeds(f"[ $(fgconsole) = {number} ]")
  24         machine.wait_for_unit(f"getty@tty{number}.service")
  25         machine.wait_until_succeeds(f"pgrep -f 'agetty.*tty{number}'")
  26
  27       machine.wait_for_unit("multi-user.target")
  28
  29       # Smoke test to make sure the pam changes didn't break regular users.
  30       machine.wait_until_succeeds("pgrep -f 'agetty.*tty1'")
  31       with subtest("login as regular user"):
  32         switchTTY(2)
  33         machine.wait_until_tty_matches("2", "login: ")
  34         machine.send_chars("test-normal-user\n")
  35         machine.wait_until_tty_matches("2", "login: test-normal-user")
  36         machine.wait_until_tty_matches("2", "Password: ")
  37         machine.send_chars("${password}\n")
  38         machine.wait_until_succeeds("pgrep -u test-normal-user bash")
  39         machine.send_chars("whoami > /tmp/1\n")
  40         machine.wait_for_file("/tmp/1")
  41         assert "test-normal-user" in machine.succeed("cat /tmp/1")
  42
  43       with subtest("create homed encrypted user"):
  44         # TODO: Figure out how to pass password manually.
  45         #
  46         # This environment variable is used for homed internal testing
  47         # and is not documented.
  48         machine.succeed("NEWPASSWORD=${password} homectl create --shell=/run/current-system/sw/bin/bash --storage=luks -G wheel test-homed-user")
  49
  50       with subtest("login as homed user"):
  51         switchTTY(3)
  52         machine.wait_until_tty_matches("3", "login: ")
  53         machine.send_chars("test-homed-user\n")
  54         machine.wait_until_tty_matches("3", "login: test-homed-user")
  55         machine.wait_until_tty_matches("3", "Password: ")
  56         machine.send_chars("${password}\n")
  57         machine.wait_until_succeeds("pgrep -t tty3 -u test-homed-user bash")
  58         machine.send_chars("whoami > /tmp/2\n")
  59         machine.wait_for_file("/tmp/2")
  60         assert "test-homed-user" in machine.succeed("cat /tmp/2")
  61
  62       with subtest("change homed user password"):
  63         switchTTY(4)
  64         machine.wait_until_tty_matches("4", "login: ")
  65         machine.send_chars("test-homed-user\n")
  66         machine.wait_until_tty_matches("4", "login: test-homed-user")
  67         machine.wait_until_tty_matches("4", "Password: ")
  68         machine.send_chars("${password}\n")
  69         machine.wait_until_succeeds("pgrep -t tty4 -u test-homed-user bash")
  70         machine.send_chars("passwd\n")
  71         # homed does it in a weird order, it asks for new passes, then it asks
  72         # for the old one.
  73         machine.sleep(2)
  74         machine.send_chars("${newPass}\n")
  75         machine.sleep(2)
  76         machine.send_chars("${newPass}\n")
  77         machine.sleep(4)
  78         machine.send_chars("${password}\n")
  79         machine.wait_until_fails("pgrep -t tty4 passwd")
  80
  81         @polling_condition
  82         def not_logged_in_tty5():
  83           machine.fail("pgrep -t tty5 bash")
  84
  85         switchTTY(5)
  86         with not_logged_in_tty5: # type: ignore[union-attr]
  87           machine.wait_until_tty_matches("5", "login: ")
  88           machine.send_chars("test-homed-user\n")
  89           machine.wait_until_tty_matches("5", "login: test-homed-user")
  90           machine.wait_until_tty_matches("5", "Password: ")
  91           machine.send_chars("${password}\n")
  92           machine.wait_until_tty_matches("5", "Password incorrect or not sufficient for authentication of user test-homed-user.")
  93           machine.wait_until_tty_matches("5", "Sorry, try again: ")
  94         machine.send_chars("${newPass}\n")
  95         machine.send_chars("whoami > /tmp/4\n")
  96         machine.wait_for_file("/tmp/4")
  97         assert "test-homed-user" in machine.succeed("cat /tmp/4")
  98
  99       with subtest("homed user should be in wheel according to NSS"):
 100         machine.succeed("userdbctl group wheel -s io.systemd.NameServiceSwitch | grep test-homed-user")
 101     '';
 102   }
 103 )