blob: 7c45de00544f33549f4ce3094e0edb8a9e19c2e4 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
|
{ lib, ... }:
{
# https://github.com/linux-audit/audit-testsuite
# This test is meant to *only* run the audit regression testsuite.
# The test mutates the audit rules on the system it runs on, and can not run in the nix build sandbox.
# Thus a dedicated VM test makes sense.
name = "audit-testsuite";
meta = {
maintainers = with lib.maintainers; [ grimmauld ];
};
nodes.machine =
{ pkgs, ... }:
{
# https://github.com/linux-audit/audit-testsuite/blob/5a10451642ac1ba2fa4b31c06a21cf9aa2d38b66/tests/amcast_joinpart/test#L86
# tests use LC_TIME=en_DK.utf8 to force ISO 8601 date format
i18n.extraLocales = [ "en_DK.UTF-8/UTF-8" ];
security.polkit.enable = true; # needed for run0
security.audit.backlogLimit = 8192;
security.auditd = {
enable = true;
plugins.af_unix.active = true;
settings = {
num_logs = 4;
disk_full_action = "rotate";
};
};
environment.systemPackages = [ pkgs.audit.testsuite.runner ];
};
testScript = ''
start_all()
machine.wait_for_unit("auditd.service")
machine.wait_for_unit("network.target") # netfilter test requires network to be up
# we need a valid session to which we can send commands, so we use run0
machine.succeed("run0 --pty audit-testsuite-runner")
'';
}
|
