nixos/tests/userborn-subids-mutable-etc.nix


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61

{ lib, ... }:

# Custom passwordFilesLocation with mutable /etc, subid files exposed via
# systemd bind mount units.

{
  name = "userborn-subids-mutable-etc";

  meta.maintainers = with lib.maintainers; [ rvdp ];

  nodes.machine =
    { ... }:
    {
      services.userborn = {
        enable = true;
        passwordFilesLocation = "/var/lib/nixos";
      };

      users.users.alice.isNormalUser = true;

      specialisation.with-bob.configuration = {
        users.users.bob.isNormalUser = true;
      };
    };

  testScript = ''
    machine.wait_for_unit("userborn.service")

    with subtest("/etc/subuid is a regular file backed by passwordFilesLocation"):
        assert machine.succeed("stat -c '%F' /etc/subuid").strip() == "regular file"
        machine.succeed("mountpoint -q /etc/subuid")
        machine.succeed("systemctl is-active etc-subuid.mount etc-subgid.mount")
        a = machine.succeed("stat -c %d:%i /etc/subuid").strip()
        b = machine.succeed("stat -c %d:%i /var/lib/nixos/subuid").strip()
        assert a == b

    with subtest("newuidmap accepts the bind-mounted file"):
        machine.succeed("runuser -u alice -- unshare --user --map-auto -- true")

    before = machine.succeed("cat /etc/subuid")
    machine.succeed(
        "/run/current-system/specialisation/with-bob/bin/switch-to-configuration switch"
    )

    with subtest("bind is refreshed across activations without stacking"):
        n = machine.succeed("grep -c ' /etc/subuid ' /proc/self/mountinfo").strip()
        assert n == "1", f"expected 1 mount on /etc/subuid, got {n}"
        a = machine.succeed("stat -c %d:%i /etc/subuid").strip()
        b = machine.succeed("stat -c %d:%i /var/lib/nixos/subuid").strip()
        assert a == b

    with subtest("alice's range survived and bob was added"):
        after = machine.succeed("cat /etc/subuid")
        assert "alice:" in after and "bob:" in after
        for line in before.splitlines():
            assert line in after

    with subtest("newuidmap still works after the swap"):
        machine.succeed("runuser -u alice -- unshare --user --map-auto -- true")
  '';
}