blob: 7932a73b7c9b0f158c7ca60319831acc5de6668f (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
|
{ lib, ... }:
let
# All passwords are "test"
rootHashedPasswordFile = "$y$j9T$6ueoTO5y7vvFsGvpQJEEa.$vubxgBiMnkTCtRtPD3hNiZHa7Nm1WsJeE9QomYqSRXB";
updatedRootHashedPassword = "$y$j9T$pBCO9N1FRF1rSl6V15n9n/$1JmRLEYPO7TRCx43cvLO19u59WA/oqTEhmSR4wrhzr.";
normaloPassword = "test";
updatedNormaloHashedPassword = "$y$j9T$IEWqhKtWg.r.8fVkSEF56.$iKNxdMC6hOAQRp6eBtYvBk4c7BGpONXeZMqc8I/LM46";
sysuserInitialHashedPassword = "$y$j9T$Kb6jGrk41hudTZpNjazf11$iw7fZXrewC6JxRaGPz7/gPXDZ.Z1VWsupvy81Hi1XiD";
updatedSysuserInitialHashedPassword = "$y$j9T$kUBVhgOdSjymSfwfRVja70$eqCwWzVsz0fI0Uc6JsdD2CYMCpfJcErqnIqva2JCi1D";
newNormaloHashedPassword = "$y$j9T$UFBMWbGjjVola0YE9YCcV/$jRSi5S6lzkcifbuqjMcyXLTwgOGm9BTQk/G/jYaxroC";
in
{
name = "userborn";
meta.maintainers = with lib.maintainers; [ nikstur ];
nodes.machine = {
services.userborn.enable = true;
# Read this password file at runtime from outside the Nix store.
environment.etc."rootpw.secret".text = rootHashedPasswordFile;
users = {
users = {
root = {
# Override the empty root password set by the test instrumentation.
hashedPasswordFile = lib.mkForce "/etc/rootpw.secret";
};
normalo = {
isNormalUser = true;
password = normaloPassword;
};
sysuser = {
isSystemUser = true;
group = "sysusers";
initialHashedPassword = sysuserInitialHashedPassword;
};
};
groups = {
sysusers = { };
};
};
specialisation.new-generation.configuration = {
users = {
users = {
root = {
# Forcing this to null simulates removing the config value in a new
# generation.
hashedPasswordFile = lib.mkOverride 9 null;
hashedPassword = updatedRootHashedPassword;
};
normalo = {
hashedPassword = updatedNormaloHashedPassword;
};
sysuser = {
initialHashedPassword = lib.mkForce updatedSysuserInitialHashedPassword;
};
new-normalo = {
isNormalUser = true;
hashedPassword = newNormaloHashedPassword;
};
normalo-disabled = {
enable = false;
isNormalUser = true;
};
};
groups = {
new-group = { };
};
};
};
};
testScript = ''
machine.wait_for_unit("userborn.service")
with subtest("Correct mode on the password files"):
assert machine.succeed("stat -c '%a' /etc/passwd") == "644\n"
assert machine.succeed("stat -c '%a' /etc/group") == "644\n"
assert machine.succeed("stat -c '%a' /etc/shadow") == "0\n"
with subtest("root user has correct password"):
print(machine.succeed("getent passwd root"))
assert "${rootHashedPasswordFile}" in machine.succeed("getent shadow root"), "root user password is not correct"
with subtest("normalo user is created"):
print(machine.succeed("getent passwd normalo"))
assert 1000 <= int(machine.succeed("id --user normalo")), "normalo user doesn't have a normal UID"
assert machine.succeed("stat -c '%U' /home/normalo") == "normalo\n"
with subtest("system user is created with correct password"):
print(machine.succeed("getent passwd sysuser"))
assert 1000 > int(machine.succeed("id --user sysuser")), "sysuser user doesn't have a system UID"
assert "${sysuserInitialHashedPassword}" in machine.succeed("getent shadow sysuser"), "system user password is not correct"
with subtest("normalo-disabled is NOT created"):
machine.fail("id normalo-disabled")
# Check if user's home has been created
machine.fail("[ -d '/home/normalo-disabled' ]")
with subtest("sysusers group is created"):
print(machine.succeed("getent group sysusers"))
with subtest("Check files"):
print(machine.succeed("grpck -r"))
print(machine.succeed("pwck -r"))
machine.succeed("/run/current-system/specialisation/new-generation/bin/switch-to-configuration switch")
with subtest("root user password is updated"):
print(machine.succeed("getent passwd root"))
assert "${updatedRootHashedPassword}" in machine.succeed("getent shadow root"), "root user password is not updated"
with subtest("normalo user password is updated"):
print(machine.succeed("getent passwd normalo"))
assert "${updatedNormaloHashedPassword}" in machine.succeed("getent shadow normalo"), "normalo user password is not updated"
with subtest("system user password is NOT updated"):
print(machine.succeed("getent passwd sysuser"))
assert "${sysuserInitialHashedPassword}" in machine.succeed("getent shadow sysuser"), "sysuser user password is not updated"
with subtest("new-normalo user is created after switching to new generation"):
print(machine.succeed("getent passwd new-normalo"))
assert 1000 <= int(machine.succeed("id --user new-normalo")), "new-normalo user doesn't have a normal UID"
assert machine.succeed("stat -c '%U' /home/new-normalo") == "new-normalo\n"
assert "${newNormaloHashedPassword}" in machine.succeed("getent shadow new-normalo"), "new-normalo user password is not correct"
with subtest("new-group group is created after switching to new generation"):
print(machine.succeed("getent group new-group"))
with subtest("Check files"):
print(machine.succeed("grpck -r"))
print(machine.succeed("pwck -r"))
'';
}
|
