pyrox.dev
1import ./make-test.nix ({ pkgs, ... }:
2{
3 name = "ecryptfs";
4
5 machine = { config, pkgs, ... }: {
6 imports = [ ./common/user-account.nix ];
7 boot.kernelModules = [ "ecryptfs" ];
8 security.pam.enableEcryptfs = true;
9 environment.systemPackages = with pkgs; [ keyutils ];
10 };
11
12 testScript = ''
13 $machine->waitForUnit("default.target");
14
15 # Set alice up with a password and a home
16 $machine->succeed("(echo foobar; echo foobar) | passwd alice");
17 $machine->succeed("chown -R alice.users ~alice");
18
19 # Migrate alice's home
20 my $out = $machine->succeed("echo foobar | ecryptfs-migrate-home -u alice");
21 $machine->log("ecryptfs-migrate-home said: $out");
22
23 # Log alice in (ecryptfs passwhrase is wrapped during first login)
24 $machine->sleep(2); # urgh: wait for username prompt
25 $machine->sendChars("alice\n");
26 $machine->sleep(1);
27 $machine->sendChars("foobar\n");
28 $machine->sleep(2);
29 $machine->sendChars("logout\n");
30 $machine->sleep(2);
31
32 # Why do I need to do this??
33 $machine->succeed("su alice -c ecryptfs-umount-private || true");
34 $machine->sleep(1);
35 $machine->fail("mount | grep ecryptfs"); # check that encrypted home is not mounted
36
37 # Show contents of the user keyring
38 my $out = $machine->succeed("su - alice -c 'keyctl list \@u'");
39 $machine->log("keyctl unlink said: " . $out);
40
41 # Log alice again
42 $machine->sendChars("alice\n");
43 $machine->sleep(1);
44 $machine->sendChars("foobar\n");
45 $machine->sleep(2);
46
47 # Create some files in encrypted home
48 $machine->succeed("su alice -c 'touch ~alice/a'");
49 $machine->succeed("su alice -c 'echo c > ~alice/b'");
50
51 # Logout
52 $machine->sendChars("logout\n");
53 $machine->sleep(2);
54
55 # Why do I need to do this??
56 $machine->succeed("su alice -c ecryptfs-umount-private || true");
57 $machine->sleep(1);
58
59 # Check that the filesystem is not accessible
60 $machine->fail("mount | grep ecryptfs");
61 $machine->succeed("su alice -c 'test \! -f ~alice/a'");
62 $machine->succeed("su alice -c 'test \! -f ~alice/b'");
63
64 # Log alice once more
65 $machine->sendChars("alice\n");
66 $machine->sleep(1);
67 $machine->sendChars("foobar\n");
68 $machine->sleep(2);
69
70 # Check that the files are there
71 $machine->sleep(1);
72 $machine->succeed("su alice -c 'test -f ~alice/a'");
73 $machine->succeed("su alice -c 'test -f ~alice/b'");
74 $machine->succeed(qq%test "\$(cat ~alice/b)" = "c"%);
75
76 # Catch https://github.com/NixOS/nixpkgs/issues/16766
77 $machine->succeed("su alice -c 'ls -lh ~alice/'");
78
79 $machine->sendChars("logout\n");
80 '';
81})