pyrox.dev
1# Some tests to ensure doas is working properly.
2import ./make-test-python.nix (
3 { lib, ... }: {
4 name = "doas";
5 meta = with lib.maintainers; {
6 maintainers = [ cole-h ];
7 };
8
9 nodes.machine =
10 { ... }:
11 {
12 users.groups = { foobar = {}; barfoo = {}; baz = { gid = 1337; }; };
13 users.users = {
14 test0 = { isNormalUser = true; extraGroups = [ "wheel" ]; };
15 test1 = { isNormalUser = true; };
16 test2 = { isNormalUser = true; extraGroups = [ "foobar" ]; };
17 test3 = { isNormalUser = true; extraGroups = [ "barfoo" ]; };
18 test4 = { isNormalUser = true; extraGroups = [ "baz" ]; };
19 test5 = { isNormalUser = true; };
20 test6 = { isNormalUser = true; };
21 test7 = { isNormalUser = true; };
22 };
23
24 security.doas = {
25 enable = true;
26 wheelNeedsPassword = false;
27
28 extraRules = [
29 { users = [ "test1" ]; groups = [ "foobar" ]; }
30 { users = [ "test2" ]; noPass = true; setEnv = [ "CORRECT" "HORSE=BATTERY" ]; }
31 { groups = [ "barfoo" 1337 ]; noPass = true; }
32 { users = [ "test5" ]; noPass = true; keepEnv = true; runAs = "test1"; }
33 { users = [ "test6" ]; noPass = true; keepEnv = true; setEnv = [ "-STAPLE" ]; }
34 { users = [ "test7" ]; noPass = true; setEnv = [ "-SSH_AUTH_SOCK" ]; }
35 ];
36 };
37 };
38
39 testScript = ''
40 with subtest("users in wheel group should have passwordless doas"):
41 machine.succeed('su - test0 -c "doas -u root true"')
42
43 with subtest("test1 user should not be able to use doas without password"):
44 machine.fail('su - test1 -c "doas -n -u root true"')
45
46 with subtest("test2 user should be able to keep some env"):
47 if "CORRECT=1" not in machine.succeed('su - test2 -c "CORRECT=1 doas env"'):
48 raise Exception("failed to keep CORRECT")
49
50 if "HORSE=BATTERY" not in machine.succeed('su - test2 -c "doas env"'):
51 raise Exception("failed to setenv HORSE=BATTERY")
52
53 with subtest("users in group 'barfoo' shouldn't require password"):
54 machine.succeed("doas -u test3 doas -n -u root true")
55
56 with subtest("users in group 'baz' (GID 1337) shouldn't require password"):
57 machine.succeed("doas -u test4 doas -n -u root echo true")
58
59 with subtest("test5 user should be able to run commands under test1"):
60 machine.succeed("doas -u test5 doas -n -u test1 true")
61
62 with subtest("test5 user should not be able to run commands under root"):
63 machine.fail("doas -u test5 doas -n -u root true")
64
65 with subtest("test6 user should be able to keepenv"):
66 envs = ["BATTERY=HORSE", "CORRECT=false"]
67 out = machine.succeed(
68 'su - test6 -c "BATTERY=HORSE CORRECT=false STAPLE=Tr0ub4dor doas env"'
69 )
70
71 if not all(env in out for env in envs):
72 raise Exception("failed to keep BATTERY or CORRECT")
73 if "STAPLE=Tr0ub4dor" in out:
74 raise Exception("failed to exclude STAPLE")
75
76 with subtest("test7 should not have access to SSH_AUTH_SOCK"):
77 if "SSH_AUTH_SOCK=HOLEY" in machine.succeed(
78 'su - test7 -c "SSH_AUTH_SOCK=HOLEY doas env"'
79 ):
80 raise Exception("failed to exclude SSH_AUTH_SOCK")
81
82 # Test that the doas setuid wrapper precedes the unwrapped version in PATH after
83 # calling doas.
84 # The PATH set by doas is defined in
85 # ../../pkgs/tools/security/doas/0001-add-NixOS-specific-dirs-to-safe-PATH.patch
86 with subtest("recursive calls to doas from subprocesses should succeed"):
87 machine.succeed('doas -u test0 sh -c "doas -u test0 true"')
88
89 with subtest("test0 should inherit TERMINFO_DIRS from the user environment"):
90 dirs = machine.succeed(
91 "su - test0 -c 'doas -u root $SHELL -c \"echo \$TERMINFO_DIRS\"'"
92 )
93
94 if not "test0" in dirs:
95 raise Exception(f"user profile TERMINFO_DIRS is not preserved: {dirs}")
96 '';
97 }
98)