pyrox.dev
1import ./make-test-python.nix ({ pkgs, ... }: {
2 name = "usbguard";
3 meta = with pkgs.lib.maintainers; {
4 maintainers = [ tnias ];
5 };
6
7 nodes.machine =
8 { ... }:
9 {
10 services.usbguard = {
11 enable = true;
12 IPCAllowedUsers = [ "alice" "root" ];
13
14 # As virtual USB devices get attached to the "QEMU USB Hub" we need to
15 # allow Hubs. Otherwise we would have to explicitly allow them too.
16 rules = ''
17 allow with-interface equals { 09:00:00 }
18 '';
19 };
20 imports = [ ./common/user-account.nix ];
21 };
22
23 testScript = ''
24 # create a blank disk image for our fake USB stick
25 with open(machine.state_dir / "usbstick.img", "wb") as stick:
26 stick.write(b"\x00" * (1024 * 1024))
27
28 # wait for machine to have started and the usbguard service to be up
29 machine.wait_for_unit("usbguard.service")
30
31 with subtest("IPC access control"):
32 # User "alice" is allowed to access the IPC interface
33 machine.succeed("su alice -c 'usbguard list-devices'")
34
35 # User "bob" is not allowed to access the IPC interface
36 machine.fail("su bob -c 'usbguard list-devices'")
37
38 with subtest("check basic functionality"):
39 # at this point we expect that no USB HDD is connected
40 machine.fail("usbguard list-devices | grep -E 'QEMU USB HARDDRIVE'")
41
42 # insert usb device
43 machine.send_monitor_command(
44 f"drive_add 0 id=stick,if=none,file={stick.name},format=raw"
45 )
46 machine.send_monitor_command("device_add usb-storage,id=stick,drive=stick")
47
48 # the attached USB HDD should show up after a short while
49 machine.wait_until_succeeds("usbguard list-devices | grep -E 'QEMU USB HARDDRIVE'")
50
51 # at this point there should be a **blocked** USB HDD
52 machine.succeed("usbguard list-devices | grep -E 'block.*QEMU USB HARDDRIVE'")
53 machine.fail("usbguard list-devices | grep -E ' allow .*QEMU USB HARDDRIVE'")
54
55 # allow storage devices
56 machine.succeed("usbguard allow-device 'with-interface { 08:*:* }'")
57
58 # at this point there should be an **allowed** USB HDD
59 machine.succeed("usbguard list-devices | grep -E ' allow .*QEMU USB HARDDRIVE'")
60 machine.fail("usbguard list-devices | grep -E ' block .*QEMU USB HARDDRIVE'")
61 '';
62})