nixos/hardened test: add failing test-case for deferred mounts

Changed files
+19
nixos
tests
+19
nixos/tests/hardened.nix
···
{ users.users.alice = { isNormalUser = true; extraGroups = [ "proc" ]; };
users.users.sybil = { isNormalUser = true; group = "wheel"; };
imports = [ ../modules/profiles/hardened.nix ];
+
virtualisation.emptyDiskImages = [ 4096 ];
+
boot.initrd.postDeviceCommands = ''
+
${pkgs.dosfstools}/bin/mkfs.vfat -n EFISYS /dev/vdb
+
'';
+
fileSystems = lib.mkVMOverride {
+
"/efi" = {
+
device = "/dev/disk/by-label/EFISYS";
+
fsType = "vfat";
+
options = [ "noauto" ];
+
};
+
};
};
testScript =
···
# Test access to kcore
subtest "kcore", sub {
$machine->fail("cat /proc/kcore");
+
};
+
+
# Test deferred mount
+
subtest "mount", sub {
+
$machine->fail("mountpoint -q /efi"); # was deferred
+
$machine->execute("mkdir -p /efi");
+
$machine->succeed("mount /dev/disk/by-label/EFISYS /efi");
+
$machine->succeed("mountpoint -q /efi"); # now mounted
};
'';
})