tests: Add `encrypted-home-os-key-file' installation test.
Based on encrypted-home-os, this test verifies unlocking via a key file. * gnu/tests/install.scm (%encrypted-home-os-key-file), (%encrypted-home-os-key-file-source): New variables. (%test-encrypted-home-os-key-file): New exported variables. (%encrypted-home-installation-script): Generate initrd with a key file for unlocking the LUKS. Change-Id: I04460155284bdef7e18da645f2b4b26bd8e86636 Signed-off-by: Ludovic Courtès <ludo@gnu.org>master
parent
086850e5b2
commit
10ea0dba00
|
@ -35,6 +35,7 @@
|
||||||
#:use-module (gnu packages admin)
|
#:use-module (gnu packages admin)
|
||||||
#:use-module (gnu packages bootloaders)
|
#:use-module (gnu packages bootloaders)
|
||||||
#:use-module (gnu packages commencement) ;for 'guile-final'
|
#:use-module (gnu packages commencement) ;for 'guile-final'
|
||||||
|
#:use-module (gnu packages cpio)
|
||||||
#:use-module (gnu packages cryptsetup)
|
#:use-module (gnu packages cryptsetup)
|
||||||
#:use-module (gnu packages disk)
|
#:use-module (gnu packages disk)
|
||||||
#:use-module (gnu packages emacs)
|
#:use-module (gnu packages emacs)
|
||||||
|
@ -67,6 +68,7 @@
|
||||||
%test-raid-root-os
|
%test-raid-root-os
|
||||||
%test-encrypted-root-os
|
%test-encrypted-root-os
|
||||||
%test-encrypted-home-os
|
%test-encrypted-home-os
|
||||||
|
%test-encrypted-home-os-key-file
|
||||||
%test-encrypted-root-not-boot-os
|
%test-encrypted-root-not-boot-os
|
||||||
%test-btrfs-root-os
|
%test-btrfs-root-os
|
||||||
%test-btrfs-root-on-subvolume-os
|
%test-btrfs-root-on-subvolume-os
|
||||||
|
@ -975,6 +977,18 @@ echo -n " %luks-passphrase " | \\
|
||||||
mkfs.ext4 -L root-fs /dev/vdb2
|
mkfs.ext4 -L root-fs /dev/vdb2
|
||||||
mkfs.ext4 -L home-fs /dev/mapper/the-home-device
|
mkfs.ext4 -L home-fs /dev/mapper/the-home-device
|
||||||
mount /dev/vdb2 /mnt
|
mount /dev/vdb2 /mnt
|
||||||
|
|
||||||
|
# This script is used for both encrypted-home-os and encrypted-home-os-key-file
|
||||||
|
# tests. So we also add the keyfile here.
|
||||||
|
dd if=/dev/zero of=/key-file.bin bs=4096 count=1
|
||||||
|
( cd /mnt;
|
||||||
|
echo /key-file.bin | cpio -oH newc > key-file.cpio
|
||||||
|
chmod 0000 key-file.cpio
|
||||||
|
mv /key-file.bin .
|
||||||
|
)
|
||||||
|
echo -n " %luks-passphrase " | \\
|
||||||
|
cryptsetup luksAddKey --key-file - -i 1 /dev/vdb3 /mnt/key-file.bin
|
||||||
|
|
||||||
mkdir /mnt/home
|
mkdir /mnt/home
|
||||||
mount /dev/mapper/the-home-device /mnt/home
|
mount /dev/mapper/the-home-device /mnt/home
|
||||||
df -h /mnt /mnt/home
|
df -h /mnt /mnt/home
|
||||||
|
@ -1018,11 +1032,69 @@ launched as a shepherd service."
|
||||||
(mlet* %store-monad ((images (run-install %encrypted-home-os
|
(mlet* %store-monad ((images (run-install %encrypted-home-os
|
||||||
%encrypted-home-os-source
|
%encrypted-home-os-source
|
||||||
#:script
|
#:script
|
||||||
%encrypted-home-installation-script))
|
%encrypted-home-installation-script
|
||||||
|
#:packages (list cpio)))
|
||||||
(command (qemu-command* images)))
|
(command (qemu-command* images)))
|
||||||
(run-basic-test %encrypted-home-os command "encrypted-home-os"
|
(run-basic-test %encrypted-home-os command "encrypted-home-os"
|
||||||
#:initialization enter-luks-passphrase-for-home)))))
|
#:initialization enter-luks-passphrase-for-home)))))
|
||||||
|
|
||||||
|
|
||||||
|
;;;
|
||||||
|
;;; LUKS-encrypted /home, unencrypted root. The unlock is done using a key
|
||||||
|
;;; file.
|
||||||
|
;;;
|
||||||
|
(define-os-with-source (%encrypted-home-os-key-file
|
||||||
|
%encrypted-home-os-key-file-source)
|
||||||
|
(use-modules (gnu) (gnu tests))
|
||||||
|
|
||||||
|
(operating-system
|
||||||
|
(host-name "cipherhome")
|
||||||
|
(timezone "Europe/Prague")
|
||||||
|
(locale "en_US.utf8")
|
||||||
|
|
||||||
|
(bootloader (bootloader-configuration
|
||||||
|
(bootloader grub-bootloader)
|
||||||
|
(targets (list "/dev/vdb"))
|
||||||
|
(extra-initrd "/key-file.cpio")))
|
||||||
|
(kernel-arguments '("console=ttyS0"))
|
||||||
|
|
||||||
|
(mapped-devices (list (mapped-device
|
||||||
|
(source (uuid "12345678-1234-1234-1234-123456789abc"))
|
||||||
|
(target "the-home-device")
|
||||||
|
(type (luks-device-mapping-with-options
|
||||||
|
#:key-file "/key-file.bin")))))
|
||||||
|
(file-systems (cons* (file-system
|
||||||
|
(device (file-system-label "root-fs"))
|
||||||
|
(mount-point "/")
|
||||||
|
(type "ext4"))
|
||||||
|
(file-system
|
||||||
|
(device (file-system-label "home-fs"))
|
||||||
|
(mount-point "/home")
|
||||||
|
(type "ext4")
|
||||||
|
(dependencies mapped-devices))
|
||||||
|
%base-file-systems))
|
||||||
|
(services (cons (service marionette-service-type
|
||||||
|
(marionette-configuration
|
||||||
|
(imported-modules '((gnu services herd)
|
||||||
|
(guix combinators)))))
|
||||||
|
%base-services))))
|
||||||
|
|
||||||
|
(define %test-encrypted-home-os-key-file
|
||||||
|
(system-test
|
||||||
|
(name "encrypted-home-os-key-file")
|
||||||
|
(description
|
||||||
|
"Test functionality of an OS installed with a LUKS /home partition with
|
||||||
|
unlock done using a key file")
|
||||||
|
(value
|
||||||
|
(mlet* %store-monad ((images (run-install %encrypted-home-os-key-file
|
||||||
|
%encrypted-home-os-key-file-source
|
||||||
|
#:script
|
||||||
|
%encrypted-home-installation-script
|
||||||
|
#:packages (list cpio)))
|
||||||
|
(command (qemu-command* images)))
|
||||||
|
(run-basic-test %encrypted-home-os-key-file
|
||||||
|
command "encrypted-home-os-key-file")))))
|
||||||
|
|
||||||
|
|
||||||
;;;
|
;;;
|
||||||
;;; LUKS-encrypted root file system and /boot in a non-encrypted partition.
|
;;; LUKS-encrypted root file system and /boot in a non-encrypted partition.
|
||||||
|
|
Reference in New Issue