95 lines
2.6 KiB
Nix
95 lines
2.6 KiB
Nix
{
|
|
name = "authorization";
|
|
|
|
nodes.machine = {
|
|
virtualisation.writableStore = true;
|
|
# TODO add a test without allowed-users setting. allowed-users is uncommon among NixOS users.
|
|
nix.settings.allowed-users = ["alice" "bob"];
|
|
nix.settings.trusted-users = ["alice"];
|
|
|
|
users.users.alice.isNormalUser = true;
|
|
users.users.bob.isNormalUser = true;
|
|
users.users.mallory.isNormalUser = true;
|
|
|
|
nix.settings.experimental-features = "nix-command";
|
|
};
|
|
|
|
testScript =
|
|
let
|
|
pathFour = "/nix/store/20xfy868aiic0r0flgzq4n5dq1yvmxkn-four";
|
|
in
|
|
''
|
|
machine.wait_for_unit("multi-user.target")
|
|
machine.succeed("""
|
|
exec 1>&2
|
|
echo kSELDhobKaF8/VdxIxdP7EQe+Q > one
|
|
diff $(nix store add-file one) one
|
|
""")
|
|
machine.succeed("""
|
|
su --login alice -c '
|
|
set -x
|
|
cd ~
|
|
echo ehHtmfuULXYyBV6NBk6QUi8iE0 > two
|
|
ls
|
|
diff $(echo $(nix store add-file two)) two' 1>&2
|
|
""")
|
|
machine.succeed("""
|
|
su --login bob -c '
|
|
set -x
|
|
cd ~
|
|
echo 0Jw8RNp7cK0W2AdNbcquofcOVk > three
|
|
diff $(nix store add-file three) three
|
|
' 1>&2
|
|
""")
|
|
|
|
# We're going to check that a path is not created
|
|
machine.succeed("""
|
|
! [[ -e ${pathFour} ]]
|
|
""")
|
|
machine.succeed("""
|
|
su --login mallory -c '
|
|
set -x
|
|
cd ~
|
|
echo 5mgtDj0ohrWkT50TLR0f4tIIxY > four;
|
|
(! nix store add-file four 2>&1) | grep -F "cannot open connection to remote store"
|
|
(! nix store add-file four 2>&1) | grep -F "Connection reset by peer"
|
|
! [[ -e ${pathFour} ]]
|
|
' 1>&2
|
|
""")
|
|
|
|
# Check that the file _can_ be added, and matches the expected path we were checking
|
|
machine.succeed("""
|
|
exec 1>&2
|
|
echo 5mgtDj0ohrWkT50TLR0f4tIIxY > four
|
|
four="$(nix store add-file four)"
|
|
diff $four four
|
|
diff <(echo $four) <(echo ${pathFour})
|
|
""")
|
|
|
|
machine.succeed("""
|
|
su --login alice -c 'nix-store --verify --repair'
|
|
""")
|
|
|
|
machine.succeed("""
|
|
set -x
|
|
su --login bob -c '(! nix-store --verify --repair 2>&1)' | tee diag 1>&2
|
|
grep -F "you are not privileged to repair paths" diag
|
|
""")
|
|
|
|
machine.succeed("""
|
|
set -x
|
|
su --login mallory -c '
|
|
nix-store --generate-binary-cache-key cache1.example.org sk1 pk1
|
|
(! nix store sign --key-file sk1 ${pathFour} 2>&1)' | tee diag 1>&2
|
|
grep -F "cannot open connection to remote store 'daemon'" diag
|
|
""")
|
|
|
|
machine.succeed("""
|
|
su --login bob -c '
|
|
nix-store --generate-binary-cache-key cache1.example.org sk1 pk1
|
|
nix store sign --key-file sk1 ${pathFour}
|
|
'
|
|
""")
|
|
'';
|
|
}
|