tests: test unsigned initrd/kernel either, plus some machinery for sb tests

This commit is contained in:
Raito Bezarius 2022-11-25 18:42:37 +01:00
parent 3779e81b20
commit dec7c06e6b
1 changed files with 58 additions and 8 deletions

View File

@ -163,12 +163,15 @@
]; ];
}; };
checks.x86_64-linux = { checks.x86_64-linux = let
lanzaboote-boot = nixpkgs-test.legacyPackages.x86_64-linux.nixosTest mkSecureBootTest = { name, machine ? {}, testScript }: nixpkgs-test.legacyPackages.x86_64-linux.nixosTest {
{ inherit name testScript;
name = "stub-boot"; nodes.machine = { lib, ... }: {
nodes.machine = { ... }: { imports = [
imports = [ self.nixosModules.lanzaboote ]; self.nixosModules.lanzaboote
machine
];
nixpkgs.overlays = [ self.overlays.default ]; nixpkgs.overlays = [ self.overlays.default ];
virtualisation = { virtualisation = {
@ -183,16 +186,63 @@
}; };
boot.lanzaboote = { boot.lanzaboote = {
enable = true; enable = true;
enrollKeys = true; enrollKeys = lib.mkDefault true;
pkiBundle = ./pki; pkiBundle = ./pki;
package = lanzatool; package = lanzatool;
}; };
}; };
};
mkUnsignedTest = { name, path }: mkSecureBootTest {
inherit name;
testScript = '' testScript = ''
import json
import os.path
bootspec = None
def extract_bspec_attr(attr):
return bootspec.get(attr)
def convert_to_esp(store_file_path):
store_dir = os.path.basename(os.path.dirname(store_file_path))
filename = os.path.basename(store_file_path)
return f'/boot/EFI/nixos/{store_dir}-{filename}.efi'
machine.start() machine.start()
print(machine.succeed("bootctl status")) bootspec = json.loads(machine.succeed("cat /run/current-system/bootspec/boot.v1.json"))
print(machine.succeed("ls /boot/EFI/nixos"))
src_path = ${path.src}
dst_path = ${path.dst}
machine.succeed(f"cp -rf {src_path} {dst_path}")
machine.succeed("sync")
machine.crash()
machine.start()
machine.wait_for_console_text("panicked")
''; '';
}; };
in
{
# TODO: user mode: OK
# TODO: how to get in: {deployed, audited} mode ?
lanzaboote-boot = mkSecureBootTest {
name = "signed-files-boot-under-secureboot";
testScript = ''
machine.start()
assert "Secure Boot: enabled (user)" in machine.succeed("bootctl status")
'';
};
is-initrd-secured = mkUnsignedTest {
name = "unsigned-initrd-do-not-boot-under-secureboot";
path = {
src = "extract_bspec_attr('initrd')";
dst = "\"/boot/EFI/nixos/initrd\"";
};
};
is-kernel-secured = mkUnsignedTest {
name = "unsigned-kernel-do-not-boot-under-secureboot";
path = {
src = "extract_bspec_attr('kernel')";
dst = "\"/boot/EFI/nixos/kernel\"";
};
};
}; };
}; };
} }