cafkafk/nixpkgs
cafkafk/nixpkgs
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

nixosTests.ssh-agent-auth: Test both sudo and sudo-rs

Browse source
This commit is contained in:
nicoo 2023-12-24 15:50:12 +00:00
parent 7e70c08470
commit 9b8812794b
1 changed files with 11 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
nixos/tests/ssh-agent-auth.nix
View file

@ -5,7 +5,7 @@ import ./make-test-python.nix ({ lib, pkgs, ... }:
name = "ssh-agent-auth"; name = "ssh-agent-auth";
meta.maintainers = with lib.maintainers; [ nicoo ]; meta.maintainers = with lib.maintainers; [ nicoo ];
nodes.sudoVM = { lib, ... }: { nodes = let nodeConfig = n: { ... }: {
users.users = { users.users = {
admin = { admin = {
isNormalUser = true; isNormalUser = true;
@ -16,7 +16,7 @@ import ./make-test-python.nix ({ lib, pkgs, ... }:
}; };
security.pam.enableSSHAgentAuth = true; security.pam.enableSSHAgentAuth = true;
security.sudo = { security.${lib.replaceStrings [ "_" ] [ "-" ] n} = {
enable = true; enable = true;
wheelNeedsPassword = true; # We are checking `pam_ssh_agent_auth(8)` works for a sudoer wheelNeedsPassword = true; # We are checking `pam_ssh_agent_auth(8)` works for a sudoer
}; };
@ -24,6 +24,7 @@ import ./make-test-python.nix ({ lib, pkgs, ... }:
# Necessary for pam_ssh_agent_auth >_>' # Necessary for pam_ssh_agent_auth >_>'
services.openssh.enable = true; services.openssh.enable = true;
}; };
in lib.genAttrs [ "sudo" "sudo_rs" ] nodeConfig;
testScript = let testScript = let
privateKeyPath = "/home/admin/.ssh/id_ecdsa"; privateKeyPath = "/home/admin/.ssh/id_ecdsa";
@ -36,13 +37,15 @@ import ./make-test-python.nix ({ lib, pkgs, ... }:
${lib.getExe pkgs.faketty} sudo -u foo -- id -un ${lib.getExe pkgs.faketty} sudo -u foo -- id -un
''; '';
in '' in ''
sudoVM.copy_from_host("${snakeOilPrivateKey}", "${privateKeyPath}") for vm in (sudo, sudo_rs):
sudoVM.succeed("chmod -R 0700 /home/admin") sudo_impl = vm.name.replace("_", "-")
sudoVM.succeed("chown -R admin:users /home/admin") with subtest(f"wheel user can auth with ssh-agent for {sudo_impl}"):
vm.copy_from_host("${snakeOilPrivateKey}", "${privateKeyPath}")
vm.succeed("chmod -R 0700 /home/admin")
vm.succeed("chown -R admin:users /home/admin")
with subtest("sudoer can auth through pam_ssh_agent_auth(8)"): # Run `userScript` in an environment with an SSH-agent available
# Run `userScript` in an environment with an SSH-agent available assert vm.succeed("sudo -u admin -- ssh-agent ${userScript} 2>&1").strip() == "foo"
assert sudoVM.succeed("sudo -u admin -- ssh-agent ${userScript} 2>&1").strip() == "foo"
''; '';
} }
) )