nixos/tests/aesmd.nix


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62

import ./make-test-python.nix ({ pkgs, lib, ... }: {
  name = "aesmd";
  meta = {
    maintainers = with lib.maintainers; [ veehaitch ];
  };

  nodes.machine = { lib, ... }: {
    services.aesmd = {
      enable = true;
      settings = {
        defaultQuotingType = "ecdsa_256";
        proxyType = "direct";
        whitelistUrl = "http://nixos.org";
      };
    };

    # Should have access to the AESM socket
    users.users."sgxtest" = {
      isNormalUser = true;
      extraGroups = [ "sgx" ];
    };

    # Should NOT have access to the AESM socket
    users.users."nosgxtest".isNormalUser = true;

    # We don't have a real SGX machine in NixOS tests
    systemd.services.aesmd.unitConfig.AssertPathExists = lib.mkForce [ ];
  };

  testScript = ''
    with subtest("aesmd.service starts"):
      machine.wait_for_unit("aesmd.service")
      status, main_pid = machine.systemctl("show --property MainPID --value aesmd.service")
      assert status == 0, "Could not get MainPID of aesmd.service"
      main_pid = main_pid.strip()

    with subtest("aesmd.service runtime directory permissions"):
      runtime_dir = "/run/aesmd";
      res = machine.succeed(f"stat -c '%a %U %G' {runtime_dir}").strip()
      assert "750 aesmd sgx" == res, f"{runtime_dir} does not have the expected permissions: {res}"

    with subtest("aesm.socket available on host"):
      socket_path = "/var/run/aesmd/aesm.socket"
      machine.wait_until_succeeds(f"test -S {socket_path}")
      machine.succeed(f"test 777 -eq $(stat -c '%a' {socket_path})")
      for op in [ "-r", "-w", "-x" ]:
        machine.succeed(f"sudo -u sgxtest test {op} {socket_path}")
        machine.fail(f"sudo -u nosgxtest test {op} {socket_path}")

    with subtest("Copies white_list_cert_to_be_verify.bin"):
      whitelist_path = "/var/opt/aesmd/data/white_list_cert_to_be_verify.bin"
      whitelist_perms = machine.succeed(
        f"nsenter -m -t {main_pid} ${pkgs.coreutils}/bin/stat -c '%a' {whitelist_path}"
      ).strip()
      assert "644" == whitelist_perms, f"white_list_cert_to_be_verify.bin has permissions {whitelist_perms}"

    with subtest("Writes and binds aesm.conf in service namespace"):
      aesmd_config = machine.succeed(f"nsenter -m -t {main_pid} ${pkgs.coreutils}/bin/cat /etc/aesmd.conf")

      assert aesmd_config == "whitelist url = http://nixos.org\nproxy type = direct\ndefault quoting type = ecdsa_256\n", "aesmd.conf differs"
  '';
})