1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
|
import ./make-test-python.nix ({ lib, pkgs, ... }:
{
name = "systemd-credentials-tpm2";
meta = {
maintainers = with pkgs.lib.maintainers; [ tmarkus ];
};
nodes.machine = { pkgs, ... }: {
virtualisation.tpm.enable = true;
environment.systemPackages = with pkgs; [ diffutils ];
};
testScript = ''
CRED_NAME = "testkey"
CRED_RAW_FILE = f"/root/{CRED_NAME}"
CRED_FILE = f"/root/{CRED_NAME}.cred"
def systemd_run(machine, cmd):
machine.log(f"Executing command (via systemd-run): \"{cmd}\"")
(status, out) = machine.execute( " ".join([
"systemd-run",
"--service-type=exec",
"--quiet",
"--wait",
"-E PATH=\"$PATH\"",
"-p StandardOutput=journal",
"-p StandardError=journal",
f"-p LoadCredentialEncrypted={CRED_NAME}:{CRED_FILE}",
f"$SHELL -c '{cmd}'"
]) )
if status != 0:
raise Exception(f"systemd_run failed (status {status})")
machine.log("systemd-run finished successfully")
machine.wait_for_unit("multi-user.target")
with subtest("Check whether TPM device exists"):
machine.succeed("test -e /dev/tpm0")
machine.succeed("test -e /dev/tpmrm0")
with subtest("Check whether systemd-creds detects TPM2 correctly"):
cmd = "systemd-creds has-tpm2"
machine.log(f"Running \"{cmd}\"")
(status, _) = machine.execute(cmd)
# Check exit code equals 0 or 1 (1 means firmware support is missing, which is OK here)
if status != 0 and status != 1:
raise Exception("systemd-creds failed to detect TPM2")
with subtest("Encrypt credential using systemd-creds"):
machine.succeed(f"dd if=/dev/urandom of={CRED_RAW_FILE} bs=1k count=16")
machine.succeed(f"systemd-creds --with-key=host+tpm2 encrypt --name=testkey {CRED_RAW_FILE} {CRED_FILE}")
with subtest("Write provided credential and check for equality"):
CRED_OUT_FILE = f"/root/{CRED_NAME}.out"
systemd_run(machine, f"systemd-creds cat testkey > {CRED_OUT_FILE}")
machine.succeed(f"cmp --silent -- {CRED_RAW_FILE} {CRED_OUT_FILE}")
with subtest("Check whether systemd service can see credential in systemd-creds list"):
systemd_run(machine, f"systemd-creds list | grep {CRED_NAME}")
with subtest("Check whether systemd service can access credential in $CREDENTIALS_DIRECTORY"):
systemd_run(machine, f"cmp --silent -- $CREDENTIALS_DIRECTORY/{CRED_NAME} {CRED_RAW_FILE}")
'';
})
|
