nixpkgs/nixos/tests/systemd-credentials-tpm2.nix

import ./make-test-python.nix ({ lib, pkgs, ... }:
{
  name = "systemd-credentials-tpm2";

  meta = {
    maintainers = with pkgs.lib.maintainers; [ tmarkus ];
  };

  nodes.machine = { pkgs, ... }: {
    virtualisation.tpm.enable = true;
    environment.systemPackages = with pkgs; [ diffutils ];
  };

  testScript = ''
    CRED_NAME = "testkey"
    CRED_RAW_FILE = f"/root/{CRED_NAME}"
    CRED_FILE = f"/root/{CRED_NAME}.cred"

    def systemd_run(machine, cmd):
        machine.log(f"Executing command (via systemd-run): \"{cmd}\"")

        (status, out) = machine.execute( " ".join([
            "systemd-run",
            "--service-type=exec",
            "--quiet",
            "--wait",
            "-E PATH=\"$PATH\"",
            "-p StandardOutput=journal",
            "-p StandardError=journal",
            f"-p LoadCredentialEncrypted={CRED_NAME}:{CRED_FILE}",
            f"$SHELL -c '{cmd}'"
            ]) )

        if status != 0:
            raise Exception(f"systemd_run failed (status {status})")

        machine.log("systemd-run finished successfully")

    machine.wait_for_unit("multi-user.target")

    with subtest("Check whether TPM device exists"):
        machine.succeed("test -e /dev/tpm0")
        machine.succeed("test -e /dev/tpmrm0")

    with subtest("Check whether systemd-creds detects TPM2 correctly"):
        cmd = "systemd-creds has-tpm2"
        machine.log(f"Running \"{cmd}\"")
        (status, _) = machine.execute(cmd)

        # Check exit code equals 0 or 1 (1 means firmware support is missing, which is OK here)
        if status != 0 and status != 1:
            raise Exception("systemd-creds failed to detect TPM2")

    with subtest("Encrypt credential using systemd-creds"):
        machine.succeed(f"dd if=/dev/urandom of={CRED_RAW_FILE} bs=1k count=16")
        machine.succeed(f"systemd-creds --with-key=host+tpm2 encrypt --name=testkey {CRED_RAW_FILE} {CRED_FILE}")

    with subtest("Write provided credential and check for equality"):
        CRED_OUT_FILE = f"/root/{CRED_NAME}.out"
        systemd_run(machine, f"systemd-creds cat testkey > {CRED_OUT_FILE}")
        machine.succeed(f"cmp --silent -- {CRED_RAW_FILE} {CRED_OUT_FILE}")

    with subtest("Check whether systemd service can see credential in systemd-creds list"):
        systemd_run(machine, f"systemd-creds list | grep {CRED_NAME}")

    with subtest("Check whether systemd service can access credential in $CREDENTIALS_DIRECTORY"):
        systemd_run(machine, f"cmp --silent -- $CREDENTIALS_DIRECTORY/{CRED_NAME} {CRED_RAW_FILE}")
  '';
})