mirror of
https://github.com/NixOS/nixpkgs.git
synced 2024-12-30 01:23:03 +00:00
0bdba6c99b
This change removes the bespoke logic around identifying block devices. Instead of trying to find the right device by iterating over `qemu.drives` and guessing the right partition number (e.g. /dev/vda{1,2}), devices are now identified by persistent names provided by udev in /dev/disk/by-*. Before this change, the root device was formatted on demand in the initrd. However, this makes it impossible to use filesystem identifiers to identify devices. Now, the formatting step is performed before the VM is started. Because some tests, however, rely on this behaviour, a utility function to replace this behaviour in added in /nixos/tests/common/auto-format-root-device.nix. Devices that contain neither a partition table nor a filesystem are identified by their hardware serial number which is injecetd via QEMU (and is thus persistent and predictable). PCI paths are not a reliably way to identify devices because their availability and numbering depends on the QEMU machine type. This change makes the module more robust against changes in QEMU and the kernel (non-persistent device naming) and by decoupling abstractions (i.e. rootDevice, bootPartition, and bootLoaderDevice) enables further improvement down the line.
74 lines
2.3 KiB
Nix
74 lines
2.3 KiB
Nix
import ./make-test-python.nix ({ lib, pkgs, ... }: {
|
|
name = "luks";
|
|
|
|
nodes.machine = { pkgs, ... }: {
|
|
imports = [ ./common/auto-format-root-device.nix ];
|
|
|
|
# Use systemd-boot
|
|
virtualisation = {
|
|
emptyDiskImages = [ 512 512 ];
|
|
useBootLoader = true;
|
|
useEFIBoot = true;
|
|
# To boot off the encrypted disk, we need to have a init script which comes from the Nix store
|
|
mountHostNixStore = true;
|
|
};
|
|
boot.loader.systemd-boot.enable = true;
|
|
|
|
boot.kernelParams = lib.mkOverride 5 [ "console=tty1" ];
|
|
|
|
environment.systemPackages = with pkgs; [ cryptsetup ];
|
|
|
|
specialisation = rec {
|
|
boot-luks.configuration = {
|
|
boot.initrd.luks.devices = lib.mkVMOverride {
|
|
# We have two disks and only type one password - key reuse is in place
|
|
cryptroot.device = "/dev/vdb";
|
|
cryptroot2.device = "/dev/vdc";
|
|
};
|
|
virtualisation.rootDevice = "/dev/mapper/cryptroot";
|
|
};
|
|
boot-luks-custom-keymap.configuration = lib.mkMerge [
|
|
boot-luks.configuration
|
|
{
|
|
console.keyMap = "neo";
|
|
}
|
|
];
|
|
};
|
|
};
|
|
|
|
enableOCR = true;
|
|
|
|
testScript = ''
|
|
# Create encrypted volume
|
|
machine.wait_for_unit("multi-user.target")
|
|
machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -")
|
|
machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdc -")
|
|
|
|
# Boot from the encrypted disk
|
|
machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks.conf")
|
|
machine.succeed("sync")
|
|
machine.crash()
|
|
|
|
# Boot and decrypt the disk
|
|
machine.start()
|
|
machine.wait_for_text("Passphrase for")
|
|
machine.send_chars("supersecret\n")
|
|
machine.wait_for_unit("multi-user.target")
|
|
|
|
assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
|
|
|
|
# Boot from the encrypted disk with custom keymap
|
|
machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks-custom-keymap.conf")
|
|
machine.succeed("sync")
|
|
machine.crash()
|
|
|
|
# Boot and decrypt the disk
|
|
machine.start()
|
|
machine.wait_for_text("Passphrase for")
|
|
machine.send_chars("havfkhfrkfl\n")
|
|
machine.wait_for_unit("multi-user.target")
|
|
|
|
assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
|
|
'';
|
|
})
|