From 10ea0dba00fe0d2449e53dad0f1a4d97ac333841 Mon Sep 17 00:00:00 2001
From: Tomas Volf <~@wolfsden.cz>
Date: Thu, 11 Jan 2024 18:35:41 +0100
Subject: tests: Add `encrypted-home-os-key-file' installation test.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Based on encrypted-home-os, this test verifies unlocking via a key file.

* gnu/tests/install.scm (%encrypted-home-os-key-file),
(%encrypted-home-os-key-file-source): New variables.
(%test-encrypted-home-os-key-file): New exported variables.
(%encrypted-home-installation-script): Generate initrd with a key file for
unlocking the LUKS.

Change-Id: I04460155284bdef7e18da645f2b4b26bd8e86636
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
---
 gnu/tests/install.scm | 74 ++++++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 73 insertions(+), 1 deletion(-)

(limited to 'gnu/tests')

diff --git a/gnu/tests/install.scm b/gnu/tests/install.scm
index daa4647299..6794bca145 100644
--- a/gnu/tests/install.scm
+++ b/gnu/tests/install.scm
@@ -35,6 +35,7 @@
   #:use-module (gnu packages admin)
   #:use-module (gnu packages bootloaders)
   #:use-module (gnu packages commencement)       ;for 'guile-final'
+  #:use-module (gnu packages cpio)
   #:use-module (gnu packages cryptsetup)
   #:use-module (gnu packages disk)
   #:use-module (gnu packages emacs)
@@ -67,6 +68,7 @@
             %test-raid-root-os
             %test-encrypted-root-os
             %test-encrypted-home-os
+            %test-encrypted-home-os-key-file
             %test-encrypted-root-not-boot-os
             %test-btrfs-root-os
             %test-btrfs-root-on-subvolume-os
@@ -975,6 +977,18 @@ echo -n " %luks-passphrase " | \\
 mkfs.ext4 -L root-fs /dev/vdb2
 mkfs.ext4 -L home-fs /dev/mapper/the-home-device
 mount /dev/vdb2 /mnt
+
+# This script is used for both encrypted-home-os and encrypted-home-os-key-file
+# tests.  So we also add the keyfile here.
+dd if=/dev/zero of=/key-file.bin bs=4096 count=1
+( cd /mnt;
+  echo /key-file.bin | cpio -oH newc > key-file.cpio
+  chmod 0000 key-file.cpio
+  mv /key-file.bin .
+)
+echo -n " %luks-passphrase " | \\
+  cryptsetup luksAddKey --key-file - -i 1 /dev/vdb3 /mnt/key-file.bin
+
 mkdir /mnt/home
 mount /dev/mapper/the-home-device /mnt/home
 df -h /mnt /mnt/home
@@ -1018,11 +1032,69 @@ launched as a shepherd service."
     (mlet* %store-monad ((images (run-install %encrypted-home-os
                                               %encrypted-home-os-source
                                               #:script
-                                              %encrypted-home-installation-script))
+                                              %encrypted-home-installation-script
+                                              #:packages (list cpio)))
                          (command (qemu-command* images)))
       (run-basic-test %encrypted-home-os command "encrypted-home-os"
                       #:initialization enter-luks-passphrase-for-home)))))
 
+
+;;;
+;;; LUKS-encrypted /home, unencrypted root.  The unlock is done using a key
+;;; file.
+;;;
+(define-os-with-source (%encrypted-home-os-key-file
+                        %encrypted-home-os-key-file-source)
+  (use-modules (gnu) (gnu tests))
+
+  (operating-system
+    (host-name "cipherhome")
+    (timezone "Europe/Prague")
+    (locale "en_US.utf8")
+
+    (bootloader (bootloader-configuration
+                 (bootloader grub-bootloader)
+                 (targets (list "/dev/vdb"))
+                 (extra-initrd "/key-file.cpio")))
+    (kernel-arguments '("console=ttyS0"))
+
+    (mapped-devices (list (mapped-device
+                           (source (uuid "12345678-1234-1234-1234-123456789abc"))
+                           (target "the-home-device")
+                           (type (luks-device-mapping-with-options
+                                  #:key-file "/key-file.bin")))))
+    (file-systems (cons* (file-system
+                           (device (file-system-label "root-fs"))
+                           (mount-point "/")
+                           (type "ext4"))
+                         (file-system
+                           (device (file-system-label "home-fs"))
+                           (mount-point "/home")
+                           (type "ext4")
+                           (dependencies mapped-devices))
+                        %base-file-systems))
+    (services (cons (service marionette-service-type
+                             (marionette-configuration
+                              (imported-modules '((gnu services herd)
+                                                  (guix combinators)))))
+                    %base-services))))
+
+(define %test-encrypted-home-os-key-file
+  (system-test
+   (name "encrypted-home-os-key-file")
+   (description
+    "Test functionality of an OS installed with a LUKS /home partition with
+unlock done using a key file")
+   (value
+    (mlet* %store-monad ((images (run-install %encrypted-home-os-key-file
+                                              %encrypted-home-os-key-file-source
+                                              #:script
+                                              %encrypted-home-installation-script
+                                              #:packages (list cpio)))
+                         (command (qemu-command* images)))
+      (run-basic-test %encrypted-home-os-key-file
+                      command "encrypted-home-os-key-file")))))
+
 
 ;;;
 ;;; LUKS-encrypted root file system and /boot in a non-encrypted partition.
-- 
cgit v1.2.3