import ./make-test-python.nix ({ pkgs, lib, ... }: let password = "foobarfoo"; newPass = "barfoobar"; in { name = "systemd-homed"; nodes.machine = { config, pkgs, ... }: { services.homed.enable = true; users.users.test-normal-user = { extraGroups = [ "wheel" ]; isNormalUser = true; initialPassword = password; }; }; testScript = '' def switchTTY(number): machine.send_key(f"alt-f{number}") machine.wait_until_succeeds(f"[ $(fgconsole) = {number} ]") machine.wait_for_unit(f"getty@tty{number}.service") machine.wait_until_succeeds(f"pgrep -f 'agetty.*tty{number}'") machine.wait_for_unit("multi-user.target") # Smoke test to make sure the pam changes didn't break regular users. machine.wait_until_succeeds("pgrep -f 'agetty.*tty1'") with subtest("login as regular user"): switchTTY(2) machine.wait_until_tty_matches("2", "login: ") machine.send_chars("test-normal-user\n") machine.wait_until_tty_matches("2", "login: test-normal-user") machine.wait_until_tty_matches("2", "Password: ") machine.send_chars("${password}\n") machine.wait_until_succeeds("pgrep -u test-normal-user bash") machine.send_chars("whoami > /tmp/1\n") machine.wait_for_file("/tmp/1") assert "test-normal-user" in machine.succeed("cat /tmp/1") with subtest("create homed encrypted user"): # TODO: Figure out how to pass password manually. # # This environment variable is used for homed internal testing # and is not documented. machine.succeed("NEWPASSWORD=${password} homectl create --shell=/run/current-system/sw/bin/bash --storage=luks -G wheel test-homed-user") with subtest("login as homed user"): switchTTY(3) machine.wait_until_tty_matches("3", "login: ") machine.send_chars("test-homed-user\n") machine.wait_until_tty_matches("3", "login: test-homed-user") machine.wait_until_tty_matches("3", "Password: ") machine.send_chars("${password}\n") machine.wait_until_succeeds("pgrep -t tty3 -u test-homed-user bash") machine.send_chars("whoami > /tmp/2\n") machine.wait_for_file("/tmp/2") assert "test-homed-user" in machine.succeed("cat /tmp/2") with subtest("change homed user password"): switchTTY(4) machine.wait_until_tty_matches("4", "login: ") machine.send_chars("test-homed-user\n") machine.wait_until_tty_matches("4", "login: test-homed-user") machine.wait_until_tty_matches("4", "Password: ") machine.send_chars("${password}\n") machine.wait_until_succeeds("pgrep -t tty4 -u test-homed-user bash") machine.send_chars("passwd\n") # homed does it in a weird order, it asks for new passes, then it asks # for the old one. machine.sleep(2) machine.send_chars("${newPass}\n") machine.sleep(2) machine.send_chars("${newPass}\n") machine.sleep(4) machine.send_chars("${password}\n") machine.wait_until_fails("pgrep -t tty4 passwd") @polling_condition def not_logged_in_tty5(): machine.fail("pgrep -t tty5 bash") switchTTY(5) with not_logged_in_tty5: # type: ignore[union-attr] machine.wait_until_tty_matches("5", "login: ") machine.send_chars("test-homed-user\n") machine.wait_until_tty_matches("5", "login: test-homed-user") machine.wait_until_tty_matches("5", "Password: ") machine.send_chars("${password}\n") machine.wait_until_tty_matches("5", "Password incorrect or not sufficient for authentication of user test-homed-user.") machine.wait_until_tty_matches("5", "Sorry, try again: ") machine.send_chars("${newPass}\n") machine.send_chars("whoami > /tmp/4\n") machine.wait_for_file("/tmp/4") assert "test-homed-user" in machine.succeed("cat /tmp/4") with subtest("homed user should be in wheel according to NSS"): machine.succeed("userdbctl group wheel -s io.systemd.NameServiceSwitch | grep test-homed-user") ''; })