Raito BezariusandTom Hubrecht
c493fb668e
Two things happens here: - we consider supplementary groups that are known for authentication, fixes #968. - we check supplementary groups if they are our build users group and throw an error if they are (new behavior). Nonetheless, we did not remove the ability for `matchUser` to recurse and check for groups that the user may have but the connection might not have communicated as part of their groups, i.e. if a process reduces its list of groups via a call to setgroups, it will still be authorized. This will come in another commit. The authorization NixOS test has been extended with a store ping test running in systemd with DynamicUser=true *AND* a supplementary group in allowed-users. Co-authored-by: Tom Hubrecht <github@mail.hubrecht.ovh> Change-Id: I25b2b8304d66a04651cea523b5585a5d15ceebe8 Signed-off-by: Raito Bezarius <raito@lix.systems>
109 lines
3.2 KiB
Nix
109 lines
3.2 KiB
Nix
{
|
|
name = "authorization";
|
|
|
|
nodes.machine = { config, ... }: {
|
|
virtualisation.writableStore = true;
|
|
# TODO add a test without allowed-users setting. allowed-users is uncommon among NixOS users.
|
|
nix.settings.allowed-users = ["alice" "bob" "@special-group"];
|
|
nix.settings.trusted-users = ["alice"];
|
|
|
|
users.users.alice.isNormalUser = true;
|
|
users.users.bob.isNormalUser = true;
|
|
users.users.mallory.isNormalUser = true;
|
|
users.groups.special-group = {};
|
|
|
|
systemd.services.nix-connect-test = {
|
|
description = "Test Nix daemon connection as a DynamicUser with allowed suppgp";
|
|
serviceConfig = {
|
|
DynamicUser = true;
|
|
SupplementaryGroups = "special-group";
|
|
ExecStart = "${config.nix.package}/bin/nix store ping";
|
|
Restart = "on-failure";
|
|
RemainAfterExit = true;
|
|
};
|
|
wantedBy = [ "multi-user.target" ];
|
|
};
|
|
|
|
nix.settings.experimental-features = "nix-command";
|
|
};
|
|
|
|
testScript =
|
|
let
|
|
pathFour = "/nix/store/20xfy868aiic0r0flgzq4n5dq1yvmxkn-four";
|
|
in
|
|
''
|
|
machine.wait_for_unit("multi-user.target")
|
|
machine.wait_for_unit("nix-connect-test.service")
|
|
machine.succeed("""
|
|
exec 1>&2
|
|
echo kSELDhobKaF8/VdxIxdP7EQe+Q > one
|
|
diff $(nix store add-file one) one
|
|
""")
|
|
machine.succeed("""
|
|
su --login alice -c '
|
|
set -x
|
|
cd ~
|
|
echo ehHtmfuULXYyBV6NBk6QUi8iE0 > two
|
|
ls
|
|
diff $(echo $(nix store add-file two)) two' 1>&2
|
|
""")
|
|
machine.succeed("""
|
|
su --login bob -c '
|
|
set -x
|
|
cd ~
|
|
echo 0Jw8RNp7cK0W2AdNbcquofcOVk > three
|
|
diff $(nix store add-file three) three
|
|
' 1>&2
|
|
""")
|
|
|
|
# We're going to check that a path is not created
|
|
machine.succeed("""
|
|
! [[ -e ${pathFour} ]]
|
|
""")
|
|
machine.succeed("""
|
|
su --login mallory -c '
|
|
set -x
|
|
cd ~
|
|
echo 5mgtDj0ohrWkT50TLR0f4tIIxY > four;
|
|
(! nix store add-file four 2>&1) | grep -F "cannot open connection to remote store"
|
|
(! nix store add-file four 2>&1) | grep -F "Connection reset by peer"
|
|
! [[ -e ${pathFour} ]]
|
|
' 1>&2
|
|
""")
|
|
|
|
# Check that the file _can_ be added, and matches the expected path we were checking
|
|
machine.succeed("""
|
|
exec 1>&2
|
|
echo 5mgtDj0ohrWkT50TLR0f4tIIxY > four
|
|
four="$(nix store add-file four)"
|
|
diff $four four
|
|
diff <(echo $four) <(echo ${pathFour})
|
|
""")
|
|
|
|
machine.succeed("""
|
|
su --login alice -c 'nix-store --verify --repair'
|
|
""")
|
|
|
|
machine.succeed("""
|
|
set -x
|
|
su --login bob -c '(! nix-store --verify --repair 2>&1)' | tee diag 1>&2
|
|
grep -F "you are not privileged to repair paths" diag
|
|
""")
|
|
|
|
machine.succeed("""
|
|
set -x
|
|
su --login mallory -c '
|
|
nix-store --generate-binary-cache-key cache1.example.org sk1 pk1
|
|
(! nix store sign --key-file sk1 ${pathFour} 2>&1)' | tee diag 1>&2
|
|
grep -F "cannot open connection to remote store 'daemon'" diag
|
|
""")
|
|
|
|
machine.succeed("""
|
|
su --login bob -c '
|
|
nix-store --generate-binary-cache-key cache1.example.org sk1 pk1
|
|
nix store sign --key-file sk1 ${pathFour}
|
|
'
|
|
""")
|
|
'';
|
|
}
|