From b089c39a2364725a7331f8e9a3a5198fc3dc0ef8 Mon Sep 17 00:00:00 2001 From: "Dino A. Dai Zovi" Date: Sun, 11 Jul 2021 20:00:06 +0000 Subject: nixos/tests: update initrd-secrets test to test secret in /run/keys Since /run/keys is a ramfs, it is not paged out and a good place to copy secrets to. Test whether secrets with a path in /run/keys exist after initrd. --- nixos/tests/initrd-secrets.nix | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/nixos/tests/initrd-secrets.nix b/nixos/tests/initrd-secrets.nix index 10dd908502d..113a9cebf78 100644 --- a/nixos/tests/initrd-secrets.nix +++ b/nixos/tests/initrd-secrets.nix @@ -13,7 +13,12 @@ let machine = { ... }: { virtualisation.useBootLoader = true; - boot.initrd.secrets."/test" = secretInStore; + boot.initrd.secrets = { + "/test" = secretInStore; + + # This should *not* need to be copied in postMountCommands + "/run/keys/test" = secretInStore; + }; boot.initrd.postMountCommands = '' cp /test /mnt-root/secret-from-initramfs ''; @@ -26,7 +31,8 @@ let start_all() machine.wait_for_unit("multi-user.target") machine.succeed( - "cmp ${secretInStore} /secret-from-initramfs" + "cmp ${secretInStore} /secret-from-initramfs", + "cmp ${secretInStore} /run/keys/test", ) ''; }; -- cgit 1.4.1