diff options
author | Leon Schuermann <leon-git@lschuermann.xyz> | 2018-01-17 21:56:08 +0700 |
---|---|---|
committer | Jörg Thalheim <Mic92@users.noreply.github.com> | 2018-01-17 14:56:08 +0000 |
commit | f297ddb5c97b23756c2a0685536edffeb20720c4 (patch) | |
tree | 8e2fef07aaea6c6b43c3655477fe4bf9ef751cfb /nixos/tests | |
parent | 9844e027c4a078cdc99e47ca8ba1e4fc13bf5667 (diff) | |
download | nixpkgs-f297ddb5c97b23756c2a0685536edffeb20720c4.tar nixpkgs-f297ddb5c97b23756c2a0685536edffeb20720c4.tar.gz nixpkgs-f297ddb5c97b23756c2a0685536edffeb20720c4.tar.bz2 nixpkgs-f297ddb5c97b23756c2a0685536edffeb20720c4.tar.lz nixpkgs-f297ddb5c97b23756c2a0685536edffeb20720c4.tar.xz nixpkgs-f297ddb5c97b23756c2a0685536edffeb20720c4.tar.zst nixpkgs-f297ddb5c97b23756c2a0685536edffeb20720c4.zip |
sudo: define extra rules in Nix language (#33905)
Diffstat (limited to 'nixos/tests')
-rw-r--r-- | nixos/tests/misc.nix | 5 | ||||
-rw-r--r-- | nixos/tests/sudo.nix | 93 |
2 files changed, 93 insertions, 5 deletions
diff --git a/nixos/tests/misc.nix b/nixos/tests/misc.nix index 79290861cb0..6de17518214 100644 --- a/nixos/tests/misc.nix +++ b/nixos/tests/misc.nix @@ -115,11 +115,6 @@ import ./make-test.nix ({ pkgs, ...} : { $machine->succeed("nix-store -qR /run/current-system | grep nixos-"); }; - # Test sudo - subtest "sudo", sub { - $machine->succeed("su - sybil -c 'sudo true'"); - }; - # Test sysctl subtest "sysctl", sub { $machine->waitForUnit("systemd-sysctl.service"); diff --git a/nixos/tests/sudo.nix b/nixos/tests/sudo.nix new file mode 100644 index 00000000000..35addb0ee80 --- /dev/null +++ b/nixos/tests/sudo.nix @@ -0,0 +1,93 @@ +# Some tests to ensure sudo is working properly. + +let + password = "helloworld"; + +in + import ./make-test.nix ({ pkgs, ...} : { + name = "sudo"; + meta = with pkgs.stdenv.lib.maintainers; { + maintainers = [ lschuermann ]; + }; + + machine = + { config, lib, pkgs, ... }: + with lib; + { + users.extraGroups = { foobar = {}; barfoo = {}; baz = { gid = 1337; }; }; + users.users = { + test0 = { isNormalUser = true; extraGroups = [ "wheel" ]; }; + test1 = { isNormalUser = true; password = password; }; + test2 = { isNormalUser = true; extraGroups = [ "foobar" ]; password = password; }; + test3 = { isNormalUser = true; extraGroups = [ "barfoo" ]; }; + test4 = { isNormalUser = true; extraGroups = [ "baz" ]; }; + test5 = { isNormalUser = true; }; + }; + + security.sudo = { + enable = true; + wheelNeedsPassword = false; + + extraRules = [ + # SUDOERS SYNTAX CHECK (Test whether the module produces a valid output; + # errors being detected by the visudo checks. + + # These should not create any entries + { users = [ "notest1" ]; commands = [ ]; } + { commands = [ { command = "ALL"; options = [ ]; } ]; } + + # Test defining commands with the options syntax, though not setting any options + { users = [ "notest2" ]; commands = [ { command = "ALL"; options = [ ]; } ]; } + + + # CONFIGURATION FOR TEST CASES + { users = [ "test1" ]; groups = [ "foobar" ]; commands = [ "ALL" ]; } + { groups = [ "barfoo" 1337 ]; commands = [ { command = "ALL"; options = [ "NOPASSWD" "NOSETENV" ]; } ]; } + { users = [ "test5" ]; commands = [ { command = "ALL"; options = [ "NOPASSWD" "SETENV" ]; } ]; runAs = "test1:barfoo"; } + ]; + }; + }; + + testScript = + '' + subtest "users in wheel group should have passwordless sudo", sub { + $machine->succeed("su - test0 -c \"sudo -u root true\""); + }; + + subtest "test1 user should have sudo with password", sub { + $machine->succeed("su - test1 -c \"echo ${password} | sudo -S -u root true\""); + }; + + subtest "test1 user should not be able to use sudo without password", sub { + $machine->fail("su - test1 -c \"sudo -n -u root true\""); + }; + + subtest "users in group 'foobar' should be able to use sudo with password", sub { + $machine->succeed("sudo -u test2 echo ${password} | sudo -S -u root true"); + }; + + subtest "users in group 'barfoo' should be able to use sudo without password", sub { + $machine->succeed("sudo -u test3 sudo -n -u root true"); + }; + + subtest "users in group 'baz' (GID 1337) should be able to use sudo without password", sub { + $machine->succeed("sudo -u test4 sudo -n -u root echo true"); + }; + + subtest "test5 user should be able to run commands under test1", sub { + $machine->succeed("sudo -u test5 sudo -n -u test1 true"); + }; + + subtest "test5 user should not be able to run commands under root", sub { + $machine->fail("sudo -u test5 sudo -n -u root true"); + }; + + subtest "test5 user should be able to keep his environment", sub { + $machine->succeed("sudo -u test5 sudo -n -E -u test1 true"); + }; + + subtest "users in group 'barfoo' should not be able to keep their environment", sub { + $machine->fail("sudo -u test3 sudo -n -E -u root true"); + }; + ''; + }) |