push sheeet

nixos/tests/activation/etc-overlay-immutable.nix

@@ -0,0 +1,104 @@
+{ lib, ... }:
+{
+
+  name = "activation-etc-overlay-immutable";
+
+  meta.maintainers = with lib.maintainers; [ nikstur ];
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      system.etc.overlay.enable = true;
+      system.etc.overlay.mutable = false;
+
+      # Prerequisites
+      systemd.sysusers.enable = true;
+      users.mutableUsers = false;
+      boot.initrd.systemd.enable = true;
+      boot.kernelPackages = pkgs.linuxPackages_latest;
+      time.timeZone = "Utc";
+
+      # The standard resolvconf service tries to write to /etc and crashes,
+      # which makes nixos-rebuild exit uncleanly when switching into the new generation
+      services.resolved.enable = true;
+
+      environment.etc = {
+        "mountpoint/.keep".text = "keep";
+        "filemount".text = "keep";
+      };
+
+      specialisation.new-generation.configuration = {
+        environment.etc."newgen".text = "newgen";
+      };
+      specialisation.newer-generation.configuration = {
+        environment.etc."newergen".text = "newergen";
+      };
+    };
+
+  testScript = # python
+    ''
+      newergen = machine.succeed("realpath /run/current-system/specialisation/newer-generation/bin/switch-to-configuration").rstrip()
+
+      with subtest("/run/nixos-etc-metadata/ is mounted"):
+        print(machine.succeed("mountpoint /run/nixos-etc-metadata"))
+
+      with subtest("No temporary files leaked into stage 2"):
+        machine.succeed("[ ! -e /etc-metadata-image ]")
+        machine.succeed("[ ! -e /etc-basedir ]")
+
+      with subtest("/etc is mounted as an overlay"):
+        machine.succeed("findmnt --kernel --type overlay /etc")
+
+      with subtest("direct symlinks point to the target without indirection"):
+        assert machine.succeed("readlink -n /etc/localtime") == "/etc/zoneinfo/Utc"
+
+      with subtest("/etc/mtab points to the right file"):
+        assert "/proc/mounts" == machine.succeed("readlink --no-newline /etc/mtab")
+
+      with subtest("Correct mode on the source password files"):
+        assert machine.succeed("stat -c '%a' /var/lib/nixos/etc/passwd") == "644\n"
+        assert machine.succeed("stat -c '%a' /var/lib/nixos/etc/group") == "644\n"
+        assert machine.succeed("stat -c '%a' /var/lib/nixos/etc/shadow") == "0\n"
+        assert machine.succeed("stat -c '%a' /var/lib/nixos/etc/gshadow") == "0\n"
+
+      with subtest("Password files are symlinks to /var/lib/nixos/etc"):
+        assert machine.succeed("readlink -f /etc/passwd") == "/var/lib/nixos/etc/passwd\n"
+        assert machine.succeed("readlink -f /etc/group") == "/var/lib/nixos/etc/group\n"
+        assert machine.succeed("readlink -f /etc/shadow") == "/var/lib/nixos/etc/shadow\n"
+        assert machine.succeed("readlink -f /etc/gshadow") == "/var/lib/nixos/etc/gshadow\n"
+
+      with subtest("switching to the same generation"):
+        machine.succeed("/run/current-system/bin/switch-to-configuration test")
+
+      with subtest("the initrd didn't get rebuilt"):
+        machine.succeed("test /run/current-system/initrd -ef /run/current-system/specialisation/new-generation/initrd")
+
+      with subtest("switching to a new generation"):
+        machine.fail("stat /etc/newgen")
+
+        machine.succeed("mount -t tmpfs tmpfs /etc/mountpoint")
+        machine.succeed("touch /etc/mountpoint/extra-file")
+        machine.succeed("mount --bind /dev/null /etc/filemount")
+
+        machine.succeed("/run/current-system/specialisation/new-generation/bin/switch-to-configuration switch")
+
+        assert machine.succeed("cat /etc/newgen") == "newgen"
+
+        print(machine.succeed("findmnt /etc/mountpoint"))
+        print(machine.succeed("ls /etc/mountpoint"))
+        print(machine.succeed("stat /etc/mountpoint/extra-file"))
+        print(machine.succeed("findmnt /etc/filemount"))
+
+        machine.succeed(f"{newergen} switch")
+
+        tmpMounts = machine.succeed("find /run -maxdepth 1 -type d -regex '/run/nixos-etc\\..*'").rstrip()
+        print(tmpMounts)
+        metaMounts = machine.succeed("find /run -maxdepth 1 -type d -regex '/run/nixos-etc-metadata.*'").rstrip()
+        print(metaMounts)
+
+        numOfTmpMounts = len(tmpMounts.splitlines())
+        numOfMetaMounts = len(metaMounts.splitlines())
+        assert numOfTmpMounts == 0, f"Found {numOfTmpMounts} remaining tmpmounts"
+        assert numOfMetaMounts == 1, f"Found {numOfMetaMounts} remaining metamounts"
+    '';
+}

nixos/tests/activation/etc-overlay-mutable.nix

@@ -0,0 +1,81 @@
+{ lib, ... }:
+{
+
+  name = "activation-etc-overlay-mutable";
+
+  meta.maintainers = with lib.maintainers; [ nikstur ];
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      system.etc.overlay.enable = true;
+      system.etc.overlay.mutable = true;
+
+      # Prerequisites
+      boot.initrd.systemd.enable = true;
+      boot.kernelPackages = pkgs.linuxPackages_latest;
+
+      specialisation.new-generation.configuration = {
+        environment.etc."newgen".text = "newgen";
+      };
+      specialisation.newer-generation.configuration = {
+        environment.etc."newergen".text = "newergen";
+      };
+    };
+
+  testScript = # python
+    ''
+      newergen = machine.succeed("realpath /run/current-system/specialisation/newer-generation/bin/switch-to-configuration").rstrip()
+
+      with subtest("/run/nixos-etc-metadata/ is mounted"):
+        print(machine.succeed("mountpoint /run/nixos-etc-metadata"))
+
+      with subtest("No temporary files leaked into stage 2"):
+        machine.succeed("[ ! -e /etc-metadata-image ]")
+        machine.succeed("[ ! -e /etc-basedir ]")
+
+      with subtest("/etc is mounted as an overlay"):
+        machine.succeed("findmnt --kernel --type overlay /etc")
+
+      with subtest("switching to the same generation"):
+        machine.succeed("/run/current-system/bin/switch-to-configuration test")
+
+      with subtest("the initrd didn't get rebuilt"):
+        machine.succeed("test /run/current-system/initrd -ef /run/current-system/specialisation/new-generation/initrd")
+
+      with subtest("switching to a new generation"):
+        machine.fail("stat /etc/newgen")
+        machine.succeed("echo -n 'mutable' > /etc/mutable")
+
+        # Directory
+        machine.succeed("mkdir /etc/mountpoint")
+        machine.succeed("mount -t tmpfs tmpfs /etc/mountpoint")
+        machine.succeed("touch /etc/mountpoint/extra-file")
+
+        # File
+        machine.succeed("touch /etc/filemount")
+        machine.succeed("mount --bind /dev/null /etc/filemount")
+
+        machine.succeed("/run/current-system/specialisation/new-generation/bin/switch-to-configuration switch")
+
+        assert machine.succeed("cat /etc/newgen") == "newgen"
+        assert machine.succeed("cat /etc/mutable") == "mutable"
+
+        print(machine.succeed("findmnt /etc/mountpoint"))
+        print(machine.succeed("stat /etc/mountpoint/extra-file"))
+        print(machine.succeed("findmnt /etc/filemount"))
+
+        machine.succeed(f"{newergen} switch")
+        assert machine.succeed("cat /etc/newergen") == "newergen"
+
+        tmpMounts = machine.succeed("find /run -maxdepth 1 -type d -regex '/run/nixos-etc\\..*'").rstrip()
+        print(tmpMounts)
+        metaMounts = machine.succeed("find /run -maxdepth 1 -type d -regex '/run/nixos-etc-metadata.*'").rstrip()
+        print(metaMounts)
+
+        numOfTmpMounts = len(tmpMounts.splitlines())
+        numOfMetaMounts = len(metaMounts.splitlines())
+        assert numOfTmpMounts == 0, f"Found {numOfTmpMounts} remaining tmpmounts"
+        assert numOfMetaMounts == 1, f"Found {numOfMetaMounts} remaining metamounts"
+    '';
+}

nixos/tests/activation/nix-channel.nix

@@ -0,0 +1,28 @@
+{ lib, ... }:
+
+{
+
+  name = "activation-nix-channel";
+
+  meta.maintainers = with lib.maintainers; [ nikstur ];
+
+  nodes.machine = {
+    nix.channel.enable = true;
+  };
+
+  testScript =
+    { nodes, ... }:
+    ''
+      machine.start(allow_reboot=True)
+
+      assert machine.succeed("cat /root/.nix-channels") == "${nodes.machine.system.defaultChannel} nixos\n"
+
+      nixpkgs_unstable_channel = "https://nixos.org/channels/nixpkgs-unstable nixpkgs"
+      machine.succeed(f"echo '{nixpkgs_unstable_channel}' > /root/.nix-channels")
+
+      machine.reboot()
+
+      assert machine.succeed("cat /root/.nix-channels") == f"{nixpkgs_unstable_channel}\n"
+    '';
+
+}

nixos/tests/activation/nixos-init.nix

@@ -0,0 +1,54 @@
+{ lib, pkgs, ... }:
+
+{
+  name = "nixos-init";
+
+  meta.maintainers = with lib.maintainers; [ nikstur ];
+
+  nodes.machine =
+    { modulesPath, ... }:
+    {
+      imports = [
+        "${modulesPath}/profiles/perlless.nix"
+      ];
+      virtualisation.mountHostNixStore = false;
+      virtualisation.useNixStoreImage = true;
+
+      system.nixos-init.enable = true;
+      # Forcibly set this to only these specific values.
+      boot.nixStoreMountOpts = lib.mkForce [
+        "nodev"
+        "nosuid"
+      ];
+    };
+
+  testScript =
+    { nodes, ... }: # python
+    ''
+      with subtest("init"):
+        with subtest("/nix/store is mounted with the correct options"):
+          findmnt_output = machine.succeed("findmnt --direction backward --first-only --noheadings --output OPTIONS /nix/store").strip()
+          print(findmnt_output)
+          t.assertIn("nodev", findmnt_output)
+          t.assertIn("nosuid", findmnt_output)
+
+        t.assertEqual("${nodes.machine.system.build.toplevel}", machine.succeed("readlink /run/booted-system").strip())
+
+      with subtest("activation"):
+        t.assertEqual("${nodes.machine.system.build.toplevel}", machine.succeed("readlink /run/current-system").strip())
+        t.assertEqual("${nodes.machine.hardware.firmware}/lib/firmware", machine.succeed("cat /sys/module/firmware_class/parameters/path").strip())
+        t.assertEqual("${pkgs.kmod}/bin/modprobe", machine.succeed("cat /proc/sys/kernel/modprobe").strip())
+        t.assertEqual("${nodes.machine.environment.usrbinenv}", machine.succeed("readlink /usr/bin/env").strip())
+        t.assertEqual("${nodes.machine.environment.binsh}", machine.succeed("readlink /bin/sh").strip())
+
+      machine.wait_for_unit("multi-user.target")
+      with subtest("systemd state passing"):
+        systemd_analyze_output = machine.succeed("systemd-analyze")
+        print(systemd_analyze_output)
+        t.assertIn("(initrd)", systemd_analyze_output, "systemd-analyze has no information about the initrd")
+
+        ps_output = machine.succeed("ps ax -o command | grep systemd | head -n 1")
+        print(ps_output)
+        t.assertIn("--deserialize", ps_output, "--deserialize flag wasn't passed to systemd")
+    '';
+}

nixos/tests/activation/perlless.nix

@@ -0,0 +1,26 @@
+{ lib, ... }:
+
+{
+
+  name = "activation-perlless";
+
+  meta.maintainers = with lib.maintainers; [ nikstur ];
+
+  nodes.machine =
+    { pkgs, modulesPath, ... }:
+    {
+      imports = [ "${modulesPath}/profiles/perlless.nix" ];
+
+      boot.kernelPackages = pkgs.linuxPackages_latest;
+
+      virtualisation.mountHostNixStore = false;
+      virtualisation.useNixStoreImage = true;
+    };
+
+  testScript = ''
+    perl_store_paths = machine.succeed("ls /nix/store | grep perl || true")
+    print(perl_store_paths)
+    assert len(perl_store_paths) == 0
+  '';
+
+}

nixos/tests/activation/var.nix

@@ -0,0 +1,18 @@
+{ lib, ... }:
+
+{
+
+  name = "activation-var";
+
+  meta.maintainers = with lib.maintainers; [ nikstur ];
+
+  nodes.machine = { };
+
+  testScript = ''
+    assert machine.succeed("stat -c '%a' /var/tmp") == "1777\n"
+    assert machine.succeed("stat -c '%a' /var/empty") == "555\n"
+    assert machine.succeed("stat -c '%U' /var/empty") == "root\n"
+    assert machine.succeed("stat -c '%G' /var/empty") == "root\n"
+    assert "i" in machine.succeed("lsattr -d /var/empty")
+  '';
+}