1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108

{
  name = "authorization";

  nodes.machine = { config, ... }: {
    virtualisation.writableStore = true;
    # TODO add a test without allowed-users setting. allowed-users is uncommon among NixOS users.
    nix.settings.allowed-users = ["alice" "bob" "@special-group"];
    nix.settings.trusted-users = ["alice"];

    users.users.alice.isNormalUser = true;
    users.users.bob.isNormalUser = true;
    users.users.mallory.isNormalUser = true;
    users.groups.special-group = {};

    systemd.services.nix-connect-test = {
      description = "Test Nix daemon connection as a DynamicUser with allowed suppgp";
      serviceConfig = {
        DynamicUser = true;
        SupplementaryGroups = "special-group";
        ExecStart = "${config.nix.package}/bin/nix store ping";
        Restart = "on-failure";
        RemainAfterExit = true;
      };
      wantedBy = [ "multi-user.target" ];
    };

    nix.settings.experimental-features = "nix-command";
  };

  testScript =
  let
    pathFour = "/nix/store/20xfy868aiic0r0flgzq4n5dq1yvmxkn-four";
  in
  ''
    machine.wait_for_unit("multi-user.target")
    machine.wait_for_unit("nix-connect-test.service")
    machine.succeed("""
      exec 1>&2
      echo kSELDhobKaF8/VdxIxdP7EQe+Q > one
      diff $(nix store add-file one) one
    """)
    machine.succeed("""
      su --login alice -c '
        set -x
        cd ~
        echo ehHtmfuULXYyBV6NBk6QUi8iE0 > two
        ls
        diff $(echo $(nix store add-file two)) two' 1>&2
    """)
    machine.succeed("""
      su --login bob -c '
        set -x
        cd ~
        echo 0Jw8RNp7cK0W2AdNbcquofcOVk > three
        diff $(nix store add-file three) three
      ' 1>&2
    """)

    # We're going to check that a path is not created
    machine.succeed("""
      ! [[ -e ${pathFour} ]]
    """)
    machine.succeed("""
      su --login mallory -c '
        set -x
        cd ~
        echo 5mgtDj0ohrWkT50TLR0f4tIIxY > four;
        (! nix store add-file four 2>&1) | grep -F "cannot open connection to remote store"
        (! nix store add-file four 2>&1) | grep -F "Connection reset by peer"
        ! [[ -e ${pathFour} ]]
      ' 1>&2
    """)

    # Check that the file _can_ be added, and matches the expected path we were checking
    machine.succeed("""
      exec 1>&2
      echo 5mgtDj0ohrWkT50TLR0f4tIIxY > four
      four="$(nix store add-file four)"
      diff $four four
      diff <(echo $four) <(echo ${pathFour})
    """)

    machine.succeed("""
      su --login alice -c 'nix-store --verify --repair'
    """)

    machine.succeed("""
      set -x
      su --login bob -c '(! nix-store --verify --repair 2>&1)' | tee diag 1>&2
      grep -F "you are not privileged to repair paths" diag
    """)

    machine.succeed("""
        set -x
        su --login mallory -c '
          nix-store --generate-binary-cache-key cache1.example.org sk1 pk1
          (! nix store sign --key-file sk1 ${pathFour} 2>&1)' | tee diag 1>&2
        grep -F "cannot open connection to remote store 'daemon'" diag
    """)

    machine.succeed("""
        su --login bob -c '
          nix-store --generate-binary-cache-key cache1.example.org sk1 pk1
          nix store sign --key-file sk1 ${pathFour}
        '
    """)
  '';
}