depot/nixos/tests/userborn-immutable-users.nix
Luke Granger-Brown 57725ef3ec Squashed 'third_party/nixpkgs/' content from commit 76612b17c0ce
git-subtree-dir: third_party/nixpkgs
git-subtree-split: 76612b17c0ce71689921ca12d9ffdc9c23ce40b2
2024-11-10 23:59:47 +00:00

75 lines
1.9 KiB
Nix

{ lib, ... }:
let
normaloHashedPassword = "$y$j9T$IEWqhKtWg.r.8fVkSEF56.$iKNxdMC6hOAQRp6eBtYvBk4c7BGpONXeZMqc8I/LM46";
common = {
services.userborn.enable = true;
users.mutableUsers = false;
};
in
{
name = "userborn-immutable-users";
meta.maintainers = with lib.maintainers; [ nikstur ];
nodes.machine =
{ config, ... }:
{
imports = [ common ];
users = {
users = {
normalo = {
isNormalUser = true;
hashedPassword = normaloHashedPassword;
};
};
};
specialisation.new-generation = {
inheritParentConfig = false;
configuration = {
nixpkgs = {
inherit (config.nixpkgs) hostPlatform;
};
imports = [ common ];
users.users = {
new-normalo = {
isNormalUser = true;
};
};
};
};
};
testScript = ''
machine.wait_for_unit("userborn.service")
with subtest("normalo user is created"):
assert "${normaloHashedPassword}" in machine.succeed("getent shadow normalo"), "normalo user password is not correct"
with subtest("Fail to add new user manually"):
machine.fail("useradd manual-normalo")
with subtest("Fail to add delete user manually"):
machine.fail("userdel normalo")
machine.succeed("/run/current-system/specialisation/new-generation/bin/switch-to-configuration switch")
with subtest("normalo user is disabled"):
print(machine.succeed("getent shadow normalo"))
assert "!*" in machine.succeed("getent shadow normalo"), "normalo user is not disabled"
with subtest("new-normalo user is created after switching to new generation"):
print(machine.succeed("getent passwd new-normalo"))
with subtest("Still fail to add new user manually"):
machine.fail("useradd again-normalo")
'';
}