aboutsummaryrefslogtreecommitdiff
path: root/tests/guix-home.sh
blob: 649d811a0cd0443c5151d6ab07120d3eeddd4864 (about) (plain) 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228

# GNU Guix --- Functional package management for GNU
# Copyright © 2021-2023 Andrew Tropin <andrew@trop.in>
# Copyright © 2021 Oleg Pykhalov <go.wigust@gmail.com>
# Copyright © 2022, 2023 Ludovic Courtès <ludo@gnu.org>
#
# This file is part of GNU Guix.
#
# GNU Guix is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 3 of the License, or (at
# your option) any later version.
#
# GNU Guix is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.

#
# Test the 'guix home' using the external store, if any.
#

set -e

guix home --version

container_supported ()
{
    if guile -c '((@ (guix scripts environment) assert-container-features))'
    then
	return 0
    else
	return 1
    fi
}

localstatedir="$(guile -c '(use-modules (guix config))(display %localstatedir)')"
NIX_STORE_DIR="$(guile -c '(use-modules (guix config))(display %storedir)')"
GUIX_DAEMON_SOCKET="$localstatedir/guix/daemon-socket/socket"
export NIX_STORE_DIR GUIX_DAEMON_SOCKET

# Run tests only when a "real" daemon is available.
if ! guile -c '(use-modules (guix)) (exit (false-if-exception (open-connection)))'
then
    exit 77
fi

STORE_PARENT="$(dirname "$NIX_STORE_DIR")"
export STORE_PARENT
if test "$STORE_PARENT" = "/"; then exit 77; fi

test_directory="$(mktemp -d)"
trap 'chmod -Rf +w "$test_directory"; rm -rf "$test_directory"' EXIT

(
    cd "$test_directory" || exit 77

    cat > "home.scm" <<'EOF'
(use-modules (guix gexp)
             (gnu home)
             (gnu home services)
             (gnu home services shells)
             (gnu packages bash)
             (gnu services))

(home-environment
 (services
  (list
   (simple-service 'test-config
                   home-files-service-type
                   (list `(".config/test.conf"
                           ,(plain-file
                             "tmp-file.txt"
                             "the content of ~/.config/test.conf"))))

   (service home-bash-service-type
            (home-bash-configuration
             (guix-defaults? #t)
             (bashrc (list (local-file "dot-bashrc")))))

   (simple-service 'add-environment-variable
                   home-environment-variables-service-type
                   `(("TODAY" . "26 messidor")
                     ("SHELL" . ,(file-append bash "/bin/bash"))
                     ("BUILDHOST_TIME" . ,#~(strftime "%c"
                                             (localtime (current-time))))
                     ("STRING_WITH_ESCAPES" . "chars: \" /\\")
                     ("LITERAL" . ,(literal-string "${abc}"))))

   (simple-service 'home-bash-service-extension-test
                   home-bash-service-type
                   (home-bash-extension
                    (environment-variables
                      '(("PS1" . "$GUIX_ENVIRONMENT λ ")))
                    (aliases
                      `(("run" . "guix shell")
                        ("path" . ,(literal-string "echo $PATH"))))
                    (bashrc
                     (list
                      (plain-file
                       "bashrc-test-config.sh"
                       "# the content of bashrc-test-config.sh"))))))))
EOF

    echo -n "# dot-bashrc test file for guix home" > "dot-bashrc"

    # Check whether the graph commands work as expected.
    guix home extension-graph "home.scm" | grep 'label = "home-activation"'
    guix home extension-graph "home.scm" | grep 'label = "home-symlink-manager"'
    guix home extension-graph "home.scm" | grep 'label = "home"'

    # There are no Shepherd services so the one below must fail.
    guix home shepherd-graph "home.scm" && false

    if container_supported
    then
	# Run the home in a container.  Always use bash inside container for
        # reproducibility of the tests.
        # TODO: Make container independent from external environment variables.
        SHELL=bash
	guix home container home.scm -- true
	guix home container home.scm -- false && false
	test "$(guix home container home.scm -- echo '$HOME')" = "$HOME"
	guix home container home.scm -- cat '~/.config/test.conf' | \
	    grep "the content of"
	guix home container home.scm -- test -h '~/.bashrc'
	test "$(guix home container home.scm -- id -u)" = 1000
	guix home container home.scm -- test -f '$HOME/sample/home.scm' && false
	guix home container home.scm --expose="$PWD=$HOME/sample" -- \
	     test -f '$HOME/sample/home.scm'
	guix home container home.scm --expose="$PWD=$HOME/sample" -- \
	     rm -v '$HOME/sample/home.scm' && false
    else
	echo "'guix home container' test SKIPPED" >&2
    fi

    HOME="$test_directory"
    export HOME

    #
    # Test 'guix home reconfigure'.
    #

    echo "# This file will be overridden and backed up." > "$HOME/.bashrc"
    mkdir "$HOME/.config"
    echo "This file will be overridden too." > "$HOME/.config/test.conf"
    echo "This file will stay around." > "$HOME/.config/random-file"

    guix home reconfigure "${test_directory}/home.scm"
    test -d "${HOME}/.guix-home"
    test -h "${HOME}/.bash_profile"
    test -h "${HOME}/.bashrc"
    grep 'alias run="guix shell"' "$HOME/.bashrc"
    grep "alias path='echo \$PATH'" "$HOME/.bashrc"
    test "$(tail -n 2 "${HOME}/.bashrc")" == "\
# dot-bashrc test file for guix home
# the content of bashrc-test-config.sh"
    grep -q "the content of ~/.config/test.conf" "${HOME}/.config/test.conf"
    grep '^export PS1="\$GUIX_ENVIRONMENT λ "$' "${HOME}/.bash_profile"

    ( . "${HOME}/.guix-home/setup-environment"; test "$TODAY" = "26 messidor" )
    ( . "${HOME}/.guix-home/setup-environment"; test "$LITERAL" = '${abc}' )
    ( . "${HOME}/.guix-home/setup-environment";
      test "$STRING_WITH_ESCAPES" = "chars: \" /\\")
    ( . "${HOME}/.guix-home/setup-environment";
      echo "$SHELL" | grep "/gnu/store/.*/bin/bash" )

    # This one should still be here.
    grep "stay around" "$HOME/.config/random-file"

    # Make sure preexisting files were backed up.
    grep "overridden" "$HOME"/*guix-home*backup/.bashrc
    grep "overridden" "$HOME"/*guix-home*backup/.config/test.conf
    rm -r "$HOME"/*guix-home*backup

    #
    # Test 'guix home describe'.
    #

    configuration_file()
    {
        guix home describe                      \
            | grep 'configuration file:'        \
            | cut -d : -f 2                     \
            | xargs echo
    }
    test "$(cat "$(configuration_file)")" == "$(cat home.scm)"

    canonical_file_name()
    {
        guix home describe                      \
            | grep 'canonical file name:'       \
            | cut -d : -f 2                     \
            | xargs echo
    }
    test "$(canonical_file_name)" == "$(readlink "${HOME}/.guix-home")"

    #
    # Configure a new generation.
    #

    # Change the bashrc snippet content and comment out one service.
    sed -i "home.scm" -e's/the content of/the NEW content of/g'
    sed -i "home.scm" -e"s/(simple-service 'test-config/#;(simple-service 'test-config/g"

    guix home reconfigure "${test_directory}/home.scm"
    test "$(tail -n 2 "${HOME}/.bashrc")" == "\
# dot-bashrc test file for guix home
# the NEW content of bashrc-test-config.sh"

    # This file must have been removed and not backed up.
    test ! -e "$HOME/.config/test.conf"
    test ! -e "$HOME"/*guix-home*backup/.config/test.conf

    test "$(cat "$(configuration_file)")" == "$(cat home.scm)"
    test "$(canonical_file_name)" == "$(readlink "${HOME}/.guix-home")"

    test $(guix home list-generations | grep "^Generation" | wc -l) -eq 2

    #
    # Test 'guix home search'.
    #

    guix home search mcron | grep "^name: home-mcron"
    guix home search scheduling daemon | grep "^name: home-mcron"
)
generated by cgit
ULAR PURPOSE. See the ;;; GNU General Public License for more details. ;;; ;;; You should have received a copy of the GNU General Public License ;;; along with GNU Guix. If not, see <http://www.gnu.org/licenses/>. (define-module (gnu system pam) #:use-module (guix records) #:use-module (guix derivations) #:use-module (guix diagnostics) #:use-module (guix gexp) #:use-module (guix i18n) #:use-module (gnu services) #:use-module (gnu services shepherd) #:use-module (gnu system setuid) #:use-module (ice-9 match) #:use-module (srfi srfi-1) #:use-module (srfi srfi-9) #:use-module (srfi srfi-11) #:use-module (srfi srfi-26) #:use-module ((guix utils) #:select (%current-system)) #:use-module (gnu packages linux) #:export (pam-service pam-service-name pam-service-account pam-service-auth pam-service-password pam-service-session pam-entry pam-entry-control pam-entry-module pam-entry-arguments pam-limits-entry pam-limits-entry-domain pam-limits-entry-type pam-limits-entry-item pam-limits-entry-value pam-limits-entry->string pam-services->directory unix-pam-service base-pam-services session-environment-service session-environment-service-type pam-extension pam-extension-transformer pam-extension-shepherd-requirements pam-root-service-type pam-root-service)) ;;; Commentary: ;;; ;;; Configuration of the pluggable authentication modules (PAM). ;;; ;;; Code: ;; PAM services (see ;; <http://www.linux-pam.org/Linux-PAM-html/sag-configuration-file.html>.) (define-record-type* <pam-service> pam-service make-pam-service pam-service? (name pam-service-name) ; string ;; The four "management groups". (account pam-service-account ; list of <pam-entry> (default '())) (auth pam-service-auth (default '())) (password pam-service-password (default '())) (session pam-service-session (default '()))) (define-record-type* <pam-entry> pam-entry make-pam-entry pam-entry? (control pam-entry-control) ; string (module pam-entry-module) ; file name (arguments pam-entry-arguments ; list of string-valued g-expressions (default '()))) ;; PAM limits entries are used by the pam_limits PAM module to set or override ;; limits on system resources for user sessions. The format is specified ;; here: http://linux-pam.org/Linux-PAM-html/sag-pam_limits.html (define-record-type <pam-limits-entry> (make-pam-limits-entry domain type item value) pam-limits-entry? (domain pam-limits-entry-domain) ; string (type pam-limits-entry-type) ; symbol (item pam-limits-entry-item) ; symbol (value pam-limits-entry-value)) ; symbol or number (define (pam-limits-entry domain type item value) "Construct a pam-limits-entry ensuring that the provided values are valid." (define (valid? value) (case item ((priority) (number? value)) ((nice) (and (number? value) (>= value -20) (<= value 19))) (else (or (and (number? value) (>= value -1)) (member value '(unlimited infinity)))))) (define items (list 'core 'data 'fsize 'memlock 'nofile 'rss 'stack 'cpu 'nproc 'as 'maxlogins 'maxsyslogins 'priority 'locks 'sigpending 'msgqueue 'nice 'rtprio)) (when (not (member type '(hard soft both))) (error "invalid limit type" type)) (when (not (member item items)) (error "invalid limit item" item)) (when (not (valid? value)) (error "invalid limit value" value)) (make-pam-limits-entry domain type item value)) (define (pam-limits-entry->string entry) "Convert a pam-limits-entry record to a string." (match entry (($ <pam-limits-entry> domain type item value) (string-join (list domain (if (eq? type 'both) "-" (symbol->string type)) (symbol->string item) (cond ((symbol? value) (symbol->string value)) (else (number->string value)))) " ")))) (define (pam-service->configuration service) "Return the derivation building the configuration file for SERVICE, to be dumped in /etc/pam.d/NAME, where NAME is the name of SERVICE." (define (entry->gexp type entry) (match entry (($ <pam-entry> control module (arguments ...)) #~(format #t "~a ~a ~a ~a~%" #$type #$control #$module (string-join (list #$@arguments)))))) (match service (($ <pam-service> name account auth password session) (define builder #~(begin (with-output-to-file #$output (lambda () #$@(append (map (cut entry->gexp "account" <>) account) (map (cut entry->gexp "auth" <>) auth) (map (cut entry->gexp "password" <>) password) (map (cut entry->gexp "session" <>) session)) #t)))) (computed-file name builder)))) (define (pam-services->directory services) "Return the derivation to build the configuration directory to be used as /etc/pam.d for SERVICES." (let ((names (map pam-service-name services)) (files (map pam-service->configuration services))) (define builder #~(begin (use-modules (ice-9 match) (srfi srfi-1)) (mkdir #$output) (for-each (match-lambda ((name file) (symlink file (string-append #$output "/" name)))) ;; Since <pam-service> objects cannot be compared with ;; 'equal?' since they contain gexps, which contain ;; closures, use 'delete-duplicates' on the build-side ;; instead. See <http://bugs.gnu.org/20037>. (delete-duplicates '#$(zip names files))))) (computed-file "pam.d" builder))) (define %pam-other-services ;; The "other" PAM configuration, which denies everything (see ;; <http://www.linux-pam.org/Linux-PAM-html/sag-configuration-example.html>.) (let ((deny (pam-entry (control "required") (module "pam_deny.so")))) (pam-service (name "other") (account (list deny)) (auth (list deny)) (password (list deny)) (session (list deny))))) (define unix-pam-service (let ((unix (pam-entry (control "required") (module "pam_unix.so"))) (env (pam-entry ; to honor /etc/environment. (control "required") (module "pam_env.so")))) (lambda* (name #:key allow-empty-passwords? allow-root? motd login-uid? gnupg?) "Return a standard Unix-style PAM service for NAME. When ALLOW-EMPTY-PASSWORDS? is true, allow empty passwords. When ALLOW-ROOT? is true, allow root to run the command without authentication. When MOTD is true, it should be a file-like object used as the message-of-the-day. When LOGIN-UID? is true, require the 'pam_loginuid' module; that module sets /proc/self/loginuid, which the libc 'getlogin' function relies on. When GNUPG? is true, require the 'pam_gnupg.so' module; that module hands over the login password to 'gpg-agent'." ;; See <http://www.linux-pam.org/Linux-PAM-html/sag-configuration-example.html>. (pam-service (name name) (account (list unix)) (auth (append (if allow-root? (list (pam-entry (control "sufficient") (module "pam_rootok.so"))) '()) (list (if allow-empty-passwords? (pam-entry (control "required") (module "pam_unix.so") (arguments '("nullok"))) unix)) (if gnupg? (list (pam-entry (control "required") (module (file-append pam-gnupg "/lib/security/pam_gnupg.so")))) '()))) (password (list (pam-entry (control "required") (module "pam_unix.so") ;; Store SHA-512 encrypted passwords in /etc/shadow. (arguments '("sha512" "shadow"))))) (session `(,@(if motd (list (pam-entry (control "optional") (module "pam_motd.so") (arguments (list #~(string-append "motd=" #$motd))))) '()) ,@(if login-uid? (list (pam-entry ;to fill in /proc/self/loginuid (control "required") (module "pam_loginuid.so"))) '()) ,@(if gnupg? (list (pam-entry (control "required") (module (file-append pam-gnupg "/lib/security/pam_gnupg.so")))) '()) ,env ,unix)))))) (define (rootok-pam-service command) "Return a PAM service for COMMAND such that 'root' does not need to authenticate to run COMMAND." (let ((unix (pam-entry (control "required") (module "pam_unix.so")))) (pam-service (name command) (account (list unix)) (auth (list (pam-entry (control "sufficient") (module "pam_rootok.so")))) (password (list unix)) (session (list unix))))) (define* (base-pam-services #:key allow-empty-passwords?) "Return the list of basic PAM services everyone would want." ;; TODO: Add other Shadow programs? (append (list %pam-other-services) ;; These programs are setuid-root. (map (cut unix-pam-service <> #:allow-empty-passwords? allow-empty-passwords?) '("passwd" "chfn" "sudo")) ;; This is setuid-root, as well. Allow root to run "su" without ;; authenticating. (list (unix-pam-service "su" #:allow-empty-passwords? allow-empty-passwords? #:allow-root? #t)) ;; These programs are not setuid-root, and we want root to be able ;; to run them without having to authenticate (notably because ;; 'useradd' and 'groupadd' are run during system activation.) (map rootok-pam-service '("useradd" "userdel" "usermod" "groupadd" "groupdel" "groupmod")))) ;;; ;;; System-wide environment variables. ;;; (define (environment-variables->environment-file vars) "Return a file for pam_env(8) that contains environment variables VARS." (apply mixed-text-file "environment" (append-map (match-lambda ((key . value) (list key "=" value "\n"))) vars))) (define session-environment-service-type (service-type (name 'session-environment) (extensions (list (service-extension etc-service-type (lambda (vars) (list `("environment" ,(environment-variables->environment-file vars))))))) (compose concatenate) (extend append) (description "Populate @file{/etc/environment}, which is honored by @code{pam_env}, with the specified environment variables. The value of this service is a list of name/value pairs for environments variables, such as: @example '((\"TZ\" . \"Canada/Pacific\")) @end example\n"))) (define (session-environment-service vars) "Return a service that builds the @file{/etc/environment}, which can be read by PAM-aware applications to set environment variables for sessions. VARS should be an association list in which both the keys and the values are strings or string-valued gexps." (service session-environment-service-type vars)) ;;; ;;; PAM root service. ;;; ;; Extension of the PAM configuration. A PAM transformer consists of a ;; procedure acting on each PAM entry; 'shepherd-requirements' lists services ;; that the meta 'pam' Shepherd service will depend on. (define-record-type* <pam-extension> pam-extension make-pam-extension pam-extension? (transformer pam-extension-transformer) (shepherd-requirements pam-extension-shepherd-requirements (default '()))) ;; Overall PAM configuration: a list of services, plus a procedure that takes ;; one <pam-service> and returns a <pam-service>. The procedure is used to ;; implement cross-cutting concerns such as the use of the 'elogind.so' ;; session module that keeps track of logged-in users. (define-record-type* <pam-configuration> pam-configuration make-pam-configuration pam-configuration? ;list of <pam-service> (services pam-configuration-services) ;list of procedures <pam-entry> -> <pam-entry> (transformers pam-configuration-transformers) ;list of symbols (shepherd-requirements pam-configuration-shepherd-requirements)) (define (/etc-entry config) "Return the /etc/pam.d entry corresponding to CONFIG." (match config (($ <pam-configuration> services transformers shepherd-requirements) (let ((services (map (apply compose identity transformers) services))) `(("pam.d" ,(pam-services->directory services))))))) (define (pam-shepherd-service config) "Return the PAM synchronization shepherd service corresponding to CONFIG." (match config (($ <pam-configuration> services transformers shepherd-requirements) (list (shepherd-service (documentation "Synchronization point for services that need to be started for PAM to work.") (provision '(pam)) (requirement shepherd-requirements) (start #~(const #t)) (stop #~(const #f))))))) (define (extend-configuration initial extensions) "Extend INITIAL with NEW." ;; TODO: Remove deprecation shim. (define cleaned-extensions (map (lambda (ext) (if (procedure? ext) (begin (warning (G_ "'pam-root-service-type' extensions should \ now use the <pam-extension> record~%")) (pam-extension (transformer ext))) ext)) extensions)) (let-values (((services pam-extensions) (partition pam-service? cleaned-extensions))) (pam-configuration (services (append (pam-configuration-services initial) services)) (transformers (append (pam-configuration-transformers initial) (map pam-extension-transformer pam-extensions))) (shepherd-requirements (append (pam-configuration-shepherd-requirements initial) (append-map pam-extension-shepherd-requirements pam-extensions)))))) (define pam-root-service-type (service-type (name 'pam) (extensions (list (service-extension setuid-program-service-type (lambda (_) (list (file-like->setuid-program (file-append linux-pam "/sbin/unix_chkpwd"))))) (service-extension etc-service-type /etc-entry) (service-extension shepherd-root-service-type pam-shepherd-service))) ;; Arguments include <pam-service> as well as procedures. (compose concatenate) (extend extend-configuration) (description "Configure the Pluggable Authentication Modules (PAM) for all the specified @dfn{PAM services}. Each PAM service corresponds to a program, such as @command{login} or @command{sshd}, and specifies for instance how the program may authenticate users or what it should do when opening a new session."))) (define* (pam-root-service base #:key (transformers '()) (shepherd-requirements '())) "The \"root\" PAM service, which collects <pam-service> instance and turns them into a /etc/pam.d directory, including the <pam-service> listed in BASE. TRANSFORM is a procedure that takes a <pam-service> and returns a <pam-service>. It can be used to implement cross-cutting concerns that affect all the PAM services." (service pam-root-service-type (pam-configuration (services base) (transformers transformers) (shepherd-requirements shepherd-requirements))))
generated by cgit