aboutsummaryrefslogtreecommitdiff
path: root/tests/modules.scm
blob: e70d2d9e0806bda2e43bba9a76eb509589afab3e (about) (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
;;; GNU Guix --- Functional package management for GNU
;;; Copyright © 2016, 2017 Ludovic Courtès <ludo@gnu.org>
;;;
;;; This file is part of GNU Guix.
;;;
;;; GNU Guix is free software; you can redistribute it and/or modify it
;;; under the terms of the GNU General Public License as published by
;;; the Free Software Foundation; either version 3 of the License, or (at
;;; your option) any later version.
;;;
;;; GNU Guix is distributed in the hope that it will be useful, but
;;; WITHOUT ANY WARRANTY; without even the implied warranty of
;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
;;; GNU General Public License for more details.
;;;
;;; You should have received a copy of the GNU General Public License
;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.

(define-module (test-modules)
  #:use-module (guix modules)
  #:use-module ((guix build-system gnu) #:select (%gnu-build-system-modules))
  #:use-module ((guix utils) #:select (call-with-temporary-directory))
  #:use-module (srfi srfi-1)
  #:use-module (srfi srfi-34)
  #:use-module (srfi srfi-64))

(test-begin "modules")

(test-assert "closure of (guix build gnu-build-system)"
  (lset= equal?
         (live-module-closure '((guix build gnu-build-system)))
         (source-module-closure '((guix build gnu-build-system)))
         %gnu-build-system-modules
         (source-module-closure %gnu-build-system-modules)
         (live-module-closure %gnu-build-system-modules)))

(test-assert "closure of (gnu build install)"
  (lset= equal?
         (live-module-closure '((gnu build install)))
         (source-module-closure '((gnu build install)))))

(test-assert "closure of (gnu build image)"
  (lset= equal?
         (live-module-closure '((gnu build image)))
         (source-module-closure '((gnu build image)))))

(test-equal "&missing-dependency-error"
  '(something that does not exist)
  (call-with-temporary-directory
   (lambda (directory)
     (call-with-output-file (string-append directory "/foobar.scm")
       (lambda (port)
         (write '(define-module (foobar)
                   #:use-module (something that does not exist))
                port)))

     (call-with-output-file (string-append directory "/baz.scm")
       (lambda (port)
         (write '(define-module (baz)
                   #:use-module (foobar))
                port)))

     (guard (c ((missing-dependency-error? c)
                (missing-dependency-module c)))
       (source-module-closure '((baz)) (list directory)
                              #:select? (const #t))))))

(test-end)
n the derivation building the configuration file for SERVICE, to be dumped in /etc/pam.d/NAME, where NAME is the name of SERVICE." (define (entry->gexp type entry) (match entry (($ <pam-entry> control module (arguments ...)) #~(format #t "~a ~a ~a ~a~%" #$type #$control #$module (string-join (list #$@arguments)))))) (match service (($ <pam-service> name account auth password session) (define builder #~(begin (with-output-to-file #$output (lambda () #$@(append (map (cut entry->gexp "account" <>) account) (map (cut entry->gexp "auth" <>) auth) (map (cut entry->gexp "password" <>) password) (map (cut entry->gexp "session" <>) session)) #t)))) (computed-file name builder)))) (define (pam-services->directory services) "Return the derivation to build the configuration directory to be used as /etc/pam.d for SERVICES." (let ((names (map pam-service-name services)) (files (map pam-service->configuration services))) (define builder #~(begin (use-modules (ice-9 match) (srfi srfi-1)) (mkdir #$output) (for-each (match-lambda ((name file) (symlink file (string-append #$output "/" name)))) ;; Since <pam-service> objects cannot be compared with ;; 'equal?' since they contain gexps, which contain ;; closures, use 'delete-duplicates' on the build-side ;; instead. See <http://bugs.gnu.org/20037>. (delete-duplicates '#$(zip names files))))) (computed-file "pam.d" builder))) (define %pam-other-services ;; The "other" PAM configuration, which denies everything (see ;; <http://www.linux-pam.org/Linux-PAM-html/sag-configuration-example.html>.) (let ((deny (pam-entry (control "required") (module "pam_deny.so")))) (pam-service (name "other") (account (list deny)) (auth (list deny)) (password (list deny)) (session (list deny))))) (define unix-pam-service (let ((unix (pam-entry (control "required") (module "pam_unix.so"))) (env (pam-entry ; to honor /etc/environment. (control "required") (module "pam_env.so")))) (lambda* (name #:key allow-empty-passwords? allow-root? motd login-uid? gnupg?) "Return a standard Unix-style PAM service for NAME. When ALLOW-EMPTY-PASSWORDS? is true, allow empty passwords. When ALLOW-ROOT? is true, allow root to run the command without authentication. When MOTD is true, it should be a file-like object used as the message-of-the-day. When LOGIN-UID? is true, require the 'pam_loginuid' module; that module sets /proc/self/loginuid, which the libc 'getlogin' function relies on. When GNUPG? is true, require the 'pam_gnupg.so' module; that module hands over the login password to 'gpg-agent'." ;; See <http://www.linux-pam.org/Linux-PAM-html/sag-configuration-example.html>. (pam-service (name name) (account (list unix)) (auth (append (if allow-root? (list (pam-entry (control "sufficient") (module "pam_rootok.so"))) '()) (list (if allow-empty-passwords? (pam-entry (control "required") (module "pam_unix.so") (arguments '("nullok"))) unix)) (if gnupg? (list (pam-entry (control "required") (module (file-append pam-gnupg "/lib/security/pam_gnupg.so")))) '()))) (password (list (pam-entry (control "required") (module "pam_unix.so") ;; Store SHA-512 encrypted passwords in /etc/shadow. (arguments '("sha512" "shadow"))))) (session `(,@(if motd (list (pam-entry (control "optional") (module "pam_motd.so") (arguments (list #~(string-append "motd=" #$motd))))) '()) ,@(if login-uid? (list (pam-entry ;to fill in /proc/self/loginuid (control "required") (module "pam_loginuid.so"))) '()) ,@(if gnupg? (list (pam-entry (control "required") (module (file-append pam-gnupg "/lib/security/pam_gnupg.so")))) '()) ,env ,unix)))))) (define (rootok-pam-service command) "Return a PAM service for COMMAND such that 'root' does not need to authenticate to run COMMAND." (let ((unix (pam-entry (control "required") (module "pam_unix.so")))) (pam-service (name command) (account (list unix)) (auth (list (pam-entry (control "sufficient") (module "pam_rootok.so")))) (password (list unix)) (session (list unix))))) (define* (base-pam-services #:key allow-empty-passwords?) "Return the list of basic PAM services everyone would want." ;; TODO: Add other Shadow programs? (append (list %pam-other-services) ;; These programs are setuid-root. (map (cut unix-pam-service <> #:allow-empty-passwords? allow-empty-passwords?) '("passwd" "chfn" "sudo")) ;; This is setuid-root, as well. Allow root to run "su" without ;; authenticating. (list (unix-pam-service "su" #:allow-empty-passwords? allow-empty-passwords? #:allow-root? #t)) ;; These programs are not setuid-root, and we want root to be able ;; to run them without having to authenticate (notably because ;; 'useradd' and 'groupadd' are run during system activation.) (map rootok-pam-service '("useradd" "userdel" "usermod" "groupadd" "groupdel" "groupmod")))) ;;; ;;; System-wide environment variables. ;;; (define (environment-variables->environment-file vars) "Return a file for pam_env(8) that contains environment variables VARS." (apply mixed-text-file "environment" (append-map (match-lambda ((key . value) (list key "=" value "\n"))) vars))) (define session-environment-service-type (service-type (name 'session-environment) (extensions (list (service-extension etc-service-type (lambda (vars) (list `("environment" ,(environment-variables->environment-file vars))))))) (compose concatenate) (extend append) (description "Populate @file{/etc/environment}, which is honored by @code{pam_env}, with the specified environment variables. The value of this service is a list of name/value pairs for environments variables, such as: @example '((\"TZ\" . \"Canada/Pacific\")) @end example\n"))) (define (session-environment-service vars) "Return a service that builds the @file{/etc/environment}, which can be read by PAM-aware applications to set environment variables for sessions. VARS should be an association list in which both the keys and the values are strings or string-valued gexps." (service session-environment-service-type vars)) ;;; ;;; PAM root service. ;;; ;; Extension of the PAM configuration. A PAM transformer consists of a ;; procedure acting on each PAM entry; 'shepherd-requirements' lists services ;; that the meta 'pam' Shepherd service will depend on. (define-record-type* <pam-extension> pam-extension make-pam-extension pam-extension? (transformer pam-extension-transformer) (shepherd-requirements pam-extension-shepherd-requirements (default '()))) ;; Overall PAM configuration: a list of services, plus a procedure that takes ;; one <pam-service> and returns a <pam-service>. The procedure is used to ;; implement cross-cutting concerns such as the use of the 'elogind.so' ;; session module that keeps track of logged-in users. (define-record-type* <pam-configuration> pam-configuration make-pam-configuration pam-configuration? ;list of <pam-service> (services pam-configuration-services) ;list of procedures <pam-entry> -> <pam-entry> (transformers pam-configuration-transformers) ;list of symbols (shepherd-requirements pam-configuration-shepherd-requirements)) (define (/etc-entry config) "Return the /etc/pam.d entry corresponding to CONFIG." (match config (($ <pam-configuration> services transformers shepherd-requirements) (let ((services (map (apply compose identity transformers) services))) `(("pam.d" ,(pam-services->directory services))))))) (define (pam-shepherd-service config) "Return the PAM synchronization shepherd service corresponding to CONFIG." (match config (($ <pam-configuration> services transformers shepherd-requirements) (list (shepherd-service (documentation "Synchronization point for services that need to be started for PAM to work.") (provision '(pam)) (requirement shepherd-requirements) (start #~(const #t)) (stop #~(const #f))))))) (define (extend-configuration initial extensions) "Extend INITIAL with NEW." ;; TODO: Remove deprecation shim. (define cleaned-extensions (map (lambda (ext) (if (procedure? ext) (begin (warning (G_ "'pam-root-service-type' extensions should \ now use the <pam-extension> record~%")) (pam-extension (transformer ext))) ext)) extensions)) (let-values (((services pam-extensions) (partition pam-service? cleaned-extensions))) (pam-configuration (services (append (pam-configuration-services initial) services)) (transformers (append (pam-configuration-transformers initial) (map pam-extension-transformer pam-extensions))) (shepherd-requirements (append (pam-configuration-shepherd-requirements initial) (append-map pam-extension-shepherd-requirements pam-extensions)))))) (define pam-root-service-type (service-type (name 'pam) (extensions (list (service-extension setuid-program-service-type (lambda (_) (list (file-like->setuid-program (file-append linux-pam "/sbin/unix_chkpwd"))))) (service-extension etc-service-type /etc-entry) (service-extension shepherd-root-service-type pam-shepherd-service))) ;; Arguments include <pam-service> as well as procedures. (compose concatenate) (extend extend-configuration) (description "Configure the Pluggable Authentication Modules (PAM) for all the specified @dfn{PAM services}. Each PAM service corresponds to a program, such as @command{login} or @command{sshd}, and specifies for instance how the program may authenticate users or what it should do when opening a new session."))) (define* (pam-root-service base #:key (transformers '()) (shepherd-requirements '())) "The \"root\" PAM service, which collects <pam-service> instance and turns them into a /etc/pam.d directory, including the <pam-service> listed in BASE. TRANSFORM is a procedure that takes a <pam-service> and returns a <pam-service>. It can be used to implement cross-cutting concerns that affect all the PAM services." (service pam-root-service-type (pam-configuration (services base) (transformers transformers) (shepherd-requirements shepherd-requirements))))