mirror of
https://github.com/NixOS/nixpkgs.git
synced 2026-08-26 18:24:53 +00:00
66 lines
2.4 KiB
Nix
66 lines
2.4 KiB
Nix
{ lib, ... }:
|
|
{
|
|
|
|
name = "utmp";
|
|
|
|
meta = {
|
|
maintainers = with lib.maintainers; [ grimmauld ];
|
|
};
|
|
|
|
nodes = {
|
|
machine = {
|
|
imports = [ ./common/user-account.nix ];
|
|
security.audit.enable = true;
|
|
security.auditd.enable = true;
|
|
};
|
|
};
|
|
|
|
testScript = ''
|
|
import re
|
|
|
|
def extract_utmp_fields(line: str) -> tuple[str, str] | None:
|
|
m = re.match(r"^\[\d*\]\s*\[\d*\]\s*\[([^\]\s]*)\s*]\s*\[([^\]\s]*)\s*]", line)
|
|
if not m:
|
|
return None
|
|
return m.group(1), m.group(2)
|
|
|
|
machine.wait_for_unit("auditd.service")
|
|
machine.wait_for_unit("systemd-update-utmp.service")
|
|
machine.wait_for_file("/run/utmp")
|
|
|
|
with subtest("systemd updated utmp"):
|
|
utmp = machine.succeed("utmpdump /run/utmp").strip().split("\n")
|
|
print(utmp)
|
|
assert extract_utmp_fields(utmp[0]) == ("~~", "reboot") # first entry is the reboot
|
|
|
|
with subtest("Test utmp entries are created by logins"):
|
|
machine.wait_for_unit("multi-user.target")
|
|
machine.wait_until_tty_matches("1", "login: ")
|
|
machine.send_chars("alice\n")
|
|
machine.wait_until_tty_matches("1", "Password: ")
|
|
machine.send_chars("foobar\n")
|
|
machine.wait_until_succeeds("pgrep -u alice bash")
|
|
utmp = machine.succeed("utmpdump /run/utmp").strip().split("\n")
|
|
print(utmp)
|
|
assert extract_utmp_fields(utmp[1]) == ("tty1", "alice") # second entry is alice login
|
|
machine.send_chars("exit\n")
|
|
machine.wait_until_fails("pgrep -u alice bash")
|
|
|
|
with subtest("Test utmp entries are cleaned after logout"):
|
|
utmp = machine.succeed("utmpdump /run/utmp").strip().split("\n")
|
|
print(utmp)
|
|
assert extract_utmp_fields(utmp[1]) in [("tty1", ""), ("tty1", "LOGIN")] # tty1 previously in use by alice is now clear
|
|
|
|
with subtest("audit logs utmp system boot"):
|
|
audit_log = machine.succeed("ausearch -m SYSTEM_BOOT")
|
|
print(audit_log)
|
|
# audit 4.2.1 truncates too long comm entries, while systemd shortened the entry from `systemd-update-utmp` (truncated) to `update-utmp`
|
|
# see also:
|
|
# - systemd: https://github.com/systemd/systemd/pull/43144
|
|
# - audit: https://github.com/linux-audit/audit-userspace/commit/d7ea98263ebdb974b383a4057856a5ec339776fc
|
|
# accept either fix in this test
|
|
assert 'comm="update-utmp"' in audit_log or f'comm="{"systemd-update-utmp"[:15]}"' in audit_log
|
|
'';
|
|
|
|
}
|