mirror of
https://github.com/libguestfs/libguestfs.git
synced 2026-03-21 22:53:37 +00:00
tests: add LUKS-on-LVM test
Create a new (fake) Fedora disk image with two partitions. /dev/sda1 is the boot partition as usual, /dev/sda2 is used as an LVM PV. The VG has four LVs, Root and LV1 through LV3. Each LV holds a LUKS device (with a different key). Each decrypted LUKS device holds an ext2 filesystem, with "/dev/mapper/Root-luks" holding the root filesystem. Each filesystem has a dedicated label (ROOT, LV1, LV2, LV3). In the test case, run guestfish in inspector mode, twice. In the first invocation, provide the LUKS passphrases by LV name. Also specific to the first invocation, fetch the LUKS UUIDs by LV name. In the second invocation, provide the LUKS passphrases by UUID. In both invocations, after decryption, check the filesystem labels, the /dev/mapper/* names generated for the decrypted LUKS block devices, and the existence of "/etc/fedora-release" on the root filesystem. Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1658126 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Message-Id: <20220223162120.16729-3-lersek@redhat.com> Acked-by: Richard W.M. Jones <rjones@redhat.com>
This commit is contained in:
Laszlo Ersek
1
.gitignore
vendored
1
.gitignore
vendored
@@ -452,6 +452,7 @@ Makefile.in
|
||||
/test-data/phony-guests/debian.img
|
||||
/test-data/phony-guests/fedora.img
|
||||
/test-data/phony-guests/fedora-btrfs.img
|
||||
/test-data/phony-guests/fedora-luks-on-lvm.img
|
||||
/test-data/phony-guests/fedora-lvm-on-luks.img
|
||||
/test-data/phony-guests/fedora-md1.img
|
||||
/test-data/phony-guests/fedora-md2.img
|
||||
|
||||
@@ -49,6 +49,7 @@ disk_images = \
|
||||
fedora-md1.img \
|
||||
fedora-md2.img \
|
||||
fedora-btrfs.img \
|
||||
fedora-luks-on-lvm.img \
|
||||
fedora-lvm-on-luks.img \
|
||||
ubuntu.img \
|
||||
archlinux.img \
|
||||
@@ -96,6 +97,12 @@ fedora-btrfs.img: make-fedora-img.pl \
|
||||
fedora.db
|
||||
SRCDIR=$(srcdir) LAYOUT=btrfs $(top_builddir)/run --test ./$<
|
||||
|
||||
# Make a (dummy) Fedora image with LUKS-on-LVM.
|
||||
fedora-luks-on-lvm.img: make-fedora-img.pl \
|
||||
fedora-journal.tar.xz \
|
||||
fedora.db
|
||||
SRCDIR=$(srcdir) LAYOUT=luks-on-lvm $(top_builddir)/run --test ./$<
|
||||
|
||||
# Make a (dummy) Fedora image with LVM-on-LUKS.
|
||||
fedora-lvm-on-luks.img: make-fedora-img.pl \
|
||||
fedora-journal.tar.xz \
|
||||
|
||||
@@ -183,6 +183,24 @@
|
||||
</devices>
|
||||
</domain>
|
||||
|
||||
<!-- LUKS passwords are 'FEDORA-Root', 'FEDORA-LV1', 'FEDORA-LV2',
|
||||
'FEDORA-LV3' -->
|
||||
<domain type='test'>
|
||||
<name>fedora-luks-on-lvm</name>
|
||||
<memory>1048576</memory>
|
||||
<os>
|
||||
<type>hvm</type>
|
||||
<boot dev='hd'/>
|
||||
</os>
|
||||
<devices>
|
||||
<disk type='file' device='disk'>
|
||||
<driver name='qemu' type='raw'/>
|
||||
<source file='@abs_builddir@/fedora-luks-on-lvm.img'/>
|
||||
<target dev='vda' bus='virtio'/>
|
||||
</disk>
|
||||
</devices>
|
||||
</domain>
|
||||
|
||||
<!-- LUKS password is 'FEDORA' -->
|
||||
<domain type='test'>
|
||||
<name>fedora-lvm-on-luks</name>
|
||||
|
||||
@@ -200,6 +200,60 @@ EOF
|
||||
init_lvm_root ('/dev/mapper/luks');
|
||||
}
|
||||
|
||||
elsif ($ENV{LAYOUT} eq 'luks-on-lvm') {
|
||||
push (@images, "fedora-luks-on-lvm.img-t");
|
||||
|
||||
open (my $fstab, '>', "fedora.fstab") or die;
|
||||
print $fstab <<EOF;
|
||||
LABEL=BOOT /boot ext2 default 0 0
|
||||
LABEL=ROOT / ext2 default 0 0
|
||||
EOF
|
||||
close ($fstab) or die;
|
||||
|
||||
$bootdev = '/dev/sda1';
|
||||
|
||||
$g->disk_create ("fedora-luks-on-lvm.img-t", "raw", $IMAGE_SIZE);
|
||||
|
||||
$g->add_drive ("fedora-luks-on-lvm.img-t", format => "raw");
|
||||
$g->launch ();
|
||||
|
||||
$g->part_init ('/dev/sda', 'mbr');
|
||||
foreach my $p (@PARTITIONS) {
|
||||
$g->part_add('/dev/sda', @$p);
|
||||
}
|
||||
|
||||
# Create the Volume Group on /dev/sda2.
|
||||
$g->pvcreate ('/dev/sda2');
|
||||
$g->vgcreate ('VG', ['/dev/sda2']);
|
||||
$g->lvcreate ('Root', 'VG', 32);
|
||||
$g->lvcreate ('LV1', 'VG', 32);
|
||||
$g->lvcreate ('LV2', 'VG', 32);
|
||||
$g->lvcreate ('LV3', 'VG', 64);
|
||||
|
||||
# Format each Logical Group as a LUKS device, with a different password.
|
||||
$g->luks_format ('/dev/VG/Root', 'FEDORA-Root', 0);
|
||||
$g->luks_format ('/dev/VG/LV1', 'FEDORA-LV1', 0);
|
||||
$g->luks_format ('/dev/VG/LV2', 'FEDORA-LV2', 0);
|
||||
$g->luks_format ('/dev/VG/LV3', 'FEDORA-LV3', 0);
|
||||
|
||||
# Open the LUKS devices. This creates nodes like /dev/mapper/*-luks.
|
||||
$g->cryptsetup_open ('/dev/VG/Root', 'FEDORA-Root', 'Root-luks');
|
||||
$g->cryptsetup_open ('/dev/VG/LV1', 'FEDORA-LV1', 'LV1-luks');
|
||||
$g->cryptsetup_open ('/dev/VG/LV2', 'FEDORA-LV2', 'LV2-luks');
|
||||
$g->cryptsetup_open ('/dev/VG/LV3', 'FEDORA-LV3', 'LV3-luks');
|
||||
|
||||
# Phony root filesystem.
|
||||
$g->mkfs ('ext2', '/dev/mapper/Root-luks', blocksize => 4096, label => 'ROOT');
|
||||
$g->set_uuid ('/dev/mapper/Root-luks', '01234567-0123-0123-0123-012345678902');
|
||||
|
||||
# Other filesystems, just for testing findfs-label.
|
||||
$g->mkfs ('ext2', '/dev/mapper/LV1-luks', blocksize => 4096, label => 'LV1');
|
||||
$g->mkfs ('ext2', '/dev/mapper/LV2-luks', blocksize => 1024, label => 'LV2');
|
||||
$g->mkfs ('ext2', '/dev/mapper/LV3-luks', blocksize => 2048, label => 'LV3');
|
||||
|
||||
$g->mount ('/dev/mapper/Root-luks', '/');
|
||||
}
|
||||
|
||||
else {
|
||||
print STDERR "$0: Unknown LAYOUT: ",$ENV{LAYOUT},"\n";
|
||||
exit 1;
|
||||
|
||||
@@ -464,11 +464,13 @@ TESTS += \
|
||||
luks/test-luks.sh \
|
||||
luks/test-luks-list.sh \
|
||||
luks/test-key-option.sh \
|
||||
luks/test-key-option-inspect-luks-on-lvm.sh \
|
||||
luks/test-key-option-inspect-lvm-on-luks.sh
|
||||
EXTRA_DIST += \
|
||||
luks/test-luks.sh \
|
||||
luks/test-luks-list.sh \
|
||||
luks/test-key-option.sh \
|
||||
luks/test-key-option-inspect-luks-on-lvm.sh \
|
||||
luks/test-key-option-inspect-lvm-on-luks.sh
|
||||
|
||||
TESTS += \
|
||||
|
||||
103
tests/luks/test-key-option-inspect-luks-on-lvm.sh
Executable file
103
tests/luks/test-key-option-inspect-luks-on-lvm.sh
Executable file
@@ -0,0 +1,103 @@
|
||||
#!/bin/bash -
|
||||
# libguestfs
|
||||
# Copyright (C) 2019-2022 Red Hat Inc.
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
|
||||
# Test the --key option. It is handled by common code so we only need
|
||||
# to test one tool (guestfish).
|
||||
|
||||
set -e
|
||||
|
||||
$TEST_FUNCTIONS
|
||||
skip_if_skipped
|
||||
skip_unless_feature_available luks
|
||||
skip_unless_phony_guest fedora-luks-on-lvm.img
|
||||
|
||||
# Start a background guestfish instance to check key specification by Logical
|
||||
# Volume names.
|
||||
guestfish=(guestfish --listen --ro --inspector
|
||||
--add ../test-data/phony-guests/fedora-luks-on-lvm.img)
|
||||
keys_by_lvname=(--key /dev/VG/Root:key:FEDORA-Root
|
||||
--key /dev/VG/LV1:key:FEDORA-LV1
|
||||
--key /dev/VG/LV2:key:FEDORA-LV2
|
||||
--key /dev/VG/LV3:key:FEDORA-LV3)
|
||||
|
||||
# The variable assignment below will fail, and abort the script, if guestfish
|
||||
# refuses to start up.
|
||||
fish_ref=$("${guestfish[@]}" "${keys_by_lvname[@]}")
|
||||
|
||||
# Set GUESTFISH_PID as necessary for the remote access.
|
||||
eval "$fish_ref"
|
||||
|
||||
# From this point on, if any remote guestfish command fails, that will cause
|
||||
# *both* the guestfish server *and* this script to exit, with an error.
|
||||
# However, we also want the background guestfish process to exit if (a) this
|
||||
# script exits cleanly, or (b) this script exits with a failure due to a reason
|
||||
# that's different from a failed remote command.
|
||||
function cleanup_guestfish
|
||||
{
|
||||
if [ -n "$GUESTFISH_PID" ]; then
|
||||
guestfish --remote -- exit >/dev/null 2>&1 || :
|
||||
fi
|
||||
}
|
||||
trap cleanup_guestfish EXIT
|
||||
|
||||
# Get the UUIDs of the LUKS devices.
|
||||
uuid_root=$(guestfish --remote -- luks-uuid /dev/VG/Root)
|
||||
uuid_lv1=$( guestfish --remote -- luks-uuid /dev/VG/LV1)
|
||||
uuid_lv2=$( guestfish --remote -- luks-uuid /dev/VG/LV2)
|
||||
uuid_lv3=$( guestfish --remote -- luks-uuid /dev/VG/LV3)
|
||||
|
||||
# The actual test.
|
||||
function check_filesystems
|
||||
{
|
||||
local decrypted_root decrypted_lv1 decrypted_lv2 decrypted_lv3 exists
|
||||
|
||||
# Get the names of the decrypted LUKS block devices that host the filesystems
|
||||
# with the labels listed below.
|
||||
decrypted_root=$(guestfish --remote -- findfs-label ROOT)
|
||||
decrypted_lv1=$( guestfish --remote -- findfs-label LV1)
|
||||
decrypted_lv2=$( guestfish --remote -- findfs-label LV2)
|
||||
decrypted_lv3=$( guestfish --remote -- findfs-label LV3)
|
||||
|
||||
# Verify the device names. These come from decrypt_mountables() in
|
||||
# "common/options/decrypt.c".
|
||||
test /dev/mapper/luks-"$uuid_root" = "$decrypted_root"
|
||||
test /dev/mapper/luks-"$uuid_lv1" = "$decrypted_lv1"
|
||||
test /dev/mapper/luks-"$uuid_lv2" = "$decrypted_lv2"
|
||||
test /dev/mapper/luks-"$uuid_lv3" = "$decrypted_lv3"
|
||||
|
||||
# Check "/etc/fedora-release" on the root fs.
|
||||
exists=$(guestfish --remote -- exists /etc/fedora-release)
|
||||
test true = "$exists"
|
||||
}
|
||||
check_filesystems
|
||||
|
||||
# Exit the current guestfish background process.
|
||||
guestfish --remote -- exit
|
||||
GUESTFISH_PID=
|
||||
|
||||
# Start up a similar guestfish background process, but specify the keys by
|
||||
# UUID.
|
||||
keys_by_uuid=(--key "$uuid_root":key:FEDORA-Root
|
||||
--key "$uuid_lv1":key:FEDORA-LV1
|
||||
--key "$uuid_lv2":key:FEDORA-LV2
|
||||
--key "$uuid_lv3":key:FEDORA-LV3)
|
||||
fish_ref=$("${guestfish[@]}" "${keys_by_uuid[@]}")
|
||||
eval "$fish_ref"
|
||||
|
||||
# Repeat the test.
|
||||
check_filesystems
|
||||
Reference in New Issue
Block a user