From b91284626711400eb6f7d8a6600604b9879d8b38 Mon Sep 17 00:00:00 2001 From: Philipp Bartsch Date: Sat, 16 Jan 2021 23:15:52 +0100 Subject: [PATCH] nixos/tests/usbguard: init --- nixos/tests/all-tests.nix | 1 + nixos/tests/usbguard.nix | 62 +++++++++++++++++++++ pkgs/os-specific/linux/usbguard/default.nix | 3 + 3 files changed, 66 insertions(+) create mode 100644 nixos/tests/usbguard.nix diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index 902c3bbc65e..966c7844657 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -402,6 +402,7 @@ in unbound = handleTest ./unbound.nix {}; unit-php = handleTest ./web-servers/unit-php.nix {}; upnp = handleTest ./upnp.nix {}; + usbguard = handleTest ./usbguard.nix {}; uwsgi = handleTest ./uwsgi.nix {}; v2ray = handleTest ./v2ray.nix {}; vault = handleTest ./vault.nix {}; diff --git a/nixos/tests/usbguard.nix b/nixos/tests/usbguard.nix new file mode 100644 index 00000000000..a5d78f316fb --- /dev/null +++ b/nixos/tests/usbguard.nix @@ -0,0 +1,62 @@ +import ./make-test-python.nix ({ pkgs, ... }: { + name = "usbguard"; + meta = with pkgs.stdenv.lib.maintainers; { + maintainers = [ tnias ]; + }; + + machine = + { ... }: + { + services.usbguard = { + enable = true; + IPCAllowedUsers = [ "alice" "root" ]; + + # As virtual USB devices get attached to the "QEMU USB Hub" we need to + # allow Hubs. Otherwise we would have to explicitly allow them too. + rules = '' + allow with-interface equals { 09:00:00 } + ''; + }; + imports = [ ./common/user-account.nix ]; + }; + + testScript = '' + # create a blank disk image for our fake USB stick + with open(machine.state_dir + "/usbstick.img", "wb") as stick: + stick.write(b"\x00" * (1024 * 1024)) + + # wait for machine to have started and the usbguard service to be up + machine.wait_for_unit("usbguard.service") + + with subtest("IPC access control"): + # User "alice" is allowed to access the IPC interface + machine.succeed("su alice -c 'usbguard list-devices'") + + # User "bob" is not allowed to access the IPC interface + machine.fail("su bob -c 'usbguard list-devices'") + + with subtest("check basic functionality"): + # at this point we expect that no USB HDD is connected + machine.fail("usbguard list-devices | grep -E 'QEMU USB HARDDRIVE'") + + # insert usb device + machine.send_monitor_command( + f"drive_add 0 id=stick,if=none,file={stick.name},format=raw" + ) + machine.send_monitor_command("device_add usb-storage,id=stick,drive=stick") + + # the attached USB HDD should show up after a short while + machine.wait_until_succeeds("usbguard list-devices | grep -E 'QEMU USB HARDDRIVE'") + + # at this point there should be a **blocked** USB HDD + machine.succeed("usbguard list-devices | grep -E 'block.*QEMU USB HARDDRIVE'") + machine.fail("usbguard list-devices | grep -E ' allow .*QEMU USB HARDDRIVE'") + + # allow storage devices + machine.succeed("usbguard allow-device 'with-interface { 08:*:* }'") + + # at this point there should be an **allowed** USB HDD + machine.succeed("usbguard list-devices | grep -E ' allow .*QEMU USB HARDDRIVE'") + machine.fail("usbguard list-devices | grep -E ' block .*QEMU USB HARDDRIVE'") + ''; +}) diff --git a/pkgs/os-specific/linux/usbguard/default.nix b/pkgs/os-specific/linux/usbguard/default.nix index 55832dc7ade..7d4563baee4 100644 --- a/pkgs/os-specific/linux/usbguard/default.nix +++ b/pkgs/os-specific/linux/usbguard/default.nix @@ -3,6 +3,7 @@ , fetchFromGitHub , autoreconfHook , installShellFiles +, nixosTests , asciidoc , pkg-config , libxslt @@ -73,6 +74,8 @@ stdenv.mkDerivation rec { installShellCompletion --zsh --name _usbguard scripts/usbguard-zsh-completion ''; + passthru.tests = nixosTests.usbguard; + meta = with lib; { description = "The USBGuard software framework helps to protect your computer against BadUSB"; longDescription = ''