10:21 a.m.
Create a new (fake) Fedora disk image with two partitions. /dev/sda1 is
the boot partition as usual, /dev/sda2 is used as an LVM PV. The VG has
four LVs, Root and LV1 through LV3.
Each LV holds a LUKS device (with a different key). Each decrypted LUKS
device holds an ext2 filesystem, with "/dev/mapper/Root-luks" holding the
root filesystem.
Each filesystem has a dedicated label (ROOT, LV1, LV2, LV3).
In the test case, run guestfish in inspector mode, twice.
In the first invocation, provide the LUKS passphrases by LV name. Also
specific to the first invocation, fetch the LUKS UUIDs by LV name.
In the second invocation, provide the LUKS passphrases by UUID.
In both invocations, after decryption, check the filesystem labels, the
/dev/mapper/* names generated for the decrypted LUKS block devices, and
the existence of "/etc/fedora-release" on the root filesystem.
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1658126
Signed-off-by: Laszlo Ersek <lersek(a)redhat.com>
---
test-data/phony-guests/Makefile.am | 7 ++
tests/Makefile.am | 2 +
.gitignore | 1 +
test-data/phony-guests/guests.xml.in | 18 ++++
test-data/phony-guests/make-fedora-img.pl | 54 ++++++++++
tests/luks/test-key-option-inspect-luks-on-lvm.sh | 103 ++++++++++++++++++++
6 files changed, 185 insertions(+)
diff --git a/test-data/phony-guests/Makefile.am b/test-data/phony-guests/Makefile.am
index 0114d10bb170..0a41f168bdfc 100644
--- a/test-data/phony-guests/Makefile.am
+++ b/test-data/phony-guests/Makefile.am
@@ -49,6 +49,7 @@ disk_images = \
fedora-md1.img \
fedora-md2.img \
fedora-btrfs.img \
+ fedora-luks-on-lvm.img \
fedora-lvm-on-luks.img \
ubuntu.img \
archlinux.img \
@@ -96,6 +97,12 @@ fedora-btrfs.img: make-fedora-img.pl \
fedora.db
SRCDIR=$(srcdir) LAYOUT=btrfs $(top_builddir)/run --test ./$<
+# Make a (dummy) Fedora image with LUKS-on-LVM.
+fedora-luks-on-lvm.img: make-fedora-img.pl \
+ fedora-journal.tar.xz \
+ fedora.db
+ SRCDIR=$(srcdir) LAYOUT=luks-on-lvm $(top_builddir)/run --test ./$<
+
# Make a (dummy) Fedora image with LVM-on-LUKS.
fedora-lvm-on-luks.img: make-fedora-img.pl \
fedora-journal.tar.xz \
diff --git a/tests/Makefile.am b/tests/Makefile.am
index 9112726750a7..9a2a2aab59a5 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -464,11 +464,13 @@ TESTS += \
luks/test-luks.sh \
luks/test-luks-list.sh \
luks/test-key-option.sh \
+ luks/test-key-option-inspect-luks-on-lvm.sh \
luks/test-key-option-inspect-lvm-on-luks.sh
EXTRA_DIST += \
luks/test-luks.sh \
luks/test-luks-list.sh \
luks/test-key-option.sh \
+ luks/test-key-option-inspect-luks-on-lvm.sh \
luks/test-key-option-inspect-lvm-on-luks.sh
TESTS += \
diff --git a/.gitignore b/.gitignore
index 8fb61aa7bb66..4c7656fccd6e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -452,6 +452,7 @@ Makefile.in
/test-data/phony-guests/debian.img
/test-data/phony-guests/fedora.img
/test-data/phony-guests/fedora-btrfs.img
+/test-data/phony-guests/fedora-luks-on-lvm.img
/test-data/phony-guests/fedora-lvm-on-luks.img
/test-data/phony-guests/fedora-md1.img
/test-data/phony-guests/fedora-md2.img
diff --git a/test-data/phony-guests/guests.xml.in b/test-data/phony-guests/guests.xml.in
index 3af6b27af073..dfcccc3d4cff 100644
--- a/test-data/phony-guests/guests.xml.in
+++ b/test-data/phony-guests/guests.xml.in
@@ -183,6 +183,24 @@
</devices>
</domain>
+ <!-- LUKS passwords are 'FEDORA-Root', 'FEDORA-LV1',
'FEDORA-LV2',
+ 'FEDORA-LV3' -->
+ <domain type='test'>
+ <name>fedora-luks-on-lvm</name>
+ <memory>1048576</memory>
+ <os>
+ <type>hvm</type>
+ <boot dev='hd'/>
+ </os>
+ <devices>
+ <disk type='file' device='disk'>
+ <driver name='qemu' type='raw'/>
+ <source file='@abs_builddir(a)/fedora-luks-on-lvm.img'/>
+ <target dev='vda' bus='virtio'/>
+ </disk>
+ </devices>
+ </domain>
+
<!-- LUKS password is 'FEDORA' -->
<domain type='test'>
<name>fedora-lvm-on-luks</name>
diff --git a/test-data/phony-guests/make-fedora-img.pl
b/test-data/phony-guests/make-fedora-img.pl
index 4cd6ef9575eb..84d4742e9000 100755
--- a/test-data/phony-guests/make-fedora-img.pl
+++ b/test-data/phony-guests/make-fedora-img.pl
@@ -200,6 +200,60 @@ EOF
init_lvm_root ('/dev/mapper/luks');
}
+elsif ($ENV{LAYOUT} eq 'luks-on-lvm') {
+ push (@images, "fedora-luks-on-lvm.img-t");
+
+ open (my $fstab, '>', "fedora.fstab") or die;
+ print $fstab <<EOF;
+LABEL=BOOT /boot ext2 default 0 0
+LABEL=ROOT / ext2 default 0 0
+EOF
+ close ($fstab) or die;
+
+ $bootdev = '/dev/sda1';
+
+ $g->disk_create ("fedora-luks-on-lvm.img-t", "raw",
$IMAGE_SIZE);
+
+ $g->add_drive ("fedora-luks-on-lvm.img-t", format =>
"raw");
+ $g->launch ();
+
+ $g->part_init ('/dev/sda', 'mbr');
+ foreach my $p (@PARTITIONS) {
+ $g->part_add('/dev/sda', @$p);
+ }
+
+ # Create the Volume Group on /dev/sda2.
+ $g->pvcreate ('/dev/sda2');
+ $g->vgcreate ('VG', ['/dev/sda2']);
+ $g->lvcreate ('Root', 'VG', 32);
+ $g->lvcreate ('LV1', 'VG', 32);
+ $g->lvcreate ('LV2', 'VG', 32);
+ $g->lvcreate ('LV3', 'VG', 64);
+
+ # Format each Logical Group as a LUKS device, with a different password.
+ $g->luks_format ('/dev/VG/Root', 'FEDORA-Root', 0);
+ $g->luks_format ('/dev/VG/LV1', 'FEDORA-LV1', 0);
+ $g->luks_format ('/dev/VG/LV2', 'FEDORA-LV2', 0);
+ $g->luks_format ('/dev/VG/LV3', 'FEDORA-LV3', 0);
+
+ # Open the LUKS devices. This creates nodes like /dev/mapper/*-luks.
+ $g->cryptsetup_open ('/dev/VG/Root', 'FEDORA-Root',
'Root-luks');
+ $g->cryptsetup_open ('/dev/VG/LV1', 'FEDORA-LV1',
'LV1-luks');
+ $g->cryptsetup_open ('/dev/VG/LV2', 'FEDORA-LV2',
'LV2-luks');
+ $g->cryptsetup_open ('/dev/VG/LV3', 'FEDORA-LV3',
'LV3-luks');
+
+ # Phony root filesystem.
+ $g->mkfs ('ext2', '/dev/mapper/Root-luks', blocksize => 4096,
label => 'ROOT');
+ $g->set_uuid ('/dev/mapper/Root-luks',
'01234567-0123-0123-0123-012345678902');
+
+ # Other filesystems, just for testing findfs-label.
+ $g->mkfs ('ext2', '/dev/mapper/LV1-luks', blocksize => 4096,
label => 'LV1');
+ $g->mkfs ('ext2', '/dev/mapper/LV2-luks', blocksize => 1024,
label => 'LV2');
+ $g->mkfs ('ext2', '/dev/mapper/LV3-luks', blocksize => 2048,
label => 'LV3');
+
+ $g->mount ('/dev/mapper/Root-luks', '/');
+}
+
else {
print STDERR "$0: Unknown LAYOUT: ",$ENV{LAYOUT},"\n";
exit 1;
diff --git a/tests/luks/test-key-option-inspect-luks-on-lvm.sh
b/tests/luks/test-key-option-inspect-luks-on-lvm.sh
new file mode 100755
index 000000000000..bf8aa3b1ee6e
--- /dev/null
+++ b/tests/luks/test-key-option-inspect-luks-on-lvm.sh
@@ -0,0 +1,103 @@
+#!/bin/bash -
+# libguestfs
+# Copyright (C) 2019-2022 Red Hat Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+# Test the --key option. It is handled by common code so we only need
+# to test one tool (guestfish).
+
+set -e
+
+$TEST_FUNCTIONS
+skip_if_skipped
+skip_unless_feature_available luks
+skip_unless_phony_guest fedora-luks-on-lvm.img
+
+# Start a background guestfish instance to check key specification by Logical
+# Volume names.
+guestfish=(guestfish --listen --ro --inspector
+ --add ../test-data/phony-guests/fedora-luks-on-lvm.img)
+keys_by_lvname=(--key /dev/VG/Root:key:FEDORA-Root
+ --key /dev/VG/LV1:key:FEDORA-LV1
+ --key /dev/VG/LV2:key:FEDORA-LV2
+ --key /dev/VG/LV3:key:FEDORA-LV3)
+
+# The variable assignment below will fail, and abort the script, if guestfish
+# refuses to start up.
+fish_ref=$("${guestfish[@]}" "${keys_by_lvname[@]}")
+
+# Set GUESTFISH_PID as necessary for the remote access.
+eval "$fish_ref"
+
+# From this point on, if any remote guestfish command fails, that will cause
+# *both* the guestfish server *and* this script to exit, with an error.
+# However, we also want the background guestfish process to exit if (a) this
+# script exits cleanly, or (b) this script exits with a failure due to a reason
+# that's different from a failed remote command.
+function cleanup_guestfish
+{
+ if [ -n "$GUESTFISH_PID" ]; then
+ guestfish --remote -- exit >/dev/null 2>&1 || :
+ fi
+}
+trap cleanup_guestfish EXIT
+
+# Get the UUIDs of the LUKS devices.
+uuid_root=$(guestfish --remote -- luks-uuid /dev/VG/Root)
+uuid_lv1=$( guestfish --remote -- luks-uuid /dev/VG/LV1)
+uuid_lv2=$( guestfish --remote -- luks-uuid /dev/VG/LV2)
+uuid_lv3=$( guestfish --remote -- luks-uuid /dev/VG/LV3)
+
+# The actual test.
+function check_filesystems
+{
+ local decrypted_root decrypted_lv1 decrypted_lv2 decrypted_lv3 exists
+
+ # Get the names of the decrypted LUKS block devices that host the filesystems
+ # with the labels listed below.
+ decrypted_root=$(guestfish --remote -- findfs-label ROOT)
+ decrypted_lv1=$( guestfish --remote -- findfs-label LV1)
+ decrypted_lv2=$( guestfish --remote -- findfs-label LV2)
+ decrypted_lv3=$( guestfish --remote -- findfs-label LV3)
+
+ # Verify the device names. These come from decrypt_mountables() in
+ # "common/options/decrypt.c".
+ test /dev/mapper/luks-"$uuid_root" = "$decrypted_root"
+ test /dev/mapper/luks-"$uuid_lv1" = "$decrypted_lv1"
+ test /dev/mapper/luks-"$uuid_lv2" = "$decrypted_lv2"
+ test /dev/mapper/luks-"$uuid_lv3" = "$decrypted_lv3"
+
+ # Check "/etc/fedora-release" on the root fs.
+ exists=$(guestfish --remote -- exists /etc/fedora-release)
+ test true = "$exists"
+}
+check_filesystems
+
+# Exit the current guestfish background process.
+guestfish --remote -- exit
+GUESTFISH_PID=
+
+# Start up a similar guestfish background process, but specify the keys by
+# UUID.
+keys_by_uuid=(--key "$uuid_root":key:FEDORA-Root
+ --key "$uuid_lv1":key:FEDORA-LV1
+ --key "$uuid_lv2":key:FEDORA-LV2
+ --key "$uuid_lv3":key:FEDORA-LV3)
+fish_ref=$("${guestfish[@]}" "${keys_by_uuid[@]}")
+eval "$fish_ref"
+
+# Repeat the test.
+check_filesystems
--
2.19.1.3.g30247aa5d201