Add developer accessible backdoor to VM tests infrastructure.

[domenkozar]

Thanks to @dezgeg for prototype implementation, I've
cleaned it up and added documentation.

I admit it's not clear to me if console access via $TMPDIR is considered a security issue, on a builder running multiple tests, I'd expect this could be considered an adversary.

[nlewo]

Do we really need to set a password?

      services.openssh.enable = true;
      services.openssh.permitRootLogin = "yes";
      services.openssh.extraConfig = "PermitEmptyPasswords yes";
      users.extraUsers.root.password = "";

[domenkozar]

Not really. I was hesitant to do that, but then again once it has a backdoor, why even bother with passwords.

[domenkozar]

Done.

[dezgeg]

There is an empty password already set in this file: https://github.com/NixOS/nixpkgs/blob/922916c51e2d9f664fd80c659bdb21047e0fb464/nixos/modules/testing/test-instrumentation.nix#L136

[domenkozar]

@nlewo @dezgeg I've removed redundant SSH, let me know what you think.

[roberth]

👍

I'd expect the temporary directory to have sufficiently restrictive permissions anyway. That's a problem that Nix should already solve. An adversary will have just as hard a time attacking a backdoored test as he would attacking a non-backdoored test.

Some potential improvements:

A similar backdoor to the perl script could be added, to provide access to library functions on machines and to relay the vm backdoors.

Also the tester could print the backdoor instructions, although it won't be able to point the user to the right path because of that one security measure to prevent dangerous accidental /tmp references in built packages, or do we have an obscure impure environment variable with that info?

[domenkozar]

A similar backdoor to the perl script could be added, to provide access to library functions on machines and to relay the vm backdoors.

Sounds good to me - anyone should feel free to contribute that, my motivation was to have a system that works and is documented. Hopefully that sparkles simplification :)

Also the tester could print the backdoor instructions, although it won't be able to point the user to the right path because of that one security measure to prevent dangerous accidental /tmp references in built packages, or do we have an obscure impure environment variable with that info?

Shouldn't be an issue to echo $TMPDIR to logs. My willpower to do more test debugging is very low, as I was deep into it in last days, can we also consider this an improvement yet to be done? :)

[roberth]

Iirc, $TMPDIR is /build/..... in the sandbox, which is backed by /tmp/..... on the host.
This is a great addition. I won't let perfect get in the way of better.

[aszlig]

Hm... what if we add a .debug attribute to the result of makeTest that turns the whole thing into a fixed output derivation (where we have networking) with a dummy hash, allowing to connect directly via SPICE for example?

[roberth]

@aszlig That's also an interesting approach. What do you think of the PR as is?

[domenkozar]

I'm merging this by discarding my concern about backdoor being a security issue given that shell is also placed into the temp directory - which is then used by testing infrastructure.

I know this is far from perfect, but I've managed to debug my test failures easily - so it does the job. Any improvements are welcome to be done on top of this work.

Going to backport to 18.09 as well.