disk-deactivate: wipe raid arrays before stopping them (#1248)
Closes #1247 ## How to test 1. Go to $TMP: `cd "$(mktemp -d)"` 2. Get [the gist](https://gist.github.com/kmein/9644e65ab8218a4b57c35cb9290b86ad): `wget https://gist.githubusercontent.com/kmein/9644e65ab8218a4b57c35cb9290b86ad/raw/3ec76f6a142abb1f4ea3764563a8843984b300d4/flake.nix` 3. See it fail: `nix build` (output: _Exception: The canary file survived the Disko wipe process!_) 4. Switch the branch: `sed -i 's#github:nix-community/disko#github:kmein/disko?ref=fix/mdadm-destroy#' flake.nix` 5. Watch it work: `nix build`
This commit is contained in:
@@ -60,6 +60,7 @@ def deactivate:
|
||||
]
|
||||
elif (.type | contains("raid")) then
|
||||
[
|
||||
"wipefs --all -f \(.path | shellquote)",
|
||||
"mdadm --stop \(.name | shellquote)"
|
||||
]
|
||||
else
|
||||
|
||||
@@ -0,0 +1,130 @@
|
||||
{
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (pkgs) lib;
|
||||
|
||||
diskoModule = ../module.nix;
|
||||
|
||||
diskoConfig = {
|
||||
disko.devices.disk = {
|
||||
main = {
|
||||
device = "/dev/vdb";
|
||||
type = "disk";
|
||||
content = {
|
||||
type = "gpt";
|
||||
partitions = {
|
||||
ESP = {
|
||||
type = "EF00";
|
||||
size = "500M";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "vfat";
|
||||
mountpoint = "/boot";
|
||||
mountOptions = [ "umask=0077" ];
|
||||
};
|
||||
};
|
||||
encryptedSwap = {
|
||||
size = "100%";
|
||||
content = {
|
||||
type = "swap";
|
||||
randomEncryption = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
// (lib.genAttrs [ "pool1" "pool2" ] (name: {
|
||||
type = "disk";
|
||||
device =
|
||||
{
|
||||
pool1 = "/dev/vdc";
|
||||
pool2 = "/dev/vdd";
|
||||
}
|
||||
.${name};
|
||||
content = {
|
||||
type = "gpt";
|
||||
partitions.mdadm = {
|
||||
size = "100%";
|
||||
content = {
|
||||
type = "mdraid";
|
||||
name = "raid0";
|
||||
};
|
||||
};
|
||||
};
|
||||
}));
|
||||
|
||||
disko.devices.mdadm.raid0 = {
|
||||
type = "mdadm";
|
||||
level = 0;
|
||||
content = {
|
||||
type = "btrfs";
|
||||
extraArgs = [ "-f" ];
|
||||
mountpoint = "/";
|
||||
};
|
||||
};
|
||||
};
|
||||
in
|
||||
pkgs.testers.runNixOSTest {
|
||||
name = "disko-btrfs-mdadm-resurrection";
|
||||
|
||||
nodes.machine =
|
||||
{ config, pkgs, ... }:
|
||||
{
|
||||
imports = [
|
||||
diskoModule
|
||||
diskoConfig
|
||||
];
|
||||
|
||||
boot.loader.grub.devices = [ "/dev/null" ];
|
||||
|
||||
virtualisation.emptyDiskImages = [
|
||||
4096
|
||||
4096
|
||||
4096
|
||||
];
|
||||
boot.swraid.enable = true;
|
||||
environment.systemPackages = with pkgs; [
|
||||
mdadm
|
||||
btrfs-progs
|
||||
cryptsetup
|
||||
parted
|
||||
];
|
||||
};
|
||||
|
||||
testScript =
|
||||
{ nodes, ... }:
|
||||
let
|
||||
inherit (nodes.machine.system.build) destroyScript formatScript mountScript;
|
||||
in
|
||||
''
|
||||
machine.wait_for_unit("multi-user.target")
|
||||
|
||||
print("Running initial format and mount...")
|
||||
machine.succeed("${formatScript}")
|
||||
machine.succeed("${mountScript}")
|
||||
|
||||
print("Writing canary file...")
|
||||
machine.succeed("echo 'I survived the wipe!' > /mnt/canary.txt")
|
||||
machine.succeed("sync")
|
||||
|
||||
machine.succeed("umount -R /mnt")
|
||||
|
||||
print("Running the destroy script...")
|
||||
machine.execute("${destroyScript}")
|
||||
|
||||
print("Attempting to reformat and remount...")
|
||||
machine.execute("${formatScript}")
|
||||
machine.execute("${mountScript}")
|
||||
|
||||
print("Checking if the canary file is still there...")
|
||||
status, output = machine.execute("cat /mnt/canary.txt")
|
||||
|
||||
if status == 0 and "I survived the wipe!" in output:
|
||||
raise Exception("The canary file survived the Disko wipe process!")
|
||||
else:
|
||||
print("Test passed: Data was successfully destroyed.")
|
||||
'';
|
||||
}
|
||||
Reference in New Issue
Block a user