usb.rb 27.1 KB
Newer Older
1
2
3
4
5
6
7
8
9
# Returns a hash that for each preset the running Tails is aware of
# maps the source to the destination.
def get_persistence_presets(skip_links = false)
  # Perl script that prints all persistence presets (one per line) on
  # the form: <mount_point>:<comma-separated-list-of-options>
  script = <<-EOF
  use strict;
  use warnings FATAL => "all";
  use Tails::Persistence::Configuration::Presets;
Tails developers's avatar
Tails developers committed
10
11
  foreach my $preset (Tails::Persistence::Configuration::Presets->new()->all) {
    say $preset->destination, ":", join(",", @{$preset->options});
12
  }
13
14
15
16
EOF
  # VMCommand:s cannot handle newlines, and they're irrelevant in the
  # above perl script any way
  script.delete!("\n")
17
  presets = $vm.execute_successfully("perl -E '#{script}'").stdout.chomp.split("\n")
18
19
20
21
22
23
24
25
26
  assert presets.size >= 10, "Got #{presets.size} persistence presets, " +
                             "which is too few"
  persistence_mapping = Hash.new
  for line in presets
    destination, options_str = line.split(":")
    options = options_str.split(",")
    is_link = options.include? "link"
    next if is_link and skip_links
    source_str = options.find { |option| /^source=/.match option }
27
28
29
30
31
32
33
    # If no source is given as an option, live-boot's persistence
    # feature defaults to the destination minus the initial "/".
    if source_str.nil?
      source = destination.partition("/").last
    else
      source = source_str.split("=")[1]
    end
34
35
36
37
38
39
40
41
42
43
44
    persistence_mapping[source] = destination
  end
  return persistence_mapping
end

def persistent_dirs
  get_persistence_presets
end

def persistent_mounts
  get_persistence_presets(true)
45
46
end

47
def persistent_volumes_mountpoints
48
  $vm.execute("ls -1 -d /live/persistence/*_unlocked/").stdout.chomp.split
49
50
end

51
52
53
54
55
56
57
58
def recover_from_upgrader_failure
    $vm.execute('killall tails-upgrade-frontend tails-upgrade-frontend-wrapper zenity')
    # Remove unnecessary sleep for retry
    $vm.execute_successfully('sed -i "/^sleep 30$/d" ' +
                             '/usr/local/bin/tails-upgrade-frontend-wrapper')
    $vm.spawn('tails-upgrade-frontend-wrapper', user: LIVE_USER)
end

59
Given /^I clone USB drive "([^"]+)" to a new USB drive "([^"]+)"$/ do |from, to|
60
  $vm.storage.clone_to_new_disk(from, to)
61
62
63
end

Given /^I unplug USB drive "([^"]+)"$/ do |name|
64
  $vm.unplug_drive(name)
65
66
end

67
Given /^the computer is set to boot from the old Tails DVD$/ do
68
  $vm.set_cdrom_boot(OLD_TAILS_ISO)
69
70
end

71
Given /^the computer is set to boot in UEFI mode$/ do
72
  $vm.set_os_loader('UEFI')
73
74
75
  @os_loader = 'UEFI'
end

anonym's avatar
anonym committed
76
77
78
79
80
81
82
def tails_installer_selected_device
  @installer.child('Target Device:', roleName: 'label').parent
    .child('', roleName: 'combo box', recursive: false).name
end

def tails_installer_is_device_selected?(name)
  device = $vm.disk_dev(name)
83
  tails_installer_selected_device[/#{device}\d*$/]
anonym's avatar
anonym committed
84
85
end

anonym's avatar
anonym committed
86
def tails_installer_match_status(pattern)
anonym's avatar
anonym committed
87
  @installer.child('', roleName: 'text').text[pattern]
anonym's avatar
anonym committed
88
89
end

90
class UpgradeNotSupported < StandardError
91
92
end

93
def usb_install_helper(name)
94
  if tails_installer_match_status(/It is impossible to upgrade the device .+ #{$vm.disk_dev(name)}\d* /)
95
    raise UpgradeNotSupported
96
  end
97
  assert(tails_installer_is_device_selected?(name))
98
  begin
99
100
    @installer.button('Install Tails').click
    @installer.child('Question', roleName: 'alert').button('Yes').click
101
102
103
104
105
106
    try_for(30*60) do
      @installer
        .child('Information', roleName: 'alert')
        .child('Installation complete!', roleName: 'label')
      true
    end
107
  rescue FindFailed => e
108
109
    path = $vm.execute_successfully('ls -1 /tmp/tails-installer-*').stdout.chomp
    debug_log("Tails Installer debug log:\n" + $vm.file_content(path))
110
111
    raise e
  end
112
113
end

114
When /^I start Tails Installer in "([^"]+)" mode$/ do |mode|
115
116
  step 'I run "export DEBUG=1 ; tails-installer-launcher" in GNOME Terminal'
  installer_launcher = Dogtail::Application.new('tails-installer-launcher')
117
118
119
120
121
122
                         .child('Tails Installer', roleName: 'frame')
  # Sometimes Dogtail will find the button and click it before it is
  # shown (searchShowingOnly is not perfect) which generally means
  # clicking somewhere on the Terminal => the click is lost *and* the
  # installer does no go to the foreground. So let's wait a bit extra.
  sleep 3
123
  installer_launcher.button(mode).click
124
  @installer = Dogtail::Application.new('tails-installer')
125
  @installer.child('Tails Installer', roleName: 'frame')
anonym's avatar
anonym committed
126
  # ... and something similar (for consecutive steps) again.
127
128
  sleep 3
  $vm.focus_window('Tails Installer')
129
130
end

131
Then /^Tails Installer detects that a device is too small$/ do
132
  try_for(10) do
133
    tails_installer_match_status(/^The device .* is too small to install Tails/)
134
  end
135
136
end

137
138
139
140
141
142
When /^I am told that the destination device cannot be upgraded$/ do
  try_for(10) do
    tails_installer_match_status(/^It is impossible to upgrade the device/)
  end
end

anonym's avatar
anonym committed
143
When /^I am suggested to do a "Install by cloning"$/ do
144
145
146
147
148
149
  try_for(10) do
    tails_installer_match_status(
      /You should instead use "Install by cloning" to upgrade Tails/
    )
  end
end
150
151

Then /^a suitable USB device is (?:still )?not found$/ do
152
153
154
  @installer.child(
    'No device suitable to install Tails could be found', roleName: 'label'
  )
155
156
157
158
159
160
161
162
163
164
165
166
end

Then /^(no|the "([^"]+)") USB drive is selected$/ do |mode, name|
  try_for(30) do
    if mode == 'no'
      tails_installer_selected_device == ''
    else
      tails_installer_is_device_selected?(name)
    end
  end
end

167
168
When /^I "([^"]*)" Tails to USB drive "([^"]+)"$/ do |mode, name|
  step "I start Tails Installer in \"#{mode}\" mode"
169
170
171
  usb_install_helper(name)
end

anonym's avatar
anonym committed
172
When /^I fail to "([^"]*)" Tails to USB drive "([^"]+)"$/ do |mode, name|
173
  begin
174
    step "I \"#{mode}\" Tails to USB drive \"#{name}\""
175
  rescue UpgradeNotSupported
176
177
178
179
180
181
    # this is what we expect
  else
    raise "The USB installer should not succeed"
  end
end

182
183
184
185
186
Given /^I plug and mount a USB drive containing the Tails ISO$/ do
  iso_dir = share_host_files(TAILS_ISO)
  @iso_path = "#{iso_dir}/#{File.basename(TAILS_ISO)}"
end

187
When /^I do a "Upgrade from ISO" on USB drive "([^"]+)"$/ do |name|
188
  step 'I start Tails Installer in "Upgrade from ISO" mode'
189
190
191
  @installer.child('Use existing Live system ISO:', roleName: 'label')
    .parent.button('(None)').click
  file_chooser = @installer.child('Select a File', roleName: 'file chooser')
192
  @screen.type("l", Sikuli::KeyModifier.CTRL)
193
  # The only visible text element will be the path entry
194
  file_chooser.child(roleName: 'text').typeText(@iso_path + '\n')
195
  file_chooser.button('Open').click
196
197
198
199
200
  usb_install_helper(name)
end

Given /^I enable all persistence presets$/ do
  @screen.wait('PersistenceWizardPresets.png', 20)
201
202
203
204
205
206
  # Select the "Persistent" folder preset, which is checked by default.
  @screen.type(Sikuli::Key.TAB)
  # Check all non-default persistence presets, i.e. all *after* the
  # "Persistent" folder, which are unchecked by default.
  (persistent_dirs.size - 1).times do
    @screen.type(Sikuli::Key.TAB + Sikuli::Key.SPACE)
207
  end
208
  @screen.wait_and_click('PersistenceWizardSave.png', 10)
intrigeri's avatar
intrigeri committed
209
  @screen.wait('PersistenceWizardDone.png', 60)
210
  @screen.type(Sikuli::Key.F4, Sikuli::KeyModifier.ALT)
211
212
end

213
When /^I disable the first persistence preset$/ do
214
  step 'I start "Configure persistent volume" via the GNOME "Tails" applications menu'
215
216
217
218
219
220
221
  @screen.wait('PersistenceWizardPresets.png', 300)
  @screen.type(Sikuli::Key.SPACE)
  @screen.wait_and_click('PersistenceWizardSave.png', 10)
  @screen.wait('PersistenceWizardDone.png', 30)
  @screen.type(Sikuli::Key.F4, Sikuli::KeyModifier.ALT)
end

222
Given /^I create a persistent partition$/ do
223
  step 'I start "Configure persistent volume" via the GNOME "Tails" applications menu'
intrigeri's avatar
intrigeri committed
224
  @screen.wait('PersistenceWizardStart.png', 60)
225
  @screen.type(@persistence_password + "\t" + @persistence_password + Sikuli::Key.ENTER)
Tails developers's avatar
Tails developers committed
226
  @screen.wait('PersistenceWizardPresets.png', 300)
227
228
229
  step "I enable all persistence presets"
end

230
def check_disk_integrity(name, dev, scheme)
231
  info = $vm.execute("udisksctl info --block-device '#{dev}'").stdout
232
233
234
235
236
237
238
  info_split = info.split("\n  org\.freedesktop\.UDisks2\.PartitionTable:\n")
  dev_info = info_split[0]
  part_table_info = info_split[1]
  assert(part_table_info.match("^    Type: +#{scheme}$"),
         "Unexpected partition scheme on USB drive '#{name}', '#{dev}'")
end

239
def check_part_integrity(name, dev, usage, fs_type, part_label, part_type = nil)
240
  info = $vm.execute("udisksctl info --block-device '#{dev}'").stdout
241
  info_split = info.split("\n  org\.freedesktop\.UDisks2\.Partition:\n")
242
243
  dev_info = info_split[0]
  part_info = info_split[1]
244
  assert(dev_info.match("^    IdUsage: +#{usage}$"),
245
         "Unexpected device field 'usage' on USB drive '#{name}', '#{dev}'")
246
247
248
  assert(dev_info.match("^    IdType: +#{fs_type}$"),
         "Unexpected device field 'IdType' on USB drive '#{name}', '#{dev}'")
  assert(part_info.match("^    Name: +#{part_label}$"),
249
         "Unexpected partition label on USB drive '#{name}', '#{dev}'")
250
251
252
253
  if part_type
    assert(part_info.match("^    Type: +#{part_type}$"),
           "Unexpected partition type on USB drive '#{name}', '#{dev}'")
  end
254
255
end

256
def tails_is_installed_helper(name, tails_root, loader)
257
  disk_dev = $vm.disk_dev(name)
258
259
  part_dev = disk_dev + "1"
  check_disk_integrity(name, disk_dev, "gpt")
260
261
262
  check_part_integrity(name, part_dev, "filesystem", "vfat", "Tails",
                       # EFI System Partition
                       'c12a7328-f81f-11d2-ba4b-00a0c93ec93b')
263

264
  target_root = "/mnt/new"
265
  $vm.execute("mkdir -p #{target_root}")
266
  $vm.execute("mount #{part_dev} #{target_root}")
267

268
  c = $vm.execute("diff -qr '#{tails_root}/live' '#{target_root}/live'")
269
  assert(c.success?,
270
         "USB drive '#{name}' has differences in /live:\n#{c.stdout}\n#{c.stderr}")
271

272
  syslinux_files = $vm.execute("ls -1 #{target_root}/syslinux").stdout.chomp.split
273
  # We deal with these files separately
274
  ignores = ["syslinux.cfg", "exithelp.cfg", "ldlinux.c32", "ldlinux.sys"]
275
  for f in syslinux_files - ignores do
276
    c = $vm.execute("diff -q '#{tails_root}/#{loader}/#{f}' " +
277
                    "'#{target_root}/syslinux/#{f}'")
278
279
280
281
282
    assert(c.success?, "USB drive '#{name}' has differences in " +
           "'/syslinux/#{f}'")
  end

  # The main .cfg is named differently vs isolinux
283
  c = $vm.execute("diff -q '#{tails_root}/#{loader}/#{loader}.cfg' " +
284
                  "'#{target_root}/syslinux/syslinux.cfg'")
285
286
287
  assert(c.success?, "USB drive '#{name}' has differences in " +
         "'/syslinux/syslinux.cfg'")

288
289
  $vm.execute("umount #{target_root}")
  $vm.execute("sync")
290
291
end

292
293
294
295
296
297
298
Then /^the running Tails is installed on USB drive "([^"]+)"$/ do |target_name|
  loader = boot_device_type == "usb" ? "syslinux" : "isolinux"
  tails_is_installed_helper(target_name, "/lib/live/mount/medium", loader)
end

Then /^the ISO's Tails is installed on USB drive "([^"]+)"$/ do |target_name|
  iso_root = "/mnt/iso"
299
  $vm.execute("mkdir -p #{iso_root}")
300
  $vm.execute("mount -o loop #{@iso_path} #{iso_root}")
Tails developers's avatar
Tails developers committed
301
  tails_is_installed_helper(target_name, iso_root, "isolinux")
302
  $vm.execute("umount #{iso_root}")
303
304
end

305
Then /^there is no persistence partition on USB drive "([^"]+)"$/ do |name|
306
307
  data_part_dev = $vm.disk_dev(name) + "2"
  assert(!$vm.execute("test -b #{data_part_dev}").success?,
308
309
310
         "USB drive #{name} has a partition '#{data_part_dev}'")
end

311
Then /^a Tails persistence partition exists on USB drive "([^"]+)"$/ do |name|
312
  dev = $vm.disk_dev(name) + "2"
313
  check_part_integrity(name, dev, "crypto", "crypto_LUKS", "TailsData")
314

315
316
  # The LUKS container may already be opened, e.g. by udisks after
  # we've run tails-persistence-setup.
317
  c = $vm.execute("ls -1 --hide 'control' /dev/mapper/")
318
319
  if c.success?
    for candidate in c.stdout.split("\n")
320
      luks_info = $vm.execute("cryptsetup status '#{candidate}'")
321
322
323
324
325
326
327
      if luks_info.success? and luks_info.stdout.match("^\s+device:\s+#{dev}$")
        luks_dev = "/dev/mapper/#{candidate}"
        break
      end
    end
  end
  if luks_dev.nil?
328
329
    c = $vm.execute("echo #{@persistence_password} | " +
                    "cryptsetup luksOpen #{dev} #{name}")
330
331
332
    assert(c.success?, "Couldn't open LUKS device '#{dev}' on  drive '#{name}'")
    luks_dev = "/dev/mapper/#{name}"
  end
333
334

  # Adapting check_part_integrity() seems like a bad idea so here goes
335
  info = $vm.execute("udisksctl info --block-device '#{luks_dev}'").stdout
336
337
338
339
  assert info.match("^    CryptoBackingDevice: +'/[a-zA-Z0-9_/]+'$")
  assert info.match("^    IdUsage: +filesystem$")
  assert info.match("^    IdType: +ext[34]$")
  assert info.match("^    IdLabel: +TailsData$")
340
341

  mount_dir = "/mnt/#{name}"
342
  $vm.execute("mkdir -p #{mount_dir}")
343
  c = $vm.execute("mount '#{luks_dev}' #{mount_dir}")
344
  assert(c.success?,
Tails developers's avatar
Tails developers committed
345
         "Couldn't mount opened LUKS device '#{dev}' on drive '#{name}'")
346

347
348
349
  $vm.execute("umount #{mount_dir}")
  $vm.execute("sync")
  $vm.execute("cryptsetup luksClose #{name}")
350
351
end

352
Given /^I enable persistence$/ do
353
354
355
  @screen.wait_and_click('TailsGreeterPersistencePassphrase.png', 10)
  @screen.type(@persistence_password + Sikuli::Key.ENTER)
  @screen.wait('TailsGreeterPersistenceUnlocked.png', 30)
356
357
end

358
359
def tails_persistence_enabled?
  persistence_state_file = "/var/lib/live/config/tails.persistence"
360
361
  return $vm.execute("test -e '#{persistence_state_file}'").success? &&
         $vm.execute(". '#{persistence_state_file}' && " +
362
                     'test "$TAILS_PERSISTENCE_ENABLED" = true').success?
363
364
end

365
366
Given /^all persistence presets(| from the old Tails version)(| but the first one) are enabled$/ do |old_tails, except_first|
  assert(old_tails.empty? || except_first.empty?, "Unsupported case.")
367
368
369
  try_for(120, :msg => "Persistence is disabled") do
    tails_persistence_enabled?
  end
370
  unexpected_mounts = Array.new
371
  # Check that all persistent directories are mounted
372
373
  if old_tails.empty?
    expected_mounts = persistent_mounts
374
375
376
377
378
379
    if ! except_first.empty?
      first_expected_mount_source      = expected_mounts.keys[0]
      first_expected_mount_destination = expected_mounts[first_expected_mount_source]
      expected_mounts.delete(first_expected_mount_source)
      unexpected_mounts = [first_expected_mount_destination]
    end
380
  else
381
    assert_not_nil($remembered_persistence_mounts)
382
    expected_mounts = $remembered_persistence_mounts
383
  end
384
  mount = $vm.execute("mount").stdout.chomp
385
  for _, dir in expected_mounts do
386
387
388
    assert(mount.include?("on #{dir} "),
           "Persistent directory '#{dir}' is not mounted")
  end
389
390
391
392
  for dir in unexpected_mounts do
    assert(! mount.include?("on #{dir} "),
           "Persistent directory '#{dir}' is mounted")
  end
393
394
end

395
396
397
398
Given /^persistence is disabled$/ do
  assert(!tails_persistence_enabled?, "Persistence is enabled")
end

399
def boot_device
400
401
  # Approach borrowed from
  # config/chroot_local_includes/lib/live/config/998-permissions
402
403
  boot_dev_id = $vm.execute("udevadm info --device-id-of-file=/lib/live/mount/medium").stdout.chomp
  boot_dev = $vm.execute("readlink -f /dev/block/'#{boot_dev_id}'").stdout.chomp
404
405
406
  return boot_dev
end

anonym's avatar
anonym committed
407
def device_info(dev)
408
409
  # Approach borrowed from
  # config/chroot_local_includes/lib/live/config/998-permissions
anonym's avatar
anonym committed
410
411
412
413
414
415
  info = $vm.execute("udevadm info --query=property --name='#{dev}'").stdout.chomp
  info.split("\n").map { |e| e.split('=') } .to_h
end

def boot_device_type
  device_info(boot_device)['ID_BUS']
416
417
end

418
419
420
Then /^Tails is running from (.*) drive "([^"]+)"$/ do |bus, name|
  bus = bus.downcase
  case bus
421
  when "sata"
422
423
424
425
426
    expected_bus = "ata"
  else
    expected_bus = bus
  end
  assert_equal(expected_bus, boot_device_type)
427
  actual_dev = boot_device
428
429
430
431
432
433
  # The boot partition differs between an using Tails installer and
  # isohybrids. There's also a strange case isohybrids are thought to
  # be booting from the "raw" device, and not a partition of it
  # (#10504).
  expected_devs = ['', '1', '4'].map { |e| $vm.disk_dev(name) + e }
  assert(expected_devs.include?(actual_dev),
434
         "We are running from device #{actual_dev}, but for #{bus} drive " +
435
         "'#{name}' we expected to run from one of #{expected_devs}")
436
437
438
439
440
end

Then /^the boot device has safe access rights$/ do

  super_boot_dev = boot_device.sub(/[[:digit:]]+$/, "")
441
  devs = $vm.execute("ls -1 #{super_boot_dev}*").stdout.chomp.split
442
  assert(devs.size > 0, "Could not determine boot device")
443
  all_users = $vm.execute("cut -d':' -f1 /etc/passwd").stdout.chomp.split
444
  all_users_with_groups = all_users.collect do |user|
445
    groups = $vm.execute("groups #{user}").stdout.chomp.sub(/^#{user} : /, "").split(" ")
446
447
448
    [user, groups]
  end
  for dev in devs do
449
450
451
    dev_owner = $vm.execute("stat -c %U #{dev}").stdout.chomp
    dev_group = $vm.execute("stat -c %G #{dev}").stdout.chomp
    dev_perms = $vm.execute("stat -c %a #{dev}").stdout.chomp
452
    assert_equal("root", dev_owner)
453
454
    assert(dev_group == "disk" || dev_group == "root",
           "Boot device '#{dev}' owned by group '#{dev_group}', expected " +
455
           "'disk' or 'root'.")
456
    assert_equal("660", dev_perms)
457
458
459
460
461
462
463
    for user, groups in all_users_with_groups do
      next if user == "root"
      assert(!(groups.include?(dev_group)),
             "Unprivileged user '#{user}' is in group '#{dev_group}' which " +
             "owns boot device '#{dev}'")
    end
  end
464

465
  info = $vm.execute("udisksctl info --block-device '#{super_boot_dev}'").stdout
intrigeri's avatar
intrigeri committed
466
  assert(info.match("^    HintSystem: +true$"),
467
         "Boot device '#{super_boot_dev}' is not system internal for udisks")
468
469
end

470
Then /^all persistent filesystems have safe access rights$/ do
471
  persistent_volumes_mountpoints.each do |mountpoint|
472
473
474
    fs_owner = $vm.execute("stat -c %U #{mountpoint}").stdout.chomp
    fs_group = $vm.execute("stat -c %G #{mountpoint}").stdout.chomp
    fs_perms = $vm.execute("stat -c %a #{mountpoint}").stdout.chomp
475
476
477
    assert_equal("root", fs_owner)
    assert_equal("root", fs_group)
    assert_equal('775', fs_perms)
478
479
480
  end
end

481
Then /^all persistence configuration files have safe access rights$/ do
482
  persistent_volumes_mountpoints.each do |mountpoint|
483
    assert($vm.execute("test -e #{mountpoint}/persistence.conf").success?,
484
           "#{mountpoint}/persistence.conf does not exist, while it should")
485
    assert($vm.execute("test ! -e #{mountpoint}/live-persistence.conf").success?,
486
           "#{mountpoint}/live-persistence.conf does exist, while it should not")
487
    $vm.execute(
488
489
      "ls -1 #{mountpoint}/persistence.conf #{mountpoint}/live-*.conf"
    ).stdout.chomp.split.each do |f|
490
491
492
      file_owner = $vm.execute("stat -c %U '#{f}'").stdout.chomp
      file_group = $vm.execute("stat -c %G '#{f}'").stdout.chomp
      file_perms = $vm.execute("stat -c %a '#{f}'").stdout.chomp
493
494
495
      assert_equal("tails-persistence-setup", file_owner)
      assert_equal("tails-persistence-setup", file_group)
      assert_equal("600", file_perms)
496
    end
Tails developers's avatar
Tails developers committed
497
  end
498
499
end

500
Then /^all persistent directories(| from the old Tails version) have safe access rights$/ do |old_tails|
501
502
503
  if old_tails.empty?
    expected_dirs = persistent_dirs
  else
504
    assert_not_nil($remembered_persistence_dirs)
505
    expected_dirs = $remembered_persistence_dirs
506
  end
507
  persistent_volumes_mountpoints.each do |mountpoint|
508
    expected_dirs.each do |src, dest|
Tails developers's avatar
Tails developers committed
509
      full_src = "#{mountpoint}/#{src}"
510
511
512
      assert_vmcommand_success $vm.execute("test -d #{full_src}")
      dir_perms = $vm.execute_successfully("stat -c %a '#{full_src}'").stdout.chomp
      dir_owner = $vm.execute_successfully("stat -c %U '#{full_src}'").stdout.chomp
513
      if dest.start_with?("/home/#{LIVE_USER}")
514
        expected_perms = "700"
515
        expected_owner = LIVE_USER
516
517
518
519
520
521
522
523
524
525
      else
        expected_perms = "755"
        expected_owner = "root"
      end
      assert_equal(expected_perms, dir_perms,
                   "Persistent source #{full_src} has permission " \
                   "#{dir_perms}, expected #{expected_perms}")
      assert_equal(expected_owner, dir_owner,
                   "Persistent source #{full_src} has owner " \
                   "#{dir_owner}, expected #{expected_owner}")
526
527
528
529
    end
  end
end

530
When /^I write some files expected to persist$/ do
531
  persistent_mounts.each do |_, dir|
532
    owner = $vm.execute("stat -c %U #{dir}").stdout.chomp
533
    assert($vm.execute("touch #{dir}/XXX_persist", :user => owner).success?,
534
           "Could not create file in persistent directory #{dir}")
535
536
537
  end
end

538
539
540
541
542
543
When /^I write some dotfile expected to persist$/ do
  assert($vm.execute("touch /live/persistence/TailsData_unlocked/dotfiles/.XXX_persist",
                     :user => LIVE_USER).success?,
         "Could not create a file in the dotfiles persistence.")
end

544
When /^I remove some files expected to persist$/ do
545
  persistent_mounts.each do |_, dir|
546
    owner = $vm.execute("stat -c %U #{dir}").stdout.chomp
547
    assert($vm.execute("rm #{dir}/XXX_persist", :user => owner).success?,
548
           "Could not remove file in persistent directory #{dir}")
549
550
551
552
  end
end

When /^I write some files not expected to persist$/ do
553
  persistent_mounts.each do |_, dir|
554
    owner = $vm.execute("stat -c %U #{dir}").stdout.chomp
555
    assert($vm.execute("touch #{dir}/XXX_gone", :user => owner).success?,
556
           "Could not create file in persistent directory #{dir}")
557
558
559
  end
end

560
When /^I take note of which persistence presets are available$/ do
561
562
  $remembered_persistence_mounts = persistent_mounts
  $remembered_persistence_dirs = persistent_dirs
563
564
565
566
567
568
end

Then /^the expected persistent files(| created with the old Tails version) are present in the filesystem$/ do |old_tails|
  if old_tails.empty?
    expected_mounts = persistent_mounts
  else
569
    assert_not_nil($remembered_persistence_mounts)
570
    expected_mounts = $remembered_persistence_mounts
571
572
  end
  expected_mounts.each do |_, dir|
573
    assert($vm.execute("test -e #{dir}/XXX_persist").success?,
574
           "Could not find expected file in persistent directory #{dir}")
575
    assert(!$vm.execute("test -e #{dir}/XXX_gone").success?,
576
577
578
579
           "Found file that should not have persisted in persistent directory #{dir}")
  end
end

580
581
582
583
584
585
586
587
Then /^the expected persistent dotfile is present in the filesystem$/ do
  expected_dirs = persistent_dirs
  assert($vm.execute("test -L #{expected_dirs['dotfiles']}/.XXX_persist").success?,
         "Could not find expected persistent dotfile link.")
  assert($vm.execute("test -e $(readlink -f #{expected_dirs['dotfiles']}/.XXX_persist)").success?,
           "Could not find expected persistent dotfile link target.")
end

588
Then /^only the expected files are present on the persistence partition on USB drive "([^"]+)"$/ do |name|
589
  assert(!$vm.is_running?)
590
  disk = {
591
    :path => $vm.storage.disk_path(name),
592
    :opts => {
593
      :format => $vm.storage.disk_format(name),
594
595
596
      :readonly => true
    }
  }
597
  $vm.storage.guestfs_disk_helper(disk) do |g, disk_handle|
598
599
600
601
602
603
604
605
606
    partitions = g.part_list(disk_handle).map do |part_desc|
      disk_handle + part_desc["part_num"].to_s
    end
    partition = partitions.find do |part|
      g.blkid(part)["PART_ENTRY_NAME"] == "TailsData"
    end
    assert_not_nil(partition, "Could not find the 'TailsData' partition " \
                              "on disk '#{disk_handle}'")
    luks_mapping = File.basename(partition) + "_unlocked"
607
    g.luks_open(partition, @persistence_password, luks_mapping)
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
    luks_dev = "/dev/mapper/#{luks_mapping}"
    mount_point = "/"
    g.mount(luks_dev, mount_point)
    assert_not_nil($remembered_persistence_mounts)
    $remembered_persistence_mounts.each do |dir, _|
      # Guestfs::exists may have a bug; if the file exists, 1 is
      # returned, but if it doesn't exist false is returned. It seems
      # the translation of C types into Ruby types is glitchy.
      assert(g.exists("/#{dir}/XXX_persist") == 1,
             "Could not find expected file in persistent directory #{dir}")
      assert(g.exists("/#{dir}/XXX_gone") != 1,
             "Found file that should not have persisted in persistent directory #{dir}")
    end
    g.umount(mount_point)
    g.luks_close(luks_dev)
  end
624
end
625
626

When /^I delete the persistent partition$/ do
627
  step 'I start "Delete persistent volume" via the GNOME "Tails" applications menu'
intrigeri's avatar
intrigeri committed
628
  @screen.wait("PersistenceWizardDeletionStart.png", 120)
629
630
631
  @screen.type(" ")
  @screen.wait("PersistenceWizardDone.png", 120)
end
632
633

Then /^Tails has started in UEFI mode$/ do
634
  assert($vm.execute("test -d /sys/firmware/efi").success?,
635
636
         "/sys/firmware/efi does not exist")
 end
637
638

Given /^I create a ([[:alpha:]]+) label on disk "([^"]+)"$/ do |type, name|
639
  $vm.storage.disk_mklabel(name, type)
640
end
641

642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
Given /^the file system changes introduced in version (.+) are (not )?present(?: in the (\S+) Browser's chroot)?$/ do |version, not_present, chroot_browser|
  assert_equal('1.1~test', version)
  upgrade_applied = not_present.nil?
  chroot_browser = "#{chroot_browser.downcase}-browser" if chroot_browser
  changes = [
    {
      filesystem: :rootfs,
      path: 'some_new_file',
      status: :added,
      new_content: <<-EOF
Some content
      EOF
    },
    {
      filesystem: :rootfs,
      path: 'etc/amnesia/version',
      status: :modified,
      new_content: <<-EOF
#{version} - 20380119
ffffffffffffffffffffffffffffffffffffffff
live-build: 3.0.5+really+is+2.0.12-0.tails2
live-boot: 4.0.2-1
live-config: 4.0.4-1
      EOF
    },
    {
      filesystem: :rootfs,
      path: 'etc/os-release',
      status: :modified,
      new_content: <<-EOF
TAILS_PRODUCT_NAME="Tails"
TAILS_VERSION_ID="#{version}"
      EOF
    },
    {
      filesystem: :rootfs,
      path: 'usr/share/common-licenses/BSD',
      status: :removed
    },
    {
      filesystem: :medium,
      path: 'utils/linux/syslinux',
      status: :removed
    },
  ]
  changes.each do |change|
    case change[:filesystem]
    when :rootfs
      path = '/'
      path += "var/lib/#{chroot_browser}/chroot/" if chroot_browser
      path += change[:path]
    when :medium
      path = '/lib/live/mount/medium/' + change[:path]
    else
      raise "Unknown filesysten '#{change[:filesystem]}'"
    end
    case change[:status]
    when :removed
      assert_equal(!upgrade_applied, $vm.file_exist?(path))
    when :added
      assert_equal(upgrade_applied, $vm.file_exist?(path))
      if upgrade_applied && change[:new_content]
        assert_equal(change[:new_content], $vm.file_content(path))
      end
    when :modified
      assert($vm.file_exist?(path))
      if upgrade_applied
        assert_not_nil(change[:new_content])
        assert_equal(change[:new_content], $vm.file_content(path))
      end
    else
      raise "Unknown status '#{change[:status]}'"
    end
  end
end

Then /^I am proposed to install an incremental upgrade to version (.+)$/ do |version|
719
  recovery_proc = Proc.new do
720
    recover_from_upgrader_failure
721
722
723
724
725
726
727
  end
  failure_pic = 'TailsUpgraderFailure.png'
  success_pic = "TailsUpgraderUpgradeTo#{version}.png"
  retry_tor(recovery_proc) do
    match, _ = @screen.waitAny([success_pic, failure_pic], 2*60)
    assert_equal(success_pic, match)
  end
728
729
730
731
732
733
end

When /^I agree to install the incremental upgrade$/ do
  @screen.click('TailsUpgraderUpgradeNowButton.png')
end

anonym's avatar
anonym committed
734
735
Then /^I can successfully install the incremental upgrade to version (.+)$/ do |version|
  step 'I agree to install the incremental upgrade'
736
737
738
739
740
741
742
743
744
745
746
  recovery_proc = Proc.new do
    recover_from_upgrader_failure
    step "I am proposed to install an incremental upgrade to version #{version}"
    step 'I agree to install the incremental upgrade'
  end
  failure_pic = 'TailsUpgraderFailure.png'
  success_pic = "TailsUpgraderDone.png"
  retry_tor(recovery_proc) do
    match, _ = @screen.waitAny([success_pic, failure_pic], 2*60)
    assert_equal(success_pic, match)
  end
747
end