Add a Github workflow for executing the tests in Qemu on actual kernels. #23

gnoack · 2022-07-07T19:58:32Z

@l0kod This is running the go-landlock tests as Github actions on qemu... (It's based on the example at https://github.com/florianl/bluebox/blob/main/.github/workflows/example.yml by @florianl)

Some unsolved logistics problems:

It probably uses a few more CPU cycles than regular tests, but it might be worth it.
If we use something like this, it would also be good to host the kernel images in a better place than my personal repo. Do you already have a place for such a use case where Landlock-enabled kernels can be fetched?

l0kod · 2022-08-05T09:52:23Z

It probably uses a few more CPU cycles than regular tests, but it might be worth it.

We can optimize the Qemu command yes, I'll create a repo with some scripts.

If we use something like this, it would also be good to host the kernel images in a better place than my personal repo. Do you already have a place for such a use case where Landlock-enabled kernels can be fetched?

I'm using Qemu for tests too, but I have a patch to enable it on User-Mode Linux, which makes testing easier. Actually it is trivial to enable it on UML but it is incompatible with hostfs (for which I have a patch almost ready to be send). I think UML should be enough for the Go and Rust libraries. I can provide the kernel configuration and some scripts to deal with UML. Your use of initramfs is neat for Qemu but may not be required with UML and hostfs. Let me sketch something next week.

What would be great is a way to build the kernels from source but cache the result. Do you know a "standard" way to do that with GitHub?

l0kod · 2022-08-05T09:56:54Z

.github/workflows/kernel_integration.yml

+
+      - name: build initramfs
+        run: |
+          go install github.com/florianl/bluebox@latest


Let's use a pinned commit to avoid unexpected behavior. We'll have to update it from time to time but I think it's worth it.

I'd prefer to not use external tools though. Why is bluebox required? What about using a base file (e.g. from ubuntu-latest) and append the required test files to the cpio archive?

gnoack · 2022-08-05T14:24:55Z

I'm using Qemu for tests too, but I have a patch to enable it on User-Mode Linux, which makes testing easier. Actually it is trivial to enable it on UML but it is incompatible with hostfs (for which I have a patch almost ready to be send). I think UML should be enough for the Go and Rust libraries. I can provide the kernel configuration and some scripts to deal with UML. Your use of initramfs is neat for Qemu but may not be required with UML and hostfs. Let me sketch something next week.

Sounds good to me too.

What would be great is a way to build the kernels from source but cache the result. Do you know a "standard" way to do that with GitHub?

No idea, I'm also a beginner at that. I met florianl@ (author of bluebox) at a local Go meetup a few weeks ago, and he showed me that the existing users also have large repos with precompiled kernels on Github. I'm not sure whether it's worth investing that much effort.

bluebox has the advantage of producing very small cpio images, and due to Go compiling everything statically, there are not many more requirements than the test binaries themselves. It works well for Go, and I use it for running the kernel selftests on qemu as well: https://github.com/gnoack/landlock-selftests-runner

This is all not very urgent, we can also attempt the UML-based approach if you can get that working on Github actions.

l0kod · 2022-08-05T16:54:58Z

.github/workflows/kernel_integration.yml

@@ -0,0 +1,68 @@
+name: 'Kernel Integration Tests'
+


You should add permissions: {}, cf. https://github.com/landlock-lsm/rust-landlock/blob/main/.github/workflows/rust.yml

l0kod · 2022-08-05T16:55:49Z

.github/workflows/kernel_integration.yml

+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ '**' ]


It should be "main", the branch to merge against.

l0kod · 2022-08-05T16:57:09Z

.github/workflows/kernel_integration.yml

+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        kernel-version: ["5.12.0-plus", "5.15", "5.19-rc4"]


Oh nice, I didn't know about the matrix strategy.

l0kod · 2022-08-05T16:59:01Z

.github/workflows/kernel_integration.yml

+      - name: get kernel
+        # Fetch the public kernel image that will be used in this test run.
+        run: |
+          curl -s -L -o bzImage.${{ matrix.kernel-version }} --fail https://github.com/gnoack/linux-kernel-images/blob/main/bzImage.${{ matrix.kernel-version }}?raw=true


Do you need to download whereas it is in a GitHub repository?

Anyway, I would prefer to download this bzImage from a bleeding-edge distro package.

l0kod · 2022-08-08T15:10:27Z

What would be great is a way to build the kernels from source but cache the result. Do you know a "standard" way to do that with GitHub?

No idea, I'm also a beginner at that. I met florianl@ (author of bluebox) at a local Go meetup a few weeks ago, and he showed me that the existing users also have large repos with precompiled kernels on Github. I'm not sure whether it's worth investing that much effort.

There is actions/cache: https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows

NicolasT · 2022-08-28T14:38:02Z

Actually it is trivial to enable it on UML but it is incompatible with hostfs (for which I have a patch almost ready to be send). I think UML should be enough for the Go and Rust libraries. I can provide the kernel configuration and some scripts to deal with UML.

@l0kod, could you share some more info on this? I'm considering to use UML to test landlock-hs, but due to ARCH_EPHEMERAL_INODES that's a no-go for now.

l0kod · 2022-08-29T13:19:30Z

Actually it is trivial to enable it on UML but it is incompatible with hostfs (for which I have a patch almost ready to be send). I think UML should be enough for the Go and Rust libraries. I can provide the kernel configuration and some scripts to deal with UML.

@l0kod, could you share some more info on this? I'm considering to use UML to test landlock-hs, but due to ARCH_EPHEMERAL_INODES that's a no-go for now.

ARCH_EPHEMERAL_INODES exists because hostfs could be used in an UML system, and Landlock doesn't support hostfs for now. However, if you want to test Landlock with a tmpfs on UML it will work. For this, you need to patch the kernel and select Landlock:

diff --git a/arch/um/Kconfig b/arch/um/Kconfig
index 78de31ac1da7..98f1228b7de2 100644
--- a/arch/um/Kconfig
+++ b/arch/um/Kconfig
@@ -5,7 +5,6 @@ menu "UML-specific options"
 config UML
        bool
        default y
-       select ARCH_EPHEMERAL_INODES
        select ARCH_HAS_GCOV_PROFILE_ALL
        select ARCH_HAS_KCOV
        select ARCH_HAS_STRNCPY_FROM_USER

I'll send this patch and the hostfs fix (with tests) in the coming weeks, but you can still use this one to create a standalone UML binary.

l0kod · 2022-08-29T17:59:28Z

I need to create a repository with the required kernel files to test Landlock, but in the meantime here is a minimal UML configuration for Landlock. You can build a (5.19) kernel with ARCH=um make.

NicolasT · 2022-08-31T14:02:42Z

Thanks @l0kod. I'll need to fall-back to using Qemu instead of UML though in my project, since the GHC Haskell RTS' memory allocation subsystem does things in a way that work fine on "regular" Linux systems, but not in UML, because of how the behaviour of its mmap implementation differs.

Add a Github workflow for executing the tests in Qemu on actual kernels.

c7a8957

gnoack requested a review from l0kod July 7, 2022 19:58

l0kod reviewed Aug 5, 2022

View reviewed changes

l0kod requested changes Aug 5, 2022

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add a Github workflow for executing the tests in Qemu on actual kernels. #23

Add a Github workflow for executing the tests in Qemu on actual kernels. #23

gnoack commented Jul 7, 2022

l0kod commented Aug 5, 2022

l0kod Aug 5, 2022

gnoack commented Aug 5, 2022 •

edited

l0kod Aug 5, 2022

l0kod Aug 5, 2022

l0kod Aug 5, 2022

l0kod Aug 5, 2022

l0kod commented Aug 8, 2022

NicolasT commented Aug 28, 2022

l0kod commented Aug 29, 2022

l0kod commented Aug 29, 2022 •

edited

NicolasT commented Aug 31, 2022

Add a Github workflow for executing the tests in Qemu on actual kernels. #23

Are you sure you want to change the base?

Add a Github workflow for executing the tests in Qemu on actual kernels. #23

Conversation

gnoack commented Jul 7, 2022

l0kod commented Aug 5, 2022

l0kod Aug 5, 2022

Choose a reason for hiding this comment

gnoack commented Aug 5, 2022 • edited

l0kod Aug 5, 2022

Choose a reason for hiding this comment

l0kod Aug 5, 2022

Choose a reason for hiding this comment

l0kod Aug 5, 2022

Choose a reason for hiding this comment

l0kod Aug 5, 2022

Choose a reason for hiding this comment

l0kod commented Aug 8, 2022

NicolasT commented Aug 28, 2022

l0kod commented Aug 29, 2022

l0kod commented Aug 29, 2022 • edited

NicolasT commented Aug 31, 2022

gnoack commented Aug 5, 2022 •

edited

l0kod commented Aug 29, 2022 •

edited