Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Handle secureboot on&off for ima_evm tests #13673

Merged
merged 1 commit into from Nov 16, 2021
Merged

Handle secureboot on&off for ima_evm tests #13673

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
68 changes: 47 additions & 21 deletions lib/bootloader_setup.pm
View file
Open in desktop
Expand Up @@ -334,7 +334,8 @@ sub uefi_bootmenu_params {
# assume bios+grub+anim already waited in start.sh
# in grub2 it's tricky to set the screen resolution
#send_key_until_needlematch('grub2-enter-edit-mode', 'e', 5, 0.5);
(is_jeos) ? send_key_until_needlematch('grub2-enter-edit-mode', 'e', 5, 0.5)
(is_jeos)
? send_key_until_needlematch('grub2-enter-edit-mode', 'e', 5, 0.5)
: send_key 'e';
# Kiwi in TW uses grub2-mkconfig instead of the custom kiwi config
# Locate gfxpayload parameter and update it
Expand Down Expand Up @@ -647,14 +648,17 @@ sub autoyast_boot_params {
$autoyast_args .= "$proto://10.0.2.1/";
$autoyast_args .= 'data/' if $ay_var !~ /^aytests\//;
$autoyast_args .= $ay_var;
} elsif ($ay_var =~ /^ASSET_\d+$/) {
}
elsif ($ay_var =~ /^ASSET_\d+$/) {
rfan1 marked this conversation as resolved.
Show resolved Hide resolved
# In case profile is uploaded as an ASSET we need just filename
$ay_var = basename(get_required_var($ay_var));
$autoyast_args .= autoinst_url("/assets/other/$ay_var");
} elsif ($ay_var !~ /^slp$|:\/\//) {
}
elsif ($ay_var !~ /^slp$|:\/\//) {
# Getting profile from the worker as openQA asset
$autoyast_args .= data_url($ay_var);
} else {
}
else {
# Getting profile by direct url or slp
$autoyast_args .= $ay_var;
}
Expand Down Expand Up @@ -772,7 +776,8 @@ sub remote_install_bootmenu_params {
if (is_sle('=11-sp4')) {
#11-SP4 only support ssh=1
$params .= " ssh=1 VNC=1 VNCSize=1024x768 VNCPassword=$testapi::password ";
} else {
}
else {
$params .= " sshd=1 VNC=1 VNCSize=1024x768 VNCPassword=$testapi::password ";
}
}
Expand Down Expand Up @@ -894,7 +899,12 @@ sub tianocore_enter_menu {
}

sub tianocore_disable_secureboot {
my $basetest = shift;

my ($basetest, $revert) = @_;

my $neelle_sb_conf_attempt = $revert ? 'tianocore-devicemanager-sb-conf-disabled' : 'tianocore-devicemanager-sb-conf-attempt-sb';
rfan1 marked this conversation as resolved.
Show resolved Hide resolved
my $neelle_sb_change_state = $revert ? 'tianocore-devicemanager-sb-conf-enabled' : 'tianocore-devicemanager-sb-conf-attempt-sb';
my $neelle_sb_config_state = $revert ? 'tianocore-secureboot-enabled' : 'tianocore-secureboot-not-enabled';

assert_screen 'grub2';
send_key 'c';
Expand All @@ -906,18 +916,18 @@ sub tianocore_disable_secureboot {
send_key 'ret';
send_key_until_needlematch('tianocore-devicemanager-sb-conf', 'down', 5, 5);
send_key 'ret';
send_key_until_needlematch('tianocore-devicemanager-sb-conf-attempt-sb', 'down', 5, 5);
send_key_until_needlematch($neelle_sb_conf_attempt, 'down', 5, 5);
send_key 'spc';
assert_screen 'tianocore-devicemanager-sb-conf-changed';
send_key 'ret';
assert_screen 'tianocore-devicemanager-sb-conf-attempt-sb';
assert_screen($neelle_sb_change_state);
send_key 'f10';
assert_screen 'tianocore-bootmanager-save-changes';
send_key 'Y';
send_key_until_needlematch 'tianocore-devicemanager', 'esc';
send_key_until_needlematch 'tianocore-mainmenu-reset', 'down';
send_key 'ret';
send_key 'ret' if check_screen('tianocore-secureboot-not-enabled', 20);
send_key 'ret' if check_screen($neelle_sb_config_state, 20);
$basetest->wait_grub;
}

Expand Down Expand Up @@ -990,7 +1000,8 @@ sub zkvm_add_disk {
my $name = $svirt->name;
my $patched_img = "$zkvm_img_path/$name" . "a.img";
$svirt->add_disk({file => $patched_img, dev_id => 'a'});
} else {
}
else {
# Copy existing disk image to local storage
if (get_var("HDD_$di")) {
my $basename = basename(get_var("HDD_$di"));
Expand All @@ -1002,10 +1013,12 @@ sub zkvm_add_disk {
if (my $size = get_var("HDDSIZEGB_$di")) {
$size .= "G";
$svirt->add_disk({file => $hdd_path, backingfile => 1, dev_id => $dev_id, size => $size});
} else {
}
else {
$svirt->add_disk({file => $hdd_path, backingfile => 1, dev_id => $dev_id});
}
} else {
}
else {
# Create a new image, most likely it can be image for installation
# or additional optional drive for further testing
my $size = sprintf("%dG", get_var("HDDSIZEGB_$di", get_var('HDDSIZEGB', 4)));
Expand All @@ -1021,18 +1034,22 @@ sub zkvm_add_pty {
my ($svirt) = shift;

# serial console used for the serial log
$svirt->add_pty({
$svirt->add_pty(
{
pty_dev => SERIAL_CONSOLE_DEFAULT_DEVICE,
pty_dev_type => 'pty',
target_type => 'sclp',
target_port => SERIAL_CONSOLE_DEFAULT_PORT});
target_port => SERIAL_CONSOLE_DEFAULT_PORT
});

# sut-serial (serial terminal: emulation of QEMU's virtio console for svirt)
$svirt->add_pty({
$svirt->add_pty(
{
pty_dev => SERIAL_TERMINAL_DEFAULT_DEVICE,
pty_dev_type => 'pty',
target_type => 'virtio',
target_port => SERIAL_TERMINAL_DEFAULT_PORT});
target_port => SERIAL_TERMINAL_DEFAULT_PORT
});
}

sub zkvm_add_interface {
Expand Down Expand Up @@ -1147,7 +1164,10 @@ sub add_grub_cmdline_settings {
add => $add,
update_grub => 0,
search => get_cmdline_var(),
}, ['update_grub', 'search'], @_);
},
['update_grub', 'search'],
@_
);

change_grub_config('"$', " $add\"", $args{search}, "g", $args{update_grub});
}
Expand Down Expand Up @@ -1181,7 +1201,10 @@ sub replace_grub_cmdline_settings {
new => $new,
update_grub => 0,
search => get_cmdline_var(),
}, ['update_grub', 'search'], @_);
},
['update_grub', 'search'],
@_
);
change_grub_config($old, $new, $args{search}, "g", $args{update_grub});
}

Expand Down Expand Up @@ -1278,7 +1301,8 @@ sub compare_bootparams {
my @difference = arrays_subset($expected_boot_params, $received_boot_params);
if (scalar @difference > 0) {
record_info("params mismatch", "Actual bootloader params do not correspond to the expected ones. Mismatched params: @difference", result => 'fail');
} else {
}
else {
record_info("params ok", "Bootloader parameters are typed correctly.\nVerified parameters:\n" . join("\n", @{$expected_boot_params}));
}
}
Expand Down Expand Up @@ -1364,11 +1388,13 @@ sub prepare_disks {
if (get_var('ENCRYPT_ACTIVATE_EXISTING') || get_var('ENCRYPT_CANCEL_EXISTING')) {
create_encrypted_part(disk => $d);
if (get_var('ETC_PASSWD') && get_var('ETC_SHADOW')) {
mimic_user_to_import(disk => $d,
mimic_user_to_import(
disk => $d,
passwd => get_var('ETC_PASSWD'),
shadow => get_var('ETC_SHADOW'));
}
} else {
}
else {
script_run "parted /dev/$d mklabel gpt";
script_run "sync";
}
Expand Down
14 changes: 9 additions & 5 deletions tests/security/ima/evm_protection_digital_signatures.pm
View file
Open in desktop
Expand Up @@ -3,16 +3,16 @@
#
# Summary: Test EVM protection using digital signatures
# Note: This case should come after 'evm_protection_hmacs'
# Maintainer: llzhao <llzhao@suse.com>
# Tags: poo#53582, poo#92347
# Maintainer: llzhao <llzhao@suse.com>, rfan1 <richard.fan@suse.com>
# Tags: poo#53579, poo#100694, poo#102311

use base "opensusebasetest";
use base 'opensusebasetest';
use strict;
use warnings;
use testapi;
use utils;
use bootloader_setup "replace_grub_cmdline_settings";
use power_action_utils "power_action";
use bootloader_setup qw(replace_grub_cmdline_settings tianocore_disable_secureboot);
use power_action_utils 'power_action';

sub run {
my ($self) = @_;
Expand Down Expand Up @@ -61,7 +61,11 @@ sub run {
}
else {
replace_grub_cmdline_settings('evm=fix ima_appraise=fix', '', update_grub => 1);

# We need re-enable the secureboot after removing "ima_appraise=fix" kernel parameter
power_action('reboot', textmode => 1);
$self->wait_grub(bootloader_time => 200);
$self->tianocore_disable_secureboot('re_enable');
$self->wait_boot(textmode => 1);
$self->select_serial_terminal;

Expand Down
15 changes: 9 additions & 6 deletions tests/security/ima/evm_protection_hmacs.pm
View file
Open in desktop
@@ -1,18 +1,18 @@
# Copyright 2019-2020 SUSE LLC
# Copyright 2019-2021 SUSE LLC
# SPDX-License-Identifier: GPL-2.0-or-later
#
# Summary: Test EVM protection using HMACs
# Note: This case should come after 'evm_setup'
# Maintainer: llzhao <llzhao@suse.com>
# Tags: poo#53579
# Maintainer: llzhao <llzhao@suse.com>, rfan1 <richard.fan@suse.com>
# Tags: poo#53579, poo#100694, poo#102311

use base "opensusebasetest";
use base 'opensusebasetest';
use strict;
use warnings;
use testapi;
use utils;
use bootloader_setup "replace_grub_cmdline_settings";
use power_action_utils "power_action";
use bootloader_setup qw(replace_grub_cmdline_settings tianocore_disable_secureboot);
use power_action_utils 'power_action';

sub run {
my ($self) = @_;
Expand Down Expand Up @@ -40,7 +40,10 @@ sub run {

replace_grub_cmdline_settings('evm=fix ima_appraise=fix', '', update_grub => 1);

# We need re-enable the secureboot after removing "ima_appraise=fix" kernel parameter
power_action('reboot', textmode => 1);
$self->wait_grub(bootloader_time => 200);
$self->tianocore_disable_secureboot('re_enable');
$self->wait_boot(textmode => 1);
$self->select_serial_terminal;
my $ret = script_output($sample_cmd, 30, proceed_on_failure => 1);
Expand Down
17 changes: 10 additions & 7 deletions tests/security/ima/evm_setup.pm
View file
Open in desktop
@@ -1,18 +1,18 @@
# Copyright 2019 SUSE LLC
# Copyright 2019-2021 SUSE LLC
# SPDX-License-Identifier: GPL-2.0-or-later
#
# Summary: Setup environment for EVM protection testing
# Note: This case should come after 'ima_setup'
# Maintainer: llzhao <llzhao@suse.com>
# Tags: poo#53579
# Maintainer: llzhao <llzhao@suse.com>, rfan1 <richard.fan@suse.com>
# Tags: poo#53579, poo#100694, poo#102311

use base "opensusebasetest";
use base 'opensusebasetest';
use strict;
use warnings;
use testapi;
use utils;
use bootloader_setup "add_grub_cmdline_settings";
use power_action_utils "power_action";
use bootloader_setup qw(replace_grub_cmdline_settings tianocore_disable_secureboot);
use power_action_utils 'power_action';

sub run {
my ($self) = @_;
Expand All @@ -38,7 +38,10 @@ sub run {

add_grub_cmdline_settings("evm=fix ima_appraise=fix ima_appraise_tcb", update_grub => 1);

power_action('reboot', textmode => 1);
record_info("bsc#1189988: ", "We need disable secureboot with ima fix mode");
power_action("reboot", textmode => 1);
rfan1 marked this conversation as resolved.
Show resolved Hide resolved
$self->wait_grub(bootloader_time => 200);
$self->tianocore_disable_secureboot;
$self->wait_boot(textmode => 1);
$self->select_serial_terminal;

Expand Down
6 changes: 3 additions & 3 deletions tests/security/ima/ima_appraisal_audit.pm
View file
Open in desktop
Expand Up @@ -6,13 +6,13 @@
# Maintainer: llzhao <llzhao@suse.com>
# Tags: poo#49568, poo#92347

use base "opensusebasetest";
use base 'opensusebasetest';
use strict;
use warnings;
use testapi;
use utils;
use bootloader_setup qw(add_grub_cmdline_settings replace_grub_cmdline_settings);
use power_action_utils "power_action";
use power_action_utils 'power_action';

sub audit_verify {
}
Expand Down Expand Up @@ -44,7 +44,7 @@ sub run {

# Test both default(no ima_apprais=) and ima_appraise=log situation
add_grub_cmdline_settings("ima_appraise=log", update_grub => 1);
power_action('reboot', textmode => 1);
power_action("reboot", textmode => 1);
$self->wait_boot(textmode => 1);
$self->select_serial_terminal;

Expand Down
22 changes: 13 additions & 9 deletions tests/security/ima/ima_appraisal_digital_signatures.pm
View file
Open in desktop
Expand Up @@ -2,16 +2,16 @@
# SPDX-License-Identifier: GPL-2.0-or-later
#
# Summary: Test IMA appraisal using digital signatures
# Maintainer: llzhao <llzhao@suse.com>
# Tags: poo#49154, poo#92347
# Maintainer: llzhao <llzhao@suse.com>, rfan1 <richard.fan@suse.com>
# Tags: poo#53579, poo#100694, poo#102311

use base "opensusebasetest";
use base 'opensusebasetest';
use strict;
use warnings;
use testapi;
use utils;
use bootloader_setup qw(add_grub_cmdline_settings replace_grub_cmdline_settings);
use power_action_utils "power_action";
use bootloader_setup qw(add_grub_cmdline_settings replace_grub_cmdline_settings tianocore_disable_secureboot);
use power_action_utils 'power_action';

sub run {
my ($self) = @_;
Expand All @@ -22,12 +22,15 @@ sub run {
my $sample_cmd = 'yes --version';

my $mok_priv = '/root/certs/key.asc';
my $cert_der = "/root/certs/ima_cert.der";
my $mok_pass = "suse";
my $cert_der = '/root/certs/ima_cert.der';
my $mok_pass = 'suse';

add_grub_cmdline_settings("ima_appraise=fix", update_grub => 1);

power_action('reboot', textmode => 1);
# We need re-enable the secureboot after removing "ima_appraise=fix" kernel parameter
power_action("reboot", textmode => 1);
$self->wait_grub(bootloader_time => 200);
$self->tianocore_disable_secureboot;
$self->wait_boot(textmode => 1);
$self->select_serial_terminal;

Expand Down Expand Up @@ -65,9 +68,10 @@ sub run {
replace_grub_cmdline_settings('ima_appraise=fix', '', update_grub => 1);

power_action('reboot', textmode => 1);
$self->wait_grub(bootloader_time => 200);
$self->tianocore_disable_secureboot('re_enable');
$self->wait_boot(textmode => 1);
$self->select_serial_terminal;

assert_script_run "dmesg | grep IMA:.*completed";

# Remove security.ima attribute manually, and verify it is empty
Expand Down