From: Roberto Sassu <roberto.sassu@xxxxxxxxxx> One of the main limitations of running tests in the current environment is that features/bug fixes to be tested need to be already included in the running kernel, which is not always the case. User Mode Linux (UML) and virtual machines can be used to overcome this limitation. They allow to create a new environment and run a custom kernel built by a CI or by the user. The tests can then check the features/bug fixes of the custom kernel. Running tests in a new environment also gives the ability to control the configuration, and to have a clean state for each test by creating new environments as necessary. The current environment might not allow that, e.g. for security reasons. Introduce a mechanism for creating and managing new environments. Expose an API that allow to transparently create one or multiple environments in a test script, and to reexecute that script in the new one. Using that API requires minimal changes to the existing scripts. The API is generic enough to support different types of enviroments. The environment can be selected with the TST_ENV environment variable. At the moment, only UML is supported. QEMU will be added at a later stage. With the ability to test custom kernels, ima-evm-utils might introduce specific tests for that, separated from the tests to verify the ima-evm-utils user space functionality. At the moment, there is no such distinction, existing tests verify both. First, fix error messages and a variable in evmctl. Then, add kernel configuration options for the tests, to be merged with the default configuration. Add a new job in the Github workflow to build the UML kernel from a repository and branch specified in the LINUX_URL and LINUX_BRANCH variables (if the kernel repository does not have a branch with the same name of the ima-evm-utils one). Per Github documentation, these variables can be defined at organization, repository and environment level. Return the correct script exit code if no test was executed. Introduce the new API for creating and managing new enviroments, for existing and new test scripts. If TST_ENV is not set, calling the API results in a nop, and tests are executed in the current environment. Add the possibility to select individual tests to run in a test script, with the TST_LIST variable, so that a new environment can be created multiple times for a subset of tests (useful if for example a test require kernel settings different from the previous test). Add tests for EVM portable signatures and modify fsverity.test to use the new API. Finally, don't require making changes to the system to run fsverity.test, install a software dependency after the appropriate repository has been set up, and temporarily remove CONFIG_DEBUG_SG to avoid a kernel panic until the patches to fix it are accepted in the upstream kernel. Changelog v3: - Split config-uml in multiple parts (suggested by Mimi) and move them to kernel-configs/ - Tune the kernel configuration to avoid building unnecessary drivers for kernels to be run in virtual machines - Fix style issues in functions.sh (suggested by Stefan) - Fix environment shutdown logic - Declare variables used inside the tests in tests/portable_signatures.test as local (suggested by Stefan) v2: - Compile everything built-in for the UML kernel in Github Actions - Replace UML_MODE with TST_ENV, introduce TST_KERNEL to specify the path of the kernel to run - Temporarily disable CONFIG_DEBUG_SG (patch by Mimi) - Rename mdlen and hash variable respectively to siglen and sig (suggested by Stefan) - Always use _report_exit_and_cleanup() as trap function and pass the cleanup function as argument - Rename _run_user_mode(), _exit_user_mode(), _init_user_mode(), _cleanup_user_mode() respectively to _run_env(), _exit_env(), _init_env() and _cleanup_env() - Fix style issues in tests/functions.sh and tests/portable_signatures.test (suggested by Stefan) - Get the script exit code in _report_exit_and_cleanup() and return that if no test was executed - Mount tmpfs in the new environment, to avoid interference with the host - Don't delete fsverity-utils and mount-idmapped directories so that the built binaries are available for use without installing them (suggested by Stefan) - Rename global variables in tests/portable_signatures.test to avoid collisions (suggested by Stefan) - Declare the 'format' variable as local in get_xattr() in tests/portable_signatures.test (suggested by Stefan) - Print a message in tests/portable_signatures.test when the mount-idmapped binary is found - Check more paths for the private key in tests/portable_signatures.test (suggested by Mimi) - Increase the memory allocation for the UML kernel to 2048M to satisfy requests to mount tmpfs v1: - Use Github vars context instead of secrets (suggested by Mimi) - Define default values of LINUX_URL and LINUX_BRANCH in case they are not provided (suggested by Mimi) - Pull source code with depth 1 instead of 5, as it is not necessary now - Run 'make ARCH=um olddefconfig' before merging test-specific options in config-uml - Install haveged for CentOS 8 after the EPEL repository is configured (patch by Mimi) Mimi Zohar (2): ci: haveged requires EPEL on CentOS stream:8 Temporarily remove CONFIG_DEBUG_SG to test portable signatures Roberto Sassu (9): Fix error messages and vars in calc_evm_hmac() Add kernel configuration for tests Compile the UML kernel and download it in Github Actions Pass cleanup function and its arguments to _report_exit_and_cleanup() Add support for creating a new testing environment in functions.sh Introduce TST_LIST variable to select a test to execute Add tests for EVM portable signatures Adapt fsverity.test to be able to run in a new testing environment Use in-place built fsverity binary instead of installing it .github/workflows/ci.yml | 99 ++- build.sh | 5 + ci/fedora.sh | 12 +- kernel-configs/base | 213 ++++++ kernel-configs/integrity | 29 + src/evmctl.c | 14 +- tests/Makefile.am | 2 +- tests/boot_aggregate.test | 2 +- tests/fsverity.test | 14 +- tests/functions.sh | 113 +++- tests/install-fsverity.sh | 3 +- tests/install-mount-idmapped.sh | 6 + tests/portable_signatures.test | 1122 +++++++++++++++++++++++++++++++ 13 files changed, 1615 insertions(+), 19 deletions(-) create mode 100644 kernel-configs/base create mode 100644 kernel-configs/integrity create mode 100755 tests/install-mount-idmapped.sh create mode 100755 tests/portable_signatures.test -- 2.25.1
