[ima-evm-utils,v4,00/11] Support testing in new enviroments

Message

Roberto Sassu Jan. 26, 2023, 1:57 p.m. UTC

From: Roberto Sassu <[e-mail]>

One of the main limitations of running tests in the current environment is
that features/bug fixes to be tested need to be already included in the
running kernel, which is not always the case.

User Mode Linux (UML) and virtual machines can be used to overcome this
limitation. They allow to create a new environment and run a custom kernel
built by a CI or by the user. The tests can then check the features/bug
fixes of the custom kernel.

Running tests in a new environment also gives the ability to control the
configuration, and to have a clean state for each test by creating new
environments as necessary. The current environment might not allow that,
e.g. for security reasons.

Introduce a mechanism for creating and managing new environments. Expose an
API that allow to transparently create one or multiple environments in a
test script, and to reexecute that script in the new one. Using that API
requires minimal changes to the existing scripts.

The API is generic enough to support different types of enviroments. The
environment can be selected with the TST_ENV environment variable. At the
moment, only UML is supported. QEMU will be added at a later stage.

With the ability to test custom kernels, ima-evm-utils might introduce
specific tests for that, separated from the tests to verify the
ima-evm-utils user space functionality. At the moment, there is no such
distinction, existing tests verify both.

First, fix error messages and a variable in evmctl. Then, add kernel
configuration options for the tests, to be merged with the default
configuration. Add a new job in the Github workflow to build the UML kernel
from a repository and branch specified in the LINUX_URL and LINUX_BRANCH
variables (if the kernel repository does not have a branch with the same
name of the ima-evm-utils one). Per Github documentation, these variables
can be defined at organization, repository and environment level.

Return the correct script exit code if no test was executed. Introduce the
new API for creating and managing new enviroments, for existing and new
test scripts. If TST_ENV is not set, calling the API results in a nop, and
tests are executed in the current environment.

Add the possibility to select individual tests to run in a test script,
with the TST_LIST variable, so that a new environment can be created
multiple times for a subset of tests (useful if for example a test require
kernel settings different from the previous test).

Add tests for EVM portable signatures and modify fsverity.test to use the
new API.

Finally, don't require making changes to the system to run fsverity.test,
install a software dependency after the appropriate repository has been
set up, and temporarily remove CONFIG_DEBUG_SG to avoid a kernel panic
until the patches to fix it are accepted in the upstream kernel.

Changelog

v3:
 - Split config-uml in multiple parts (suggested by Mimi) and move them to
   kernel-configs/
 - Tune the kernel configuration to avoid building unnecessary drivers for
   kernels to be run in virtual machines
 - Fix style issues in functions.sh (suggested by Stefan)
 - Fix environment shutdown logic
 - Declare variables used inside the tests in
   tests/portable_signatures.test as local (suggested by Stefan)

v2:
 - Compile everything built-in for the UML kernel in Github Actions
 - Replace UML_MODE with TST_ENV, introduce TST_KERNEL to specify the path
   of the kernel to run
 - Temporarily disable CONFIG_DEBUG_SG (patch by Mimi)
 - Rename mdlen and hash variable respectively to siglen and sig (suggested
   by Stefan)
 - Always use _report_exit_and_cleanup() as trap function and pass the
   cleanup function as argument
 - Rename _run_user_mode(), _exit_user_mode(), _init_user_mode(),
   _cleanup_user_mode() respectively to _run_env(), _exit_env(),
   _init_env() and _cleanup_env()
 - Fix style issues in tests/functions.sh and
   tests/portable_signatures.test (suggested by Stefan)
 - Get the script exit code in _report_exit_and_cleanup() and return that
   if no test was executed
 - Mount tmpfs in the new environment, to avoid interference with the host
 - Don't delete fsverity-utils and mount-idmapped directories so that the
   built binaries are available for use without installing them (suggested
   by Stefan)
 - Rename global variables in tests/portable_signatures.test to avoid
   collisions (suggested by Stefan)
 - Declare the 'format' variable as local in get_xattr() in
   tests/portable_signatures.test (suggested by Stefan)
 - Print a message in tests/portable_signatures.test when the
   mount-idmapped binary is found
 - Check more paths for the private key in tests/portable_signatures.test
   (suggested by Mimi)
 - Increase the memory allocation for the UML kernel to 2048M to satisfy
   requests to mount tmpfs

v1:
 - Use Github vars context instead of secrets (suggested by Mimi)
 - Define default values of LINUX_URL and LINUX_BRANCH in case they are not
   provided (suggested by Mimi)
 - Pull source code with depth 1 instead of 5, as it is not necessary now
 - Run 'make ARCH=um olddefconfig' before merging test-specific options in
   config-uml
 - Install haveged for CentOS 8 after the EPEL repository is configured
   (patch by Mimi)

Mimi Zohar (2):
  ci: haveged requires EPEL on CentOS stream:8
  Temporarily remove CONFIG_DEBUG_SG to test portable signatures

Roberto Sassu (9):
  Fix error messages and vars in calc_evm_hmac()
  Add kernel configuration for tests
  Compile the UML kernel and download it in Github Actions
  Pass cleanup function and its arguments to _report_exit_and_cleanup()
  Add support for creating a new testing environment in functions.sh
  Introduce TST_LIST variable to select a test to execute
  Add tests for EVM portable signatures
  Adapt fsverity.test to be able to run in a new testing environment
  Use in-place built fsverity binary instead of installing it

 .github/workflows/ci.yml        |   99 ++-
 build.sh                        |    5 +
 ci/fedora.sh                    |   12 +-
 kernel-configs/base             |  213 ++++++
 kernel-configs/integrity        |   29 +
 src/evmctl.c                    |   14 +-
 tests/Makefile.am               |    2 +-
 tests/boot_aggregate.test       |    2 +-
 tests/fsverity.test             |   14 +-
 tests/functions.sh              |  113 +++-
 tests/install-fsverity.sh       |    3 +-
 tests/install-mount-idmapped.sh |    6 +
 tests/portable_signatures.test  | 1122 +++++++++++++++++++++++++++++++
 13 files changed, 1615 insertions(+), 19 deletions(-)
 create mode 100644 kernel-configs/base
 create mode 100644 kernel-configs/integrity
 create mode 100755 tests/install-mount-idmapped.sh
 create mode 100755 tests/portable_signatures.test