From e8d1a26d9c0920c4d190629e239d94e0edcf11a1 Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Wed, 15 Oct 2025 15:27:54 +0100 Subject: [PATCH 1/3] test: move checks around in TEST-50-DISSECT so that they can be used from multiple subtests Also set it up so that unprivileged tests can be done --- test/units/TEST-50-DISSECT.dissect.sh | 16 ++-------------- test/units/TEST-50-DISSECT.sh | 18 ++++++++++++++++++ 2 files changed, 20 insertions(+), 14 deletions(-) diff --git a/test/units/TEST-50-DISSECT.dissect.sh b/test/units/TEST-50-DISSECT.dissect.sh index d25a4cb02d4..7c0b05881ec 100755 --- a/test/units/TEST-50-DISSECT.dissect.sh +++ b/test/units/TEST-50-DISSECT.dissect.sh @@ -9,18 +9,6 @@ set -o pipefail # shellcheck source=test/units/util.sh . "$(dirname "$0")"/util.sh -# Requires kernel built with certain kconfigs, as listed in README: -# https://oracle.github.io/kconfigs/?config=UTS_RELEASE&config=DM_VERITY_VERIFY_ROOTHASH_SIG&config=DM_VERITY_VERIFY_ROOTHASH_SIG_SECONDARY_KEYRING&config=DM_VERITY_VERIFY_ROOTHASH_SIG_PLATFORM_KEYRING&config=IMA_ARCH_POLICY&config=INTEGRITY_MACHINE_KEYRING -if grep -q "$(openssl x509 -noout -subject -in /usr/share/mkosi.crt | sed 's/^.*CN=//')" /proc/keys && \ - ( . /etc/os-release; [ "$ID" != "centos" ] || systemd-analyze compare-versions "$VERSION_ID" ge 10 ) && \ - ( . /etc/os-release; [ "$ID" != "debian" ] || systemd-analyze compare-versions "$VERSION_ID" ge 13 ) && \ - ( . /etc/os-release; [ "$ID" != "ubuntu" ] || systemd-analyze compare-versions "$VERSION_ID" ge 24.04 ) && \ - systemd-analyze compare-versions "$(cryptsetup --version | sed 's/^cryptsetup \([0-9]*\.[0-9]*\.[0-9]*\) .*/\1/')" ge 2.3.0; then - verity_sig_supported=1 -else - verity_sig_supported=0 -fi - systemd-dissect --json=short "$MINIMAL_IMAGE.raw" | \ grep -q -F '{"rw":"ro","designator":"root","partition_uuid":null,"partition_label":null,"fstype":"squashfs","architecture":null,"verity":"external"' systemd-dissect "$MINIMAL_IMAGE.raw" | grep -q -F "MARKER=1" @@ -84,7 +72,7 @@ if [[ "$verity_count" -lt 1 ]]; then exit 1 fi # Ensure the kernel is verifying the signature if the mkosi key is in the keyring -if [ "$verity_sig_supported" -eq 1 ]; then +if [ "$VERITY_SIG_SUPPORTED" -eq 1 ]; then veritysetup status "$(cat "$MINIMAL_IMAGE.roothash")-verity" | grep -q "verified (with signature)" fi systemd-dissect --umount "$IMAGE_DIR/mount" @@ -746,7 +734,7 @@ EOF systemctl start testservice-50k.service systemctl is-active testservice-50k.service # Ensure the kernel is verifying the signature if the mkosi key is in the keyring -if [ "$verity_sig_supported" -eq 1 ]; then +if [ "$VERITY_SIG_SUPPORTED" -eq 1 ]; then veritysetup status "$(cat "$MINIMAL_IMAGE.roothash")-verity" | grep -q "verified (with signature)" fi # First reload should pick up the v1 marker diff --git a/test/units/TEST-50-DISSECT.sh b/test/units/TEST-50-DISSECT.sh index 0efea0fc180..033c818c880 100755 --- a/test/units/TEST-50-DISSECT.sh +++ b/test/units/TEST-50-DISSECT.sh @@ -25,10 +25,27 @@ at_exit() { done < <(find "${IMAGE_DIR}" -mindepth 1 -maxdepth 1 -type d) rm -rf "$IMAGE_DIR" + + loginctl disable-linger testuser } trap at_exit EXIT +# For unprivileged tests +loginctl enable-linger testuser + +# Requires kernel built with certain kconfigs, as listed in README: +# https://oracle.github.io/kconfigs/?config=UTS_RELEASE&config=DM_VERITY_VERIFY_ROOTHASH_SIG&config=DM_VERITY_VERIFY_ROOTHASH_SIG_SECONDARY_KEYRING&config=DM_VERITY_VERIFY_ROOTHASH_SIG_PLATFORM_KEYRING&config=IMA_ARCH_POLICY&config=INTEGRITY_MACHINE_KEYRING +if grep -q "$(openssl x509 -noout -subject -in /usr/share/mkosi.crt | sed 's/^.*CN=//')" /proc/keys && \ + ( . /etc/os-release; [ "$ID" != "centos" ] || systemd-analyze compare-versions "$VERSION_ID" ge 10 ) && \ + ( . /etc/os-release; [ "$ID" != "debian" ] || systemd-analyze compare-versions "$VERSION_ID" ge 13 ) && \ + ( . /etc/os-release; [ "$ID" != "ubuntu" ] || systemd-analyze compare-versions "$VERSION_ID" ge 24.04 ) && \ + systemd-analyze compare-versions "$(cryptsetup --version | sed 's/^cryptsetup \([0-9]*\.[0-9]*\.[0-9]*\) .*/\1/')" ge 2.3.0; then + export VERITY_SIG_SUPPORTED=1 +else + export VERITY_SIG_SUPPORTED=0 +fi + : "Setup base images" export SYSTEMD_LOG_LEVEL=debug @@ -102,6 +119,7 @@ fi udevadm control --log-level=debug IMAGE_DIR="$(mktemp -d --tmpdir="" TEST-50-IMAGES.XXX)" +chmod go+rx "$IMAGE_DIR" cp -v /usr/share/minimal* "$IMAGE_DIR/" MINIMAL_IMAGE="$IMAGE_DIR/minimal_0" MINIMAL_IMAGE_ROOTHASH="$(<"$MINIMAL_IMAGE.roothash")" From dc88805d16f9ca28deb061322bcab1bc52e5f0a0 Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Wed, 15 Oct 2025 18:46:00 +0100 Subject: [PATCH 2/3] test: also test verity signatures on debian testing/unstable debian testing/unstable do not set VERSION_ID, so if missing, assume it's testing/unstable which are new enough --- test/units/TEST-50-DISSECT.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/units/TEST-50-DISSECT.sh b/test/units/TEST-50-DISSECT.sh index 033c818c880..b42aa6e7b32 100755 --- a/test/units/TEST-50-DISSECT.sh +++ b/test/units/TEST-50-DISSECT.sh @@ -38,7 +38,7 @@ loginctl enable-linger testuser # https://oracle.github.io/kconfigs/?config=UTS_RELEASE&config=DM_VERITY_VERIFY_ROOTHASH_SIG&config=DM_VERITY_VERIFY_ROOTHASH_SIG_SECONDARY_KEYRING&config=DM_VERITY_VERIFY_ROOTHASH_SIG_PLATFORM_KEYRING&config=IMA_ARCH_POLICY&config=INTEGRITY_MACHINE_KEYRING if grep -q "$(openssl x509 -noout -subject -in /usr/share/mkosi.crt | sed 's/^.*CN=//')" /proc/keys && \ ( . /etc/os-release; [ "$ID" != "centos" ] || systemd-analyze compare-versions "$VERSION_ID" ge 10 ) && \ - ( . /etc/os-release; [ "$ID" != "debian" ] || systemd-analyze compare-versions "$VERSION_ID" ge 13 ) && \ + ( . /etc/os-release; [ "$ID" != "debian" ] || [ -z "${VERSION_ID:-}" ] || systemd-analyze compare-versions "$VERSION_ID" ge 13 ) && \ ( . /etc/os-release; [ "$ID" != "ubuntu" ] || systemd-analyze compare-versions "$VERSION_ID" ge 24.04 ) && \ systemd-analyze compare-versions "$(cryptsetup --version | sed 's/^cryptsetup \([0-9]*\.[0-9]*\.[0-9]*\) .*/\1/')" ge 2.3.0; then export VERITY_SIG_SUPPORTED=1 From c581bc8ad810a7e84952791ec644c569c30bbc56 Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Wed, 15 Oct 2025 18:46:26 +0100 Subject: [PATCH 3/3] test: sign extension images used by TEST-50-DISSECT --- test/units/util.sh | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/test/units/util.sh b/test/units/util.sh index 5264e65dee7..d07364922f2 100755 --- a/test/units/util.sh +++ b/test/units/util.sh @@ -323,6 +323,13 @@ EOF echo MARKER=1 >"$initdir/usr/lib/systemd/system/some_file" mksquashfs "$initdir" /tmp/app0.raw -noappend veritysetup format /tmp/app0.raw /tmp/app0.verity --root-hash-file /tmp/app0.roothash + openssl smime -sign -nocerts -noattr -binary \ + -in /tmp/app0.roothash \ + -inkey /usr/share/mkosi.key \ + -signer /usr/share/mkosi.crt \ + -outform der \ + -out /tmp/app0.roothash.p7s + chmod go+r /tmp/app0* initdir="/var/tmp/conf0" mkdir -p "$initdir/etc/extension-release.d" "$initdir/etc/systemd/system" "$initdir/opt" @@ -335,6 +342,13 @@ EOF echo MARKER_1 >"$initdir/etc/systemd/system/some_file" mksquashfs "$initdir" /tmp/conf0.raw -noappend veritysetup format /tmp/conf0.raw /tmp/conf0.verity --root-hash-file /tmp/conf0.roothash + openssl smime -sign -nocerts -noattr -binary \ + -in /tmp/conf0.roothash \ + -inkey /usr/share/mkosi.key \ + -signer /usr/share/mkosi.crt \ + -outform der \ + -out /tmp/conf0.roothash.p7s + chmod go+r /tmp/conf0* initdir="/var/tmp/app1" mkdir -p "$initdir/usr/lib/extension-release.d" "$initdir/usr/lib/systemd/system" "$initdir/opt"