Skip to content

Commit 4dbd123

Browse files
evgenyzevgenyz
committed
tests/probes/fwupdsecattr: Add tests
Add 2 tests: A test that would try and use real fwupd service D-Bus API if present with a HW-neutral kernel-related parameter. A test that would use a mock of the fwupd service for edge cases.
1 parent cb53632 commit 4dbd123

8 files changed

+260
-3
lines changed

‎tests/probes/CMakeLists.txt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ add_subdirectory("fileextendedattribute")
66
add_subdirectory("filehash")
77
add_subdirectory("filehash58")
88
add_subdirectory("filemd5")
9+
add_subdirectory("fwupdsecattr")
910
add_subdirectory("iflisteners")
1011
add_subdirectory("interface")
1112
add_subdirectory("isainfo")

‎tests/probes/fwupdsecattr/CMakeLists.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
if(ENABLE_PROBES_LINUX)
2+
if(DBUS_FOUND)
3+
add_oscap_test("test_probes_fwupdsecattr.sh")
4+
add_oscap_test("test_probes_fwupdsecattr_mock.sh")
5+
endif()
6+
endif()
7+

‎tests/probes/fwupdsecattr/org.freedesktop.fwupd.py

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# This is a template for D-Bus mock
2+
# see init_dbus_mock() from test_common.sh.
3+
# The Exit() method is expected by
4+
# clean_dbus_mock() from the same file.
5+
6+
__author__ = 'Evgenii Kolesnikov'
7+
__copyright__ = '''
8+
(c) 2023 Red Hat Inc.
9+
'''
10+
11+
import dbus
12+
13+
14+
BUS_NAME = 'org.freedesktop.fwupd'
15+
MAIN_OBJ = '/'
16+
MAIN_IFACE = 'org.freedesktop.fwupd'
17+
SYSTEM_BUS = False
18+
19+
20+
def load(mock, _parameters):
21+
mock.AddMethods(MAIN_IFACE, [
22+
('GetHostSecurityAttrs', '', 'aa{sv}', 'ret = self.SecurityAattrs'),
23+
('Exit', '', '', 'sys.exit()'),
24+
])
25+
26+
mock.SecurityAattrs = [
27+
{
28+
'AppstreamId': 'org.fwupd.hsi.Kernel.Lockdown', 'HsiResult': dbus.UInt32(2)
29+
},
30+
{
31+
'AppstreamId': 'org.fwupd.hsi.Kernel.InvalidStatus', 'HsiResult': dbus.UInt32(200)
32+
}
33+
]

‎tests/probes/fwupdsecattr/test_probes_fwupdsecattr.sh

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
#!/usr/bin/env bash
2+
3+
. $builddir/tests/test_common.sh
4+
5+
set -e -o pipefail
6+
7+
function test_probes_fwupdsecattr {
8+
9+
probecheck "fwupdsecattr" || return 255
10+
require_dbus "system" "org.freedesktop.fwupd" "/" || return 255
11+
12+
# Check if org.freedesktop.fwupd.GetHostSecurityAttrs method
13+
# is supported (it might fail, e.g. in hypervisor env).
14+
gdbus call --system -d org.freedesktop.fwupd -o / \
15+
-m org.freedesktop.fwupd.GetHostSecurityAttrs >/dev/null || return 255
16+
17+
local ret_val=0
18+
local DF="${srcdir}/test_probes_fwupdsecattr.xml"
19+
local RF="results.xml"
20+
21+
[ -f $RF ] && rm -f $RF
22+
23+
$OSCAP oval eval --results $RF $DF
24+
25+
if [ -f $RF ]; then
26+
verify_results "def" $DF $RF 1 && verify_results "tst" $DF $RF 1
27+
ret_val=$?
28+
else
29+
ret_val=1
30+
fi
31+
32+
return $ret_val
33+
}
34+
35+
test_probes_fwupdsecattr

‎tests/probes/fwupdsecattr/test_probes_fwupdsecattr.xml

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
<?xml version="1.0"?>
2+
<oval_definitions xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" xmlns:unix-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" xmlns:lin-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd">
3+
4+
<generator>
5+
<oval:product_name>fwupdsecattr</oval:product_name>
6+
<oval:product_version>1.0</oval:product_version>
7+
<oval:schema_version>5.11.3</oval:schema_version>
8+
<oval:timestamp>2020-02-13T00:00:00-00:00</oval:timestamp>
9+
</generator>
10+
11+
<definitions>
12+
13+
<definition class="compliance" id="oval:0:def:1" version="1"> <!-- comment="true" -->
14+
<metadata>
15+
<title>Kernel Lockdown</title>
16+
<description>Kernel lockdown is an important mechanism to limit what hardware actions userspace programs can perform.</description>
17+
</metadata>
18+
<criteria operator="AND">
19+
<criterion comment="Kernel Lockdown" test_ref="oval:0:tst:1" />
20+
</criteria>
21+
</definition>
22+
23+
</definitions>
24+
25+
<tests>
26+
27+
<lin-def:fwupdsecattr_test check="at least one" id="oval:0:tst:1" version="1" comment="true">
28+
<lin-def:object object_ref="oval:0:obj:1" />
29+
<lin-def:state state_ref="oval:0:ste:1" />
30+
</lin-def:fwupdsecattr_test>
31+
32+
</tests>
33+
34+
<objects>
35+
36+
<lin-def:fwupdsecattr_object id="oval:0:obj:1" version="1">
37+
<lin-def:stream_id datatype="string">org.fwupd.hsi.Kernel.Lockdown</lin-def:stream_id>
38+
</lin-def:fwupdsecattr_object>
39+
40+
</objects>
41+
42+
<states>
43+
44+
<lin-def:fwupdsecattr_state id="oval:0:ste:1" version="1">
45+
<lin-def:security_attr datatype="string" operation="pattern match">not-valid|not-enabled</lin-def:security_attr>
46+
</lin-def:fwupdsecattr_state>
47+
48+
</states>
49+
50+
</oval_definitions>

‎tests/probes/fwupdsecattr/test_probes_fwupdsecattr_mock.sh

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
#!/usr/bin/env bash
2+
3+
. $builddir/tests/test_common.sh
4+
5+
set -e -o pipefail
6+
7+
function test_probes_fwupdsecattr {
8+
9+
probecheck "fwupdsecattr" || return 255
10+
11+
local ret_val=0
12+
local DF="${srcdir}/test_probes_fwupdsecattr_mock.xml"
13+
local RF="results.xml"
14+
local DBUS_MOCK_NAME="org.freedesktop.fwupd"
15+
local stderr=$(mktemp test_probes_fwupdsecattr_mock.err.XXXXXX)
16+
echo "stderr file: $stderr"
17+
18+
[ -f $RF ] && rm -f $RF
19+
20+
init_dbus_mock $DBUS_MOCK_NAME
21+
$OSCAP oval eval --results $RF $DF 2>$stderr
22+
clean_dbus_mock $DBUS_MOCK_NAME
23+
24+
if [ -f $RF ]; then
25+
verify_results "def" $DF $RF 1 && verify_results "tst" $DF $RF 1
26+
ret_val=$?
27+
else
28+
ret_val=1
29+
fi
30+
31+
grep -iq "HSI key not found: org.fwupd.hsi.Kernel.InvalidOrNonExisting" $stderr || {
32+
ret_val=2
33+
echo "Expected warning 'HSI key not found: org.fwupd.hsi.Kernel.InvalidOrNonExisting' is missing!"
34+
}
35+
36+
grep -iq "Unknown/invalid FwupdSecurityAttrResult value: 200" $stderr || {
37+
ret_val=2
38+
echo "Expected warning 'Unknown/invalid FwupdSecurityAttrResult value: 200' is missing!"
39+
}
40+
41+
return $ret_val
42+
}
43+
44+
test_probes_fwupdsecattr

‎tests/probes/fwupdsecattr/test_probes_fwupdsecattr_mock.xml

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
<?xml version="1.0"?>
2+
<oval_definitions xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" xmlns:unix-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" xmlns:lin-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd">
3+
4+
<generator>
5+
<oval:product_name>fwupdsecattr</oval:product_name>
6+
<oval:product_version>1.0</oval:product_version>
7+
<oval:schema_version>5.11.3</oval:schema_version>
8+
<oval:timestamp>2020-02-13T00:00:00-00:00</oval:timestamp>
9+
</generator>
10+
11+
<definitions>
12+
13+
<definition class="compliance" id="oval:0:def:1" version="1"> <!-- comment="true" -->
14+
<metadata>
15+
<title>Kernel Lockdown</title>
16+
<description>Kernel lockdown is an important mechanism to limit what hardware actions userspace programs can perform.</description>
17+
</metadata>
18+
<criteria operator="AND">
19+
<criterion comment="Kernel Lockdown" test_ref="oval:0:tst:1" />
20+
<criterion comment="Invalid Status" test_ref="oval:0:tst:11" />
21+
</criteria>
22+
</definition>
23+
24+
<definition class="compliance" id="oval:0:def:2" version="1"> <!-- comment="unknown" -->
25+
<metadata>
26+
<title>Unknown</title>
27+
<description></description>
28+
</metadata>
29+
<criteria operator="AND">
30+
<criterion comment="Invalid" test_ref="oval:0:tst:2" />
31+
</criteria>
32+
</definition>
33+
34+
</definitions>
35+
36+
<tests>
37+
38+
<lin-def:fwupdsecattr_test check="at least one" id="oval:0:tst:1" version="1" comment="true">
39+
<lin-def:object object_ref="oval:0:obj:1" />
40+
<lin-def:state state_ref="oval:0:ste:1" />
41+
</lin-def:fwupdsecattr_test>
42+
43+
<lin-def:fwupdsecattr_test check="at least one" id="oval:0:tst:11" version="1" comment="true">
44+
<lin-def:object object_ref="oval:0:obj:11" />
45+
<lin-def:state state_ref="oval:0:ste:11" />
46+
</lin-def:fwupdsecattr_test>
47+
48+
<lin-def:fwupdsecattr_test check="at least one" id="oval:0:tst:2" version="1" comment="unknown">
49+
<lin-def:object object_ref="oval:0:obj:2" />
50+
<lin-def:state state_ref="oval:0:ste:2" />
51+
</lin-def:fwupdsecattr_test>
52+
53+
</tests>
54+
55+
<objects>
56+
57+
<lin-def:fwupdsecattr_object id="oval:0:obj:1" version="1">
58+
<lin-def:stream_id datatype="string">org.fwupd.hsi.Kernel.Lockdown</lin-def:stream_id>
59+
</lin-def:fwupdsecattr_object>
60+
61+
<lin-def:fwupdsecattr_object id="oval:0:obj:11" version="1">
62+
<lin-def:stream_id datatype="string">org.fwupd.hsi.Kernel.InvalidStatus</lin-def:stream_id>
63+
</lin-def:fwupdsecattr_object>
64+
65+
<lin-def:fwupdsecattr_object id="oval:0:obj:2" version="1">
66+
<lin-def:stream_id datatype="string">org.fwupd.hsi.Kernel.InvalidOrNonExisting</lin-def:stream_id>
67+
</lin-def:fwupdsecattr_object>
68+
69+
</objects>
70+
71+
<states>
72+
73+
<lin-def:fwupdsecattr_state id="oval:0:ste:1" version="1">
74+
<lin-def:security_attr datatype="string" operation="pattern match">not-enabled</lin-def:security_attr>
75+
</lin-def:fwupdsecattr_state>
76+
77+
<lin-def:fwupdsecattr_state id="oval:0:ste:11" version="1">
78+
<lin-def:security_attr datatype="string" operation="pattern match">invalid-hsi-result</lin-def:security_attr>
79+
</lin-def:fwupdsecattr_state>
80+
81+
<lin-def:fwupdsecattr_state id="oval:0:ste:2" version="1">
82+
<lin-def:security_attr datatype="string" operation="pattern match">not-found</lin-def:security_attr>
83+
</lin-def:fwupdsecattr_state>
84+
85+
</states>
86+
87+
</oval_definitions>

‎tests/test_common.sh.in

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -127,7 +127,7 @@ function require {
127127
# Check if Python module is available. For example:
128128
# require_python_module 'dbusmock' || return 255
129129
function require_python_module {
130-
eval "python -c \"import $1\" >/dev/null 2>&1"
130+
eval "python3 -c \"import $1\" >/dev/null 2>&1"
131131
if [ $? -gt 0 ]; then
132132
echo -e "No '$1' Python module found!\n"
133133
return 255 # Test is not applicable.
@@ -368,7 +368,7 @@ init_dbus_mock() {
368368
require_python_module "dbusmock" || return 255
369369
require "gdbus" || return 255
370370
printf "%s\n" "Initializing D-Bus mock from template: $1.py"
371-
python -m dbusmock --template "${srcdir}/$1.py" & disown
371+
python3 -m dbusmock --template "${srcdir}/$1.py" & disown
372372
# We have to replace system bus address because mock D-Bus
373373
# endpoint is created inside the user session
374374
export DBUS_SYSTEM_BUS_ADDRESS=$DBUS_SESSION_BUS_ADDRESS
@@ -379,7 +379,7 @@ init_dbus_mock() {
379379
clean_dbus_mock() {
380380
require "gdbus" || return 255
381381
printf "%s\n" "Shutting down D-Bus mock: $1"
382-
gdbus call --session -d "$1" -o / -m "$1.Exit" || true
382+
gdbus call --session -d "$1" -o / -m "$1.Exit" >/dev/null 2>&1 || true
383383
}
384384

385385
export -f assert_exists

0 commit comments

Comments
 (0)