Skip to content

Commit a6d6753

Browse files
jan-cernyjan-cerny
authored
Merge pull request #1944 from evgenyz/add_fwupd_test
Add fwupd probe test and some fixes
2 parents 9b53a55 + 20aca52 commit a6d6753

15 files changed

+366
-35
lines changed

‎.github/workflows/build.yml

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ jobs:
3434
- name: Install Deps
3535
run: |
3636
sudo apt-get update
37-
sudo apt-get -y install lcov swig xsltproc rpm-common lua5.3 libyaml-dev libapt-pkg-dev libdbus-1-dev libdbus-glib-1-dev libcurl4-openssl-dev libgcrypt-dev libselinux1-dev libgconf2-dev libacl1-dev libblkid-dev libcap-dev libxml2-dev libxslt1-dev libxml-parser-perl libxml-xpath-perl libperl-dev librpm-dev librtmp-dev libxmlsec1-dev libxmlsec1-openssl
37+
sudo apt-get -y install lcov swig xsltproc rpm-common lua5.3 libyaml-dev libapt-pkg-dev libdbus-1-dev libdbus-glib-1-dev libcurl4-openssl-dev libgcrypt-dev libselinux1-dev libgconf2-dev libacl1-dev libblkid-dev libcap-dev libxml2-dev libxslt1-dev libxml-parser-perl libxml-xpath-perl libperl-dev librpm-dev librtmp-dev libxmlsec1-dev libxmlsec1-openssl python3-dbusmock
3838
sudo apt-get -y remove rpm
3939
4040
# Runs a set of commands using the runners shell
@@ -47,6 +47,7 @@ jobs:
4747
- name: Test
4848
working-directory: ./build
4949
run: |
50+
export $(dbus-launch)
5051
ctest --output-on-failure
5152
5253
build-fedora:
@@ -56,7 +57,7 @@ jobs:
5657
image: fedora:latest
5758
steps:
5859
- name: Install Deps
59-
run: dnf install -y cmake git dbus-devel GConf2-devel libacl-devel libblkid-devel libcap-devel libcurl-devel libgcrypt-devel libselinux-devel libxml2-devel libxslt-devel libattr-devel make openldap-devel pcre-devel perl-XML-Parser perl-XML-XPath perl-devel python3-devel rpm-devel swig bzip2-devel gcc-c++ libyaml-devel xmlsec1-devel xmlsec1-openssl-devel hostname bzip2 lua rpm-build which strace
60+
run: dnf install -y cmake git dbus-devel GConf2-devel libacl-devel libblkid-devel libcap-devel libcurl-devel libgcrypt-devel libselinux-devel libxml2-devel libxslt-devel libattr-devel make openldap-devel pcre-devel perl-XML-Parser perl-XML-XPath perl-devel python3-devel python3-dbusmock rpm-devel swig bzip2-devel gcc-c++ libyaml-devel xmlsec1-devel xmlsec1-openssl-devel hostname bzip2 lua rpm-build which strace
6061
- name: Checkout
6162
uses: actions/checkout@v3
6263
with:
@@ -69,6 +70,7 @@ jobs:
6970
- name: Test
7071
working-directory: ./build
7172
run: |
73+
export $(dbus-launch)
7274
ctest --output-on-failure
7375
7476
build-macos:

‎.github/workflows/codeql.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ jobs:
3232
- name: Install Deps
3333
run: |
3434
sudo apt-get update
35-
sudo apt-get -y install lcov swig xsltproc rpm-common lua5.3 libyaml-dev libapt-pkg-dev libdbus-1-dev libdbus-glib-1-dev libcurl4-openssl-dev libgcrypt-dev libselinux1-dev libgconf2-dev libacl1-dev libblkid-dev libcap-dev libxml2-dev libxslt1-dev libxml-parser-perl libxml-xpath-perl libperl-dev librpm-dev librtmp-dev libxmlsec1-dev libxmlsec1-openssl
35+
sudo apt-get -y install lcov swig xsltproc rpm-common lua5.3 libyaml-dev libapt-pkg-dev libdbus-1-dev libdbus-glib-1-dev libcurl4-openssl-dev libgcrypt-dev libselinux1-dev libgconf2-dev libacl1-dev libblkid-dev libcap-dev libxml2-dev libxslt1-dev libxml-parser-perl libxml-xpath-perl libperl-dev librpm-dev librtmp-dev libxmlsec1-dev libxmlsec1-openssl python3-dbusmock
3636
sudo apt-get -y remove rpm
3737
3838
# Initializes the CodeQL tools for scanning.

‎docs/developer/developer.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@ On Fedora 24+, the command to install the build dependencies is:
6565
sudo yum install \
6666
cmake dbus-devel GConf2-devel libacl-devel libblkid-devel libcap-devel libcurl-devel \
6767
libgcrypt-devel libselinux-devel libxml2-devel libxslt-devel libattr-devel make openldap-devel \
68-
pcre-devel perl-XML-Parser perl-XML-XPath perl-devel python3-devel rpm-devel swig \
68+
pcre-devel perl-XML-Parser perl-XML-XPath perl-devel python3-devel python3-dbusmock rpm-devel swig \
6969
bzip2-devel gcc-c++ libyaml-devel xmlsec1-devel xmlsec1-openssl-devel
7070
----
7171

‎openscap.spec

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ BuildRequires: systemd
3131
%if %{?_with_check:1}%{!?_with_check:0}
3232
BuildRequires: perl-XML-XPath
3333
BuildRequires: bzip2
34+
BuildRequires: python3-dbusmock
3435
%endif
3536
Requires: bash
3637
Requires: bzip2-libs

‎schemas/oval/5.11.3/linux-definitions-schema.xsd

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2508,7 +2508,6 @@
25082508
</xsd:complexContent>
25092509
</xsd:complexType>
25102510
</xsd:element>
2511-
25122511
<!-- =============================================================== -->
25132512
<!-- ================= FWUPD SECURITY ATTRIBUTE ================ -->
25142513
<!-- =============================================================== -->
@@ -2569,7 +2568,7 @@
25692568
<xsd:choice>
25702569
<xsd:element ref="oval-def:set"/>
25712570
<xsd:sequence>
2572-
<xsd:element name="stream-id" type="oval-def:EntityObjectStringType">
2571+
<xsd:element name="stream_id" type="oval-def:EntityObjectStringType">
25732572
<xsd:annotation>
25742573
<xsd:documentation>This refers to a specific firmware, hardware, and fw/hw configurations and is defined by fwupd.</xsd:documentation>
25752574
</xsd:annotation>
@@ -2590,7 +2589,7 @@
25902589
<xsd:complexContent>
25912590
<xsd:extension base="oval-def:StateType">
25922591
<xsd:sequence>
2593-
<xsd:element name="security-attr" type="oval-def:EntityObjectStringType">
2592+
<xsd:element name="security_attr" type="oval-def:EntityObjectStringType">
25942593
<xsd:annotation>
25952594
<xsd:documentation>This is the current firmware security status defined by fwupd.</xsd:documentation>
25962595
</xsd:annotation>
@@ -2600,10 +2599,6 @@
26002599
</xsd:complexContent>
26012600
</xsd:complexType>
26022601
</xsd:element>
2603-
2604-
2605-
2606-
26072602
<!-- =============================================================================== -->
26082603
<!-- =============================================================================== -->
26092604
<!-- =============================================================================== -->

‎schemas/oval/5.11.3/linux-system-characteristics-schema.xsd

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1108,6 +1108,32 @@
11081108
</xsd:complexType>
11091109
</xsd:element>
11101110
<!-- =============================================================================== -->
1111+
<!-- =========================== FWUPD SECURITY ATTRIBUTE ITEM =================== -->
1112+
<!-- =============================================================================== -->
1113+
<xsd:element name="fwupdsecattr_item" substitutionGroup="oval-sc:item">
1114+
<xsd:annotation>
1115+
<xsd:documentation>This item describes a security attribute state as defined by fwupd. It extends the standard ItemType as defined in the oval-system-characteristics schema and one should refer to the ItemType description for more information.</xsd:documentation>
1116+
</xsd:annotation>
1117+
<xsd:complexType>
1118+
<xsd:complexContent>
1119+
<xsd:extension base="oval-sc:ItemType">
1120+
<xsd:sequence>
1121+
<xsd:element name="stream_id" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1">
1122+
<xsd:annotation>
1123+
<xsd:documentation>The attribute Stream ID.</xsd:documentation>
1124+
</xsd:annotation>
1125+
</xsd:element>
1126+
<xsd:element name="security_attr" type="oval-sc:EntityItemStringType" minOccurs="0" maxOccurs="1">
1127+
<xsd:annotation>
1128+
<xsd:documentation>The attribute status.</xsd:documentation>
1129+
</xsd:annotation>
1130+
</xsd:element>
1131+
</xsd:sequence>
1132+
</xsd:extension>
1133+
</xsd:complexContent>
1134+
</xsd:complexType>
1135+
</xsd:element>
1136+
<!-- =============================================================================== -->
11111137
<!-- =============================================================================== -->
11121138
<!-- =============================================================================== -->
11131139
<xsd:complexType name="EntityItemRpmVerifyResultType">

‎src/OVAL/probes/unix/linux/fwupdsecattr_probe.c

Lines changed: 28 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,7 @@ static void hsicache_callback(char *name, const uint32_t value)
8181
}
8282
entry->name = oscap_strdup(name);
8383
entry->hsi_result = value;
84+
dD("HSI cache add name: %s value: %d\n", entry->name, entry->hsi_result);
8485
LIST_INSERT_HEAD(&hsi_result_cache, entry, entries);
8586
}
8687

@@ -89,12 +90,13 @@ static uint32_t hsicache_get(const char *key)
8990
struct secattr_cache *next;
9091

9192
LIST_FOREACH(next, &hsi_result_cache, entries) {
92-
dD("HSI search key %s name %s value %d\n", key, next->name, next->hsi_result);
93+
dD("HSI search key: %s (name: %s value: %d)\n", key, next->name, next->hsi_result);
9394
if (!strncmp(next->name, key, strlen(next->name))) {
9495
return next->hsi_result;
9596
}
9697
}
9798

99+
dW("HSI key not found: %s\n", key);
98100
return UINT32_MAX;
99101
}
100102

@@ -119,13 +121,14 @@ static int get_all_security_attributes(DBusConnection *conn, void(*callback)(cha
119121
}
120122

121123
DBusMessageIter args, property_iter;
124+
_DBusBasicValue value;
122125

123126
if (!dbus_connection_send_with_reply(conn, msg, &pending, -1)) {
124-
dD("Failed to send message via dbus!");
127+
dD("Failed to send message via D-Bus!");
125128
goto cleanup;
126129
}
127130
if (pending == NULL) {
128-
dD("Invalid dbus pending call!");
131+
dD("Invalid D-Bus pending call!");
129132
goto cleanup;
130133
}
131134

@@ -135,18 +138,19 @@ static int get_all_security_attributes(DBusConnection *conn, void(*callback)(cha
135138
dbus_pending_call_block(pending);
136139
msg = dbus_pending_call_steal_reply(pending);
137140
if (msg == NULL) {
138-
dD("Failed to steal dbus pending call reply.");
141+
dD("Failed to steal D-Bus pending call reply.");
139142
goto cleanup;
140143
}
141144
dbus_pending_call_unref(pending); pending = NULL;
142145

143146
if (!dbus_message_iter_init(msg, &args)) {
144-
dD("Failed to initialize iterator over received dbus message.");
147+
dD("Failed to initialize iterator over received D-Bus message.");
145148
goto cleanup;
146149
}
147150

148151
if (dbus_message_get_type(msg) == DBUS_MESSAGE_TYPE_ERROR) {
149-
dD("Receive an error exception from dBus");
152+
dbus_message_iter_get_basic(&args, &value);
153+
dW("Received an error from D-Bus (%s): %s", dbus_message_get_error_name(msg), value.str);
150154
goto cleanup;
151155
}
152156

@@ -180,7 +184,6 @@ static int get_all_security_attributes(DBusConnection *conn, void(*callback)(cha
180184
goto cleanup;
181185
}
182186

183-
_DBusBasicValue value;
184187
dbus_message_iter_get_basic(&dict_entry, &value);
185188
property_name = oscap_strdup(value.str);
186189
dD("Element key: %s", property_name);
@@ -274,13 +277,17 @@ fwupd_security_attr_result_to_string(FwupdSecurityAttrResult result)
274277
return "supported";
275278
if (result == FWUPD_SECURITY_ATTR_RESULT_NOT_SUPPORTED)
276279
return "not-supported";
277-
return NULL;
280+
if (result == FWUPD_SECURITY_ATTR_RESULT_UNKNOWN) {
281+
dD("Got FWUPD_SECURITY_ATTR_RESULT_UNKNOWN\n");
282+
return "unknown";
283+
}
284+
dW("Unknown/invalid FwupdSecurityAttrResult value: %d\n", result);
285+
return "invalid-hsi-result";
278286
}
279287

280288
int fwupdsecattr_probe_main(probe_ctx *ctx, void *arg)
281289
{
282290
SEXP_t *val, *item, *ent, *probe_in;
283-
oval_schema_version_t oval_version;
284291
char *stream_id = NULL;
285292
const char *hsi_result_str;
286293
uint64_t hsi_result = UINT64_MAX;
@@ -294,12 +301,7 @@ int fwupdsecattr_probe_main(probe_ctx *ctx, void *arg)
294301
if (probe_in == NULL)
295302
return PROBE_ENOOBJ;
296303

297-
oval_version = probe_obj_get_platform_schema_version(probe_in);
298-
if (oval_schema_version_cmp(oval_version, OVAL_SCHEMA_VERSION(5.11.3)) < 0) {
299-
return PROBE_EOPNOTSUPP;
300-
}
301-
302-
ent = probe_obj_getent(probe_in, "stream-id", 1);
304+
ent = probe_obj_getent(probe_in, "stream_id", 1);
303305
if (ent == NULL)
304306
return PROBE_ENOENT;
305307

@@ -313,25 +315,28 @@ int fwupdsecattr_probe_main(probe_ctx *ctx, void *arg)
313315
SEXP_free(val);
314316
SEXP_free(ent);
315317

316-
DBusError dbus_error;
317-
DBusConnection *dbus_conn;
318-
319318
if (LIST_EMPTY(&hsi_result_cache)) {
319+
DBusError dbus_error;
320+
DBusConnection *dbus_conn;
321+
320322
dbus_error_init(&dbus_error);
321323
dbus_conn = connect_dbus();
322324

323325
if (dbus_conn == NULL) {
324326
dbus_error_free(&dbus_error);
325-
SEXP_t *msg = probe_msg_creat(OVAL_MESSAGE_LEVEL_INFO, "DBus connection failed, could not identify fwupd.");
327+
SEXP_t *msg = probe_msg_creat(OVAL_MESSAGE_LEVEL_INFO, "D-Bus connection failed, could not identify fwupd.");
326328
probe_cobj_set_flag(probe_ctx_getresult(ctx), SYSCHAR_FLAG_ERROR);
327329
probe_cobj_add_msg(probe_ctx_getresult(ctx), msg);
328330
SEXP_free(msg);
329331
return 0;
330332
}
331333

332-
if (get_all_security_attributes(dbus_conn, hsicache_callback, NULL)) {
334+
int res = get_all_security_attributes(dbus_conn, hsicache_callback, NULL);
335+
disconnect_dbus(dbus_conn);
336+
337+
if (res) {
333338
dbus_error_free(&dbus_error);
334-
SEXP_t *msg = probe_msg_creat(OVAL_MESSAGE_LEVEL_INFO, "fwupd is not properly installed or configured.");
339+
SEXP_t *msg = probe_msg_creat(OVAL_MESSAGE_LEVEL_INFO, "The fwupd service is not properly installed or configured.");
335340
probe_cobj_set_flag(probe_ctx_getresult(ctx), SYSCHAR_FLAG_ERROR);
336341
probe_cobj_add_msg(probe_ctx_getresult(ctx), msg);
337342
SEXP_free(msg);
@@ -343,7 +348,7 @@ int fwupdsecattr_probe_main(probe_ctx *ctx, void *arg)
343348

344349
if (hsi_result == UINT32_MAX) {
345350
item = probe_item_create(OVAL_LINUX_FWUPDSECATTR, NULL,
346-
"security-attr", OVAL_DATATYPE_STRING, "Attribute not found",
351+
"security_attr", OVAL_DATATYPE_STRING, "not-found",
347352
NULL);
348353
probe_item_setstatus(item, SYSCHAR_STATUS_NOT_COLLECTED);
349354
probe_item_collect(ctx, item);
@@ -352,12 +357,11 @@ int fwupdsecattr_probe_main(probe_ctx *ctx, void *arg)
352357

353358
hsi_result_str = fwupd_security_attr_result_to_string(hsi_result);
354359
item = probe_item_create(OVAL_LINUX_FWUPDSECATTR, NULL,
355-
"security-attr", OVAL_DATATYPE_STRING, hsi_result_str,
360+
"security_attr", OVAL_DATATYPE_STRING, hsi_result_str,
356361
NULL);
357362
probe_item_collect(ctx, item);
358363

359364
exit:
360365
free(stream_id);
361-
disconnect_dbus(dbus_conn);
362366
return 0;
363367
}

‎tests/probes/CMakeLists.txt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ add_subdirectory("fileextendedattribute")
66
add_subdirectory("filehash")
77
add_subdirectory("filehash58")
88
add_subdirectory("filemd5")
9+
add_subdirectory("fwupdsecattr")
910
add_subdirectory("iflisteners")
1011
add_subdirectory("interface")
1112
add_subdirectory("isainfo")

‎tests/probes/fwupdsecattr/CMakeLists.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
if(ENABLE_PROBES_LINUX)
2+
if(DBUS_FOUND)
3+
add_oscap_test("test_probes_fwupdsecattr.sh")
4+
add_oscap_test("test_probes_fwupdsecattr_mock.sh")
5+
endif()
6+
endif()
7+

‎tests/probes/fwupdsecattr/org.freedesktop.fwupd.py

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# This is a template for D-Bus mock
2+
# see init_dbus_mock() from test_common.sh.
3+
# The Exit() method is expected by
4+
# clean_dbus_mock() from the same file.
5+
6+
__author__ = 'Evgenii Kolesnikov'
7+
__copyright__ = '''
8+
(c) 2023 Red Hat Inc.
9+
'''
10+
11+
import dbus
12+
13+
14+
BUS_NAME = 'org.freedesktop.fwupd'
15+
MAIN_OBJ = '/'
16+
MAIN_IFACE = 'org.freedesktop.fwupd'
17+
SYSTEM_BUS = False
18+
19+
20+
def load(mock, _parameters):
21+
mock.AddMethods(MAIN_IFACE, [
22+
('GetHostSecurityAttrs', '', 'aa{sv}', 'ret = self.SecurityAattrs'),
23+
('Exit', '', '', 'sys.exit()'),
24+
])
25+
26+
mock.SecurityAattrs = [
27+
{
28+
'AppstreamId': 'org.fwupd.hsi.Kernel.Lockdown', 'HsiResult': dbus.UInt32(2)
29+
},
30+
{
31+
'AppstreamId': 'org.fwupd.hsi.Kernel.InvalidStatus', 'HsiResult': dbus.UInt32(200)
32+
}
33+
]

0 commit comments

Comments
 (0)