tests: Adjust path for swtpm state to use path under /var/tmp/

[PATCH] tests: Adjust path for swtpm state to use path under /var/tmp/

Posted by Stefan Berger 2 weeks, 3 days ago

From: Stefan Berger <stefanb@linux.ibm.com>

To avoid AppArmor-related test failures when functional test are run from
somewhere under /mnt, adjust the path to swtpm's state to use an AppArmor-
supported path, such as /var/tmp, which is provided by the python function
tempfile.TemporaryDirectory().

An update to swtpm's AppArmor profile is also being done to support /var/tmp.

Link: https://lore.kernel.org/qemu-devel/CAFEAcA8A=kWLtTZ+nua-MpzqkaEjW5srOYZruZnE2tB6vmoMig@mail.gmail.com/
Link: https://github.com/stefanberger/swtpm/pull/944
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
---
 tests/functional/test_arm_aspeed.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/tests/functional/test_arm_aspeed.py b/tests/functional/test_arm_aspeed.py
index 9761fc06a4..a574b1e521 100644
--- a/tests/functional/test_arm_aspeed.py
+++ b/tests/functional/test_arm_aspeed.py
@@ -227,11 +227,11 @@ def test_arm_ast2600_evb_buildroot_tpm(self):
 
         image_path = self.ASSET_BR2_202302_AST2600_TPM_FLASH.fetch()
 
-        socket_dir = tempfile.TemporaryDirectory(prefix="qemu_")
-        socket = os.path.join(socket_dir.name, 'swtpm-socket')
+        tpmstate_dir = tempfile.TemporaryDirectory(prefix="qemu_")
+        socket = os.path.join(tpmstate_dir.name, 'swtpm-socket')
 
         subprocess.run(['swtpm', 'socket', '-d', '--tpm2',
-                        '--tpmstate', f'dir={self.vm.temp_dir}',
+                        '--tpmstate', f'dir={tpmstate_dir.name}',
                         '--ctrl', f'type=unixio,path={socket}'])
 
         self.vm.add_args('-chardev', f'socket,id=chrtpm,path={socket}')
-- 
2.34.1

Re: [PATCH] tests: Adjust path for swtpm state to use path under /var/tmp/

Posted by Peter Maydell 2 weeks, 2 days ago

On Wed, 6 Nov 2024 at 18:08, Stefan Berger <stefanb@linux.vnet.ibm.com> wrote:
>
> From: Stefan Berger <stefanb@linux.ibm.com>
>
> To avoid AppArmor-related test failures when functional test are run from
> somewhere under /mnt, adjust the path to swtpm's state to use an AppArmor-
> supported path, such as /var/tmp, which is provided by the python function
> tempfile.TemporaryDirectory().
>
> An update to swtpm's AppArmor profile is also being done to support /var/tmp.
>
> Link: https://lore.kernel.org/qemu-devel/CAFEAcA8A=kWLtTZ+nua-MpzqkaEjW5srOYZruZnE2tB6vmoMig@mail.gmail.com/
> Link: https://github.com/stefanberger/swtpm/pull/944
> Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>

Thanks for writing this patch. I can confirm that the test now
runs OK on my Ubuntu setup, so

Tested-by: Peter Maydell <peter.maydell@linaro.org>

> ---
>  tests/functional/test_arm_aspeed.py | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/tests/functional/test_arm_aspeed.py b/tests/functional/test_arm_aspeed.py
> index 9761fc06a4..a574b1e521 100644
> --- a/tests/functional/test_arm_aspeed.py
> +++ b/tests/functional/test_arm_aspeed.py
> @@ -227,11 +227,11 @@ def test_arm_ast2600_evb_buildroot_tpm(self):
>
>          image_path = self.ASSET_BR2_202302_AST2600_TPM_FLASH.fetch()
>
> -        socket_dir = tempfile.TemporaryDirectory(prefix="qemu_")
> -        socket = os.path.join(socket_dir.name, 'swtpm-socket')

I think it would be helpful to add a brief comment here:
           # We must put the TPM state dir in /tmp/, not the build dir,
           # because some distros use AppArmor to lock down swtpm and
           # restrict the set of locations it can write to.

just as a guard against somebody in future coming along and
trying to clean up/rationalize where tests are creating their
temporary files.

> +        tpmstate_dir = tempfile.TemporaryDirectory(prefix="qemu_")
> +        socket = os.path.join(tpmstate_dir.name, 'swtpm-socket')
>
>          subprocess.run(['swtpm', 'socket', '-d', '--tpm2',
> -                        '--tpmstate', f'dir={self.vm.temp_dir}',
> +                        '--tpmstate', f'dir={tpmstate_dir.name}',
>                          '--ctrl', f'type=unixio,path={socket}'])
>
>          self.vm.add_args('-chardev', f'socket,id=chrtpm,path={socket}')
> --
> 2.34.1

thanks
-- PMM

Re: [PATCH] tests: Adjust path for swtpm state to use path under /var/tmp/

Posted by Stefan Berger 2 weeks, 2 days ago


On 11/7/24 6:09 AM, Peter Maydell wrote:
> On Wed, 6 Nov 2024 at 18:08, Stefan Berger <stefanb@linux.vnet.ibm.com> wrote:
>>
>> From: Stefan Berger <stefanb@linux.ibm.com>
>>
>> To avoid AppArmor-related test failures when functional test are run from
>> somewhere under /mnt, adjust the path to swtpm's state to use an AppArmor-
>> supported path, such as /var/tmp, which is provided by the python function
>> tempfile.TemporaryDirectory().
>>
>> An update to swtpm's AppArmor profile is also being done to support /var/tmp.
>>
>> Link: https://lore.kernel.org/qemu-devel/CAFEAcA8A=kWLtTZ+nua-MpzqkaEjW5srOYZruZnE2tB6vmoMig@mail.gmail.com/
>> Link: https://github.com/stefanberger/swtpm/pull/944
>> Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
> 
> Thanks for writing this patch. I can confirm that the test now
> runs OK on my Ubuntu setup, so

That's good to hear. However, it surprises me because the tests probably 
use /var/tmp/ as temp dir and that's no supported in the AppArmor 
profile yet.

> 
> Tested-by: Peter Maydell <peter.maydell@linaro.org>
> 
>> ---
>>   tests/functional/test_arm_aspeed.py | 6 +++---
>>   1 file changed, 3 insertions(+), 3 deletions(-)
>>
>> diff --git a/tests/functional/test_arm_aspeed.py b/tests/functional/test_arm_aspeed.py
>> index 9761fc06a4..a574b1e521 100644
>> --- a/tests/functional/test_arm_aspeed.py
>> +++ b/tests/functional/test_arm_aspeed.py
>> @@ -227,11 +227,11 @@ def test_arm_ast2600_evb_buildroot_tpm(self):
>>
>>           image_path = self.ASSET_BR2_202302_AST2600_TPM_FLASH.fetch()
>>
>> -        socket_dir = tempfile.TemporaryDirectory(prefix="qemu_")
>> -        socket = os.path.join(socket_dir.name, 'swtpm-socket')
> 
> I think it would be helpful to add a brief comment here:
>             # We must put the TPM state dir in /tmp/, not the build dir,
>             # because some distros use AppArmor to lock down swtpm and
>             # restrict the set of locations it can write to.
> 
> just as a guard against somebody in future coming along and
> trying to clean up/rationalize where tests are creating their
> temporary files.
> 
>> +        tpmstate_dir = tempfile.TemporaryDirectory(prefix="qemu_")
>> +        socket = os.path.join(tpmstate_dir.name, 'swtpm-socket')
>>
>>           subprocess.run(['swtpm', 'socket', '-d', '--tpm2',
>> -                        '--tpmstate', f'dir={self.vm.temp_dir}',
>> +                        '--tpmstate', f'dir={tpmstate_dir.name}',
>>                           '--ctrl', f'type=unixio,path={socket}'])
>>
>>           self.vm.add_args('-chardev', f'socket,id=chrtpm,path={socket}')
>> --
>> 2.34.1
> 
> thanks
> -- PMM
>

Re: [PATCH] tests: Adjust path for swtpm state to use path under /var/tmp/

Posted by Peter Maydell 2 weeks, 2 days ago

On Thu, 7 Nov 2024 at 11:58, Stefan Berger <stefanb@linux.ibm.com> wrote:
>
>
>
> On 11/7/24 6:09 AM, Peter Maydell wrote:
> > On Wed, 6 Nov 2024 at 18:08, Stefan Berger <stefanb@linux.vnet.ibm.com> wrote:
> >>
> >> From: Stefan Berger <stefanb@linux.ibm.com>
> >>
> >> To avoid AppArmor-related test failures when functional test are run from
> >> somewhere under /mnt, adjust the path to swtpm's state to use an AppArmor-
> >> supported path, such as /var/tmp, which is provided by the python function
> >> tempfile.TemporaryDirectory().
> >>
> >> An update to swtpm's AppArmor profile is also being done to support /var/tmp.
> >>
> >> Link: https://lore.kernel.org/qemu-devel/CAFEAcA8A=kWLtTZ+nua-MpzqkaEjW5srOYZruZnE2tB6vmoMig@mail.gmail.com/
> >> Link: https://github.com/stefanberger/swtpm/pull/944
> >> Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
> >
> > Thanks for writing this patch. I can confirm that the test now
> > runs OK on my Ubuntu setup, so
>
> That's good to hear. However, it surprises me because the tests probably
> use /var/tmp/ as temp dir and that's no supported in the AppArmor
> profile yet.

On my machine the temporary directory that tempfile.TemporaryDirectory()
creates is under /tmp/. This matches what the Python docs say:
 https://docs.python.org/3/library/tempfile.html#tempfile.gettempdir
where if you haven't set TMPDIR, TEMP or TMP then you get /tmp/
(assuming it exists; you get /var/tmp if it doesn't).

thanks
-- PMM

Re: [PATCH] tests: Adjust path for swtpm state to use path under /var/tmp/

Posted by Cédric Le Goater 2 weeks, 2 days ago

On 11/6/24 19:07, Stefan Berger wrote:
> From: Stefan Berger <stefanb@linux.ibm.com>
> 
> To avoid AppArmor-related test failures when functional test are run from
> somewhere under /mnt, adjust the path to swtpm's state to use an AppArmor-
> supported path, such as /var/tmp, which is provided by the python function
> tempfile.TemporaryDirectory().
> 
> An update to swtpm's AppArmor profile is also being done to support /var/tmp.
> 
> Link: https://lore.kernel.org/qemu-devel/CAFEAcA8A=kWLtTZ+nua-MpzqkaEjW5srOYZruZnE2tB6vmoMig@mail.gmail.com/
> Link: https://github.com/stefanberger/swtpm/pull/944
> Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>

Fixes: f04cb2d00d5c ("tests/functional: Convert most Aspeed machine tests")


Reviewed-by: Cédric Le Goater <clg@redhat.com>

Thanks,

C.



> ---
>   tests/functional/test_arm_aspeed.py | 6 +++---
>   1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/tests/functional/test_arm_aspeed.py b/tests/functional/test_arm_aspeed.py
> index 9761fc06a4..a574b1e521 100644
> --- a/tests/functional/test_arm_aspeed.py
> +++ b/tests/functional/test_arm_aspeed.py
> @@ -227,11 +227,11 @@ def test_arm_ast2600_evb_buildroot_tpm(self):
>   
>           image_path = self.ASSET_BR2_202302_AST2600_TPM_FLASH.fetch()
>   
> -        socket_dir = tempfile.TemporaryDirectory(prefix="qemu_")
> -        socket = os.path.join(socket_dir.name, 'swtpm-socket')
> +        tpmstate_dir = tempfile.TemporaryDirectory(prefix="qemu_")
> +        socket = os.path.join(tpmstate_dir.name, 'swtpm-socket')
>   
>           subprocess.run(['swtpm', 'socket', '-d', '--tpm2',
> -                        '--tpmstate', f'dir={self.vm.temp_dir}',
> +                        '--tpmstate', f'dir={tpmstate_dir.name}',
>                           '--ctrl', f'type=unixio,path={socket}'])
>   
>           self.vm.add_args('-chardev', f'socket,id=chrtpm,path={socket}')