Add a test case that monitors the locking of the storage by swtpm using the
directory storage backend to ensure that the lock is taken at the right
time and released when required.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Move swtpm_open_cmddev call into swtpm_cmd_tx since the latter function is
always called in a subshell that previously inherited the file descriptor
opened by the test cases. Remove swtpm_cmd_tx from nearly all test cases
and also remove closing of file descriptor 100 via 'exec 100>&-' from test
cases since this is not necessary anymore.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
clang doesn't link executables built with ASAN support to libasan, like
gcc does, so we have to use nm rather than ldd for checking for whether
the executable was built with ASAN. nm is part of the binutils package
and should be available on all systems where gcc was installed.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Add a test case for testing the --runas parameter and the ability to access
existing files that have restrictive access permission so that only allow
the --runas user is able to access these files. This is to ensure that
swtpm can access these files properly when the handling of options and the
changing to the --runas user is moved around within swtpm.
Skip the test case if swtpm is linked with ASAN since then we get these
types of error messages that fail tests:
==== Starting swtpm with interfaces socket+socket ====
==3303263==LeakSanitizer has encountered a fatal error.
==3303263==HINT: For debugging, try setting environment variable LSAN_OPTIONS=verbosity=1:log_threads=1
==3303263==HINT: LeakSanitizer does not work under ptrace (strace, gdb, etc)
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Skip tests that require the chardev after checking for the chardev
interface support in swtpm. Remove the conditional addition of chardev
related tests from the Makefile.am.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Skip test cases for TPM 1.2 if TPM 1.2 support is not provided by swtpm.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
[ skip more tests ]
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Some distros (openSUSE) have deprecated the 'net-tools' package,
so we allow for 'ss' as an alternative tool from the
iproute/iproute2 package. This is only relevant for test cases.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Add support for the --print-capabilities option to display newly
added capabilities. Adpat the man page and related test case.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Address several issues reported by shellcheck and protect
variables with quotes so we now can have filenames with spaces.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
The Ubuntu (PPA) build system executes the build on an environment that
has problems with seccomp profiles. It does not allow us to run the test
suite with swtpm applying its seccomp profile since it fails with a
'bad system call' error. To work around this we introduce the env. variable
SWTPM_TEST_SECCOMP_OPT that we can set to "--seccomp action=none" to avoid
having swtpm apply it seccomp profile.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Move wait_port_open and wait_port_closed to common file and handle
the timeout errors in test_commandline.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Delay the reading of the PID file if it is found to be empty.
This can happend if swtpm is run by valgrind.
Also, use the passed parameters rather than the global ones to check
the PID file contents against the expected pid. So far this worked
because PID and PID_FILE were variables used by every caller.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
If the test environment is running in a seccomp profile do not check
that the seccomp profile of the swtpm process runs with the action
provided in --seccomp action=... since the environment may override
this.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Get the PID of the started swtpm from the shell and validate it
against the contents of the pidfile afterwards.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
When the PID_FILE is passed to swtpm as a file descriptor in one test,
we already create a file without content when running
'exec 100<>$PID_FILE'. So we have to extend wait_for_file to also
wait for file content since the 0.2 seconds delay are sometimes not
enough for content to have been written. Otherwise we do not get the
PID of the process. We can extend the function in this way since all
its usages imply that some content should become available.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Use the mode= parameter of the TPM's state file and a unix
socket to have swtpm set the file mode bits and check that
they are set as expected.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Get the IBM TSS2 test suite from its git repo, compile it, and run
its test suite if SWTPM_TEST_EXPENSIVE=1 is set.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Add a delay of 0.2s after a file is found in wait_for_file so that the
process can also write into it. Sometimes we are also interested in the
content and don't seem to get the content since we didn't wait for
the file to have been written to. It happens occasionally when the system
is under load that we don't seem to be able to read the file content
afterwards.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Call a function display_processes_by_name that displays all processes
if needed. The function is quiet, though.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
If the file descriptor 100 is open prior to trying to open
it, it must be closed first on OS/X, otherwise we get test
case failures due to interrupted connections.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Pass the top_builddir and top_srcdir via TESTS_ENVIRONMENT
variable in Makefile.am.
Use TESTDIR for the path to the test directory and replace
previously used DIR in all occurences.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Poll for process to be gone for 1 seconds after a shutdown was requested
and it was found that the PID file had been removed.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Extend the encrypted state test with a test case using a wrong key
for decrypting the state and make sure that the init fails and the
state files remain unmodified.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
OpenBSD uses different tools for sha1 and file size calculations,
so we wrap them in functions and check which one to call by using
uname -s.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Rather than using the non-bash echo tool, which doesn't seem to
support -e on OpenBSD, use the bash echo tool to write the binary
code into a file and cat the file into the device. This also works
around a problem when a sequence contains \x0a, which then seems
to be the last character written to the device if bash's echo is
used. It does this correctly when writing to a file.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
To enable the test suite to for example run a mixture of 32- and
64bit executables, allow users to specify the executables to use by
setting the variables SWTPM_EXE, SWTPM_IOCTL, and SWTPM_BIOS via
command line.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
To be able to run tests with either one of the interfaces, add function
for running swtpm and swtpm_ioctl commands and form the command line
parameters dependent on the type of interface being passed. We rely on
environment variables to provide the specific parameters that are needed
to run the program with the appropriate parameters.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
