| Message ID | 20241106180751.6859-1-stefanb@linux.vnet.ibm.com |
|---|---|
| State | New |
| Headers | show |
| Series | tests: Adjust path for swtpm state to use path under /var/tmp/ | expand |
On 11/6/24 19:07, Stefan Berger wrote: > From: Stefan Berger <stefanb@linux.ibm.com> > > To avoid AppArmor-related test failures when functional test are run from > somewhere under /mnt, adjust the path to swtpm's state to use an AppArmor- > supported path, such as /var/tmp, which is provided by the python function > tempfile.TemporaryDirectory(). > > An update to swtpm's AppArmor profile is also being done to support /var/tmp. > > Link: https://lore.kernel.org/qemu-devel/CAFEAcA8A=kWLtTZ+nua-MpzqkaEjW5srOYZruZnE2tB6vmoMig@mail.gmail.com/ > Link: https://github.com/stefanberger/swtpm/pull/944 > Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Fixes: f04cb2d00d5c ("tests/functional: Convert most Aspeed machine tests") Reviewed-by: Cédric Le Goater <clg@redhat.com> Thanks, C. > --- > tests/functional/test_arm_aspeed.py | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) > > diff --git a/tests/functional/test_arm_aspeed.py b/tests/functional/test_arm_aspeed.py > index 9761fc06a4..a574b1e521 100644 > --- a/tests/functional/test_arm_aspeed.py > +++ b/tests/functional/test_arm_aspeed.py > @@ -227,11 +227,11 @@ def test_arm_ast2600_evb_buildroot_tpm(self): > > image_path = self.ASSET_BR2_202302_AST2600_TPM_FLASH.fetch() > > - socket_dir = tempfile.TemporaryDirectory(prefix="qemu_") > - socket = os.path.join(socket_dir.name, 'swtpm-socket') > + tpmstate_dir = tempfile.TemporaryDirectory(prefix="qemu_") > + socket = os.path.join(tpmstate_dir.name, 'swtpm-socket') > > subprocess.run(['swtpm', 'socket', '-d', '--tpm2', > - '--tpmstate', f'dir={self.vm.temp_dir}', > + '--tpmstate', f'dir={tpmstate_dir.name}', > '--ctrl', f'type=unixio,path={socket}']) > > self.vm.add_args('-chardev', f'socket,id=chrtpm,path={socket}')
On Wed, 6 Nov 2024 at 18:08, Stefan Berger <stefanb@linux.vnet.ibm.com> wrote: > > From: Stefan Berger <stefanb@linux.ibm.com> > > To avoid AppArmor-related test failures when functional test are run from > somewhere under /mnt, adjust the path to swtpm's state to use an AppArmor- > supported path, such as /var/tmp, which is provided by the python function > tempfile.TemporaryDirectory(). > > An update to swtpm's AppArmor profile is also being done to support /var/tmp. > > Link: https://lore.kernel.org/qemu-devel/CAFEAcA8A=kWLtTZ+nua-MpzqkaEjW5srOYZruZnE2tB6vmoMig@mail.gmail.com/ > Link: https://github.com/stefanberger/swtpm/pull/944 > Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Thanks for writing this patch. I can confirm that the test now runs OK on my Ubuntu setup, so Tested-by: Peter Maydell <peter.maydell@linaro.org> > --- > tests/functional/test_arm_aspeed.py | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) > > diff --git a/tests/functional/test_arm_aspeed.py b/tests/functional/test_arm_aspeed.py > index 9761fc06a4..a574b1e521 100644 > --- a/tests/functional/test_arm_aspeed.py > +++ b/tests/functional/test_arm_aspeed.py > @@ -227,11 +227,11 @@ def test_arm_ast2600_evb_buildroot_tpm(self): > > image_path = self.ASSET_BR2_202302_AST2600_TPM_FLASH.fetch() > > - socket_dir = tempfile.TemporaryDirectory(prefix="qemu_") > - socket = os.path.join(socket_dir.name, 'swtpm-socket') I think it would be helpful to add a brief comment here: # We must put the TPM state dir in /tmp/, not the build dir, # because some distros use AppArmor to lock down swtpm and # restrict the set of locations it can write to. just as a guard against somebody in future coming along and trying to clean up/rationalize where tests are creating their temporary files. > + tpmstate_dir = tempfile.TemporaryDirectory(prefix="qemu_") > + socket = os.path.join(tpmstate_dir.name, 'swtpm-socket') > > subprocess.run(['swtpm', 'socket', '-d', '--tpm2', > - '--tpmstate', f'dir={self.vm.temp_dir}', > + '--tpmstate', f'dir={tpmstate_dir.name}', > '--ctrl', f'type=unixio,path={socket}']) > > self.vm.add_args('-chardev', f'socket,id=chrtpm,path={socket}') > -- > 2.34.1 thanks -- PMM
On 11/7/24 6:09 AM, Peter Maydell wrote: > On Wed, 6 Nov 2024 at 18:08, Stefan Berger <stefanb@linux.vnet.ibm.com> wrote: >> >> From: Stefan Berger <stefanb@linux.ibm.com> >> >> To avoid AppArmor-related test failures when functional test are run from >> somewhere under /mnt, adjust the path to swtpm's state to use an AppArmor- >> supported path, such as /var/tmp, which is provided by the python function >> tempfile.TemporaryDirectory(). >> >> An update to swtpm's AppArmor profile is also being done to support /var/tmp. >> >> Link: https://lore.kernel.org/qemu-devel/CAFEAcA8A=kWLtTZ+nua-MpzqkaEjW5srOYZruZnE2tB6vmoMig@mail.gmail.com/ >> Link: https://github.com/stefanberger/swtpm/pull/944 >> Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> > > Thanks for writing this patch. I can confirm that the test now > runs OK on my Ubuntu setup, so That's good to hear. However, it surprises me because the tests probably use /var/tmp/ as temp dir and that's no supported in the AppArmor profile yet. > > Tested-by: Peter Maydell <peter.maydell@linaro.org> > >> --- >> tests/functional/test_arm_aspeed.py | 6 +++--- >> 1 file changed, 3 insertions(+), 3 deletions(-) >> >> diff --git a/tests/functional/test_arm_aspeed.py b/tests/functional/test_arm_aspeed.py >> index 9761fc06a4..a574b1e521 100644 >> --- a/tests/functional/test_arm_aspeed.py >> +++ b/tests/functional/test_arm_aspeed.py >> @@ -227,11 +227,11 @@ def test_arm_ast2600_evb_buildroot_tpm(self): >> >> image_path = self.ASSET_BR2_202302_AST2600_TPM_FLASH.fetch() >> >> - socket_dir = tempfile.TemporaryDirectory(prefix="qemu_") >> - socket = os.path.join(socket_dir.name, 'swtpm-socket') > > I think it would be helpful to add a brief comment here: > # We must put the TPM state dir in /tmp/, not the build dir, > # because some distros use AppArmor to lock down swtpm and > # restrict the set of locations it can write to. > > just as a guard against somebody in future coming along and > trying to clean up/rationalize where tests are creating their > temporary files. > >> + tpmstate_dir = tempfile.TemporaryDirectory(prefix="qemu_") >> + socket = os.path.join(tpmstate_dir.name, 'swtpm-socket') >> >> subprocess.run(['swtpm', 'socket', '-d', '--tpm2', >> - '--tpmstate', f'dir={self.vm.temp_dir}', >> + '--tpmstate', f'dir={tpmstate_dir.name}', >> '--ctrl', f'type=unixio,path={socket}']) >> >> self.vm.add_args('-chardev', f'socket,id=chrtpm,path={socket}') >> -- >> 2.34.1 > > thanks > -- PMM >
On Thu, 7 Nov 2024 at 11:58, Stefan Berger <stefanb@linux.ibm.com> wrote: > > > > On 11/7/24 6:09 AM, Peter Maydell wrote: > > On Wed, 6 Nov 2024 at 18:08, Stefan Berger <stefanb@linux.vnet.ibm.com> wrote: > >> > >> From: Stefan Berger <stefanb@linux.ibm.com> > >> > >> To avoid AppArmor-related test failures when functional test are run from > >> somewhere under /mnt, adjust the path to swtpm's state to use an AppArmor- > >> supported path, such as /var/tmp, which is provided by the python function > >> tempfile.TemporaryDirectory(). > >> > >> An update to swtpm's AppArmor profile is also being done to support /var/tmp. > >> > >> Link: https://lore.kernel.org/qemu-devel/CAFEAcA8A=kWLtTZ+nua-MpzqkaEjW5srOYZruZnE2tB6vmoMig@mail.gmail.com/ > >> Link: https://github.com/stefanberger/swtpm/pull/944 > >> Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> > > > > Thanks for writing this patch. I can confirm that the test now > > runs OK on my Ubuntu setup, so > > That's good to hear. However, it surprises me because the tests probably > use /var/tmp/ as temp dir and that's no supported in the AppArmor > profile yet. On my machine the temporary directory that tempfile.TemporaryDirectory() creates is under /tmp/. This matches what the Python docs say: https://docs.python.org/3/library/tempfile.html#tempfile.gettempdir where if you haven't set TMPDIR, TEMP or TMP then you get /tmp/ (assuming it exists; you get /var/tmp if it doesn't). thanks -- PMM
diff --git a/tests/functional/test_arm_aspeed.py b/tests/functional/test_arm_aspeed.py index 9761fc06a4..a574b1e521 100644 --- a/tests/functional/test_arm_aspeed.py +++ b/tests/functional/test_arm_aspeed.py @@ -227,11 +227,11 @@ def test_arm_ast2600_evb_buildroot_tpm(self): image_path = self.ASSET_BR2_202302_AST2600_TPM_FLASH.fetch() - socket_dir = tempfile.TemporaryDirectory(prefix="qemu_") - socket = os.path.join(socket_dir.name, 'swtpm-socket') + tpmstate_dir = tempfile.TemporaryDirectory(prefix="qemu_") + socket = os.path.join(tpmstate_dir.name, 'swtpm-socket') subprocess.run(['swtpm', 'socket', '-d', '--tpm2', - '--tpmstate', f'dir={self.vm.temp_dir}', + '--tpmstate', f'dir={tpmstate_dir.name}', '--ctrl', f'type=unixio,path={socket}']) self.vm.add_args('-chardev', f'socket,id=chrtpm,path={socket}')