Re: [PATCH ima-evm-utils] Experimental fsverity.test related GA CI improvements

[Vitaly Chikunov <vt@altlinux.org>]

Mimi,

On Thu, Dec 01, 2022 at 03:26:54AM +0300, Vitaly Chikunov wrote:
> From: Mimi Zohar <zohar@linux.ibm.com>

Forgot to --reset-author.

Thanks,

> 
> This does not make fsverity.test working on GA CI, though.
> 
> - `--device /dev/loop-control' is required for losetup(8) to work.
> - `--privileged' is required foo mount(8) to work, and this makes
>   `--security-opt seccomp=unconfined' redundant.
> - GA container does not have `/sys/kernel/security' mounted which is
>   needed for `/sys/kernel/security/integrity/ima/policy'.
> - Enable `set -x` in CI as the logs is everything we have to analyze on
>   failures.
> 
> Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
> ---
>  .github/workflows/ci.yml |  2 +-
>  build.sh                 | 12 +++++++++++-
>  tests/fsverity.test      |  2 +-
>  3 files changed, 13 insertions(+), 3 deletions(-)
> 
> diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
> index 8223b87..d2afdfe 100644
> --- a/.github/workflows/ci.yml
> +++ b/.github/workflows/ci.yml
> @@ -98,7 +98,7 @@ jobs:
>      container:
>        image: ${{ matrix.container }}
>        env: ${{ matrix.env }}
> -      options: --security-opt seccomp=unconfined
> +      options: --privileged --device /dev/loop-control
>  
>      steps:
>      - name: Show OS
> diff --git a/build.sh b/build.sh
> index cc5a258..4e2f1bb 100755
> --- a/build.sh
> +++ b/build.sh
> @@ -1,6 +1,16 @@
>  #!/bin/sh
>  # Copyright (c) 2020 Petr Vorel <pvorel@suse.cz>
>  
> +if [ -n "$CI" ]; then
> +	# If we under CI only thing we can analyze is logs so better to enable
> +	# verbosity to a maximum.
> +	set -x
> +	# This is to make stdout and stderr synchronous in the logs.
> +	exec 2>&1
> +
> +	mount -t securityfs -o rw securityfs /sys/kernel/security
> +fi
> +
>  set -e
>  
>  CC="${CC:-gcc}"
> @@ -100,7 +110,7 @@ if [ $ret -eq 0 ]; then
>  	tail -20 tests/boot_aggregate.log
>  
>  	if [ -f tests/fsverity.log ]; then
> -		tail -4 tests/fsverity.log
> +		[ -n "$CI" ] && cat tests/fsverity.log || tail tests/fsverity.log
>  		grep "skipped" tests/fsverity.log  && \
>  		   grep "skipped" tests/fsverity.log | wc -l
>  	fi
> diff --git a/tests/fsverity.test b/tests/fsverity.test
> index def06f8..1bb8362 100755
> --- a/tests/fsverity.test
> +++ b/tests/fsverity.test
> @@ -78,7 +78,7 @@ mount_loopback_file() {
>  		exit "$FAIL"
>  	fi
>  
> -	mount -o loop ${TST_IMG} $TST_MNT
> +	mount -v -o loop ${TST_IMG} $TST_MNT
>  	ret=$?
>  
>  	if [ "${ret}" -eq 0 ]; then
> -- 
> 2.33.4