legoktm · May 8, 2025 · May 6, 2025 · May 6, 2025 · May 7, 2025 · May 8, 2025
@@ -30,15 +30,53 @@
 
 print(f"I am beginning to test {current} on {hardware}")
 
-paxtest = subprocess.run(["paxtest", "blackhat"], stderr=subprocess.STDOUT, stdout=subprocess.PIPE,
-    check=False)
+# paxtest
+paxtest_results = subprocess.run(
+    ["paxtest", "blackhat"], stderr=subprocess.STDOUT, stdout=subprocess.PIPE, check=False
+)
+
+# Spectre & Meltdown Checker
 fetch = subprocess.check_output(["curl", "-L", "https://meltdown.ovh"])
 Path("/tmp/spectre-meltdown-checker.sh").write_bytes(fetch)  # noqa: S108
-checker = subprocess.run(
+checker_results = subprocess.run(
     ["bash", "/tmp/spectre-meltdown-checker.sh", "--no-color"],  # noqa: S108
-    stderr=subprocess.STDOUT, stdout=subprocess.PIPE,
+    stderr=subprocess.STDOUT,
+    stdout=subprocess.PIPE,
+    check=False,
+)
+
+# grsecurity test suite
+CLONE = Path("/tmp/securedrop")  # noqa: S108
+subprocess.check_output(["rm", "-rf", CLONE])
+subprocess.check_output(
+    ["git", "clone", "https://github.com/freedomofpress/securedrop", "--depth=1", CLONE]
+)
+subprocess.check_output(["make", "venv"], cwd=CLONE)
+
+TEST_SUITE_CONTENTS = """
+# Import all of the test_grsecurity suite, but clear testinfra_hosts so that
+# running "py.test test_grsecurity_local.py" will run the test suite locally.
+
+from common.test_grsecurity import *
+testinfra_hosts = [None]
+"""
+TEST_SUITE_PATH = CLONE / "molecule/testinfra/test_grsecurity_local.py"
+TEST_SUITE_PATH.write_text(TEST_SUITE_CONTENTS)
+
+test_suite_results = subprocess.run(
+    [
+        ".venv/bin/pytest",
+        "-v",
+        TEST_SUITE_PATH,
+    ],
+    cwd=CLONE,
+    stderr=subprocess.STDOUT,
+    stdout=subprocess.PIPE,
     check=False,
 )
+# TODO: test_grsecurity removes paxtest for now, so we need to reinstall it
+subprocess.check_call(["apt-get", "install", "-y", "paxtest"])
+
 
 def create_gist(command, result):
     headers = {
@@ -57,13 +95,15 @@ def create_gist(command, result):
         "https://api.github.com/gists",
         data=json.dumps(data).encode(),
         headers=headers,
-        method="POST"
+        method="POST",
     )
     with urllib.request.urlopen(req) as response:
         return json.loads(response.read().decode())["html_url"]
 
-paxtest_gist = create_gist("paxtest", paxtest)
-checker_gist = create_gist("spectre-meltdown-checker.sh", checker)
+
+paxtest_gist = create_gist("paxtest", paxtest_results)
+checker_gist = create_gist("spectre-meltdown-checker.sh", checker_results)
+test_suite_gist = create_gist("test_grsecurity_local.py", test_suite_results)
 
 template = f"""\
 Hello SecureDrop team,
@@ -73,27 +113,32 @@ def create_gist(command, result):
 If you're seeing this comment it means it successfully booted!
 
 I ran:
-* paxtest, exit code: {paxtest.returncode} ([logs]({paxtest_gist}))
-* spectre-meltdown-checker.sh, exit code: {checker.returncode} ([logs]({checker_gist}))
+* paxtest, exit code: {paxtest_results.returncode} ([logs]({paxtest_gist}))
+* spectre-meltdown-checker.sh, exit code: {checker_results.returncode} ([logs]({checker_gist}))
+* test_grsecurity_local.py, exit code: {test_suite_results.returncode} ([logs]({test_suite_gist}))
 
 Cheers,
 Your friendly kernel testing robot
 """
 
 print(template)
 
+
 def search_issues(kernel_version):
     headers = {
         "Accept": "application/vnd.github+json",
         "Content-Type": "application/json",
     }
-    query = urllib.parse.quote(f"repo:freedomofpress/securedrop {kernel_version} in:title state:open")
+    query = urllib.parse.quote(
+        f"repo:freedomofpress/securedrop {kernel_version} in:title state:open"
+    )
     url = f"https://api.github.com/search/issues?q={query}"
     print(f"Searching via {url}")
     req = urllib.request.Request(url, headers=headers)
     with urllib.request.urlopen(req) as response:
         return json.loads(response.read().decode())["items"]
 
+
 def create_issue(title, body):
     print("Creating issue")
     headers = {
@@ -107,6 +152,7 @@ def create_issue(title, body):
     with urllib.request.urlopen(req) as response:
         return json.loads(response.read().decode())
 
+
 def create_comment(issue_number, body):
     print("Leaving comment")
     headers = {
@@ -120,6 +166,7 @@ def create_comment(issue_number, body):
     with urllib.request.urlopen(req) as response:
         return json.loads(response.read().decode())
 
+
 issue_body = f"""\
 Dearest SecureDrop developers,
 

@@ -31,14 +31,14 @@
     - fpf_repo
 
 
-- name: Install paxtest
+- name: Install required packages for kernel testing
   apt:
-    pkg: paxtest
-    state: present
-
-- name: Install readelf/strings (needed by spectre-meltdown-checker)
-  apt:
-    pkg: binutils
+    pkg:
+      - paxtest
+      - binutils
+      - build-essential
+      - python3-virtualenv
+      - python3-dev
     state: present
 
 - name: Set permissions on github-token.json