test_grsecurity improvements to run against kernel test farm #7542
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The testinfra tests automatically remove paxtest once the test is done, but for cases where it's preinstalled, like on the kernel farm hosts, that's annoying. So let's only uninstall it if we were the ones who installed it.
It fails on the kernel test farm hosts, which use different hostnames, but more importantly, it's unnecessary. The relevant apache2 paxctld rule is set on both app and mon servers, unconditionally.
cfm
approved these changes
May 12, 2025
There was a problem hiding this comment.
Looks good. Staging CI is failing, but the failures are unrelated to these changes:
- Focal:
molecule/testinfra/common/test_automatic_updates.py
__________ test_unattended_upgrades_functional[ansible://app-staging] __________
[gw1] linux -- Python 3.9.2 /home/sdci/securedrop-source/.venv/bin/python
host = <testinfra.host.Host ansible://app-staging>
def test_unattended_upgrades_functional(host):
"""
Ensure unattended-upgrades completes successfully and ensures all packages
are up-to-date.
"""
c = host.run("sudo unattended-upgrades --dry-run --debug")
> assert c.rc == 0
E assert 1 == 0
E + where 1 = CommandResult(command=b'sudo unattended-upgrades --dry-run --debug', exit_status=1, stdout=b"Starting unattended upgrades script\nAllowed origins are: origin=Ubuntu,archive=focal, origin=Ubuntu,archive=focal-security, origin=Ubuntu,archive=focal-updates, origin=SecureDrop,codename=focal\nInitial blacklist: \nInitial whitelist (not strict): \nUsing (^linux-.*-[1-9][0-9]*\\.[0-9]+\\.[0-9]+-[0-9]+(-.+)?$|^kfreebsd-.*-[1-9][0-9]*\\.[0-9]+\\.[0-9]+-[0-9]+(-.+)?$|^gnumach-.*-[1-9][0-9]*\\.[0-9]+\\.[0-9]+-[0-9]+(-.+)?$|^.*-modules-[1-9][0-9]*\\.[0-9]+\\.[0-9]+-[0-9]+(-.+)?$|^.*-kernel-[1-9][0-9]*\\.[0-9]+\\.[0-9]+-[0-9]+(-.+)?$|^linux-.*-[1-9][0-9]*\\.[0-9]+\\.[0-9]+-[0-9]+(-.+)?$|^kfreebsd-.*-[1-9][0-9]*\\.[0-9]+\\.[0-9]+-[0-9]+(-.+)?$|^gnumach-.*-[1-9][0-9]*\\.[0-9]+\\.[0-9]+-[0-9]+(-.+)?$|^.*-modules-[1-9][0-9]*\\.[0-9]+\\.[0-9]+-[0-9]+(-.+)?$|^.*-kernel-[1-9][0-9]*\\.[0-9]+\\.[0-9]+-[0-9]+(-.+)?$) regexp to find kernel packages\nUsing (^linux-.*-5\\.15\\.181\\-1\\-grsec\\-securedrop$|^linux-.*-5\\.15\\.181\\-1$|^kfreebsd-.*-5\\.15\\.181\\-1\\-grsec\\-securedrop$|^kfreebsd-.*-5\\.15\\.181\\-1$|^gnumach-.*-5\\.15\\.181\\-1\\-grsec\\-securedrop$|^gnumach-.*-5\\.15\\.181\\-1$|^.*-modules-5\\.15\\.181\\-1\\-grsec\\-securedrop$|^.*-modules-5\\.15\\.181\\-1$|^.*-kernel-5\\.15\\.181\\-1\\-grsec\\-securedrop$|^.*-kernel-5\\.15\\.181\\-1$|^linux-.*-5\\.15\\.181\\-1\\-grsec\\-securedrop$|^linux-.*-5\\.15\\.181\\-1$|^kfreebsd-.*-5\\.15\\.181\\-1\\-grsec\\-securedrop$|^kfreebsd-.*-5\\.15\\.181\\-1$|^gnumach-.*-5\\.15\\.181\\-1\\-grsec\\-securedrop$|^gnumach-.*-5\\.15\\.181\\-1$|^.*-modules-5\\.15\\.181\\-1\\-grsec\\-securedrop$|^.*-modules-5\\.15\\.181\\-1$|^.*-kernel-5\\.15\\.181\\-1\\-grsec\\-securedrop$|^.*-kernel-5\\.15\\.181\\-1$) regexp to find running kernel packages\nChecking: ossec-agent ([<Origin component:'main' archive:'' origin:'SecureDrop' label:'' site:'apt-test.freedom.press' isTrusted:True>])\npkg ossec-agent is on hold\nsanity check failed for: set() : no package is selected to be upgraded or installed\nSIGTERM received, will stop\npkgs that look like they should be upgraded: \nSIGNAL received, stopping\n", stderr=None).rcI'll approve this change for merge and keep an eye on staging on develop.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Status
Ready for review
Description of Changes
See individual commit messages for further details.
Testing
How should the reviewer test this PR?
Deployment
Any special considerations for deployment? n/a