New issue
Advanced search Search tips

Issue 687177 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Jan 2018
Components:
EstimatedDays: ----
NextAction: ----
OS: Chrome
Pri: 1
Type: Bug



Sign in to add a comment

Chromad: Investigate adding autotests to cover seccomp policies

Project Member Reported by tnagel@chromium.org, Jan 31 2017

Issue description

Can we run a local Samba server as part of test images to get at least some coverage against seccomp regressions?
 
Labels: -CodeHealth -Pri-3 M-62 Pri-1
Project Member

Comment 2 by bugdroid1@chromium.org, Aug 7 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/platform2/+/9ccbd2abe4d94572c0c8dfd5c28ccd812ff67743

commit 9ccbd2abe4d94572c0c8dfd5c28ccd812ff67743
Author: Lutz Justen <ljusten@chromium.org>
Date: Mon Aug 07 20:50:45 2017

authpolicy: Log seccomp for verbose debug level

Enables logging of seccomp filter failures for the 'kVerbose' debug
level. This level can be set with the crosh command
'authpolicy_debug 3' or through the D-Bus call SetDefaultLogLevel(3).

The AuthPolicy daemon autotest needs a way to enable seccomp logs in
order to print the offending syscall. One way of doing this is to
write certain flags to /etc/authpolicyd_flags, but since DUTs don't
always have rootfs verification disabled, this is not an option.
With this CL, the daemon can use the D-Bus call.

See also CL:600408,CL:601788

BUG= chromium:687177 
TEST=test_that -b chell $DUT_IP enterprise_AuthPolicyDaemon

Change-Id: Ia7aac601ec6e5d916bcb847c42305dd8b60959be
Reviewed-on: https://chromium-review.googlesource.com/602128
Commit-Ready: Lutz Justen <ljusten@chromium.org>
Tested-by: Lutz Justen <ljusten@chromium.org>
Reviewed-by: Roman Sorokin <rsorokin@chromium.org>

[modify] https://crrev.com/9ccbd2abe4d94572c0c8dfd5c28ccd812ff67743/authpolicy/authpolicy_flags.cc
[modify] https://crrev.com/9ccbd2abe4d94572c0c8dfd5c28ccd812ff67743/authpolicy/authpolicy_flags.h

Project Member

Comment 3 by bugdroid1@chromium.org, Sep 14 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/autotest/+/cd8f017ddcea589351b81d75271b1c16336fe535

commit cd8f017ddcea589351b81d75271b1c16336fe535
Author: Lutz Justen <ljusten@chromium.org>
Date: Thu Sep 14 18:36:39 2017

Add AuthPolicy daemon autotest library

Adds a Python autotest library to run the basic authpolicy commands
domain join, user authentication and policy fetch, as well as helper
methods to print logs and detect seccomp failures. The test that uses
this library is going to be in a private repo.

See also CL:*447072,CL:*447073.

BUG= chromium:687177 
TEST=test_that -b chell $DUT_IP enterprise_AuthPolicyDaemon

Change-Id: I7b75ffd1ee0ae931b79afc062a864e43c20e8e08
Reviewed-on: https://chromium-review.googlesource.com/600408
Commit-Ready: Lutz Justen <ljusten@chromium.org>
Tested-by: Lutz Justen <ljusten@chromium.org>
Reviewed-by: Lutz Justen <ljusten@chromium.org>

[add] https://crrev.com/cd8f017ddcea589351b81d75271b1c16336fe535/client/common_lib/cros/authpolicy.py

Project Member

Comment 4 by bugdroid1@chromium.org, Sep 15 2017

The following revision refers to this bug:
  https://chrome-internal.googlesource.com/chromeos/autotest-private/+/d5fff1aa38c0316763c09bd2d1a67209cf229ea4

commit d5fff1aa38c0316763c09bd2d1a67209cf229ea4
Author: Lutz Justen <ljusten@chromium.org>
Date: Fri Sep 15 03:14:08 2017

Project Member

Comment 5 by bugdroid1@chromium.org, Sep 15 2017

Fixed ?
Status: Fixed (was: Assigned)
Yes, the tests should provide a good coverage now.
Status: Verified (was: Fixed)

Sign in to add a comment