Add additional test for secure boot to test rootfs corruption
A message that is not in the archive (sent off-list or not yet received): [email protected]
Hi Jan,
Sorry to bother you, any feedback on this patch?
Thanks & Regards
Shivanand K
-----Original Message-----
From: [email protected] <[email protected]> On Behalf Of Kunijadar Shivanand
Sent: 30 July 2025 14:44
To: [email protected]; [email protected]
Cc: kunijadar shivanand(ＴＳＩＰ DITC_DIT-OST) <[email protected]>; dinesh kumar(ＴＳＩＰ DITC_DIT-OST) <[email protected]>; hayashi kazuhiro(林 和宏 □ＤＩＴＣ○ＣＰＴ) <[email protected]>
Subject: [cip-dev] [isar-cip-core][PATCH] Add additional test for secure boot to test rootfs corruption
Add a test case to verify and detect rootfs corruption i.e dm-verity corrupt case.
Signed-off-by Shivanand Kunijadar <[email protected]>
--- .gitlab-ci.yml | 24 +++++++++++++++++++ scripts/submit_lava.sh | 16 +++++++++++++ .../secureboot_corrupt_rootfs_steps.yml | 7 ++++++ 3 files changed, 47 insertions(+) create mode 100644 tests/templates/secureboot_corrupt_rootfs_steps.yml
.gitlab-ci.yml +24 -0
@@ -508,6 +508,30 @@ test:qemu-arm-secure-boot-unsigned-bootloader: target: qemu-arm test_function: secure-boot-unsigned-bootloader +test:qemu-amd64-secure-boot-corrupt-rootfs: + extends: + - .test-cip-core + needs: ["build:qemu-amd64-base"] + variables: + target: qemu-amd64 + test_function: secure-boot-corrupt-rootfs + +test:qemu-arm64-secure-boot-corrupt-rootfs: + extends: + - .test-cip-core + needs: ["build:qemu-arm64-base"] + variables: + target: qemu-arm64 + test_function: secure-boot-corrupt-rootfs + +test:qemu-arm-secure-boot-corrupt-rootfs: + extends: + - .test-cip-core + needs: ["build:qemu-arm-base"] + variables: + target: qemu-arm + test_function: secure-boot-corrupt-rootfs + test:qemu-amd64-secure-boot-mismatch-keys: extends: - .test-cip-core
scripts/submit_lava.sh +16 -0
@@ -118,6 +118,22 @@ create_job_qemu () { if [ "$2" = "qemu-arm" ]; then sed -i "[email protected]@bootarm.efi@g" "${job_dir}/${1}_unsigned_bootloader_${2}.yml" fi + elif [ "$1" = "secure-boot-corrupt-rootfs" ]; then + cp $LAVA_TEMPLATES/secureboot_negative_test.yml "${job_dir}/${1}_corrupt_rootfs_${2}.yml" + cd $LAVA_TEMPLATES + sed -e '/#POSTPROCESS_STEPS#/ {' -e 'r secureboot_corrupt_rootfs_steps.yml' -e 'd' -e '}' -i "${job_dir}/${1}_corrupt_rootfs_${2}.yml" + cd - + + sed -i "s@#END_MONITOR#@reboot: Restarting system with command 'dm-verity device corrupted'@g" "${job_dir}/${1}_corrupt_rootfs_${2}.yml" + sed -i "s@#START_MONITOR#@EFI stub: UEFI Secure Boot is enabled.@g" "${job_dir}/${1}_corrupt_rootfs_${2}.yml" + sed -i "s@#ARTIFACT#@rootfs@g" "${job_dir}/${1}_corrupt_rootfs_${2}.yml" + + if [ "$2" = "qemu-arm64" ]; then + sed -i "[email protected]@bootaa64.efi@g" "${job_dir}/${1}_corrupt_rootfs_${2}.yml" + fi + if [ "$2" = "qemu-arm" ]; then + sed -i "[email protected]@bootarm.efi@g" "${job_dir}/${1}_corrupt_rootfs_${2}.yml" + fi elif [ "$1" = "secure-boot-mismatch-keys" ]; then if [ "$2" = "qemu-amd64" ]; then cp $LAVA_TEMPLATES/secureboot_negative_test.yml "${job_dir}/${1}_mismatch_keys_${2}.yml"
tests/templates/secureboot_corrupt_rootfs_steps.yml new file +7 -0
@@ -0,0 +1,7 @@ + - "apt-get update" + - "apt install -y fdisk" + - "rootfs_start_sector=$(fdisk -l -o Name,Start cip-core-image-security-cip-core-#distribution#-#architecture#.wic | awk -v name=systema '$0 ~ name {print $2}')" + - "rootfs_start=$((${rootfs_start_sector} * 512))" + # The value 96 is squashfs superblock header size, so skip header and corrupt the data after that. + - "offset=$((${rootfs_start} + 96))" + - "dd if=/dev/zero of=cip-core-image-security-cip-core-#distribution#-#architecture#.wic bs=1 seek=${offset} count=8 conv=notrunc"
--
2.39.5