test/py/tests/test_efi_secboot/conftest.py

   1 # SPDX-License-Identifier:      GPL-2.0+
   2 # Copyright (c) 2019, Linaro Limited
   3 # Author: AKASHI Takahiro <takahiro.akashi@linaro.org>
   4
   5 import os
   6 import os.path
   7 import pytest
   8 import re
   9 from subprocess import call, check_call, check_output, CalledProcessError
  10 from defs import *
  11
  12 # from test/py/conftest.py
  13 def tool_is_in_path(tool):
  14     for path in os.environ["PATH"].split(os.pathsep):
  15         fn = os.path.join(path, tool)
  16         if os.path.isfile(fn) and os.access(fn, os.X_OK):
  17             return True
  18     return False
  19
  20 #
  21 # Fixture for UEFI secure boot test
  22 #
  23 @pytest.fixture(scope='session')
  24 def efi_boot_env(request, u_boot_config):
  25     """Set up a file system to be used in UEFI secure boot test.
  26
  27     Args:
  28         request: Pytest request object.
  29         u_boot_config: U-boot configuration.
  30
  31     Return:
  32         A path to disk image to be used for testing
  33     """
  34     global HELLO_PATH
  35
  36     image_path = u_boot_config.persistent_data_dir
  37     image_path = image_path + '/' + EFI_SECBOOT_IMAGE_NAME
  38     image_size = EFI_SECBOOT_IMAGE_SIZE
  39     part_size = EFI_SECBOOT_PART_SIZE
  40     fs_type = EFI_SECBOOT_FS_TYPE
  41
  42     if HELLO_PATH == '':
  43         HELLO_PATH = u_boot_config.build_dir + '/lib/efi_loader/helloworld.efi'
  44
  45     try:
  46         mnt_point = u_boot_config.persistent_data_dir + '/mnt_efisecure'
  47         check_call('mkdir -p {}'.format(mnt_point), shell=True)
  48
  49         # create a disk/partition
  50         check_call('dd if=/dev/zero of=%s bs=1MiB count=%d'
  51                             % (image_path, image_size), shell=True)
  52         check_call('sgdisk %s -n 1:0:+%dMiB'
  53                             % (image_path, part_size), shell=True)
  54         # create a file system
  55         check_call('dd if=/dev/zero of=%s.tmp bs=1MiB count=%d'
  56                             % (image_path, part_size), shell=True)
  57         check_call('mkfs -t %s %s.tmp' % (fs_type, image_path), shell=True)
  58         check_call('dd if=%s.tmp of=%s bs=1MiB seek=1 count=%d conv=notrunc'
  59                             % (image_path, image_path, 1), shell=True)
  60         check_call('rm %s.tmp' % image_path, shell=True)
  61         loop_dev = check_output('sudo losetup -o 1MiB --sizelimit %dMiB --show -f %s | tr -d "\n"'
  62                                 % (part_size, image_path), shell=True).decode()
  63         check_output('sudo mount -t %s -o umask=000 %s %s'
  64                                 % (fs_type, loop_dev, mnt_point), shell=True)
  65
  66         # suffix
  67         # *.key: RSA private key in PEM
  68         # *.crt: X509 certificate (self-signed) in PEM
  69         # *.esl: signature list
  70         # *.hash: message digest of image as signature list
  71         # *.auth: signed signature list in signature database format
  72         # *.efi: UEFI image
  73         # *.efi.signed: signed UEFI image
  74
  75         # Create signature database
  76         ## PK
  77         check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_PK/ -keyout PK.key -out PK.crt -nodes -days 365'
  78                             % mnt_point, shell=True)
  79         check_call('cd %s; %scert-to-efi-sig-list -g %s PK.crt PK.esl; %ssign-efi-sig-list -c PK.crt -k PK.key PK PK.esl PK.auth'
  80                             % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
  81                             shell=True)
  82         ## PK_null for deletion
  83         check_call('cd %s; sleep 2; touch PK_null.esl; %ssign-efi-sig-list -c PK.crt -k PK.key PK PK_null.esl PK_null.auth'
  84                             % (mnt_point, EFITOOLS_PATH), shell=True)
  85         ## KEK
  86         check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_KEK/ -keyout KEK.key -out KEK.crt -nodes -days 365'
  87                             % mnt_point, shell=True)
  88         check_call('cd %s; %scert-to-efi-sig-list -g %s KEK.crt KEK.esl; %ssign-efi-sig-list -c PK.crt -k PK.key KEK KEK.esl KEK.auth'
  89                             % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
  90                             shell=True)
  91         ## db
  92         check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_db/ -keyout db.key -out db.crt -nodes -days 365'
  93                             % mnt_point, shell=True)
  94         check_call('cd %s; %scert-to-efi-sig-list -g %s db.crt db.esl; %ssign-efi-sig-list -c KEK.crt -k KEK.key db db.esl db.auth'
  95                             % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
  96                             shell=True)
  97         ## db1
  98         check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_db1/ -keyout db1.key -out db1.crt -nodes -days 365'
  99                             % mnt_point, shell=True)
 100         check_call('cd %s; %scert-to-efi-sig-list -g %s db1.crt db1.esl; %ssign-efi-sig-list -c KEK.crt -k KEK.key db db1.esl db1.auth'
 101                             % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
 102                             shell=True)
 103         ## db1-update
 104         check_call('cd %s; %ssign-efi-sig-list -a -c KEK.crt -k KEK.key db db1.esl db1-update.auth'
 105                             % (mnt_point, EFITOOLS_PATH), shell=True)
 106         ## dbx
 107         check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_dbx/ -keyout dbx.key -out dbx.crt -nodes -days 365'
 108                             % mnt_point, shell=True)
 109         check_call('cd %s; %scert-to-efi-sig-list -g %s dbx.crt dbx.esl; %ssign-efi-sig-list -c KEK.crt -k KEK.key dbx dbx.esl dbx.auth'
 110                             % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
 111                             shell=True)
 112
 113         # Copy image
 114         check_call('cp %s %s' % (HELLO_PATH, mnt_point), shell=True)
 115
 116         ## Sign image
 117         check_call('cd %s; sbsign --key db.key --cert db.crt helloworld.efi'
 118                             % mnt_point, shell=True)
 119         ## Digest image
 120         check_call('cd %s; %shash-to-efi-sig-list helloworld.efi db_hello.hash; %ssign-efi-sig-list -c KEK.crt -k KEK.key db db_hello.hash db_hello.auth'
 121                             % (mnt_point, EFITOOLS_PATH, EFITOOLS_PATH),
 122                             shell=True)
 123
 124         check_call('sudo umount %s' % loop_dev, shell=True)
 125         check_call('sudo losetup -d %s' % loop_dev, shell=True)
 126
 127     except CalledProcessError as e:
 128         pytest.skip('Setup failed: %s' % e.cmd)
 129         return
 130     else:
 131         yield image_path
 132     finally:
 133         call('rm -f %s' % image_path, shell=True)