test/py/tests/test_efi_secboot/conftest.py

   1 # SPDX-License-Identifier:      GPL-2.0+
   2 # Copyright (c) 2019, Linaro Limited
   3 # Author: AKASHI Takahiro <takahiro.akashi@linaro.org>
   4
   5 import os
   6 import os.path
   7 import pytest
   8 import re
   9 from subprocess import call, check_call, check_output, CalledProcessError
  10 from defs import *
  11
  12 # from test/py/conftest.py
  13 def tool_is_in_path(tool):
  14     for path in os.environ["PATH"].split(os.pathsep):
  15         fn = os.path.join(path, tool)
  16         if os.path.isfile(fn) and os.access(fn, os.X_OK):
  17             return True
  18     return False
  19
  20 #
  21 # Fixture for UEFI secure boot test
  22 #
  23 @pytest.fixture(scope='session')
  24 def efi_boot_env(request, u_boot_config):
  25     """Set up a file system to be used in UEFI secure boot test.
  26
  27     Args:
  28         request: Pytest request object.
  29         u_boot_config: U-boot configuration.
  30
  31     Return:
  32         A path to disk image to be used for testing
  33     """
  34     global HELLO_PATH
  35
  36     image_path = u_boot_config.persistent_data_dir
  37     image_path = image_path + '/' + EFI_SECBOOT_IMAGE_NAME
  38     image_size = EFI_SECBOOT_IMAGE_SIZE
  39     part_size = EFI_SECBOOT_PART_SIZE
  40     fs_type = EFI_SECBOOT_FS_TYPE
  41
  42     if HELLO_PATH == '':
  43         HELLO_PATH = u_boot_config.build_dir + '/lib/efi_loader/helloworld.efi'
  44
  45     try:
  46         non_root = tool_is_in_path('udisksctl')
  47
  48         # create a disk/partition
  49         check_call('dd if=/dev/zero of=%s bs=1MiB count=%d'
  50                             % (image_path, image_size), shell=True)
  51         check_call('sgdisk %s -n 1:0:+%dMiB'
  52                             % (image_path, part_size), shell=True)
  53         # create a file system
  54         check_call('dd if=/dev/zero of=%s.tmp bs=1MiB count=%d'
  55                             % (image_path, part_size), shell=True)
  56         check_call('mkfs -t %s %s.tmp' % (fs_type, image_path), shell=True)
  57         check_call('dd if=%s.tmp of=%s bs=1MiB seek=1 count=%d conv=notrunc'
  58                             % (image_path, image_path, 1), shell=True)
  59         check_call('rm %s.tmp' % image_path, shell=True)
  60         if non_root:
  61             out_data = check_output('udisksctl loop-setup -f %s -o %d'
  62                                 % (image_path, 1048576), shell=True).decode()
  63             m = re.search('(?<= as )(.*)\.', out_data)
  64             loop_dev = m.group(1)
  65             # print 'loop device is: %s' % loop_dev
  66             out_data = check_output('udisksctl info -b %s'
  67                                 % loop_dev, shell=True).decode()
  68             m = re.search('MountPoints:[ \t]+(.*)', out_data)
  69             mnt_point = m.group(1)
  70         else:
  71             loop_dev = check_output('sudo losetup -o 1MiB --sizelimit %dMiB --show -f %s | tr -d "\n"'
  72                                 % (part_size, image_path), shell=True).decode()
  73             mnt_point = '/mnt'
  74             check_output('sudo mount -t %s -o umask=000 %s %s'
  75                                 % (fs_type, loop_dev, mnt_point), shell=True)
  76
  77         # print 'mount point is: %s' % mnt_point
  78
  79         # suffix
  80         # *.key: RSA private key in PEM
  81         # *.crt: X509 certificate (self-signed) in PEM
  82         # *.esl: signature list
  83         # *.hash: message digest of image as signature list
  84         # *.auth: signed signature list in signature database format
  85         # *.efi: UEFI image
  86         # *.efi.signed: signed UEFI image
  87
  88         # Create signature database
  89         ## PK
  90         check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_PK/ -keyout PK.key -out PK.crt -nodes -days 365'
  91                             % mnt_point, shell=True)
  92         check_call('cd %s; %scert-to-efi-sig-list -g %s PK.crt PK.esl; %ssign-efi-sig-list -c PK.crt -k PK.key PK PK.esl PK.auth'
  93                             % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
  94                             shell=True)
  95         ## PK_null for deletion
  96         check_call('cd %s; sleep 2; touch PK_null.esl; %ssign-efi-sig-list -c PK.crt -k PK.key PK PK_null.esl PK_null.auth'
  97                             % (mnt_point, EFITOOLS_PATH), shell=True)
  98         ## KEK
  99         check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_KEK/ -keyout KEK.key -out KEK.crt -nodes -days 365'
 100                             % mnt_point, shell=True)
 101         check_call('cd %s; %scert-to-efi-sig-list -g %s KEK.crt KEK.esl; %ssign-efi-sig-list -c PK.crt -k PK.key KEK KEK.esl KEK.auth'
 102                             % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
 103                             shell=True)
 104         ## db
 105         check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_db/ -keyout db.key -out db.crt -nodes -days 365'
 106                             % mnt_point, shell=True)
 107         check_call('cd %s; %scert-to-efi-sig-list -g %s db.crt db.esl; %ssign-efi-sig-list -c KEK.crt -k KEK.key db db.esl db.auth'
 108                             % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
 109                             shell=True)
 110         ## db1
 111         check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_db1/ -keyout db1.key -out db1.crt -nodes -days 365'
 112                             % mnt_point, shell=True)
 113         check_call('cd %s; %scert-to-efi-sig-list -g %s db1.crt db1.esl; %ssign-efi-sig-list -c KEK.crt -k KEK.key db db1.esl db1.auth'
 114                             % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
 115                             shell=True)
 116         ## db1-update
 117         check_call('cd %s; %ssign-efi-sig-list -a -c KEK.crt -k KEK.key db db1.esl db1-update.auth'
 118                             % (mnt_point, EFITOOLS_PATH), shell=True)
 119         ## dbx
 120         check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_dbx/ -keyout dbx.key -out dbx.crt -nodes -days 365'
 121                             % mnt_point, shell=True)
 122         check_call('cd %s; %scert-to-efi-sig-list -g %s dbx.crt dbx.esl; %ssign-efi-sig-list -c KEK.crt -k KEK.key dbx dbx.esl dbx.auth'
 123                             % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
 124                             shell=True)
 125
 126         # Copy image
 127         check_call('cp %s %s' % (HELLO_PATH, mnt_point), shell=True)
 128
 129         ## Sign image
 130         check_call('cd %s; sbsign --key db.key --cert db.crt helloworld.efi'
 131                             % mnt_point, shell=True)
 132         ## Digest image
 133         check_call('cd %s; %shash-to-efi-sig-list helloworld.efi db_hello.hash; %ssign-efi-sig-list -c KEK.crt -k KEK.key db db_hello.hash db_hello.auth'
 134                             % (mnt_point, EFITOOLS_PATH, EFITOOLS_PATH),
 135                             shell=True)
 136
 137         if non_root:
 138             check_call('udisksctl unmount -b %s' % loop_dev, shell=True)
 139             # not needed
 140             # check_call('udisksctl loop-delete -b %s' % loop_dev, shell=True)
 141         else:
 142             check_call('sudo umount %s' % loop_dev, shell=True)
 143             check_call('sudo losetup -d %s' % loop_dev, shell=True)
 144
 145     except CalledProcessError as e:
 146         pytest.skip('Setup failed: %s' % e.cmd)
 147         return
 148     else:
 149         yield image_path
 150     finally:
 151         call('rm -f %s' % image_path, shell=True)