# # The Qubes OS Project, https://www.qubes-os.org/ # # Copyright (C) 2014-2015 # Marek Marczykowski-Górecki # Copyright (C) 2015 Wojtek Porczyk # # This library is free software; you can redistribute it and/or # modify it under the terms of the GNU Lesser General Public # License as published by the Free Software Foundation; either # version 2.1 of the License, or (at your option) any later version. # # This library is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU # Lesser General Public License for more details. # # You should have received a copy of the GNU Lesser General Public # License along with this library; if not, see . # import asyncio import multiprocessing import os import subprocess import unittest from distutils import spawn import qubes.config import qubes.tests import qubes.vm.appvm import qubes.vm.templatevm TEST_DATA = b"0123456789" * 1024 class TC_00_AppVMMixin(object): def setUp(self): super(TC_00_AppVMMixin, self).setUp() self.init_default_template(self.template) if self._testMethodName == 'test_210_time_sync': self.init_networking() self.testvm1 = self.app.add_new_vm( qubes.vm.appvm.AppVM, label='red', name=self.make_vm_name('vm1'), template=self.app.domains[self.template]) self.loop.run_until_complete(self.testvm1.create_on_disk()) self.testvm2 = self.app.add_new_vm( qubes.vm.appvm.AppVM, label='red', name=self.make_vm_name('vm2'), template=self.app.domains[self.template]) self.loop.run_until_complete(self.testvm2.create_on_disk()) self.app.save() def test_000_start_shutdown(self): # TODO: wait_for, timeout self.loop.run_until_complete(self.testvm1.start()) self.assertEqual(self.testvm1.get_power_state(), "Running") self.loop.run_until_complete(self.testvm1.shutdown(wait=True)) self.assertEqual(self.testvm1.get_power_state(), "Halted") @unittest.skipUnless(spawn.find_executable('xdotool'), "xdotool not installed") def test_010_run_xterm(self): self.loop.run_until_complete(self.testvm1.start()) self.assertEqual(self.testvm1.get_power_state(), "Running") self.loop.run_until_complete(self.wait_for_session(self.testvm1)) p = self.loop.run_until_complete(self.testvm1.run('xterm')) try: wait_count = 0 title = 'user@{}'.format(self.testvm1.name) if self.template.count("whonix"): title = 'user@host' while subprocess.call( ['xdotool', 'search', '--name', title], stdout=subprocess.DEVNULL, stderr=subprocess.STDOUT) > 0: wait_count += 1 if wait_count > 100: self.fail("Timeout while waiting for xterm window") self.loop.run_until_complete(asyncio.sleep(0.1)) self.loop.run_until_complete(asyncio.sleep(0.5)) subprocess.check_call( ['xdotool', 'search', '--name', title, 'windowactivate', 'type', 'exit\n']) wait_count = 0 while subprocess.call(['xdotool', 'search', '--name', title], stdout=open(os.path.devnull, 'w'), stderr=subprocess.STDOUT) == 0: wait_count += 1 if wait_count > 100: self.fail("Timeout while waiting for xterm " "termination") self.loop.run_until_complete(asyncio.sleep(0.1)) finally: try: p.terminate() self.loop.run_until_complete(p.wait()) except ProcessLookupError: # already dead pass @unittest.skipUnless(spawn.find_executable('xdotool'), "xdotool not installed") def test_011_run_gnome_terminal(self): if "minimal" in self.template: self.skipTest("Minimal template doesn't have 'gnome-terminal'") self.loop.run_until_complete(self.testvm1.start()) self.assertEqual(self.testvm1.get_power_state(), "Running") self.loop.run_until_complete(self.wait_for_session(self.testvm1)) p = self.loop.run_until_complete(self.testvm1.run('gnome-terminal')) try: title = 'user@{}'.format(self.testvm1.name) if self.template.count("whonix"): title = 'user@host' wait_count = 0 while subprocess.call( ['xdotool', 'search', '--name', title], stdout=open(os.path.devnull, 'w'), stderr=subprocess.STDOUT) > 0: wait_count += 1 if wait_count > 100: self.fail("Timeout while waiting for gnome-terminal window") self.loop.run_until_complete(asyncio.sleep(0.1)) self.loop.run_until_complete(asyncio.sleep(0.5)) subprocess.check_call( ['xdotool', 'search', '--name', title, 'windowactivate', '--sync', 'type', 'exit\n']) wait_count = 0 while subprocess.call(['xdotool', 'search', '--name', title], stdout=open(os.path.devnull, 'w'), stderr=subprocess.STDOUT) == 0: wait_count += 1 if wait_count > 100: self.fail("Timeout while waiting for gnome-terminal " "termination") self.loop.run_until_complete(asyncio.sleep(0.1)) finally: try: p.terminate() self.loop.run_until_complete(p.wait()) except ProcessLookupError: # already dead pass @unittest.skipUnless(spawn.find_executable('xdotool'), "xdotool not installed") @unittest.expectedFailure def test_012_qubes_desktop_run(self): self.loop.run_until_complete(self.testvm1.start()) self.assertEqual(self.testvm1.get_power_state(), "Running") xterm_desktop_path = "/usr/share/applications/xterm.desktop" # Debian has it different... xterm_desktop_path_debian = \ "/usr/share/applications/debian-xterm.desktop" try: self.loop.run_until_complete(self.testvm1.run_for_stdio( 'test -r {}'.format(xterm_desktop_path_debian))) except subprocess.CalledProcessError: pass else: xterm_desktop_path = xterm_desktop_path_debian self.loop.run_until_complete(self.wait_for_session(self.testvm1)) self.loop.run_until_complete( self.testvm1.run('qubes-desktop-run {}'.format(xterm_desktop_path))) title = 'user@{}'.format(self.testvm1.name) if self.template.count("whonix"): title = 'user@host' wait_count = 0 while subprocess.call( ['xdotool', 'search', '--name', title], stdout=open(os.path.devnull, 'w'), stderr=subprocess.STDOUT) > 0: wait_count += 1 if wait_count > 100: self.fail("Timeout while waiting for xterm window") self.loop.run_until_complete(asyncio.sleep(0.1)) self.loop.run_until_complete(asyncio.sleep(0.5)) subprocess.check_call( ['xdotool', 'search', '--name', title, 'windowactivate', '--sync', 'type', 'exit\n']) wait_count = 0 while subprocess.call(['xdotool', 'search', '--name', title], stdout=open(os.path.devnull, 'w'), stderr=subprocess.STDOUT) == 0: wait_count += 1 if wait_count > 100: self.fail("Timeout while waiting for xterm " "termination") self.loop.run_until_complete(asyncio.sleep(0.1)) def test_050_qrexec_simple_eof(self): """Test for data and EOF transmission dom0->VM""" # XXX is this still correct? this is no longer simple qrexec, # but qubes.VMShell self.loop.run_until_complete(self.testvm1.start()) try: (stdout, stderr) = self.loop.run_until_complete(asyncio.wait_for( self.testvm1.run_for_stdio('cat', input=TEST_DATA), timeout=10)) except asyncio.TimeoutError: self.fail( "Timeout, probably EOF wasn't transferred to the VM process") self.assertEqual(stdout, TEST_DATA, 'Received data differs from what was sent') self.assertFalse(stderr, 'Some data was printed to stderr') @unittest.skip('#2851, because there is no GUI in vm') def test_051_qrexec_simple_eof_reverse(self): """Test for EOF transmission VM->dom0""" @asyncio.coroutine def run(self): p = yield from self.testvm1.run( 'echo test; exec >&-; cat > /dev/null', stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE) # this will hang on test failure stdout = yield from asyncio.wait_for(p.stdout.read(), timeout=10) p.stdin.write(TEST_DATA) yield from p.stdin.drain() p.stdin.close() self.assertEqual(stdout.strip(), 'test', 'Received data differs from what was expected') # this may hang in some buggy cases self.assertFalse((yield from p.stderr.read()), 'Some data was printed to stderr') try: yield from asyncio.wait_for(p.wait(), timeout=1) except asyncio.TimeoutError: self.fail("Timeout, " "probably EOF wasn't transferred from the VM process") self.loop.run_until_complete(self.testvm1.start()) self.loop.run_until_complete(run(self)) @unittest.skip('#2851, because there is no GUI in vm') def test_052_qrexec_vm_service_eof(self): """Test for EOF transmission VM(src)->VM(dst)""" self.loop.run_until_complete(asyncio.wait([ self.testvm1.start(), self.testvm2.start()])) self.loop.run_until_complete(self.testvm2.run_for_stdio( 'cat > /etc/qubes-rpc/test.EOF', user='root', input=b'/bin/cat')) with self.qrexec_policy('test.EOF', self.testvm1, self.testvm2): try: stdout, _ = self.loop.run_until_complete(asyncio.wait_for( self.testvm1.run_for_stdio('''\ /usr/lib/qubes/qrexec-client-vm {} test.EOF \ /bin/sh -c 'echo test; exec >&-; cat >&$SAVED_FD_1' '''.format(self.testvm2.name)), timeout=10)) except asyncio.TimeoutError: self.fail("Timeout, probably EOF wasn't transferred") self.assertEqual(stdout, b'test', 'Received data differs from what was expected') @unittest.expectedFailure def test_053_qrexec_vm_service_eof_reverse(self): """Test for EOF transmission VM(src)<-VM(dst)""" self.loop.run_until_complete(asyncio.wait([ self.testvm1.start(), self.testvm2.start()])) self.create_remote_file(self.testvm2, '/etc/qubes-rpc/test.EOF', 'echo test; exec >&-; cat >/dev/null') with self.qrexec_policy('test.EOF', self.testvm1, self.testvm2): try: stdout, _ = self.loop.run_until_complete(asyncio.wait_for( self.testvm1.run_for_stdio('''\ /usr/lib/qubes/qrexec-client-vm {} test.EOF \ /bin/sh -c 'cat >&$SAVED_FD_1' '''.format(self.testvm2.name)), timeout=10)) except asyncio.TimeoutError: self.fail("Timeout, probably EOF wasn't transferred") self.assertEqual(stdout, b'test', 'Received data differs from what was expected') def test_055_qrexec_dom0_service_abort(self): """ Test if service abort (by dom0) is properly handled by source VM. If "remote" part of the service terminates, the source part should properly be notified. This includes closing its stdin (which is already checked by test_053_qrexec_vm_service_eof_reverse), but also its stdout - otherwise such service might hang on write(2) call. """ self.loop.run_until_complete(self.testvm1.start()) self.create_local_file('/etc/qubes-rpc/test.Abort', 'sleep 1') with self.qrexec_policy('test.Abort', self.testvm1, 'dom0'): try: stdout, _ = self.loop.run_until_complete(asyncio.wait_for( self.testvm1.run_for_stdio('''\ /usr/lib/qubes/qrexec-client-vm dom0 test.Abort \ /bin/cat /dev/zero; test $? -eq 141'''), timeout=10)) except asyncio.TimeoutError: self.fail("Timeout, probably stdout wasn't closed") def test_060_qrexec_exit_code_dom0(self): self.loop.run_until_complete(self.testvm1.start()) self.loop.run_until_complete(self.testvm1.run_for_stdio('exit 0')) with self.assertRaises(subprocess.CalledProcessError) as e: self.loop.run_until_complete(self.testvm1.run_for_stdio('exit 3')) self.assertEqual(e.exception.returncode, 3) def test_065_qrexec_exit_code_vm(self): self.loop.run_until_complete(asyncio.wait([ self.testvm1.start(), self.testvm2.start()])) with self.qrexec_policy('test.Retcode', self.testvm1, self.testvm2): self.create_remote_file(self.testvm2, '/etc/qubes-rpc/test.Retcode', 'exit 0') (stdout, stderr) = self.loop.run_until_complete( self.testvm1.run_for_stdio('''\ /usr/lib/qubes/qrexec-client-vm {} test.Retcode; echo $?'''.format(self.testvm2.name))) self.assertEqual(stdout, b'0\n') self.create_remote_file(self.testvm2, '/etc/qubes-rpc/test.Retcode', 'exit 3') (stdout, stderr) = self.loop.run_until_complete( self.testvm1.run_for_stdio('''\ /usr/lib/qubes/qrexec-client-vm {} test.Retcode; echo $?'''.format(self.testvm2.name))) self.assertEqual(stdout, b'3\n') def test_070_qrexec_vm_simultaneous_write(self): """Test for simultaneous write in VM(src)->VM(dst) connection This is regression test for #1347 Check for deadlock when initially both sides writes a lot of data (and not read anything). When one side starts reading, it should get the data and the remote side should be possible to write then more. There was a bug where remote side was waiting on write(2) and not handling anything else. """ self.loop.run_until_complete(asyncio.wait([ self.testvm1.start(), self.testvm2.start()])) self.create_remote_file(self.testvm2, '/etc/qubes-rpc/test.write', '''\ # first write a lot of data dd if=/dev/zero bs=993 count=10000 iflag=fullblock # and only then read something dd of=/dev/null bs=993 count=10000 iflag=fullblock ''') with self.qrexec_policy('test.write', self.testvm1, self.testvm2): try: self.loop.run_until_complete(asyncio.wait_for( # first write a lot of data to fill all the buffers # then after some time start reading self.testvm1.run_for_stdio('''\ /usr/lib/qubes/qrexec-client-vm {} test.write \ /bin/sh -c ' dd if=/dev/zero bs=993 count=10000 iflag=fullblock & sleep 1; dd of=/dev/null bs=993 count=10000 iflag=fullblock; wait' '''.format(self.testvm2.name)), timeout=10)) except subprocess.CalledProcessError: self.fail('Service call failed') except asyncio.TimeoutError: self.fail('Timeout, probably deadlock') @unittest.skip('localcmd= argument went away') def test_071_qrexec_dom0_simultaneous_write(self): """Test for simultaneous write in dom0(src)->VM(dst) connection Similar to test_070_qrexec_vm_simultaneous_write, but with dom0 as a source. """ def run(self): result.value = self.testvm2.run_service( "test.write", localcmd="/bin/sh -c '" # first write a lot of data to fill all the buffers "dd if=/dev/zero bs=993 count=10000 iflag=fullblock & " # then after some time start reading "sleep 1; " "dd of=/dev/null bs=993 count=10000 iflag=fullblock; " "wait" "'") self.create_remote_file(self.testvm2, '/etc/qubes-rpc/test.write', '''\ # first write a lot of data dd if=/dev/zero bs=993 count=10000 iflag=fullblock # and only then read something dd of=/dev/null bs=993 count=10000 iflag=fullblock ''') self.create_local_file('/etc/qubes-rpc/policy/test.write', '{} {} allow'.format(self.testvm1.name, self.testvm2.name)) t = multiprocessing.Process(target=run, args=(self,)) t.start() t.join(timeout=10) if t.is_alive(): t.terminate() self.fail("Timeout, probably deadlock") self.assertEqual(result.value, 0, "Service call failed") @unittest.skip('localcmd= argument went away') def test_072_qrexec_to_dom0_simultaneous_write(self): """Test for simultaneous write in dom0(src)<-VM(dst) connection Similar to test_071_qrexec_dom0_simultaneous_write, but with dom0 as a "hanging" side. """ result = multiprocessing.Value('i', -1) def run(self): result.value = self.testvm2.run_service( "test.write", localcmd="/bin/sh -c '" # first write a lot of data to fill all the buffers "dd if=/dev/zero bs=993 count=10000 iflag=fullblock " # then, only when all written, read something "dd of=/dev/null bs=993 count=10000 iflag=fullblock; " "'") self.loop.run_until_complete(self.testvm2.start()) p = self.testvm2.run("cat > /etc/qubes-rpc/test.write", user="root", passio_popen=True) # first write a lot of data p.stdin.write(b"dd if=/dev/zero bs=993 count=10000 iflag=fullblock &\n") # and only then read something p.stdin.write(b"dd of=/dev/null bs=993 count=10000 iflag=fullblock\n") p.stdin.write(b"sleep 1; \n") p.stdin.write(b"wait\n") p.stdin.close() p.wait() policy = open("/etc/qubes-rpc/policy/test.write", "w") policy.write("%s %s allow" % (self.testvm1.name, self.testvm2.name)) policy.close() self.addCleanup(os.unlink, "/etc/qubes-rpc/policy/test.write") t = multiprocessing.Process(target=run, args=(self,)) t.start() t.join(timeout=10) if t.is_alive(): t.terminate() self.fail("Timeout, probably deadlock") self.assertEqual(result.value, 0, "Service call failed") def test_080_qrexec_service_argument_allow_default(self): """Qrexec service call with argument""" self.loop.run_until_complete(asyncio.wait([ self.testvm1.start(), self.testvm2.start()])) self.create_remote_file(self.testvm2, '/etc/qubes-rpc/test.Argument', '/usr/bin/printf %s "$1"') with self.qrexec_policy('test.Argument', self.testvm1, self.testvm2): stdout, stderr = self.loop.run_until_complete( self.testvm1.run_for_stdio('/usr/lib/qubes/qrexec-client-vm ' '{} test.Argument+argument'.format(self.testvm2.name))) self.assertEqual(stdout, b'argument') def test_081_qrexec_service_argument_allow_specific(self): """Qrexec service call with argument - allow only specific value""" self.loop.run_until_complete(asyncio.wait([ self.testvm1.start(), self.testvm2.start()])) self.create_remote_file(self.testvm2, '/etc/qubes-rpc/test.Argument', '/usr/bin/printf %s "$1"') with self.qrexec_policy('test.Argument', '$anyvm', '$anyvm', False): with self.qrexec_policy('test.Argument+argument', self.testvm1.name, self.testvm2.name): stdout, stderr = self.loop.run_until_complete( self.testvm1.run_for_stdio( '/usr/lib/qubes/qrexec-client-vm ' '{} test.Argument+argument'.format(self.testvm2.name))) self.assertEqual(stdout, b'argument') def test_082_qrexec_service_argument_deny_specific(self): """Qrexec service call with argument - deny specific value""" self.loop.run_until_complete(asyncio.wait([ self.testvm1.start(), self.testvm2.start()])) self.create_remote_file(self.testvm2, '/etc/qubes-rpc/test.Argument', '/usr/bin/printf %s "$1"') with self.qrexec_policy('test.Argument', '$anyvm', '$anyvm'): with self.qrexec_policy('test.Argument+argument', self.testvm1, self.testvm2, allow=False): with self.assertRaises(subprocess.CalledProcessError, msg='Service request should be denied'): self.loop.run_until_complete( self.testvm1.run_for_stdio( '/usr/lib/qubes/qrexec-client-vm {} ' 'test.Argument+argument'.format(self.testvm2.name))) def test_083_qrexec_service_argument_specific_implementation(self): """Qrexec service call with argument - argument specific implementatation""" self.loop.run_until_complete(asyncio.wait([ self.testvm1.start(), self.testvm2.start()])) self.create_remote_file(self.testvm2, '/etc/qubes-rpc/test.Argument', '/usr/bin/printf %s "$1"') self.create_remote_file(self.testvm2, '/etc/qubes-rpc/test.Argument+argument', '/usr/bin/printf "specific: %s" "$1"') with self.qrexec_policy('test.Argument', self.testvm1, self.testvm2): stdout, stderr = self.loop.run_until_complete( self.testvm1.run_for_stdio('/usr/lib/qubes/qrexec-client-vm ' '{} test.Argument+argument'.format(self.testvm2.name))) self.assertEqual(stdout, b'specific: argument') def test_084_qrexec_service_argument_extra_env(self): """Qrexec service call with argument - extra env variables""" self.loop.run_until_complete(asyncio.wait([ self.testvm1.start(), self.testvm2.start()])) self.create_remote_file(self.testvm2, '/etc/qubes-rpc/test.Argument', '/usr/bin/printf "%s %s" ' '"$QREXEC_SERVICE_FULL_NAME" "$QREXEC_SERVICE_ARGUMENT"') with self.qrexec_policy('test.Argument', self.testvm1, self.testvm2): stdout, stderr = self.loop.run_until_complete( self.testvm1.run_for_stdio('/usr/lib/qubes/qrexec-client-vm ' '{} test.Argument+argument'.format(self.testvm2.name))) self.assertEqual(stdout, b'test.Argument+argument argument') def test_100_qrexec_filecopy(self): self.loop.run_until_complete(asyncio.wait([ self.testvm1.start(), self.testvm2.start()])) with self.qrexec_policy('qubes.Filecopy', self.testvm1, self.testvm2): try: self.loop.run_until_complete( self.testvm1.run_for_stdio( 'qvm-copy-to-vm {} /etc/passwd'.format( self.testvm2.name))) except subprocess.CalledProcessError as e: self.fail('qvm-copy-to-vm failed: {}'.format(e.stderr)) try: self.loop.run_until_complete(self.testvm2.run_for_stdio( 'diff /etc/passwd /home/user/QubesIncoming/{}/passwd'.format( self.testvm1.name))) except subprocess.CalledProcessError: self.fail('file differs') try: self.loop.run_until_complete(self.testvm1.run_for_stdio( 'test -f /etc/passwd')) except subprocess.CalledProcessError: self.fail('source file got removed') def test_105_qrexec_filemove(self): self.loop.run_until_complete(asyncio.wait([ self.testvm1.start(), self.testvm2.start()])) self.loop.run_until_complete(self.testvm1.run_for_stdio( 'cp /etc/passwd /tmp/passwd')) with self.qrexec_policy('qubes.Filecopy', self.testvm1, self.testvm2): try: self.loop.run_until_complete( self.testvm1.run_for_stdio( 'qvm-move-to-vm {} /tmp/passwd'.format( self.testvm2.name))) except subprocess.CalledProcessError as e: self.fail('qvm-move-to-vm failed: {}'.format(e.stderr)) try: self.loop.run_until_complete(self.testvm2.run_for_stdio( 'diff /etc/passwd /home/user/QubesIncoming/{}/passwd'.format( self.testvm1.name))) except subprocess.CalledProcessError: self.fail('file differs') with self.assertRaises(subprocess.CalledProcessError): self.loop.run_until_complete(self.testvm1.run_for_stdio( 'test -f /tmp/passwd')) def test_101_qrexec_filecopy_with_autostart(self): self.loop.run_until_complete(self.testvm1.start()) with self.qrexec_policy('qubes.Filecopy', self.testvm1, self.testvm2): try: self.loop.run_until_complete( self.testvm1.run_for_stdio( 'qvm-copy-to-vm {} /etc/passwd'.format( self.testvm2.name))) except subprocess.CalledProcessError as e: self.fail('qvm-copy-to-vm failed: {}'.format(e.stderr)) # workaround for libvirt bug (domain ID isn't updated when is started # from other application) - details in # QubesOS/qubes-core-libvirt@63ede4dfb4485c4161dd6a2cc809e8fb45ca664f # XXX is it still true with qubesd? --woju 20170523 self.testvm2._libvirt_domain = None self.assertTrue(self.testvm2.is_running()) try: self.loop.run_until_complete(self.testvm2.run_for_stdio( 'diff /etc/passwd /home/user/QubesIncoming/{}/passwd'.format( self.testvm1.name))) except subprocess.CalledProcessError: self.fail('file differs') try: self.loop.run_until_complete(self.testvm1.run_for_stdio( 'test -f /etc/passwd')) except subprocess.CalledProcessError: self.fail('source file got removed') def test_110_qrexec_filecopy_deny(self): self.loop.run_until_complete(asyncio.wait([ self.testvm1.start(), self.testvm2.start()])) with self.qrexec_policy('qubes.Filecopy', self.testvm1, self.testvm2, allow=False): with self.assertRaises(subprocess.CalledProcessError): self.loop.run_until_complete( self.testvm1.run_for_stdio( 'qvm-copy-to-vm {} /etc/passwd'.format( self.testvm2.name))) with self.assertRaises(subprocess.CalledProcessError): self.loop.run_until_complete(self.testvm1.run_for_stdio( 'test -d /home/user/QubesIncoming/{}'.format( self.testvm1.name))) @unittest.skip("Xen gntalloc driver crashes when page is mapped in the " "same domain") def test_120_qrexec_filecopy_self(self): self.testvm1.start() self.qrexec_policy('qubes.Filecopy', self.testvm1.name, self.testvm1.name) p = self.testvm1.run("qvm-copy-to-vm %s /etc/passwd" % self.testvm1.name, passio_popen=True, passio_stderr=True) p.wait() self.assertEqual(p.returncode, 0, "qvm-copy-to-vm failed: %s" % p.stderr.read()) retcode = self.testvm1.run( "diff /etc/passwd /home/user/QubesIncoming/{}/passwd".format( self.testvm1.name), wait=True) self.assertEqual(retcode, 0, "file differs") @unittest.skipUnless(spawn.find_executable('xdotool'), "xdotool not installed") def test_130_qrexec_filemove_disk_full(self): self.loop.run_until_complete(asyncio.wait([ self.testvm1.start(), self.testvm2.start()])) self.loop.run_until_complete(self.wait_for_session(self.testvm1)) # Prepare test file self.loop.run_until_complete(self.testvm1.run_for_stdio( 'yes teststring | dd of=/tmp/testfile bs=1M count=50 ' 'iflag=fullblock')) # Prepare target directory with limited size self.loop.run_until_complete(self.testvm2.run_for_stdio( 'mkdir -p /home/user/QubesIncoming && ' 'chown user /home/user/QubesIncoming && ' 'mount -t tmpfs none /home/user/QubesIncoming -o size=48M', user='root')) with self.qrexec_policy('qubes.Filecopy', self.testvm1, self.testvm2): with self.assertRaises(subprocess.CalledProcessError): self.loop.run_until_complete(self.testvm1.run_for_stdio( 'qvm-move-to-vm {} /tmp/testfile'.format( self.testvm2.name))) # Close GUI error message self.enter_keys_in_window('Error', ['Return']) # the file shouldn't be removed in source vm self.loop.run_until_complete(self.testvm1.run_for_stdio( 'test -f /tmp/testfile')) def test_200_timezone(self): """Test whether timezone setting is properly propagated to the VM""" if "whonix" in self.template: self.skipTest("Timezone propagation disabled on Whonix templates") self.loop.run_until_complete(self.testvm1.start()) vm_tz, _ = self.loop.run_until_complete(self.testvm1.run_for_stdio( 'date +%Z')) dom0_tz = subprocess.check_output(['date', '+%Z']) self.assertEqual(vm_tz.strip(), dom0_tz.strip()) # Check if reverting back to UTC works vm_tz, _ = self.loop.run_until_complete(self.testvm1.run_for_stdio( 'TZ=UTC date +%Z')) self.assertEqual(vm_tz.strip(), b'UTC') def test_210_time_sync(self): """Test time synchronization mechanism""" if self.template.startswith('whonix-'): self.skipTest('qvm-sync-clock disabled for Whonix VMs') self.loop.run_until_complete(asyncio.wait([ self.testvm1.start()])) start_time = subprocess.check_output(['date', '-u', '+%s']) try: self.app.clockvm = self.testvm1 self.app.save() # break vm and dom0 time, to check if qvm-sync-clock would fix it subprocess.check_call(['sudo', 'date', '-s', '2001-01-01T12:34:56'], stdout=subprocess.DEVNULL) self.loop.run_until_complete( self.testvm1.run_for_stdio('date -s 2001-01-01T12:34:56', user='root')) self.loop.run_until_complete( self.testvm1.run_for_stdio('qvm-sync-clock', user='root')) p = self.loop.run_until_complete( asyncio.create_subprocess_exec('sudo', 'qvm-sync-clock', stdout=asyncio.subprocess.DEVNULL)) self.loop.run_until_complete(p.wait()) self.assertEqual(p.returncode, 0) vm_time, _ = self.loop.run_until_complete( self.testvm1.run_for_stdio('date -u +%s')) self.assertAlmostEquals(int(vm_time), int(start_time), delta=30) dom0_time = subprocess.check_output(['date', '-u', '+%s']) self.assertAlmostEquals(int(dom0_time), int(start_time), delta=30) except: # reset time to some approximation of the real time subprocess.Popen( ["sudo", "date", "-u", "-s", "@" + start_time.decode()]) raise finally: self.app.clockvm = None @unittest.expectedFailure def test_250_resize_private_img(self): """ Test private.img resize, both offline and online :return: """ # First offline test self.testvm1.storage.resize('private', 4*1024**3) self.loop.run_until_complete(self.testvm1.start()) df_cmd = '( df --output=size /rw || df /rw | awk \'{print $2}\' )|' \ 'tail -n 1' # new_size in 1k-blocks new_size, _ = self.loop.run_until_complete( self.testvm1.run_for_stdio(df_cmd)) # some safety margin for FS metadata self.assertGreater(int(new_size.strip()), 3.8*1024**2) # Then online test self.loop.run_until_complete( self.testvm1.storage.resize('private', 6*1024**3)) # new_size in 1k-blocks new_size, _ = self.loop.run_until_complete( self.testvm1.run_for_stdio(df_cmd)) # some safety margin for FS metadata self.assertGreater(int(new_size.strip()), 5.8*1024**2) @unittest.skipUnless(spawn.find_executable('xdotool'), "xdotool not installed") def test_300_bug_1028_gui_memory_pinning(self): """ If VM window composition buffers are relocated in memory, GUI will still use old pointers and will display old pages :return: """ # this test does too much asynchronous operations, # so let's rewrite it as a coroutine and call it as such return self.loop.run_until_complete( self._test_300_bug_1028_gui_memory_pinning()) @asyncio.coroutine def _test_300_bug_1028_gui_memory_pinning(self): self.testvm1.memory = 800 self.testvm1.maxmem = 800 # exclude from memory balancing self.testvm1.features['service.meminfo-writer'] = False yield from self.testvm1.start() yield from self.wait_for_session(self.testvm1) # and allow large map count yield from self.testvm1.run('echo 256000 > /proc/sys/vm/max_map_count', user="root") allocator_c = ''' #include #include #include int main(int argc, char **argv) { int total_pages; char *addr, *iter; total_pages = atoi(argv[1]); addr = mmap(NULL, total_pages * 0x1000, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE | MAP_POPULATE, -1, 0); if (addr == MAP_FAILED) { perror("mmap"); exit(1); } printf("Stage1\\n"); fflush(stdout); getchar(); for (iter = addr; iter < addr + total_pages*0x1000; iter += 0x2000) { if (mlock(iter, 0x1000) == -1) { perror("mlock"); fprintf(stderr, "%d of %d\\n", (iter-addr)/0x1000, total_pages); exit(1); } } printf("Stage2\\n"); fflush(stdout); for (iter = addr+0x1000; iter < addr + total_pages*0x1000; iter += 0x2000) { if (munmap(iter, 0x1000) == -1) { perror(\"munmap\"); exit(1); } } printf("Stage3\\n"); fflush(stdout); fclose(stdout); getchar(); return 0; } ''' yield from self.testvm1.run_for_stdio('cat > allocator.c', input=allocator_c.encode()) try: stdout, stderr = yield from self.testvm1.run_for_stdio( 'gcc allocator.c -o allocator') except subprocess.CalledProcessError: self.skipTest('allocator compile failed: {}'.format(stderr)) # drop caches to have even more memory pressure yield from self.testvm1.run_for_stdio( 'echo 3 > /proc/sys/vm/drop_caches', user='root') # now fragment all free memory stdout, _ = yield from self.testvm1.run_for_stdio( "grep ^MemFree: /proc/meminfo|awk '{print $2}'") memory_pages = int(stdout) // 4 # 4k pages alloc1 = yield from self.testvm1.run( 'ulimit -l unlimited; exec /home/user/allocator {}'.format( memory_pages), user="root", stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE) # wait for memory being allocated; can't use just .read(), because EOF # passing is unreliable while the process is still running alloc1.stdin.write(b'\n') yield from alloc1.stdin.drain() alloc_out = yield from alloc1.stdout.read( len('Stage1\nStage2\nStage3\n')) if b'Stage3' not in alloc_out: # read stderr only in case of failed assert (), but still have nice # failure message (don't use self.fail() directly) # # stderr isn't always read, because on not-failed run, the process # is still running, so stderr.read() will wait (indefinitely). self.assertIn(b'Stage3', alloc_out, (yield from alloc1.stderr.read())) # now, launch some window - it should get fragmented composition buffer # it is important to have some changing content there, to generate # content update events (aka damage notify) proc = yield from self.testvm1.run( 'gnome-terminal --full-screen -e top') # help xdotool a little... yield from asyncio.sleep(2) # get window ID winid = yield from asyncio.get_event_loop().run_in_executor( subprocess.check_output, ['xdotool', 'search', '--sync', '--onlyvisible', '--class', self.testvm1.name + ':.*erminal']).decode() xprop = yield from asyncio.get_event_loop().run_in_executor( subprocess.check_output, ['xprop', '-notype', '-id', winid, '_QUBES_VMWINDOWID']) vm_winid = xprop.decode().strip().split(' ')[4] # now free the fragmented memory and trigger compaction alloc1.stdin.write(b'\n') yield from alloc1.stdin.drain() yield from alloc1.wait() yield from self.testvm1.run_for_stdio( 'echo 1 > /proc/sys/vm/compact_memory', user='root') # now window may be already "broken"; to be sure, allocate (=zero) # some memory alloc2 = yield from self.testvm1.run( 'ulimit -l unlimited; /home/user/allocator {}'.format(memory_pages), user='root') yield from alloc2.stdout.read(len('Stage1\n')) # wait for damage notify - top updates every 3 sec by default yield from asyncio.sleep(6) # now take screenshot of the window, from dom0 and VM # choose pnm format, as it doesn't have any useless metadata - easy # to compare vm_image, _ = yield from self.testvm1.run_for_stdio( 'import -window {} pnm:-'.format(vm_winid)) dom0_image = yield from asyncio.get_event_loop().run_in_executor( subprocess.check_output, ['import', '-window', winid, 'pnm:-']) if vm_image != dom0_image: self.fail("Dom0 window doesn't match VM window content") class TC_10_Generic(qubes.tests.SystemTestCase): def setUp(self): super(TC_10_Generic, self).setUp() self.init_default_template() self.vm = self.app.add_new_vm( qubes.vm.appvm.AppVM, name=self.make_vm_name('vm'), label='red', template=self.app.default_template) self.loop.run_until_complete(self.vm.create_on_disk()) self.app.save() self.vm = self.app.domains[self.vm.qid] def test_000_anyvm_deny_dom0(self): '''$anyvm in policy should not match dom0''' policy = open("/etc/qubes-rpc/policy/test.AnyvmDeny", "w") policy.write("%s $anyvm allow" % (self.vm.name,)) policy.close() self.addCleanup(os.unlink, "/etc/qubes-rpc/policy/test.AnyvmDeny") flagfile = '/tmp/test-anyvmdeny-flag' if os.path.exists(flagfile): os.remove(flagfile) self.create_local_file('/etc/qubes-rpc/test.AnyvmDeny', 'touch {}\necho service output\n'.format(flagfile)) self.loop.run_until_complete(self.vm.start()) with self.qrexec_policy('test.AnyvmDeny', self.vm, '$anyvm'): with self.assertRaises(subprocess.CalledProcessError, msg='$anyvm matched dom0') as e: self.loop.run_until_complete( self.vm.run_for_stdio( '/usr/lib/qubes/qrexec-client-vm dom0 test.AnyvmDeny')) stdout = e.exception.output stderr = e.exception.stderr self.assertFalse(os.path.exists(flagfile), 'Flag file created (service was run) even though should be denied,' ' qrexec-client-vm output: {} {}'.format(stdout, stderr)) def load_tests(loader, tests, pattern): for template in qubes.tests.list_templates(): tests.addTests(loader.loadTestsFromTestCase( type( 'TC_00_AppVM_' + template, (TC_00_AppVMMixin, qubes.tests.SystemTestCase), {'template': template}))) return tests