dom0_update.py 15 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375
  1. #
  2. # The Qubes OS Project, http://www.qubes-os.org
  3. #
  4. # Copyright (C) 2015 Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
  5. #
  6. # This program is free software; you can redistribute it and/or
  7. # modify it under the terms of the GNU General Public License
  8. # as published by the Free Software Foundation; either version 2
  9. # of the License, or (at your option) any later version.
  10. #
  11. # This program is distributed in the hope that it will be useful,
  12. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  13. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  14. # GNU General Public License for more details.
  15. #
  16. # You should have received a copy of the GNU General Public License
  17. # along with this program; if not, write to the Free Software
  18. # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
  19. # USA.
  20. #
  21. import os
  22. import shutil
  23. import subprocess
  24. import tempfile
  25. import unittest
  26. import qubes
  27. VM_PREFIX = "test-"
  28. @unittest.skipUnless(os.path.exists('/usr/bin/rpmsign') and
  29. os.path.exists('/usr/bin/rpmbuild'),
  30. 'rpm-sign and/or rpm-build not installed')
  31. class TC_00_Dom0UpgradeMixin(object):
  32. """
  33. Tests for downloading dom0 updates using VMs based on different templates
  34. """
  35. pkg_name = 'qubes-test-pkg'
  36. dom0_update_common_opts = ['--disablerepo=*', '--enablerepo=test']
  37. update_flag_path = '/var/lib/qubes/updates/dom0-updates-available'
  38. @classmethod
  39. def generate_key(cls, keydir):
  40. gpg_opts = ['gpg', '--quiet', '--no-default-keyring',
  41. '--homedir', keydir]
  42. p = subprocess.Popen(gpg_opts + ['--gen-key', '--batch'],
  43. stdin=subprocess.PIPE,
  44. stderr=open(os.devnull, 'w'))
  45. p.stdin.write('''
  46. Key-Type: RSA
  47. Key-Length: 1024
  48. Key-Usage: sign
  49. Name-Real: Qubes test
  50. Expire-Date: 0
  51. %commit
  52. '''.format(keydir=keydir).encode())
  53. p.stdin.close()
  54. p.wait()
  55. subprocess.check_call(gpg_opts + ['-a', '--export',
  56. '--output', os.path.join(keydir, 'pubkey.asc')])
  57. p = subprocess.Popen(gpg_opts + ['--with-colons', '--list-keys'],
  58. stdout=subprocess.PIPE)
  59. for line in p.stdout.readlines():
  60. fields = line.decode().split(':')
  61. if fields[0] == 'pub':
  62. return fields[4][-8:].lower()
  63. raise RuntimeError
  64. @classmethod
  65. def setUpClass(cls):
  66. super(TC_00_Dom0UpgradeMixin, cls).setUpClass()
  67. cls.tmpdir = tempfile.mkdtemp()
  68. cls.keyid = cls.generate_key(cls.tmpdir)
  69. p = subprocess.Popen(['sudo', 'dd',
  70. 'status=none', 'of=/etc/yum.repos.d/test.repo'],
  71. stdin=subprocess.PIPE)
  72. p.stdin.write(b'''
  73. [test]
  74. name = Test
  75. baseurl = http://localhost:8080/
  76. enabled = 1
  77. ''')
  78. p.stdin.close()
  79. p.wait()
  80. @classmethod
  81. def tearDownClass(cls):
  82. subprocess.check_call(['sudo', 'rm', '-f',
  83. '/etc/yum.repos.d/test.repo'])
  84. shutil.rmtree(cls.tmpdir)
  85. def setUp(self):
  86. super(TC_00_Dom0UpgradeMixin, self).setUp()
  87. if self.template.startswith('whonix-'):
  88. # Whonix redirect all the traffic through tor, so repository
  89. # on http://localhost:8080/ is unavailable
  90. self.skipTest("Test not supported for this template")
  91. self.init_default_template(self.template)
  92. self.updatevm = self.app.add_new_vm(
  93. qubes.vm.appvm.AppVM,
  94. name=self.make_vm_name("updatevm"),
  95. label='red'
  96. )
  97. self.loop.run_until_complete(self.updatevm.create_on_disk())
  98. self.app.updatevm = self.updatevm
  99. self.app.save()
  100. subprocess.call(['sudo', 'rpm', '-e', self.pkg_name],
  101. stderr=open(os.devnull, 'w'))
  102. subprocess.check_call(['sudo', 'rpm', '--import',
  103. os.path.join(self.tmpdir, 'pubkey.asc')])
  104. self.loop.run_until_complete(self.updatevm.start())
  105. self.repo_running = False
  106. def tearDown(self):
  107. super(TC_00_Dom0UpgradeMixin, self).tearDown()
  108. subprocess.call(['sudo', 'rpm', '-e', self.pkg_name], stderr=open(
  109. os.devnull, 'w'))
  110. subprocess.call(['sudo', 'rpm', '-e', 'gpg-pubkey-{}'.format(
  111. self.keyid)], stderr=open(os.devnull, 'w'))
  112. for pkg in os.listdir(self.tmpdir):
  113. if pkg.endswith('.rpm'):
  114. os.unlink(pkg)
  115. def create_pkg(self, dir, name, version):
  116. spec_path = os.path.join(dir, name+'.spec')
  117. spec = open(spec_path, 'w')
  118. spec.write(
  119. '''
  120. Name: {name}
  121. Summary: Test Package
  122. Version: {version}
  123. Release: 1
  124. Vendor: Invisible Things Lab
  125. License: GPL
  126. Group: Qubes
  127. URL: http://www.qubes-os.org
  128. %description
  129. Test package
  130. %install
  131. %files
  132. '''.format(name=name, version=version)
  133. )
  134. spec.close()
  135. subprocess.check_call(
  136. ['rpmbuild', '--quiet', '-bb', '--define', '_rpmdir {}'.format(dir),
  137. spec_path])
  138. pkg_path = os.path.join(dir, 'x86_64',
  139. '{}-{}-1.x86_64.rpm'.format(name, version))
  140. subprocess.check_call(['sudo', 'chmod', 'go-rw', '/dev/tty'])
  141. subprocess.check_call(
  142. ['rpm', '--quiet', '--define=_gpg_path {}'.format(dir),
  143. '--define=_gpg_name {}'.format("Qubes test"),
  144. '--addsign', pkg_path],
  145. stdin=open(os.devnull),
  146. stdout=open(os.devnull, 'w'),
  147. stderr=subprocess.STDOUT)
  148. subprocess.check_call(['sudo', 'chmod', 'go+rw', '/dev/tty'])
  149. return pkg_path
  150. def send_pkg(self, filename):
  151. self.loop.run_until_complete(self.updatevm.run_for_stdio(
  152. 'mkdir -p /tmp/repo; cat > /tmp/repo/{}'.format(
  153. os.path.basename(filename)),
  154. input=open(filename, 'rb').read()))
  155. try:
  156. self.loop.run_until_complete(
  157. self.updatevm.run_for_stdio('cd /tmp/repo; createrepo .'))
  158. except subprocess.CalledProcessError as e:
  159. if e.returncode == 127:
  160. self.skipTest('createrepo not installed in template {}'.format(
  161. self.template))
  162. else:
  163. self.skipTest('createrepo failed with code {}, '
  164. 'cannot perform the test'.format(retcode))
  165. self.start_repo()
  166. def start_repo(self):
  167. if self.repo_running:
  168. return
  169. self.loop.run_until_complete(self.updatevm.run(
  170. 'cd /tmp/repo && python -m SimpleHTTPServer 8080'))
  171. self.repo_running = True
  172. def test_000_update(self):
  173. """Dom0 update tests
  174. Check if package update is:
  175. - detected
  176. - installed
  177. - "updates pending" flag is cleared
  178. """
  179. filename = self.create_pkg(self.tmpdir, self.pkg_name, '1.0')
  180. subprocess.check_call(['sudo', 'rpm', '-i', filename])
  181. filename = self.create_pkg(self.tmpdir, self.pkg_name, '2.0')
  182. self.send_pkg(filename)
  183. open(self.update_flag_path, 'a').close()
  184. logpath = os.path.join(self.tmpdir, 'dom0-update-output.txt')
  185. try:
  186. subprocess.check_call(['sudo', '-E', 'qubes-dom0-update', '-y'] +
  187. self.dom0_update_common_opts,
  188. stdout=open(logpath, 'w'),
  189. stderr=subprocess.STDOUT)
  190. except subprocess.CalledProcessError:
  191. self.fail("qubes-dom0-update failed: " + open(
  192. logpath).read())
  193. retcode = subprocess.call(['rpm', '-q', '{}-1.0'.format(
  194. self.pkg_name)], stdout=open(os.devnull, 'w'))
  195. self.assertEqual(retcode, 1, 'Package {}-1.0 still installed after '
  196. 'update'.format(self.pkg_name))
  197. retcode = subprocess.call(['rpm', '-q', '{}-2.0'.format(
  198. self.pkg_name)], stdout=open(os.devnull, 'w'))
  199. self.assertEqual(retcode, 0, 'Package {}-2.0 not installed after '
  200. 'update'.format(self.pkg_name))
  201. self.assertFalse(os.path.exists(self.update_flag_path),
  202. "'updates pending' flag not cleared")
  203. def test_005_update_flag_clear(self):
  204. """Check if 'updates pending' flag is creared"""
  205. # create any pkg (but not install it) to initialize repo in the VM
  206. filename = self.create_pkg(self.tmpdir, self.pkg_name, '1.0')
  207. self.send_pkg(filename)
  208. open(self.update_flag_path, 'a').close()
  209. logpath = os.path.join(self.tmpdir, 'dom0-update-output.txt')
  210. try:
  211. subprocess.check_call(['sudo', '-E', 'qubes-dom0-update', '-y'] +
  212. self.dom0_update_common_opts,
  213. stdout=open(logpath, 'w'),
  214. stderr=subprocess.STDOUT)
  215. except subprocess.CalledProcessError:
  216. self.fail("qubes-dom0-update failed: " + open(
  217. logpath).read())
  218. with open(logpath) as f:
  219. dom0_update_output = f.read()
  220. self.assertFalse('Errno' in dom0_update_output or
  221. 'Couldn\'t' in dom0_update_output,
  222. "qubes-dom0-update reported an error: {}".
  223. format(dom0_update_output))
  224. self.assertFalse(os.path.exists(self.update_flag_path),
  225. "'updates pending' flag not cleared")
  226. def test_006_update_flag_clear(self):
  227. """Check if 'updates pending' flag is creared, using --clean"""
  228. # create any pkg (but not install it) to initialize repo in the VM
  229. filename = self.create_pkg(self.tmpdir, self.pkg_name, '1.0')
  230. self.send_pkg(filename)
  231. open(self.update_flag_path, 'a').close()
  232. # remove also repodata to test #1685
  233. if os.path.exists('/var/lib/qubes/updates/repodata'):
  234. shutil.rmtree('/var/lib/qubes/updates/repodata')
  235. logpath = os.path.join(self.tmpdir, 'dom0-update-output.txt')
  236. try:
  237. subprocess.check_call(['sudo', '-E', 'qubes-dom0-update', '-y',
  238. '--clean'] +
  239. self.dom0_update_common_opts,
  240. stdout=open(logpath, 'w'),
  241. stderr=subprocess.STDOUT)
  242. except subprocess.CalledProcessError:
  243. self.fail("qubes-dom0-update failed: " + open(
  244. logpath).read())
  245. with open(logpath) as f:
  246. dom0_update_output = f.read()
  247. self.assertFalse('Errno' in dom0_update_output or
  248. 'Couldn\'t' in dom0_update_output,
  249. "qubes-dom0-update reported an error: {}".
  250. format(dom0_update_output))
  251. self.assertFalse(os.path.exists(self.update_flag_path),
  252. "'updates pending' flag not cleared")
  253. def test_010_instal(self):
  254. filename = self.create_pkg(self.tmpdir, self.pkg_name, '1.0')
  255. self.send_pkg(filename)
  256. logpath = os.path.join(self.tmpdir, 'dom0-update-output.txt')
  257. try:
  258. subprocess.check_call(['sudo', '-E', 'qubes-dom0-update', '-y'] +
  259. self.dom0_update_common_opts + [
  260. self.pkg_name],
  261. stdout=open(logpath, 'w'),
  262. stderr=subprocess.STDOUT)
  263. except subprocess.CalledProcessError:
  264. self.fail("qubes-dom0-update failed: " + open(
  265. logpath).read())
  266. retcode = subprocess.call(['rpm', '-q', '{}-1.0'.format(
  267. self.pkg_name)], stdout=open('/dev/null', 'w'))
  268. self.assertEqual(retcode, 0, 'Package {}-1.0 not installed'.format(
  269. self.pkg_name))
  270. def test_020_install_wrong_sign(self):
  271. subprocess.call(['sudo', 'rpm', '-e', 'gpg-pubkey-{}'.format(
  272. self.keyid)])
  273. filename = self.create_pkg(self.tmpdir, self.pkg_name, '1.0')
  274. self.send_pkg(filename)
  275. logpath = os.path.join(self.tmpdir, 'dom0-update-output.txt')
  276. try:
  277. subprocess.check_call(['sudo', '-E', 'qubes-dom0-update', '-y'] +
  278. self.dom0_update_common_opts + [
  279. self.pkg_name],
  280. stdout=open(logpath, 'w'),
  281. stderr=subprocess.STDOUT)
  282. self.fail("qubes-dom0-update unexpectedly succeeded: " + open(
  283. logpath).read())
  284. except subprocess.CalledProcessError:
  285. pass
  286. retcode = subprocess.call(['rpm', '-q', '{}-1.0'.format(
  287. self.pkg_name)], stdout=open('/dev/null', 'w'))
  288. self.assertEqual(retcode, 1,
  289. 'Package {}-1.0 installed although '
  290. 'signature is invalid'.format(self.pkg_name))
  291. def test_030_install_unsigned(self):
  292. filename = self.create_pkg(self.tmpdir, self.pkg_name, '1.0')
  293. subprocess.check_call(['rpm', '--delsign', filename],
  294. stdout=open(os.devnull, 'w'),
  295. stderr=subprocess.STDOUT)
  296. self.send_pkg(filename)
  297. logpath = os.path.join(self.tmpdir, 'dom0-update-output.txt')
  298. try:
  299. subprocess.check_call(['sudo', '-E', 'qubes-dom0-update', '-y'] +
  300. self.dom0_update_common_opts +
  301. [self.pkg_name],
  302. stdout=open(logpath, 'w'),
  303. stderr=subprocess.STDOUT
  304. )
  305. self.fail("qubes-dom0-update unexpectedly succeeded: " + open(
  306. logpath).read())
  307. except subprocess.CalledProcessError:
  308. pass
  309. retcode = subprocess.call(['rpm', '-q', '{}-1.0'.format(
  310. self.pkg_name)], stdout=open('/dev/null', 'w'))
  311. self.assertEqual(retcode, 1,
  312. 'UNSIGNED package {}-1.0 installed'.format(self.pkg_name))
  313. def load_tests(loader, tests, pattern):
  314. try:
  315. app = qubes.Qubes()
  316. templates = [vm.name for vm in app.domains if
  317. isinstance(vm, qubes.vm.templatevm.TemplateVM)]
  318. except OSError:
  319. templates = []
  320. for template in templates:
  321. tests.addTests(loader.loadTestsFromTestCase(
  322. type(
  323. 'TC_00_Dom0Upgrade_' + template,
  324. (TC_00_Dom0UpgradeMixin, qubes.tests.SystemTestCase),
  325. {'template': template})))
  326. return tests