u-boot.git/test/py/tests, branch v2021.04

test: Don't unmount not (yet) mounted system

2021-03-31T11:50:17+00:00

When test suite tries to create a file for a new filesystem test case and fails,
the clean up of the exception tries to unmount the image, that has not yet been
mounted. When it happens, the fuse_mounted global variable is set to False and
inconveniently the test case tries to use sudo, so without this change the
admin of the machine gets an (annoying) email:

  Subject: *** SECURITY information for example.com ***

  example.com : Feb  5 19:43:47 : ... COMMAND=/bin/umount .../build-sandbox/persistent-data/mnt

and second run of the test cases on uncleaned build folder will ask for sudo
which is not what expected.

Besides that there is a double unmount calls during successfully run test case.

All of these due to over engineered Python try-except clause and people didn't
get it properly at all. The rule of thumb is that don't use more keywords than
try-except in the exception handling code. Nevertheless, here we adjust code
to be less intrusive to the initial logic behind that complex and unclear
constructions in the test case, although it adds a lot of lines of the code,
i.e. splits one exception handler to three, so on each step we know what
cleanup shall perform.

Signed-off-by: Andy Shevchenko 
Reviewed-by: Simon Glass

test: Include /sbin to the PATH when creating ext4 disk image

2021-03-17T16:50:19+00:00

On some distributions the mkfs.ext4 is under /sbin and /sbin is not set
for mere users. Include /sbin to the PATH when creating ext4 disk image,
so that users won't get a scary traceback from Python.

Cc: Patrick Delaunay 
Signed-off-by: Andy Shevchenko 
Reviewed-by: Simon Glass

efi_loader: correct uboot_bin_env.its file format

2021-03-07T16:37:26+00:00

Up to now the EFI capsule Python tests were always skipped. The reason is
that mkimage fails with:

uboot_bin_env.its:13.21-23.5: Warning (unit_address_vs_reg):
/images/u-boot-bin@100000: node has a unit name, but no reg property
uboot_bin_env.its:24.21-34.5: Warning (unit_address_vs_reg):
/images/u-boot-env@150000: node has a unit name, but no reg property

If a unit in a device-tree has an address, a reg property must be provided.
But adding a reg property is not the solution here.

Since 2017 unit addresses are disallowed for FIT,
cf. common/image-fit.c:1624.

So remove the unit addresses in uboot_bin_env.its.

Signed-off-by: Heinrich Schuchardt

image: Check for unit addresses in FITs

2021-02-16T03:31:54+00:00

Using unit addresses in a FIT is a security risk. Add a check for this
and disallow it.

CVE-2021-27138

Signed-off-by: Simon Glass 
Reported-by: Bruce Monroe 
Reported-by: Arie Haenel 
Reported-by: Julien Lenoir

libfdt: Check for multiple/invalid root nodes

2021-02-16T03:31:53+00:00

It is possible to construct a devicetree blob with multiple root nodes.
Update fdt_check_full() to check for this, along with a root node with an
invalid name.

CVE-2021-27097

Signed-off-by: Simon Glass 
Reported-by: Bruce Monroe 
Reported-by: Arie Haenel 
Reported-by: Julien Lenoir

test: Add tests for the 'evil' vboot attacks

2021-02-16T00:17:33+00:00

Add tests to check that these two attacks are mitigated by recent patches.

Signed-off-by: Simon Glass 
Reported-by: Bruce Monroe 
Reported-by: Arie Haenel 
Reported-by: Julien Lenoir

test: Add vboot_evil implementation

2021-02-16T00:17:29+00:00

Add a library which performs two different attacks on a FIT.

Signed-off-by: Julien Lenoir 
Signed-off-by: Bruce Monroe 
Signed-off-by: Arie Haenel 
Signed-off-by: Simon Glass

fit: Don't allow verification of images with @ nodes

2021-02-16T00:17:25+00:00

When searching for a node called 'fred', any unit address appended to the
name is ignored by libfdt, meaning that 'fred' can match 'fred@1'. This
means that we cannot be sure that the node originally intended is the one
that is used.

Disallow use of nodes with unit addresses.

Update the forge test also, since it uses @ addresses.

CVE-2021-27138

Signed-off-by: Simon Glass 
Reported-by: Bruce Monroe 
Reported-by: Arie Haenel 
Reported-by: Julien Lenoir

test: Update test_fs to not use deprecated pytest.yield_fixture()

2021-01-29T15:36:49+00:00

As noted in comments, yield_fixture has been deprecated for longer than
our minimum required version of pytest.  Newer versions of pytest cause
this to be a louder warning, and as the migration is trivial, perform it
now.

Signed-off-by: Tom Rini

test: test_ofplatdata: Mark as sandbox specific

2021-01-29T15:34:34+00:00

This test checks for output specific to the sandbox device tree, mark it
as sandbox specific.

Signed-off-by: Tom Rini