diff --git a/.gitlab/tests/cram/generic/acceleration-plan-components/110-data-model-mapper.t b/.gitlab/tests/cram/generic/acceleration-plan-components/110-data-model-mapper.t index 2d744b8c0f..ecacad61e6 100644 --- a/.gitlab/tests/cram/generic/acceleration-plan-components/110-data-model-mapper.t +++ b/.gitlab/tests/cram/generic/acceleration-plan-components/110-data-model-mapper.t @@ -51,10 +51,12 @@ Check command tree is available: Device.X_PRPLWARE-COM_SoftwareModules.DeploymentUnitUpdateCmd.Input.ModuleVersion="" Device.X_PRPLWARE-COM_SoftwareModules.DeploymentUnitUpdateCmd.Input.OptionalRoles="" Device.X_PRPLWARE-COM_SoftwareModules.DeploymentUnitUpdateCmd.Input.Password="" + Device.X_PRPLWARE-COM_SoftwareModules.DeploymentUnitUpdateCmd.Input.RegisterTrustPaths="" Device.X_PRPLWARE-COM_SoftwareModules.DeploymentUnitUpdateCmd.Input.RequiredRoles="" Device.X_PRPLWARE-COM_SoftwareModules.DeploymentUnitUpdateCmd.Input.RetainData=0 Device.X_PRPLWARE-COM_SoftwareModules.DeploymentUnitUpdateCmd.Input.URL="" Device.X_PRPLWARE-COM_SoftwareModules.DeploymentUnitUpdateCmd.Input.Username="" + Device.X_PRPLWARE-COM_SoftwareModules.DeploymentUnitUpdateCmd.Input.X_PRPLWARE-COM_AutoMountIPC="" Device.X_PRPLWARE-COM_SoftwareModules.DeploymentUnitUpdateCmd.Input.NetworkConfig. Device.X_PRPLWARE-COM_SoftwareModules.DeploymentUnitUpdateCmd.Input.NetworkConfig.AccessInterfaces="" Device.X_PRPLWARE-COM_SoftwareModules.ExecEnvDeleteCmd. @@ -83,11 +85,13 @@ Check command tree is available: Device.X_PRPLWARE-COM_SoftwareModules.InstallDUCmd.Input.OptionalRoles="" Device.X_PRPLWARE-COM_SoftwareModules.InstallDUCmd.Input.Password="" Device.X_PRPLWARE-COM_SoftwareModules.InstallDUCmd.Input.Privileged=1 + Device.X_PRPLWARE-COM_SoftwareModules.InstallDUCmd.Input.RegisterTrustPaths="" Device.X_PRPLWARE-COM_SoftwareModules.InstallDUCmd.Input.RequiredRoles="" Device.X_PRPLWARE-COM_SoftwareModules.InstallDUCmd.Input.Signature="" Device.X_PRPLWARE-COM_SoftwareModules.InstallDUCmd.Input.URL="" Device.X_PRPLWARE-COM_SoftwareModules.InstallDUCmd.Input.UUID="" Device.X_PRPLWARE-COM_SoftwareModules.InstallDUCmd.Input.Username="" + Device.X_PRPLWARE-COM_SoftwareModules.InstallDUCmd.Input.X_PRPLWARE-COM_AutoMountIPC="" Device.X_PRPLWARE-COM_SoftwareModules.InstallDUCmd.Input.NetworkConfig. Device.X_PRPLWARE-COM_SoftwareModules.InstallDUCmd.Input.NetworkConfig.AccessInterfaces="" Device.X_PRPLWARE-COM_SoftwareModules.ModifyAvailableRolesCmd. diff --git a/.gitlab/tests/cram/generic/fixtures/obuspa.expected b/.gitlab/tests/cram/generic/fixtures/obuspa.expected index 249a4992e1..48d69b1c17 100644 --- a/.gitlab/tests/cram/generic/fixtures/obuspa.expected +++ b/.gitlab/tests/cram/generic/fixtures/obuspa.expected @@ -3080,11 +3080,13 @@ Device.SoftwareModules.DeploymentUnit.{i}.Update() input:NumRequiredUIDs Device.SoftwareModules.DeploymentUnit.{i}.Update() input:OptionalRoles Device.SoftwareModules.DeploymentUnit.{i}.Update() input:Password Device.SoftwareModules.DeploymentUnit.{i}.Update() input:Privileged +Device.SoftwareModules.DeploymentUnit.{i}.Update() input:RegisterTrustPaths Device.SoftwareModules.DeploymentUnit.{i}.Update() input:RequiredRoles Device.SoftwareModules.DeploymentUnit.{i}.Update() input:RequiredUserRoles Device.SoftwareModules.DeploymentUnit.{i}.Update() input:RetainData Device.SoftwareModules.DeploymentUnit.{i}.Update() input:URL Device.SoftwareModules.DeploymentUnit.{i}.Update() input:Username +Device.SoftwareModules.DeploymentUnit.{i}.Update() input:X_PRPLWARE-COM_AutoMountIPC Device.SoftwareModules.DeploymentUnit.{i}.Vendor proto::timingila Device.SoftwareModules.DeploymentUnit.{i}.VendorConfigList proto::timingila Device.SoftwareModules.DeploymentUnit.{i}.VendorLogList proto::timingila @@ -3193,6 +3195,7 @@ Device.SoftwareModules.ExecutionUnit.{i}.NetworkConfig.PortForwarding.{i}.Intern Device.SoftwareModules.ExecutionUnit.{i}.NetworkConfig.PortForwarding.{i}.Protocol proto::timingila Device.SoftwareModules.ExecutionUnit.{i}.NetworkConfig.X_PRPLWARE-COM_DNSSDRefList proto::timingila Device.SoftwareModules.ExecutionUnit.{i}.References proto::timingila +Device.SoftwareModules.ExecutionUnit.{i}.RegisterTrustPaths proto::timingila Device.SoftwareModules.ExecutionUnit.{i}.RequiredUserRoles proto::timingila Device.SoftwareModules.ExecutionUnit.{i}.RunLevel proto::timingila Device.SoftwareModules.ExecutionUnit.{i}.SetRequestedState() proto::timingila @@ -3203,6 +3206,7 @@ Device.SoftwareModules.ExecutionUnit.{i}.Vendor Device.SoftwareModules.ExecutionUnit.{i}.VendorConfigList proto::timingila Device.SoftwareModules.ExecutionUnit.{i}.VendorLogList proto::timingila Device.SoftwareModules.ExecutionUnit.{i}.Version proto::timingila +Device.SoftwareModules.ExecutionUnit.{i}.X_PRPLWARE-COM_AutoMountIPC proto::timingila Device.SoftwareModules.ExecutionUnitNumberOfEntries proto::timingila Device.SoftwareModules.InstallDU() proto::timingila Device.SoftwareModules.InstallDU() input:AllocatedCPUPercent @@ -3221,12 +3225,14 @@ Device.SoftwareModules.InstallDU() input:NumRequiredUIDs Device.SoftwareModules.InstallDU() input:OptionalRoles Device.SoftwareModules.InstallDU() input:Password Device.SoftwareModules.InstallDU() input:Privileged +Device.SoftwareModules.InstallDU() input:RegisterTrustPaths Device.SoftwareModules.InstallDU() input:RequiredRoles Device.SoftwareModules.InstallDU() input:RequiredUserRoles Device.SoftwareModules.InstallDU() input:Signature Device.SoftwareModules.InstallDU() input:URL Device.SoftwareModules.InstallDU() input:UUID Device.SoftwareModules.InstallDU() input:Username +Device.SoftwareModules.InstallDU() input:X_PRPLWARE-COM_AutoMountIPC Device.SoftwareModules.LocalManagement. proto::timingila Device.SoftwareModules.LocalManagement.Action.{i}. proto::timingila Device.SoftwareModules.LocalManagement.Action.{i}.Action proto::timingila diff --git a/.gitlab/tests/cram/generic/lcm/035-lcm-usp.t b/.gitlab/tests/cram/generic/lcm/035-lcm-usp.t index 779f5afb74..ea3ecef411 100644 --- a/.gitlab/tests/cram/generic/lcm/035-lcm-usp.t +++ b/.gitlab/tests/cram/generic/lcm/035-lcm-usp.t @@ -37,6 +37,7 @@ Check that UDS sockets and the random USP_ENDPOINT_ID are shared with the contai $ R "${S} && execute_in_container --uuid --cmd \"ls /run/usp/\"" broker_agent_path broker_controller_path + sockets ## TODO: ## add test to check connection to USP broker: This is requiring support of USP in the test container @@ -89,6 +90,7 @@ Check that UDS sockets and the random USP_ENDPOINT_ID are shared with the contai $ R "${S} && execute_in_container --uuid --cmd \"ls /run/usp/\"" broker_agent_path broker_controller_path + sockets ## TODO: add test to check connection to USP broker: This is requiring support of USP in the test container diff --git a/.gitlab/tests/cram/generic/lcm/036-lcm-usp-auth.t b/.gitlab/tests/cram/generic/lcm/036-lcm-usp-auth.t new file mode 100644 index 0000000000..6d8385df2e --- /dev/null +++ b/.gitlab/tests/cram/generic/lcm/036-lcm-usp-auth.t @@ -0,0 +1,199 @@ +## Setup test configuration +Setup the test configuration: + + $ alias R="${CRAM_REMOTE_COMMAND:-}" + $ alias C="${CRAM_REMOTE_COPY:-}" + $ S=". /tmp/script_functions.sh" + $ C ${TESTDIR}/script_functions.sh root@${TARGET_LAN_IP}:/tmp/script_functions.sh 2>/dev/null +## FIXME: `get_arch_name` function returns wrong arch name for freedom board + $ BOARD_ARCH=$(R "${S} && get_true_arch_name") + $ SERVICE_URL="docker://registry.gitlab.com/prpl-foundation/prplos/prplos/${BOARD_ARCH}/image-lcmsampleapp-auth-supported:latest" + + +Set-up ExecEnv configuration + + $ R "${S} && set_ee_roles --roles \"Full Access\"" > /dev/null + $ R "${S} && check_available_roles --ee" + Device.LocalAgent.ControllerTrust.Role.1. + +### TRUSTED SERVICE SECTION ### +Install the container and check its status and type: + + $ R "${S} && install_ctr --url ${SERVICE_URL} --ee --uuid --privileged true --usprequired \"Full Access\"" > /dev/null + $ R "${S} && get_container_info --uuid" + Active + latest + prpl-foundation/prplos/prplos/*/image-lcmsampleapp* (glob) + $ R "${S} && get_ctr_type --uuid" + Privileged container + +Check that the container has the expected EndpointID, AutoMountIPC value: + + $ CTR_ID=$(R "${S} && get_container_parameter --uuid --param EUID") + $ R "ba-cli -l 'Cthulhu.Container.Instances.[ContainerId==\"$CTR_ID\"].AutoMountIPC?' | sed '/^$/d'" + USP_UDS_Unauthenticated + $ R "ba-cli -l 'Cthulhu.Container.Instances.[ContainerId==\"$CTR_ID\"].EndpointID?' | sed '/^$/d'" + uuid::* (glob) + $ R "ba-cli -l 'Device.SoftwareModules.ExecutionUnit.[EUID==\"$CTR_ID\"].X_PRPLWARE-COM_AutoMountIPC?' | sed '/^$/d'" + USP_UDS_Unauthenticated + $ R "ba-cli -l 'Device.SoftwareModules.ExecutionUnit.[EUID==\"$CTR_ID\"].RegisterTrustPaths?' | sed '/^$/d'" + +Check that trusted UDS sockets are mounted in the container: + + $ R "${S} && execute_in_container --uuid --cmd 'mount | grep usp'" + tmpfs on /run/usp type tmpfs* (glob) + +Check that service model is accessible on USP bus: + + $ R "usp-cli -lj Device.LCMSampleApp.? | sed '/^$/d'" + [{"Device.LCMSampleApp.":{"NumberOfDummyMultiInstances":0,"DummyGlobalString":"","DummyGlobalInt":0}}] + +Stop the container and check its status: + + $ R "${S} && stop_ctr --uuid" > /dev/null + $ R "${S} && get_container_info --uuid" + Idle + latest + prpl-foundation/prplos/prplos/*/image-lcmsampleapp* (glob) + +Uninstall the container and check everything is cleaned: + + $ R "${S} && uninstall_ctr_and_check --uuid" + [1] + + +### UNTRUSTED SERVICE SECTION ### +Install the container as untrusted and check its status and type: + + $ R "${S} && install_ctr --url ${SERVICE_URL} --ee --uuid --privileged true --usprequired \"Full Access\" --uspregisterpaths \"Device.LCMSampleApp.\" --uspautomountipc \"USP_UDS_Authenticated\"" > /dev/null + $ R "${S} && get_container_info --uuid" + Active + latest + prpl-foundation/prplos/prplos/*/image-lcmsampleapp* (glob) + $ R "${S} && get_ctr_type --uuid" + Privileged container + +Check that the container has the expected EndpointID, AutoMountIPC and RegisterTrustPaths values: + + $ CTR_ID=$(R "${S} && get_container_parameter --uuid --param EUID") + $ CTR_ENDPOINTID=$(R "ba-cli -l 'Cthulhu.Container.Instances.[ContainerId==\"${CTR_ID}\"].EndpointID?' | sed '/^$/d'") + $ R "ba-cli -l 'Cthulhu.Container.Instances.[ContainerId==\"${CTR_ID}\"].EndpointID?' | sed '/^$/d'" + uuid::* (glob) + $ R "ba-cli -l 'Cthulhu.Container.Instances.[ContainerId==\"${CTR_ID}\"].AutoMountIPC?' | sed '/^$/d'" + USP_UDS_Authenticated + $ R "ba-cli -l 'Cthulhu.Container.Instances.[ContainerId==\"${CTR_ID}\"].RegisterTrustPaths?' | sed '/^$/d'" + Device.LCMSampleApp. + $ R "ba-cli -l 'Device.SoftwareModules.ExecutionUnit.[EUID==\"$CTR_ID\"].X_PRPLWARE-COM_AutoMountIPC?' | sed '/^$/d'" + USP_UDS_Authenticated + $ R "ba-cli -l 'Device.SoftwareModules.ExecutionUnit.[EUID==\"$CTR_ID\"].RegisterTrustPaths?' | sed '/^$/d'" + Device.LCMSampleApp. + +Check that untrusted UDS sockets are mounted in the container: + + $ R "${S} && execute_in_container --uuid --cmd 'mount | grep usp'" + tmpfs on /run/usp/sockets/authenticated/broker_controller* (glob) + tmpfs on /run/usp/sockets/authenticated/broker_agent* (glob) + +Check that Device.USPServices.Trust model is filled on USP bus: + + $ R "usp-cli -lj 'Device.USPServices.Trust.[EndpointID==\"${CTR_ENDPOINTID}\"].?' | sed '/^$/d'" + [{"Device.USPServices.Trust.*.":{"TargetPaths":"Device.LCMSampleApp.","EndpointID":"*"}}] (glob) + +Check that Device.UnixDomainSockets.Authentication model is filled on USP bus: + + $ R "usp-cli -lj 'Device.UnixDomainSockets.Authentication.[EndpointID==\"${CTR_ENDPOINTID}\"].?' | sed '/^$/d'" + [{"Device.UnixDomainSockets.Authentication.*.":{"Enable":true,"Password":"*","EndpointID":"*"}}] (glob) + +Check that service model is accessible on USP bus: + + $ R "usp-cli -lj Device.LCMSampleApp.? | sed '/^$/d'" + [{"Device.LCMSampleApp.":{"NumberOfDummyMultiInstances":0,"DummyGlobalString":"","DummyGlobalInt":0}}] + +Stop the container and check its status: + + $ R "${S} && stop_ctr --uuid" > /dev/null + $ R "${S} && get_container_info --uuid" + Idle + latest + prpl-foundation/prplos/prplos/*/image-lcmsampleapp* (glob) + +Check that Device.USPServices.Trust instance still exists on USP bus: + + $ R "usp-cli -lj 'Device.USPServices.Trust.[EndpointID==\"${CTR_ENDPOINTID}\"].?' | sed '/^$/d'" + [{"Device.USPServices.Trust.*.":{"TargetPaths":"Device.LCMSampleApp.","EndpointID":"*"}}] (glob) + +Check that Device.UnixDomainSockets.Authentication instance is removed from USP bus: + + $ R "usp-cli -lj 'Device.UnixDomainSockets.Authentication.[EndpointID==\"${CTR_ENDPOINTID}\"].?' | sed '/^$/d'" + [{}] + + +Uninstall the container and check everything is cleaned: + + $ R "${S} && uninstall_ctr_and_check --uuid" + [1] + $ R "usp-cli -lj 'Device.USPServices.Trust.[EndpointID==\"${CTR_ENDPOINTID}\"].?' | sed '/^$/d'" + [{}] + +Check that trusted service can be updated to untrusted: + + $ R "${S} && install_ctr --url ${SERVICE_URL} --ee --uuid --privileged true --usprequired \"Full Access\"" > /dev/null + $ R "${S} && get_container_info --uuid" + Active + latest + prpl-foundation/prplos/prplos/*/image-lcmsampleapp* (glob) + $ CTR_ID=$(R "${S} && get_container_parameter --uuid --param EUID") + $ CTR_ENDPOINTID=$(R "ba-cli -l 'Cthulhu.Container.Instances.[ContainerId==\"${CTR_ID}\"].EndpointID?' | sed '/^$/d'") + $ R "ba-cli -l 'Cthulhu.Container.Instances.[ContainerId==\"${CTR_ID}\"].EndpointID?' | sed '/^$/d'" + uuid::* (glob) + $ R "ba-cli -l 'Cthulhu.Container.Instances.[ContainerId==\"${CTR_ID}\"].AutoMountIPC?' | sed '/^$/d'" + USP_UDS_Unauthenticated + $ R "${S} && update_ctr --url ${SERVICE_URL} --ee --uuid --privileged true --usprequired \"Full Access\" --uspregisterpaths \"Device.LCMSampleApp.\" --uspautomountipc \"USP_UDS_Authenticated\"" > /dev/null + $ R "${S} && get_container_info --uuid" + Active + latest + prpl-foundation/prplos/prplos/*/image-lcmsampleapp* (glob) + $ R "ba-cli -l 'Cthulhu.Container.Instances.[ContainerId==\"${CTR_ID}\"].EndpointID?' | sed '/^$/d'" + uuid::* (glob) + $ R "ba-cli -l 'Cthulhu.Container.Instances.[ContainerId==\"${CTR_ID}\"].AutoMountIPC?' | sed '/^$/d'" + USP_UDS_Authenticated + $ R "ba-cli -l 'Cthulhu.Container.Instances.[ContainerId==\"${CTR_ID}\"].RegisterTrustPaths?' | sed '/^$/d'" + Device.LCMSampleApp. + $ R "ba-cli -l 'Device.SoftwareModules.ExecutionUnit.[EUID==\"$CTR_ID\"].X_PRPLWARE-COM_AutoMountIPC?' | sed '/^$/d'" + USP_UDS_Authenticated + $ R "ba-cli -l 'Device.SoftwareModules.ExecutionUnit.[EUID==\"$CTR_ID\"].RegisterTrustPaths?' | sed '/^$/d'" + Device.LCMSampleApp. + +Check that EndpointID remains the same after update: + + $ CTR_ENDPOINTID_UPDATED=$(R "ba-cli -l 'Cthulhu.Container.Instances.[ContainerId==\"${CTR_ID}\"].EndpointID?' | sed '/^$/d'") + $ [ ${CTR_ENDPOINTID} = ${CTR_ENDPOINTID_UPDATED} ] && echo 'OK' || echo 'FAIL' + OK + +Check that untrusted UDS sockets are mounted in the container after update: + + $ R "${S} && execute_in_container --uuid --cmd 'mount | grep usp'" + tmpfs on /run/usp/sockets/authenticated/broker_controller* (glob) + tmpfs on /run/usp/sockets/authenticated/broker_agent* (glob) + +Check that Device.USPServices.Trust model is filled on USP bus after update: + + $ R "usp-cli -lj 'Device.USPServices.Trust.[EndpointID==\"${CTR_ENDPOINTID}\"].?' | sed '/^$/d'" + [{"Device.USPServices.Trust.*.":{"TargetPaths":"Device.LCMSampleApp.","EndpointID":"*"}}] (glob) + +Check that Device.UnixDomainSockets.Authentication model is filled on USP bus after update: + + $ R "usp-cli -lj 'Device.UnixDomainSockets.Authentication.[EndpointID==\"${CTR_ENDPOINTID}\"].?' | sed '/^$/d'" + [{"Device.UnixDomainSockets.Authentication.*.":{"Enable":true,"Password":"*","EndpointID":"*"}}] (glob) + +Check that service model is accessible on USP bus after update: + + $ R "usp-cli -lj Device.LCMSampleApp.? | sed '/^$/d'" + [{"Device.LCMSampleApp.":{"NumberOfDummyMultiInstances":0,"DummyGlobalString":"","DummyGlobalInt":0}}] + +Uninstall the container and check everything is cleaned: + + $ R "${S} && uninstall_ctr_and_check --uuid" + [1] + $ R "usp-cli -lj 'Device.USPServices.Trust.[EndpointID==\"${CTR_ENDPOINTID}\"].?' | sed '/^$/d'" + [{}] diff --git a/.gitlab/tests/cram/generic/lcm/036-lcm-usp-restrictions.t b/.gitlab/tests/cram/generic/lcm/036-lcm-usp-restrictions.t new file mode 100644 index 0000000000..45369819b1 --- /dev/null +++ b/.gitlab/tests/cram/generic/lcm/036-lcm-usp-restrictions.t @@ -0,0 +1,70 @@ +## Setup test configuration +Setup the test configuration: + + $ alias R="${CRAM_REMOTE_COMMAND:-}" + $ alias C="${CRAM_REMOTE_COPY:-}" + $ S=". /tmp/script_functions.sh" + $ C ${TESTDIR}/script_functions.sh root@${TARGET_LAN_IP}:/tmp/script_functions.sh 2>/dev/null +## FIXME: `get_arch_name` function returns wrong arch name for freedom board + $ BOARD_ARCH=$(R "${S} && get_true_arch_name") + $ READER_SERVICE_URL="docker://registry.gitlab.com/prpl-foundation/prplos/prplos/${BOARD_ARCH}/image-trusted-reader:latest" + $ PROVIDER_SERVICE_URL="docker://registry.gitlab.com/prpl-foundation/prplos/prplos/${BOARD_ARCH}/image-trusted-provider:latest" + + +Set-up ExecEnv configuration + + $ R "${S} && set_ee_roles --roles \"Full Access\",\"Untrusted\"" > /dev/null + $ R "${S} && check_available_roles --ee" + Device.LocalAgent.ControllerTrust.Role.1.,Device.LocalAgent.ControllerTrust.Role.2. + +### RESTRICTIONS CHECK ### + +Check that untrusted service cannot read the data from USP bus when RequiredRoles is "Untrusted": + + $ R "${S} && install_ctr --url ${READER_SERVICE_URL} --ee --uuid --privileged true --usprequired \"Untrusted\" --uspregisterpaths \"Device.TrustedReader.\" --uspautomountipc \"USP_UDS_Authenticated\"" > /dev/null + $ R "${S} && get_container_info --uuid" + Active + latest + prpl-foundation/prplos/prplos/*/image-trusted-reader (glob) + $ R "usp-cli -lj 'Device.TrustedReader.?' | sed '/^$/d'" + [{"Device.TrustedReader.":{"ParamPath":"Device.DeviceInfo.SerialNumber","ParamValue":"","ErrorCode":1}}] + +Uninstall the reader service: + + $ R "${S} && uninstall_ctr_and_check --uuid" + [1] + +Check that untrusted service cannot register model on USP bus when RegisterTrustPaths is empty: + + $ R "${S} && install_ctr --url ${PROVIDER_SERVICE_URL} --ee --uuid --privileged true --usprequired \"Full Access\" --uspautomountipc \"USP_UDS_Authenticated\"" > /dev/null + $ R "${S} && get_container_info --uuid" + Active + latest + prpl-foundation/prplos/prplos/*/image-trusted-provider (glob) + $ CTR_ID=$(R "${S} && get_container_parameter --uuid --param EUID") + $ CTR_ENDPOINTID=$(R "ba-cli -l 'Cthulhu.Container.Instances.[ContainerId==\"${CTR_ID}\"].EndpointID?' | sed '/^$/d'") + $ R "usp-cli -lj 'Device.USPServices.Trust.[EndpointID==\"${CTR_ENDPOINTID}\"].?' | sed '/^$/d'" + [{}] + $ R "usp-cli 'gsdm Device.' | grep TrustedProvider | sed '/^$/d'" + +Update the RegisterTrustPaths parameter for service and check that untrusted service can register only allowed paths on USP bus: + + $ R "${S} && update_ctr --url ${PROVIDER_SERVICE_URL} --ee --uuid --privileged true --usprequired \"Full Access\" --uspregisterpaths \"Device.TrustedProvider1.\" --uspautomountipc \"USP_UDS_Authenticated\"" > /dev/null + $ R "usp-cli -lj 'Device.USPServices.Trust.[EndpointID==\"${CTR_ENDPOINTID}\"].?' | sed '/^$/d'" + [{"Device.USPServices.Trust.*.":{"TargetPaths":"Device.TrustedProvider1.","EndpointID":"*"}}] (glob) + $ R "usp-cli 'gsdm Device.' | grep TrustedProvider | sed '/^$/d'" + ... (Object ) Device.TrustedProvider1. + +Update the RegisterTrustPaths parameter with several paths and check that untrusted service can register only allowed paths on USP bus: + + $ R "${S} && update_ctr --url ${PROVIDER_SERVICE_URL} --ee --uuid --privileged true --usprequired \"Full Access\" --uspregisterpaths \"Device.TrustedProvider1.,Device.TrustedProvider2.\" --uspautomountipc \"USP_UDS_Authenticated\"" > /dev/null + $ R "usp-cli -lj 'Device.USPServices.Trust.[EndpointID==\"${CTR_ENDPOINTID}\"].?' | sed '/^$/d'" + [{"Device.USPServices.Trust.*.":{"TargetPaths":"Device.TrustedProvider1.,Device.TrustedProvider2.","EndpointID":"*"}}] (glob) + $ R "usp-cli 'gsdm Device.' | grep TrustedProvider | sed '/^$/d'" + ... (Object ) Device.TrustedProvider1. + ... (Object ) Device.TrustedProvider2. + +Uninstall the provider service: + + $ R "${S} && uninstall_ctr_and_check --uuid" + [1] diff --git a/.gitlab/tests/cram/generic/lcm/038-lcm-pcm.t b/.gitlab/tests/cram/generic/lcm/038-lcm-pcm.t index 36030fc0a6..316f47684d 100644 --- a/.gitlab/tests/cram/generic/lcm/038-lcm-pcm.t +++ b/.gitlab/tests/cram/generic/lcm/038-lcm-pcm.t @@ -28,7 +28,7 @@ Create a user role with capabilities: Install the container in privileged mode with extra LCM features and check its status and type: - $ R "${S} && install_ctr --version prplos-v1 --ee --uuid --privileged true --network --hostobject --envvar --appdata --usprequired \"Full Access\" --userroles full_caps" > /dev/null + $ R "${S} && install_ctr --version prplos-v1 --ee --uuid --privileged true --network --hostobject --envvar --appdata --usprequired \"Full Access\" --userroles full_caps --uspregisterpaths \"Device.LCMSampleApp.\" --uspautomountipc \"USP_UDS_Authenticated\"" > /dev/null $ R "${S} && get_container_info --uuid" Active prplos-v1 @@ -100,13 +100,15 @@ Verify that the EnvVariables were properly restored: $ R "${S} && execute_in_container --uuid --cmd \"env\" | grep ENVVAR_KEY2" ENVVAR_KEY2=ENVVAR_VALUE2 -Check that UDS sockets and the random USP_ENDPOINT_ID are shared with the container: +Check that UDS sockets and the random USP_ENDPOINT_ID with USP_PASSWORD are shared with the container: $ R "${S} && execute_in_container --uuid --cmd \"env\" | grep USP_ENDPOINT_ID" USP_ENDPOINT_ID=uuid::* (glob) - $ R "${S} && execute_in_container --uuid --cmd \"ls /run/usp/\"" - broker_agent_path - broker_controller_path + $ R "${S} && execute_in_container --uuid --cmd \"env\" | grep USP_PASSWORD" + USP_PASSWORD=* (glob) + $ R "${S} && execute_in_container --uuid --cmd 'mount | grep usp'" + tmpfs on /run/usp/sockets/authenticated/broker_controller* (glob) + tmpfs on /run/usp/sockets/authenticated/broker_agent* (glob) Check that the container has the required capabilities: $ R "${S} && execute_in_container --uuid --cmd 'grep CapEff /proc/1/status'" @@ -124,6 +126,21 @@ Check NetworkConfig correctly applied: 1 default via 192.168.*.1 dev lcm0* (glob) +Check that the container has the expected EndpointID, AutoMountIPC and RegisterTrustPaths values: + + $ CTR_ID=$(R "${S} && get_container_parameter --uuid --param EUID") + $ CTR_ENDPOINTID=$(R "ba-cli -l 'Cthulhu.Container.Instances.[ContainerId==\"${CTR_ID}\"].EndpointID?' | sed '/^$/d'") + $ R "ba-cli -l 'Cthulhu.Container.Instances.[ContainerId==\"${CTR_ID}\"].EndpointID?' | sed '/^$/d'" + uuid::* (glob) + $ R "ba-cli -l 'Cthulhu.Container.Instances.[ContainerId==\"${CTR_ID}\"].AutoMountIPC?' | sed '/^$/d'" + USP_UDS_Authenticated + $ R "ba-cli -l 'Cthulhu.Container.Instances.[ContainerId==\"${CTR_ID}\"].RegisterTrustPaths?' | sed '/^$/d'" + Device.LCMSampleApp. + $ R "ba-cli -l 'Device.SoftwareModules.ExecutionUnit.[EUID==\"$CTR_ID\"].X_PRPLWARE-COM_AutoMountIPC?' | sed '/^$/d'" + USP_UDS_Authenticated + $ R "ba-cli -l 'Device.SoftwareModules.ExecutionUnit.[EUID==\"$CTR_ID\"].RegisterTrustPaths?' | sed '/^$/d'" + Device.LCMSampleApp. + Update to prplOS container to v2: $ R "${S} && update_ctr --version prplos-v2 --ee --uuid --privileged true" > /dev/null diff --git a/.gitlab/tests/cram/generic/lcm/script_functions.sh b/.gitlab/tests/cram/generic/lcm/script_functions.sh index 550f94e66a..2152616345 100755 --- a/.gitlab/tests/cram/generic/lcm/script_functions.sh +++ b/.gitlab/tests/cram/generic/lcm/script_functions.sh @@ -11,6 +11,10 @@ DEFAULT_URL="docker://registry.gitlab.com/prpl-foundation/prplos/prplos" DEFAULT_USPROLES="Full Access" DEFAULT_USPREQUIRED="Full Access" DEFAULT_USPOPTIONAL="" +DEFAULT_USPREGISTERPATHS="" +DEFAULT_USPAUTOMOUNTIPC="USP_UDS_Unauthenticated" +DEFAULT_USERNAME="" +DEFAULT_PASSWORD="" DEFAULT_RETAINDATA="false" DEFAULT_ENVVAR='[{Key="ENVVAR_KEY1", Value="ENVVAR_VALUE1"}, {Key="ENVVAR_KEY2", Value="ENVVAR_VALUE2"}]' @@ -91,6 +95,28 @@ get_arch_name() { esac } +## FIXME: `get_arch_name` function returns wrong arch name for freedom board +## Return the architecture name for the board, used for selecting the correct container image from registry +get_true_arch_name() { + board_name=$(cut -d',' -f2