system/systemd
system/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd synced 2024-10-06 16:21:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

test: add simple integration test for checking PCR extension works as it should

Browse source
This commit is contained in:
Lennart Poettering 2022-12-16 16:25:34 +01:00
parent 2bd33c909c
commit f44ed151c6
2 changed files with 31 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
test/TEST-70-TPM2/test.sh
View file

@ -20,6 +20,7 @@ test_append_files() {
install_dmevent
generate_module_dependencies
inst_binary tpm2_pcrextend
inst_binary tpm2_pcrread
inst_binary openssl
}

30
test/units/testsuite-70.sh
View file

@ -172,6 +172,36 @@ else
echo "/usr/lib/systemd/systemd-measure or PCR sysfs files not found, skipping signed PCR policy test case"
fi
if [ -e /usr/lib/systemd/systemd-pcrphase ] && \
[ -f /sys/class/tpm/tpm0/pcr-sha256/11 ]; then
# Let's measure the machine ID
tpm2_pcrread sha256:15 -Q -o /tmp/oldpcr15
mv /etc/machine-id /etc/machine-id.save
echo 994013bf23864ee7992eab39a96dd3bb >/etc/machine-id
SYSTEMD_FORCE_MEASURE=1 /usr/lib/systemd/systemd-pcrphase --machine-id
mv /etc/machine-id.save /etc/machine-id
tpm2_pcrread sha256:15 -Q -o /tmp/newpcr15
# And check it matches expectations
( cat /tmp/oldpcr15 ;
echo -n "machine-id:994013bf23864ee7992eab39a96dd3bb" | openssl dgst -binary -sha256 ) | openssl dgst -binary -sha256 | cmp - /tmp/newpcr15
rm /tmp/oldpcr15 /tmp/newpcr15
# And similar for the boot phase measurement into PCR 11
tpm2_pcrread sha256:11 -Q -o /tmp/oldpcr11
SYSTEMD_FORCE_MEASURE=1 /usr/lib/systemd/systemd-pcrphase foobar
tpm2_pcrread sha256:11 -Q -o /tmp/newpcr11
( cat /tmp/oldpcr11 ;
echo -n "foobar" | openssl dgst -binary -sha256 ) | openssl dgst -binary -sha256 | cmp - /tmp/newpcr11
rm /tmp/oldpcr11 /tmp/newpcr11
else
echo "/usr/lib/systemd/systemd-pcrphase or PCR sysfs files not found, skipping PCR extension test case"
fi
echo OK >/testok
exit 0