Reenable FIPS tests on SLE15, skip on tumbleweed #272
Conversation
tests/test_fips.py
Outdated
| @@ -105,20 +105,24 @@ def test_openssl_binary( | |||
| img_id = container_runtime.get_image_id_from_stdout(cmd.stdout) | |||
|
|
|||
| exec_cmd = " ".join( | |||
| [container_runtime.runner_binary, "run", "--rm"] | |||
| [container_runtime.runner_binary, "run", "--rm", "--privileged=true"] | |||
There was a problem hiding this comment.
Why do you have to run it privileged?
There was a problem hiding this comment.
because I'm running mount inside the container
tests/test_fips.py
Outdated
|
|
||
| for digest in NONFIPS_DIGESTS: | ||
| err_msg = host.run_expect( | ||
| [1], f"{exec_cmd} /bin/fips-test {digest}" | ||
| [1], | ||
| f"{exec_cmd} bash -c 'mount --bind /tmp/f /proc/sys/crypto; fips-test {digest}'", |
There was a problem hiding this comment.
In the CI test run, this returns 0.
There was a problem hiding this comment.
Now it's a 32 😵💫
Also: mount: /proc/sys/crypto: mount point does not exist
There was a problem hiding this comment.
I know, apparently the ubuntu workers need some kernel module that doesn't autoload.
dirkmueller
force-pushed
the
fipstests
branch
2 times, most recently
from
abf9390
to
3606621
Compare
dirkmueller
force-pushed
the
fipstests
branch
from
3606621
to
053a76d
Compare
| @@ -134,13 +132,15 @@ def test_openssl_fips_hashes(container_per_test): | |||
|
|
|||
| """ | |||
| for digest in NONFIPS_DIGESTS: | |||
| cmd = container_per_test.connection.run(f"openssl {digest} /dev/null") | |||
| cmd = container_per_test.connection.run( | |||
| f"env OPENSSL_FORCE_FIPS_MODE=1 openssl {digest} /dev/null" | |||
There was a problem hiding this comment.
We only want to set OPENSSL_FORCE_FIPS_MODE on hosts that are not in fips mode
dirkmueller
force-pushed
the
fipstests
branch
from
053a76d
to
078dc00
Compare
| COPY --from=builder /usr/bin/openssl /usr/bin/openssl | ||
| COPY --from=builder /usr/lib64/libcrypto.so.* /usr/lib64/ | ||
| COPY --from=builder /usr/lib64/libssl.so.* /usr/lib64/ | ||
| COPY --from=builder /usr/lib64/libz.so.1 /usr/lib64/ |
There was a problem hiding this comment.
This will break on 15.3 & 15.4:
❯ podman run --rm -it registry.suse.com/bci/bci-base:15.4 ls -al /usr/lib64/libz.so.1
ls: cannot access '/usr/lib64/libz.so.1': No such file or directory
| #: Error message from OpenSSL when a non-FIPS digest is selected in FIPS mode | ||
| FIPS_ERR_MSG = ( | ||
| "not a known digest" if OS_VERSION == "15.3" else "Error setting digest" | ||
| ) |
There was a problem hiding this comment.
The error message is now the same on all service packs
| if Version.parse(OS_VERSION) <= Version(15, 5): | ||
| assert f"Unknown message digest {digest}" in err_msg | ||
| else: | ||
| assert "disabled for FIPS" in err_msg |
There was a problem hiding this comment.
The error message is now the same on all service packs
No description provided.