mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2025-01-03 11:35:19 +00:00
tests: Add more tests for manual Secure Boot configuration
These cover the same scenarios as the matching test cases for autoselection. Signed-off-by: Andrea Bolognani <abologna@redhat.com> Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
This commit is contained in:
Andrea Bolognani
parent
66e5c43a03
commit
bf6a6f90a9
@ -0,0 +1,38 @@
|
||||
LC_ALL=C \
|
||||
PATH=/bin \
|
||||
HOME=/var/lib/libvirt/qemu/domain--1-guest \
|
||||
USER=test \
|
||||
LOGNAME=test \
|
||||
XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-guest/.local/share \
|
||||
XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-guest/.cache \
|
||||
XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \
|
||||
/usr/bin/qemu-system-x86_64 \
|
||||
-name guest=guest,debug-threads=on \
|
||||
-S \
|
||||
-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \
|
||||
-blockdev '{"driver":"file","filename":"/usr/share/OVMF/OVMF_CODE.secboot.fd","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \
|
||||
-blockdev '{"node-name":"libvirt-pflash0-format","read-only":true,"driver":"raw","file":"libvirt-pflash0-storage"}' \
|
||||
-blockdev '{"driver":"file","filename":"/path/to/guest_VARS.fd","node-name":"libvirt-pflash1-storage","auto-read-only":true,"discard":"unmap"}' \
|
||||
-blockdev '{"node-name":"libvirt-pflash1-format","read-only":false,"driver":"raw","file":"libvirt-pflash1-storage"}' \
|
||||
-machine pc-q35-4.0,usb=off,smm=on,dump-guest-core=off,memory-backend=pc.ram,pflash0=libvirt-pflash0-format,pflash1=libvirt-pflash1-format,acpi=on \
|
||||
-accel tcg \
|
||||
-cpu qemu64 \
|
||||
-global driver=cfi.pflash01,property=secure,value=on \
|
||||
-m 1024 \
|
||||
-object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":1073741824}' \
|
||||
-overcommit mem-lock=off \
|
||||
-smp 1,sockets=1,cores=1,threads=1 \
|
||||
-uuid 63840878-0deb-4095-97e6-fc444d9bc9fa \
|
||||
-display none \
|
||||
-no-user-config \
|
||||
-nodefaults \
|
||||
-chardev socket,id=charmonitor,fd=1729,server=on,wait=off \
|
||||
-mon chardev=charmonitor,id=monitor,mode=control \
|
||||
-rtc base=utc \
|
||||
-no-shutdown \
|
||||
-boot strict=on \
|
||||
-audiodev '{"id":"audio1","driver":"none"}' \
|
||||
-global ICH9-LPC.noreboot=off \
|
||||
-watchdog-action reset \
|
||||
-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
|
||||
-msg timestamp=on
|
||||
@ -0,0 +1,20 @@
|
||||
<domain type='qemu'>
|
||||
<name>guest</name>
|
||||
<uuid>63840878-0deb-4095-97e6-fc444d9bc9fa</uuid>
|
||||
<memory unit='KiB'>1048576</memory>
|
||||
<vcpu placement='static'>1</vcpu>
|
||||
<os>
|
||||
<type arch='x86_64' machine='pc-q35-4.0'>hvm</type>
|
||||
<loader readonly='yes' secure='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.secboot.fd</loader>
|
||||
<nvram template='/usr/share/OVMF/OVMF_VARS.fd'>/path/to/guest_VARS.fd</nvram>
|
||||
</os>
|
||||
<features>
|
||||
<acpi/>
|
||||
<smm state='on'/>
|
||||
</features>
|
||||
<devices>
|
||||
<emulator>/usr/bin/qemu-system-x86_64</emulator>
|
||||
<controller type='usb' model='none'/>
|
||||
<memballoon model='none'/>
|
||||
</devices>
|
||||
</domain>
|
||||
@ -0,0 +1,37 @@
|
||||
LC_ALL=C \
|
||||
PATH=/bin \
|
||||
HOME=/var/lib/libvirt/qemu/domain--1-guest \
|
||||
USER=test \
|
||||
LOGNAME=test \
|
||||
XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-guest/.local/share \
|
||||
XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-guest/.cache \
|
||||
XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \
|
||||
/usr/bin/qemu-system-x86_64 \
|
||||
-name guest=guest,debug-threads=on \
|
||||
-S \
|
||||
-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \
|
||||
-blockdev '{"driver":"file","filename":"/usr/share/OVMF/OVMF_CODE.fd","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \
|
||||
-blockdev '{"node-name":"libvirt-pflash0-format","read-only":true,"driver":"raw","file":"libvirt-pflash0-storage"}' \
|
||||
-blockdev '{"driver":"file","filename":"/path/to/guest_VARS.fd","node-name":"libvirt-pflash1-storage","auto-read-only":true,"discard":"unmap"}' \
|
||||
-blockdev '{"node-name":"libvirt-pflash1-format","read-only":false,"driver":"raw","file":"libvirt-pflash1-storage"}' \
|
||||
-machine pc-q35-4.0,usb=off,dump-guest-core=off,memory-backend=pc.ram,pflash0=libvirt-pflash0-format,pflash1=libvirt-pflash1-format,acpi=on \
|
||||
-accel tcg \
|
||||
-cpu qemu64 \
|
||||
-m 1024 \
|
||||
-object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":1073741824}' \
|
||||
-overcommit mem-lock=off \
|
||||
-smp 1,sockets=1,cores=1,threads=1 \
|
||||
-uuid 63840878-0deb-4095-97e6-fc444d9bc9fa \
|
||||
-display none \
|
||||
-no-user-config \
|
||||
-nodefaults \
|
||||
-chardev socket,id=charmonitor,fd=1729,server=on,wait=off \
|
||||
-mon chardev=charmonitor,id=monitor,mode=control \
|
||||
-rtc base=utc \
|
||||
-no-shutdown \
|
||||
-boot strict=on \
|
||||
-audiodev '{"id":"audio1","driver":"none"}' \
|
||||
-global ICH9-LPC.noreboot=off \
|
||||
-watchdog-action reset \
|
||||
-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
|
||||
-msg timestamp=on
|
||||
19
tests/qemuxml2argvdata/firmware-manual-efi-no-secboot.xml
Normal file
19
tests/qemuxml2argvdata/firmware-manual-efi-no-secboot.xml
Normal file
@ -0,0 +1,19 @@
|
||||
<domain type='qemu'>
|
||||
<name>guest</name>
|
||||
<uuid>63840878-0deb-4095-97e6-fc444d9bc9fa</uuid>
|
||||
<memory unit='KiB'>1048576</memory>
|
||||
<vcpu placement='static'>1</vcpu>
|
||||
<os>
|
||||
<type arch='x86_64' machine='pc-q35-4.0'>hvm</type>
|
||||
<loader readonly='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.fd</loader>
|
||||
<nvram template='/usr/share/OVMF/OVMF_VARS.fd'>/path/to/guest_VARS.fd</nvram>
|
||||
</os>
|
||||
<features>
|
||||
<acpi/>
|
||||
</features>
|
||||
<devices>
|
||||
<emulator>/usr/bin/qemu-system-x86_64</emulator>
|
||||
<controller type='usb' model='none'/>
|
||||
<memballoon model='none'/>
|
||||
</devices>
|
||||
</domain>
|
||||
@ -0,0 +1,38 @@
|
||||
LC_ALL=C \
|
||||
PATH=/bin \
|
||||
HOME=/var/lib/libvirt/qemu/domain--1-guest \
|
||||
USER=test \
|
||||
LOGNAME=test \
|
||||
XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-guest/.local/share \
|
||||
XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-guest/.cache \
|
||||
XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \
|
||||
/usr/bin/qemu-system-x86_64 \
|
||||
-name guest=guest,debug-threads=on \
|
||||
-S \
|
||||
-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \
|
||||
-blockdev '{"driver":"file","filename":"/usr/share/OVMF/OVMF_CODE.secboot.fd","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \
|
||||
-blockdev '{"node-name":"libvirt-pflash0-format","read-only":true,"driver":"raw","file":"libvirt-pflash0-storage"}' \
|
||||
-blockdev '{"driver":"file","filename":"/path/to/guest_VARS.fd","node-name":"libvirt-pflash1-storage","auto-read-only":true,"discard":"unmap"}' \
|
||||
-blockdev '{"node-name":"libvirt-pflash1-format","read-only":false,"driver":"raw","file":"libvirt-pflash1-storage"}' \
|
||||
-machine pc-q35-4.0,usb=off,smm=on,dump-guest-core=off,memory-backend=pc.ram,pflash0=libvirt-pflash0-format,pflash1=libvirt-pflash1-format,acpi=on \
|
||||
-accel tcg \
|
||||
-cpu qemu64 \
|
||||
-global driver=cfi.pflash01,property=secure,value=on \
|
||||
-m 1024 \
|
||||
-object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":1073741824}' \
|
||||
-overcommit mem-lock=off \
|
||||
-smp 1,sockets=1,cores=1,threads=1 \
|
||||
-uuid 63840878-0deb-4095-97e6-fc444d9bc9fa \
|
||||
-display none \
|
||||
-no-user-config \
|
||||
-nodefaults \
|
||||
-chardev socket,id=charmonitor,fd=1729,server=on,wait=off \
|
||||
-mon chardev=charmonitor,id=monitor,mode=control \
|
||||
-rtc base=utc \
|
||||
-no-shutdown \
|
||||
-boot strict=on \
|
||||
-audiodev '{"id":"audio1","driver":"none"}' \
|
||||
-global ICH9-LPC.noreboot=off \
|
||||
-watchdog-action reset \
|
||||
-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
|
||||
-msg timestamp=on
|
||||
20
tests/qemuxml2argvdata/firmware-manual-efi-secboot.xml
Normal file
20
tests/qemuxml2argvdata/firmware-manual-efi-secboot.xml
Normal file
@ -0,0 +1,20 @@
|
||||
<domain type='qemu'>
|
||||
<name>guest</name>
|
||||
<uuid>63840878-0deb-4095-97e6-fc444d9bc9fa</uuid>
|
||||
<memory unit='KiB'>1048576</memory>
|
||||
<vcpu placement='static'>1</vcpu>
|
||||
<os>
|
||||
<type arch='x86_64' machine='pc-q35-4.0'>hvm</type>
|
||||
<loader readonly='yes' secure='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.secboot.fd</loader>
|
||||
<nvram template='/usr/share/OVMF/OVMF_VARS.secboot.fd'>/path/to/guest_VARS.fd</nvram>
|
||||
</os>
|
||||
<features>
|
||||
<acpi/>
|
||||
<smm state='on'/>
|
||||
</features>
|
||||
<devices>
|
||||
<emulator>/usr/bin/qemu-system-x86_64</emulator>
|
||||
<controller type='usb' model='none'/>
|
||||
<memballoon model='none'/>
|
||||
</devices>
|
||||
</domain>
|
||||
@ -1089,6 +1089,9 @@ mymain(void)
|
||||
DO_TEST_CAPS_LATEST("firmware-manual-efi-rw-implicit");
|
||||
DO_TEST_CAPS_LATEST("firmware-manual-efi-loader-secure");
|
||||
DO_TEST_CAPS_LATEST_PARSE_ERROR("firmware-manual-efi-loader-no-path");
|
||||
DO_TEST_CAPS_LATEST("firmware-manual-efi-secboot");
|
||||
DO_TEST_CAPS_LATEST("firmware-manual-efi-no-enrolled-keys");
|
||||
DO_TEST_CAPS_LATEST("firmware-manual-efi-no-secboot");
|
||||
DO_TEST_CAPS_LATEST("firmware-manual-efi-stateless");
|
||||
DO_TEST_CAPS_LATEST("firmware-manual-efi-nvram-template");
|
||||
DO_TEST_CAPS_LATEST_PARSE_ERROR("firmware-manual-efi-nvram-template-stateless");
|
||||
|
||||
@ -0,0 +1,37 @@
|
||||
<domain type='qemu'>
|
||||
<name>guest</name>
|
||||
<uuid>63840878-0deb-4095-97e6-fc444d9bc9fa</uuid>
|
||||
<memory unit='KiB'>1048576</memory>
|
||||
<currentMemory unit='KiB'>1048576</currentMemory>
|
||||
<vcpu placement='static'>1</vcpu>
|
||||
<os>
|
||||
<type arch='x86_64' machine='pc-q35-4.0'>hvm</type>
|
||||
<loader readonly='yes' secure='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.secboot.fd</loader>
|
||||
<nvram template='/usr/share/OVMF/OVMF_VARS.fd'>/path/to/guest_VARS.fd</nvram>
|
||||
<boot dev='hd'/>
|
||||
</os>
|
||||
<features>
|
||||
<acpi/>
|
||||
<smm state='on'/>
|
||||
</features>
|
||||
<cpu mode='custom' match='exact' check='none'>
|
||||
<model fallback='forbid'>qemu64</model>
|
||||
</cpu>
|
||||
<clock offset='utc'/>
|
||||
<on_poweroff>destroy</on_poweroff>
|
||||
<on_reboot>restart</on_reboot>
|
||||
<on_crash>destroy</on_crash>
|
||||
<devices>
|
||||
<emulator>/usr/bin/qemu-system-x86_64</emulator>
|
||||
<controller type='usb' index='0' model='none'/>
|
||||
<controller type='sata' index='0'>
|
||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x1f' function='0x2'/>
|
||||
</controller>
|
||||
<controller type='pci' index='0' model='pcie-root'/>
|
||||
<input type='mouse' bus='ps2'/>
|
||||
<input type='keyboard' bus='ps2'/>
|
||||
<audio id='1' type='none'/>
|
||||
<watchdog model='itco' action='reset'/>
|
||||
<memballoon model='none'/>
|
||||
</devices>
|
||||
</domain>
|
||||
@ -0,0 +1,36 @@
|
||||
<domain type='qemu'>
|
||||
<name>guest</name>
|
||||
<uuid>63840878-0deb-4095-97e6-fc444d9bc9fa</uuid>
|
||||
<memory unit='KiB'>1048576</memory>
|
||||
<currentMemory unit='KiB'>1048576</currentMemory>
|
||||
<vcpu placement='static'>1</vcpu>
|
||||
<os>
|
||||
<type arch='x86_64' machine='pc-q35-4.0'>hvm</type>
|
||||
<loader readonly='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.fd</loader>
|
||||
<nvram template='/usr/share/OVMF/OVMF_VARS.fd'>/path/to/guest_VARS.fd</nvram>
|
||||
<boot dev='hd'/>
|
||||
</os>
|
||||
<features>
|
||||
<acpi/>
|
||||
</features>
|
||||
<cpu mode='custom' match='exact' check='none'>
|
||||
<model fallback='forbid'>qemu64</model>
|
||||
</cpu>
|
||||
<clock offset='utc'/>
|
||||
<on_poweroff>destroy</on_poweroff>
|
||||
<on_reboot>restart</on_reboot>
|
||||
<on_crash>destroy</on_crash>
|
||||
<devices>
|
||||
<emulator>/usr/bin/qemu-system-x86_64</emulator>
|
||||
<controller type='usb' index='0' model='none'/>
|
||||
<controller type='sata' index='0'>
|
||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x1f' function='0x2'/>
|
||||
</controller>
|
||||
<controller type='pci' index='0' model='pcie-root'/>
|
||||
<input type='mouse' bus='ps2'/>
|
||||
<input type='keyboard' bus='ps2'/>
|
||||
<audio id='1' type='none'/>
|
||||
<watchdog model='itco' action='reset'/>
|
||||
<memballoon model='none'/>
|
||||
</devices>
|
||||
</domain>
|
||||
@ -0,0 +1,37 @@
|
||||
<domain type='qemu'>
|
||||
<name>guest</name>
|
||||
<uuid>63840878-0deb-4095-97e6-fc444d9bc9fa</uuid>
|
||||
<memory unit='KiB'>1048576</memory>
|
||||
<currentMemory unit='KiB'>1048576</currentMemory>
|
||||
<vcpu placement='static'>1</vcpu>
|
||||
<os>
|
||||
<type arch='x86_64' machine='pc-q35-4.0'>hvm</type>
|
||||
<loader readonly='yes' secure='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.secboot.fd</loader>
|
||||
<nvram template='/usr/share/OVMF/OVMF_VARS.secboot.fd'>/path/to/guest_VARS.fd</nvram>
|
||||
<boot dev='hd'/>
|
||||
</os>
|
||||
<features>
|
||||
<acpi/>
|
||||
<smm state='on'/>
|
||||
</features>
|
||||
<cpu mode='custom' match='exact' check='none'>
|
||||
<model fallback='forbid'>qemu64</model>
|
||||
</cpu>
|
||||
<clock offset='utc'/>
|
||||
<on_poweroff>destroy</on_poweroff>
|
||||
<on_reboot>restart</on_reboot>
|
||||
<on_crash>destroy</on_crash>
|
||||
<devices>
|
||||
<emulator>/usr/bin/qemu-system-x86_64</emulator>
|
||||
<controller type='usb' index='0' model='none'/>
|
||||
<controller type='sata' index='0'>
|
||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x1f' function='0x2'/>
|
||||
</controller>
|
||||
<controller type='pci' index='0' model='pcie-root'/>
|
||||
<input type='mouse' bus='ps2'/>
|
||||
<input type='keyboard' bus='ps2'/>
|
||||
<audio id='1' type='none'/>
|
||||
<watchdog model='itco' action='reset'/>
|
||||
<memballoon model='none'/>
|
||||
</devices>
|
||||
</domain>
|
||||
@ -925,6 +925,9 @@ mymain(void)
|
||||
DO_TEST_CAPS_LATEST("firmware-manual-efi-rw");
|
||||
DO_TEST_CAPS_LATEST("firmware-manual-efi-rw-implicit");
|
||||
DO_TEST_CAPS_LATEST("firmware-manual-efi-loader-secure");
|
||||
DO_TEST_CAPS_LATEST("firmware-manual-efi-secboot");
|
||||
DO_TEST_CAPS_LATEST("firmware-manual-efi-no-enrolled-keys");
|
||||
DO_TEST_CAPS_LATEST("firmware-manual-efi-no-secboot");
|
||||
DO_TEST_CAPS_LATEST("firmware-manual-efi-stateless");
|
||||
DO_TEST_CAPS_LATEST("firmware-manual-efi-nvram-template");
|
||||
DO_TEST_CAPS_LATEST("firmware-manual-efi-nvram-network-iscsi");
|
||||
|
||||
Loading…
Reference in New Issue
Block a user