kconfig_hardened_check/test_engine.py

   1 #!/usr/bin/python3
   2
   3 """
   4 This tool helps me to check Linux kernel options against
   5 my security hardening preferences for X86_64, ARM64, X86_32, and ARM.
   6 Let the computers do their job!
   7
   8 Author: Alexander Popov <alex.popov@linux.com>
   9
  10 This module performs unit-testing of the kconfig-hardened-check engine.
  11 """
  12
  13 # pylint: disable=missing-function-docstring,line-too-long
  14
  15 import unittest
  16 from collections import OrderedDict
  17 import json
  18 from .engine import KconfigCheck, CmdlineCheck, OR, AND, populate_with_data, perform_checks
  19
  20
  21 class TestEngine(unittest.TestCase):
  22     """
  23     Example test scenario:
  24
  25         # 1. prepare the checklist
  26         config_checklist = []
  27         config_checklist += [KconfigCheck('reason_1', 'decision_1', 'KCONFIG_NAME', 'expected_1')]
  28         config_checklist += [CmdlineCheck('reason_2', 'decision_2', 'cmdline_name', 'expected_2')]
  29
  30         # 2. prepare the parsed kconfig options
  31         parsed_kconfig_options = OrderedDict()
  32         parsed_kconfig_options['CONFIG_KCONFIG_NAME'] = 'UNexpected_1'
  33
  34         # 3. prepare the parsed cmdline options
  35         parsed_cmdline_options = OrderedDict()
  36         parsed_cmdline_options['cmdline_name'] = 'expected_2'
  37
  38         # 4. prepare the kernel version
  39         kernel_version = (42, 43)
  40
  41         # 5. run the engine
  42         result = []
  43         self.run_engine(config_checklist,
  44                         parsed_kconfig_options, parsed_cmdline_options, kernel_version,
  45                         result)
  46
  47         # 6. check that the results are correct
  48         # self.assertEqual(...
  49     """
  50
  51     @staticmethod
  52     def run_engine(checklist,
  53                    parsed_kconfig_options, parsed_cmdline_options, kernel_version,
  54                    result):
  55         # populate the checklist with data
  56         if parsed_kconfig_options:
  57             populate_with_data(checklist, parsed_kconfig_options, 'kconfig')
  58         if parsed_cmdline_options:
  59             populate_with_data(checklist, parsed_cmdline_options, 'cmdline')
  60         if kernel_version:
  61             populate_with_data(checklist, kernel_version, 'version')
  62
  63         # now everything is ready, perform the checks
  64         perform_checks(checklist)
  65
  66         # print the table with the results
  67         print('TABLE:')
  68         for opt in checklist:
  69             opt.table_print(None, True) # default mode, with_results
  70             print()
  71
  72         # print the results in JSON
  73         print('JSON:')
  74         for opt in checklist:
  75             result.append(opt.json_dump(True)) # with_results
  76         print(json.dumps(result))
  77         print()
  78
  79     def test_single_kconfig(self):
  80         # 1. prepare the checklist
  81         config_checklist = []
  82         config_checklist += [KconfigCheck('reason_1', 'decision_1', 'NAME_1', 'expected_1')]
  83         config_checklist += [KconfigCheck('reason_2', 'decision_2', 'NAME_2', 'expected_2')]
  84         config_checklist += [KconfigCheck('reason_3', 'decision_3', 'NAME_3', 'expected_3')]
  85         config_checklist += [KconfigCheck('reason_4', 'decision_4', 'NAME_4', 'is not set')]
  86         config_checklist += [KconfigCheck('reason_5', 'decision_5', 'NAME_5', 'is present')]
  87         config_checklist += [KconfigCheck('reason_6', 'decision_6', 'NAME_6', 'is present')]
  88         config_checklist += [KconfigCheck('reason_7', 'decision_7', 'NAME_7', 'is not off')]
  89         config_checklist += [KconfigCheck('reason_8', 'decision_8', 'NAME_8', 'is not off')]
  90         config_checklist += [KconfigCheck('reason_9', 'decision_9', 'NAME_9', 'is not off')]
  91         config_checklist += [KconfigCheck('reason_10', 'decision_10', 'NAME_10', 'is not off')]
  92
  93         # 2. prepare the parsed kconfig options
  94         parsed_kconfig_options = OrderedDict()
  95         parsed_kconfig_options['CONFIG_NAME_1'] = 'expected_1'
  96         parsed_kconfig_options['CONFIG_NAME_2'] = 'UNexpected_2'
  97         parsed_kconfig_options['CONFIG_NAME_5'] = 'UNexpected_5'
  98         parsed_kconfig_options['CONFIG_NAME_7'] = 'really_not_off'
  99         parsed_kconfig_options['CONFIG_NAME_8'] = 'off'
 100         parsed_kconfig_options['CONFIG_NAME_9'] = '0'
 101
 102         # 3. run the engine
 103         result = []
 104         self.run_engine(config_checklist, parsed_kconfig_options, None, None, result)
 105
 106         # 4. check that the results are correct
 107         self.assertEqual(
 108                 result,
 109                 [["CONFIG_NAME_1", "kconfig", "expected_1", "decision_1", "reason_1", "OK"],
 110                  ["CONFIG_NAME_2", "kconfig", "expected_2", "decision_2", "reason_2", "FAIL: \"UNexpected_2\""],
 111                  ["CONFIG_NAME_3", "kconfig", "expected_3", "decision_3", "reason_3", "FAIL: is not found"],
 112                  ["CONFIG_NAME_4", "kconfig", "is not set", "decision_4", "reason_4", "OK: is not found"],
 113                  ["CONFIG_NAME_5", "kconfig", "is present", "decision_5", "reason_5", "OK: is present"],
 114                  ["CONFIG_NAME_6", "kconfig", "is present", "decision_6", "reason_6", "FAIL: is not present"],
 115                  ["CONFIG_NAME_7", "kconfig", "is not off", "decision_7", "reason_7", "OK: is not off, \"really_not_off\""],
 116                  ["CONFIG_NAME_8", "kconfig", "is not off", "decision_8", "reason_8", "FAIL: is off"],
 117                  ["CONFIG_NAME_9", "kconfig", "is not off", "decision_9", "reason_9", "FAIL: is off, \"0\""],
 118                  ["CONFIG_NAME_10", "kconfig", "is not off", "decision_10", "reason_10", "FAIL: is off, not found"]]
 119         )
 120
 121     def test_single_cmdline(self):
 122         # 1. prepare the checklist
 123         config_checklist = []
 124         config_checklist += [CmdlineCheck('reason_1', 'decision_1', 'name_1', 'expected_1')]
 125         config_checklist += [CmdlineCheck('reason_2', 'decision_2', 'name_2', 'expected_2')]
 126         config_checklist += [CmdlineCheck('reason_3', 'decision_3', 'name_3', 'expected_3')]
 127         config_checklist += [CmdlineCheck('reason_4', 'decision_4', 'name_4', 'is not set')]
 128         config_checklist += [CmdlineCheck('reason_5', 'decision_5', 'name_5', 'is present')]
 129         config_checklist += [CmdlineCheck('reason_6', 'decision_6', 'name_6', 'is present')]
 130         config_checklist += [CmdlineCheck('reason_7', 'decision_7', 'name_7', 'is not off')]
 131         config_checklist += [CmdlineCheck('reason_8', 'decision_8', 'name_8', 'is not off')]
 132         config_checklist += [CmdlineCheck('reason_9', 'decision_9', 'name_9', 'is not off')]
 133         config_checklist += [CmdlineCheck('reason_10', 'decision_10', 'name_10', 'is not off')]
 134
 135         # 2. prepare the parsed cmdline options
 136         parsed_cmdline_options = OrderedDict()
 137         parsed_cmdline_options['name_1'] = 'expected_1'
 138         parsed_cmdline_options['name_2'] = 'UNexpected_2'
 139         parsed_cmdline_options['name_5'] = ''
 140         parsed_cmdline_options['name_7'] = ''
 141         parsed_cmdline_options['name_8'] = 'off'
 142         parsed_cmdline_options['name_9'] = '0'
 143
 144         # 3. run the engine
 145         result = []
 146         self.run_engine(config_checklist, None, parsed_cmdline_options, None, result)
 147
 148         # 4. check that the results are correct
 149         self.assertEqual(
 150                 result,
 151                 [["name_1", "cmdline", "expected_1", "decision_1", "reason_1", "OK"],
 152                  ["name_2", "cmdline", "expected_2", "decision_2", "reason_2", "FAIL: \"UNexpected_2\""],
 153                  ["name_3", "cmdline", "expected_3", "decision_3", "reason_3", "FAIL: is not found"],
 154                  ["name_4", "cmdline", "is not set", "decision_4", "reason_4", "OK: is not found"],
 155                  ["name_5", "cmdline", "is present", "decision_5", "reason_5", "OK: is present"],
 156                  ["name_6", "cmdline", "is present", "decision_6", "reason_6", "FAIL: is not present"],
 157                  ["name_7", "cmdline", "is not off", "decision_7", "reason_7", "OK: is not off, \"\""],
 158                  ["name_8", "cmdline", "is not off", "decision_8", "reason_8", "FAIL: is off"],
 159                  ["name_9", "cmdline", "is not off", "decision_9", "reason_9", "FAIL: is off, \"0\""],
 160                  ["name_10", "cmdline", "is not off", "decision_10", "reason_10", "FAIL: is off, not found"]]
 161         )
 162
 163     def test_OR(self):
 164         # 1. prepare the checklist
 165         config_checklist = []
 166         config_checklist += [OR(KconfigCheck('reason_1', 'decision_1', 'NAME_1', 'expected_1'),
 167                                 KconfigCheck('reason_2', 'decision_2', 'NAME_2', 'expected_2'))]
 168         config_checklist += [OR(KconfigCheck('reason_3', 'decision_3', 'NAME_3', 'expected_3'),
 169                                 KconfigCheck('reason_4', 'decision_4', 'NAME_4', 'expected_4'))]
 170         config_checklist += [OR(KconfigCheck('reason_5', 'decision_5', 'NAME_5', 'expected_5'),
 171                                 KconfigCheck('reason_6', 'decision_6', 'NAME_6', 'expected_6'))]
 172         config_checklist += [OR(KconfigCheck('reason_6', 'decision_6', 'NAME_6', 'expected_6'),
 173                                 KconfigCheck('reason_7', 'decision_7', 'NAME_7', 'is not set'))]
 174
 175         # 2. prepare the parsed kconfig options
 176         parsed_kconfig_options = OrderedDict()
 177         parsed_kconfig_options['CONFIG_NAME_1'] = 'expected_1'
 178         parsed_kconfig_options['CONFIG_NAME_2'] = 'UNexpected_2'
 179         parsed_kconfig_options['CONFIG_NAME_3'] = 'UNexpected_3'
 180         parsed_kconfig_options['CONFIG_NAME_4'] = 'expected_4'
 181         parsed_kconfig_options['CONFIG_NAME_5'] = 'UNexpected_5'
 182         parsed_kconfig_options['CONFIG_NAME_6'] = 'UNexpected_6'
 183
 184         # 3. run the engine
 185         result = []
 186         self.run_engine(config_checklist, parsed_kconfig_options, None, None, result)
 187
 188         # 4. check that the results are correct
 189         self.assertEqual(
 190                 result,
 191                 [["CONFIG_NAME_1", "kconfig", "expected_1", "decision_1", "reason_1", "OK"],
 192                  ["CONFIG_NAME_3", "kconfig", "expected_3", "decision_3", "reason_3", "OK: CONFIG_NAME_4 is \"expected_4\""],
 193                  ["CONFIG_NAME_5", "kconfig", "expected_5", "decision_5", "reason_5", "FAIL: \"UNexpected_5\""],
 194                  ["CONFIG_NAME_6", "kconfig", "expected_6", "decision_6", "reason_6", "OK: CONFIG_NAME_7 is not found"]]
 195         )
 196
 197     def test_AND(self):
 198         # 1. prepare the checklist
 199         config_checklist = []
 200         config_checklist += [AND(KconfigCheck('reason_1', 'decision_1', 'NAME_1', 'expected_1'),
 201                                 KconfigCheck('reason_2', 'decision_2', 'NAME_2', 'expected_2'))]
 202         config_checklist += [AND(KconfigCheck('reason_3', 'decision_3', 'NAME_3', 'expected_3'),
 203                                 KconfigCheck('reason_4', 'decision_4', 'NAME_4', 'expected_4'))]
 204         config_checklist += [AND(KconfigCheck('reason_5', 'decision_5', 'NAME_5', 'expected_5'),
 205                                 KconfigCheck('reason_6', 'decision_6', 'NAME_6', 'expected_6'))]
 206
 207         # 2. prepare the parsed kconfig options
 208         parsed_kconfig_options = OrderedDict()
 209         parsed_kconfig_options['CONFIG_NAME_1'] = 'expected_1'
 210         parsed_kconfig_options['CONFIG_NAME_2'] = 'expected_2'
 211         parsed_kconfig_options['CONFIG_NAME_3'] = 'expected_3'
 212         parsed_kconfig_options['CONFIG_NAME_4'] = 'UNexpected_4'
 213         parsed_kconfig_options['CONFIG_NAME_5'] = 'UNexpected_5'
 214         parsed_kconfig_options['CONFIG_NAME_6'] = 'expected_6'
 215
 216         # 3. run the engine
 217         result = []
 218         self.run_engine(config_checklist, parsed_kconfig_options, None, None, result)
 219
 220         # 4. check that the results are correct
 221         self.assertEqual(
 222                 result,
 223                 [["CONFIG_NAME_1", "kconfig", "expected_1", "decision_1", "reason_1", "OK"],
 224                  ["CONFIG_NAME_3", "kconfig", "expected_3", "decision_3", "reason_3", "FAIL: CONFIG_NAME_4 is not \"expected_4\""],
 225                  ["CONFIG_NAME_5", "kconfig", "expected_5", "decision_5", "reason_5", "FAIL: \"UNexpected_5\""]]
 226         )