X-Git-Url: https://jxself.org/git/?a=blobdiff_plain;f=.github%2Fworkflows%2Ffunctional_test.yml;h=b9590eeda6d415736f5a65b68458471df9ee508c;hb=bc3e49d1daa960b9f242a725dd948770b9e65d9e;hp=1f2306ef07557cc01558b5ea629a030daed23e0b;hpb=1ce05a70f02ee64a076362725be748290e9c031b;p=kconfig-hardened-check.git diff --git a/.github/workflows/functional_test.yml b/.github/workflows/functional_test.yml index 1f2306e..b9590ee 100644 --- a/.github/workflows/functional_test.yml +++ b/.github/workflows/functional_test.yml @@ -12,156 +12,61 @@ jobs: runs-on: ubuntu-latest strategy: - max-parallel: 3 + max-parallel: 1 fail-fast: false matrix: # Current ubuntu-latest (Ubuntu 22.04) provides the following versions of Python: - python-version: ['3.7', '3.8', '3.9', '3.10', '3.11'] + python-version: ['3.8', '3.9', '3.10', '3.11', '3.12'] steps: - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v4 + uses: actions/setup-python@v5 with: python-version: ${{ matrix.python-version }} - name: Install package run: | python -m pip install --upgrade pip - pip install coverage - pip --verbose install git+https://github.com/a13xp0p0v/kconfig-hardened-check - echo ">>>>> first start <<<<<" - kconfig-hardened-check + echo "Install the package via pip..." + pip --verbose install git+https://github.com/a13xp0p0v/kernel-hardening-checker + echo "Run the installed tool..." + kernel-hardening-checker - name: Check all configs with the installed tool run: | - echo ">>>>> check all configs <<<<<" + echo "Check all configs with the installed tool..." + sysctl -a > /tmp/sysctls CONFIG_DIR=`find /opt/hostedtoolcache/Python/ -name config_files` - KCONFIGS=`find $CONFIG_DIR -type f | grep "\.config"` + KCONFIGS=`find $CONFIG_DIR -type f | grep -e "\.config" -e "\.gz"` COUNT=0 for C in $KCONFIGS do COUNT=$(expr $COUNT + 1) - echo -e "\n>>>>> checking config number $COUNT <<<<<" - kconfig-hardened-check -c $C -l /proc/cmdline + echo -e "\n>>>>> checking kconfig number $COUNT <<<<<" + kernel-hardening-checker -c $C -l /proc/cmdline -s /tmp/sysctls done - echo -e "\n>>>>> checking $COUNT configs is done <<<<<" + echo -e "\nHave checked $COUNT kconfigs" - name: Get source code for collecting coverage - uses: actions/checkout@v3 - - - name: Collect coverage for the basic functionality - run: | - echo ">>>>> get help <<<<<" - coverage run -a --branch bin/kconfig-hardened-check - coverage run -a --branch bin/kconfig-hardened-check -h - - echo ">>>>> get version <<<<<" - coverage run -a --branch bin/kconfig-hardened-check --version - - echo ">>>>> print the security hardening preferences <<<<<" - coverage run -a --branch bin/kconfig-hardened-check -p X86_64 - coverage run -a --branch bin/kconfig-hardened-check -p X86_64 -m verbose - coverage run -a --branch bin/kconfig-hardened-check -p X86_64 -m json - - coverage run -a --branch bin/kconfig-hardened-check -p X86_32 - coverage run -a --branch bin/kconfig-hardened-check -p X86_32 -m verbose - coverage run -a --branch bin/kconfig-hardened-check -p X86_32 -m json - - coverage run -a --branch bin/kconfig-hardened-check -p ARM64 - coverage run -a --branch bin/kconfig-hardened-check -p ARM64 -m verbose - coverage run -a --branch bin/kconfig-hardened-check -p ARM64 -m json - - coverage run -a --branch bin/kconfig-hardened-check -p ARM - coverage run -a --branch bin/kconfig-hardened-check -p ARM -m verbose - coverage run -a --branch bin/kconfig-hardened-check -p ARM -m json - - echo ">>>>> check the example kconfig files and cmdline <<<<<" - cat /proc/cmdline - echo "l1tf=off mds=full randomize_kstack_offset=on iommu.passthrough=0" > ./cmdline_example - cat ./cmdline_example - CONFIG_DIR=`find . -name config_files` - KCONFIGS=`find $CONFIG_DIR -type f | grep "\.config"` - COUNT=0 - for C in $KCONFIGS - do - COUNT=$(expr $COUNT + 1) - echo -e "\n>>>>> checking config number $COUNT <<<<<" - coverage run -a --branch bin/kconfig-hardened-check -c $C - coverage run -a --branch bin/kconfig-hardened-check -c $C -m verbose > /dev/null - coverage run -a --branch bin/kconfig-hardened-check -c $C -l /proc/cmdline - coverage run -a --branch bin/kconfig-hardened-check -c $C -l ./cmdline_example - coverage run -a --branch bin/kconfig-hardened-check -c $C -l ./cmdline_example -m verbose > /dev/null - coverage run -a --branch bin/kconfig-hardened-check -c $C -l ./cmdline_example -m json - coverage run -a --branch bin/kconfig-hardened-check -c $C -l ./cmdline_example -m show_ok - coverage run -a --branch bin/kconfig-hardened-check -c $C -l ./cmdline_example -m show_fail - done - echo -e "\n>>>>> checking $COUNT configs is done <<<<<" + uses: actions/checkout@v4 - - name: Collect coverage for error handling + - name: Run the functional tests and collect the coverage run: | - echo ">>>>> lonely -l <<<<<" - ! coverage run -a --branch bin/kconfig-hardened-check -l /proc/cmdline - - echo ">>>>> wrong modes for -p <<<<<" - ! coverage run -a --branch bin/kconfig-hardened-check -p X86_64 -m show_ok - ! coverage run -a --branch bin/kconfig-hardened-check -p X86_64 -m show_fail - - echo ">>>>> -p and -c together <<<<<" - ! coverage run -a --branch bin/kconfig-hardened-check -p X86_64 -c kconfig_hardened_check/config_files/distros/fedora_34.config - - cp kconfig_hardened_check/config_files/distros/fedora_34.config ./test.config - - echo ">>>>> no kernel version <<<<<" - sed '3d' test.config > error.config - ! coverage run -a --branch bin/kconfig-hardened-check -c error.config - - echo ">>>>> strange kernel version string <<<<<" - sed '3 s/5./version 5./' test.config > error.config - ! coverage run -a --branch bin/kconfig-hardened-check -c error.config - - echo ">>>>> no arch <<<<<" - sed '305d' test.config > error.config - ! coverage run -a --branch bin/kconfig-hardened-check -c error.config - - echo ">>>>> more than one arch <<<<<" - cp test.config error.config - echo 'CONFIG_ARM64=y' >> error.config - ! coverage run -a --branch bin/kconfig-hardened-check -c error.config - - echo ">>>>> invalid disabled kconfig option <<<<<" - sed '28 s/is not set/is not set yet/' test.config > error.config - ! coverage run -a --branch bin/kconfig-hardened-check -c error.config - - echo ">>>>> invalid enabled kconfig option <<<<<" - cp test.config error.config - echo 'CONFIG_FOO=is not set' >> error.config - ! coverage run -a --branch bin/kconfig-hardened-check -c error.config - - echo ">>>>> one config option multiple times <<<<<" - cp test.config error.config - echo 'CONFIG_BUG=y' >> error.config - ! coverage run -a --branch bin/kconfig-hardened-check -c error.config - - echo ">>>>> invalid compiler versions <<<<<" - cp test.config error.config - sed '8 s/CONFIG_CLANG_VERSION=0/CONFIG_CLANG_VERSION=120000/' test.config > error.config - ! coverage run -a --branch bin/kconfig-hardened-check -c error.config - - echo ">>>>> multi-line cmdline file <<<<<" - echo 'hey man 1' > cmdline - echo 'hey man 2' >> cmdline - ! coverage run -a --branch bin/kconfig-hardened-check -c test.config -l cmdline + pip install coverage + sh .github/workflows/functional_test.sh - name: Prepare final coverage report run: | coverage xml -i -o coverage.xml - name: Handle coverage - uses: codecov/codecov-action@v3 + uses: codecov/codecov-action@v4 + env: + CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} with: files: ./coverage.xml flags: functional_test - name: codecov-umbrella + name: functional_test_upload fail_ci_if_error: true verbose: true