lp:~arighi/qa-regression-testing

Author: Andrea Righi
Author Date: 2023-10-04 16:03:47 UTC

scripts/test-kernel-security.py: support zstd compressed modules

BugLink: https://bugs.launchpad.net/bugs/2038437

New mantic kernels now have zstd compressed modules, that means modules
files are not named *.ko anymore, but *.ko.zst instead.

Make sure to support both formats when running the test.

Signed-off-by: Andrea Righi <andrea.righi@canonical.com>

Author: Andrea Righi
Author Date: 2023-04-11 13:09:29 UTC

test-apparmor: support python2 and python3

Signed-off-by: Andrea Righi <andrea.righi@canonical.com>

Author: Andrea Righi
Author Date: 2023-04-11 12:26:41 UTC

test-apparmor: skip python2 envfilter in Lunar

python2 has been droppped in Lunar, so we can skip python2 related
tests.

Signed-off-by: Andrea Righi <andrea.righi@canonical.com>

Author: Andrea Righi
Author Date: 2023-04-11 06:26:19 UTC

kernel-security: support both python2 and python3

python2 has been removed in Lunar. Change the shebang of the python
scripts to select either python2 or python3 at runtime, depending on
which one is available in the system.

Signed-off-by: Andrea Righi <andrea.righi@canonical.com>

Author: Andrea Righi
Author Date: 2023-03-25 09:12:55 UTC

test-kernel-security.py: skip RANDOM_TRUST_CPU check with kernel 6.2

Kernel 6.2 dropped CONFIG_RANDOM_TRUST_CPU with this commit:

  b9b01a5625b5 ("random: use random.trust_{bootloader,cpu} command line option only")

Do not report an error with kernels >= 6.2 if this config is not
defined.

Signed-off-by: Andrea Righi <andrea.righi@canonical.com>

Author: Andrea Righi
Author Date: 2021-09-09 10:38:10 UTC

test-apparmor: do not apply CAP_CHECKPOINT_RESTORE in impish

We don't need to apply the CAP_CHECKPOINT_RESTORE workaround anymore in
impish, because the apparmor package already contains the definition of
this new capability in severity.db.

Signed-off-by: Andrea Righi <andrea.righi@canonical.com>

Author: Andrea Righi
Author Date: 2021-07-05 14:38:23 UTC

kernel-security/ptrace: support new gdb error message

To determine if ptrace() is allowed or not ptrace-restrictions.sh is
checking the error message returned by gdb. However newer versions of
gdb (in impish) changed the error string from 'Operation not permitted'
to 'Inappropriate ioctl for device', but the result is still the same.

Make sure to recognize both strings to prevent false positive failures.

Signed-off-by: Andrea Righi <andrea.righi@canonical.com>

Author: Andrea Righi
Author Date: 2021-02-18 10:22:29 UTC

scripts/test-kernel-security.py: properly support linux 5.11

Both PAGE_POISONING_ZERO and PAGE_POISONING_NO_SANITY configs have been
removed by the following upstream commits (starting with 5.11):

 8f424750baaa ("mm, page_poison: remove CONFIG_PAGE_POISONING_NO_SANITY")
 f289041ed4cf ("mm, page_poison: remove CONFIG_PAGE_POISONING_ZERO")

Adjust the kernel security test accordingly.

Signed-off-by: Andrea Righi <andrea.righi@canonical.com>

Author: Andrea Righi
Author Date: 2021-02-18 10:22:29 UTC

scripts/test-kernel-security.py: properly support linux 5.11

Both PAGE_POISONING_ZERO and PAGE_POISONING_NO_SANITY configs have been
removed by the following upstream commits (starting with 5.11):

 8f424750baaa ("mm, page_poison: remove CONFIG_PAGE_POISONING_NO_SANITY")
 f289041ed4cf ("mm, page_poison: remove CONFIG_PAGE_POISONING_ZERO")

Adjust the kernel security test accordingly.

Signed-off-by: Andrea Righi <andrea.righi@canonical.com>

Author: Avital Ostromich
Author Date: 2021-02-12 01:23:26 UTC

Reupload updated focal audits, update audit README

 - Replace focal audits with those based on the current image builds
 - Add audits with policy-kit script output
 - Add improvements section to README, remove Ubuntu Touch

Author: Emilia Torino
Author Date: 2019-09-19 14:43:02 UTC

adding condition on how the encoded string should be depending on versions as tomcat7 and tomcat8 <= 16.04 are missing single quotes and backslash encoding

Author: Emilia Torino
Author Date: 2019-07-22 19:59:23 UTC

Merge branch 'master' of git+ssh://git.launchpad.net/qa-regression-testing into docker_test