From 8fbc93345e50d4541600e1ec9e633d4c33f7d787 Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Sun, 3 May 2026 13:27:32 +0100 Subject: [PATCH 1/3] test: bump device timeout to 300s for TPM2 tests Booting with TPM2 has become slower recently so tests are randomly failing, try to bump the default device timeout in those test VMs --- test/integration-tests/TEST-70-TPM2/meson.build | 3 +++ test/integration-tests/TEST-86-MULTI-PROFILE-UKI/meson.build | 3 +++ 2 files changed, 6 insertions(+) diff --git a/test/integration-tests/TEST-70-TPM2/meson.build b/test/integration-tests/TEST-70-TPM2/meson.build index bf66f8f73e..5932215ceb 100644 --- a/test/integration-tests/TEST-70-TPM2/meson.build +++ b/test/integration-tests/TEST-70-TPM2/meson.build @@ -10,5 +10,8 @@ integration_tests += [ 'vm' : true, 'firmware' : 'auto', 'tpm' : true, + 'cmdline' : integration_test_template['cmdline'] + [ + 'systemd.default_device_timeout_sec=300', + ], }, ] diff --git a/test/integration-tests/TEST-86-MULTI-PROFILE-UKI/meson.build b/test/integration-tests/TEST-86-MULTI-PROFILE-UKI/meson.build index 51a7097090..acc3512e33 100644 --- a/test/integration-tests/TEST-86-MULTI-PROFILE-UKI/meson.build +++ b/test/integration-tests/TEST-86-MULTI-PROFILE-UKI/meson.build @@ -7,5 +7,8 @@ integration_tests += [ 'vm' : true, 'firmware' : 'auto', 'tpm' : true, + 'cmdline' : integration_test_template['cmdline'] + [ + 'systemd.default_device_timeout_sec=300', + ], }, ] From 2fc008b9e437065c5e33b98cc7410dc91f555564 Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Sun, 3 May 2026 16:23:41 +0100 Subject: [PATCH 2/3] test: make TEST-70-TPM2 robust against reruns The test leaves a lot of state around, and when the test is re-run, for example due to the qemu bug that makes a VM reboot instead of shutting down, it fails. Do more cleanups in the traps. [ 162.642175] TEST-70-TPM2.sh[2815]: Calculated public key name: 000b2b66edc3a466e81059286aaf38d09ea42a7a9dcdf6ba3b664c62f0cae4ce4f66 [ 162.642628] TEST-70-TPM2.sh[2815]: PolicyAuthorize calculated digest: 2caa740101f65734d50395d6abc64fa46015d40d1f5de239434578544e592a92 [ 162.643681] TEST-70-TPM2.sh[2815]: Calculated NV index name: 000b439cfa1534815bbe8d33b80c56f5a8d17d36fe94a7782b23a37b50def5fc5eaa [ 162.645111] TEST-70-TPM2.sh[2815]: PolicyAuthorizeNV calculated digest: 69ee0e89fafe6b9df2cd6a5defbf74aa46cf6d92703e645d463549da4ba5e1a4 [ 162.645407] TEST-70-TPM2.sh[2815]: Combined signed PCR policies and pcrlock policies cannot be calculated offline, currently. [ 162.649576] TEST-70-TPM2.sh[2815]: Releasing crypt device /dev/loop0 context. [ 162.652433] TEST-70-TPM2.sh[2815]: Releasing device-mapper backend. [ 162.653518] TEST-70-TPM2.sh[2815]: Closing read only fd for /dev/loop0. [ 162.654359] TEST-70-TPM2.sh[2815]: Closing read write fd for /dev/loop0. [ 162.654786] TEST-70-TPM2.sh[2815]: Failed to encrypt device: Operation not supported Fixes https://github.com/systemd/systemd/issues/38241 --- test/units/TEST-70-TPM2.creds.sh | 8 ++++++-- test/units/TEST-70-TPM2.cryptenroll.sh | 6 ++++++ test/units/TEST-70-TPM2.cryptsetup.sh | 13 +++++++++++++ test/units/TEST-70-TPM2.measure.sh | 25 +++++++++++++++++++++++++ test/units/TEST-70-TPM2.nvpcr.sh | 2 +- test/units/TEST-70-TPM2.pcrextend.sh | 10 ++++++++++ test/units/TEST-70-TPM2.pcrlock.sh | 21 ++++++++++++++++++++- 7 files changed, 81 insertions(+), 4 deletions(-) diff --git a/test/units/TEST-70-TPM2.creds.sh b/test/units/TEST-70-TPM2.creds.sh index 15899d1057..53ff862e18 100755 --- a/test/units/TEST-70-TPM2.creds.sh +++ b/test/units/TEST-70-TPM2.creds.sh @@ -5,6 +5,12 @@ set -o pipefail export SYSTEMD_LOG_LEVEL=debug +at_exit() { + rm -f /tmp/testdata /tmp/testdata.encrypted +} + +trap at_exit EXIT + # Ensure that sandboxing doesn't stop creds from being accessible echo "test" >/tmp/testdata systemd-creds encrypt /tmp/testdata /tmp/testdata.encrypted --with-key=tpm2 @@ -12,5 +18,3 @@ systemd-creds encrypt /tmp/testdata /tmp/testdata.encrypted --with-key=tpm2 systemd-run -p PrivateDevices=yes -p LoadCredentialEncrypted=testdata.encrypted:/tmp/testdata.encrypted --pipe --wait systemd-creds cat testdata.encrypted | cmp - /tmp/testdata # SetCredentialEncrypted systemd-run -p PrivateDevices=yes -p SetCredentialEncrypted=testdata.encrypted:"$(cat /tmp/testdata.encrypted)" --pipe --wait systemd-creds cat testdata.encrypted | cmp - /tmp/testdata - -rm -f /tmp/testdata diff --git a/test/units/TEST-70-TPM2.cryptenroll.sh b/test/units/TEST-70-TPM2.cryptenroll.sh index d09f702093..07309429d7 100755 --- a/test/units/TEST-70-TPM2.cryptenroll.sh +++ b/test/units/TEST-70-TPM2.cryptenroll.sh @@ -11,6 +11,12 @@ cryptenroll_wipe_and_check() {( grep -qE "Wiped slot [[:digit:]]+" /tmp/cryptenroll.out )} +at_exit() { + rm -f "${IMAGE:-}" /tmp/cryptenroll.out /tmp/password +} + +trap at_exit EXIT + # There is an external issue with libcryptsetup on ppc64 that hits 95% of Ubuntu ppc64 test runs, so skip it if [[ "$(uname -m)" == "ppc64le" ]]; then echo "Skipping systemd-cryptenroll tests on ppc64le, see https://github.com/systemd/systemd/issues/27716" diff --git a/test/units/TEST-70-TPM2.cryptsetup.sh b/test/units/TEST-70-TPM2.cryptsetup.sh index 24c87d0f24..5a7f0facfc 100755 --- a/test/units/TEST-70-TPM2.cryptsetup.sh +++ b/test/units/TEST-70-TPM2.cryptsetup.sh @@ -31,10 +31,23 @@ tpm_check_failure_with_wrong_pin() { } at_exit() { + set +e + + umount /tmp/dditest.mnt + systemd-cryptsetup detach test-volume + systemd-cryptsetup detach dditest + # Evict the TPM primary key that we persisted if [[ -n "${PERSISTENT_HANDLE:-}" ]]; then tpm2_evictcontrol -c "$PERSISTENT_HANDLE" fi + + if [[ -n "${DEVICE:-}" ]]; then + systemd-dissect --detach "$DEVICE" + fi + + rm -rf /tmp/dditest /tmp/dditest.mnt + rm -f /tmp/dditest.raw "${IMAGE:-}" "${PRIMARY:-}" /tmp/passphrase /tmp/pcr.dat /tmp/srk.pub /tmp/srk2.pub } trap at_exit EXIT diff --git a/test/units/TEST-70-TPM2.measure.sh b/test/units/TEST-70-TPM2.measure.sh index 30fa51e521..90d6390da0 100755 --- a/test/units/TEST-70-TPM2.measure.sh +++ b/test/units/TEST-70-TPM2.measure.sh @@ -14,6 +14,31 @@ if [[ ! -x "${SD_MEASURE:?}" ]]; then exit 0 fi +at_exit() { + set +e + + systemd-cryptsetup detach test-volume2 + rm -f "${IMAGE:-}" \ + /tmp/passphrase \ + /tmp/pcrsign-private.pem \ + /tmp/pcrsign-public.pem \ + /tmp/pcrsign.sig \ + /tmp/pcrsign.sig2 \ + /tmp/pcrsign.sig3 \ + /tmp/pcrsign.sig4 \ + /tmp/pcrsign.sig5 \ + /tmp/pcrsign.sig6 \ + /tmp/pcrsign.sig7 \ + /tmp/pcrtestdata \ + /tmp/pcrtestdata.encrypted \ + /tmp/result \ + /tmp/result.json \ + /tmp/tpmdata1 \ + /tmp/tpmdata2 +} + +trap at_exit EXIT + IMAGE="$(mktemp /tmp/systemd-measure-XXX.image)" echo HALLO >/tmp/tpmdata1 diff --git a/test/units/TEST-70-TPM2.nvpcr.sh b/test/units/TEST-70-TPM2.nvpcr.sh index 29319e601a..571b3eea77 100755 --- a/test/units/TEST-70-TPM2.nvpcr.sh +++ b/test/units/TEST-70-TPM2.nvpcr.sh @@ -21,7 +21,7 @@ at_exit() { fi rm -rf /run/nvpcr /tmp/nvpcr - rm -f /var/tmp/nvpcr.raw /run/verity.d/test-79-nvpcr.crt + rm -f /var/tmp/nvpcr.raw /run/verity.d/test-70-nvpcr.crt /run/systemd/nvpcr/test.anchor } trap at_exit EXIT diff --git a/test/units/TEST-70-TPM2.pcrextend.sh b/test/units/TEST-70-TPM2.pcrextend.sh index 14808f0763..ec330576b2 100755 --- a/test/units/TEST-70-TPM2.pcrextend.sh +++ b/test/units/TEST-70-TPM2.pcrextend.sh @@ -19,6 +19,16 @@ at_exit() { # Dump the event log on fail, to make debugging a bit easier jq --seq --slurp Date: Sun, 3 May 2026 16:33:38 +0100 Subject: [PATCH 3/3] test: make TEST-86-MULTI-PROFILE-UKI robust against reruns When qemu reboots instead of shutting down after the last iteration, the profile is already set to profile2 but the /root/encrypted.raw is gone so the test fails. Reset the default boot entry at the end of the test to make it robust against reruns. Fixes https://github.com/systemd/systemd/issues/39553 --- test/units/TEST-86-MULTI-PROFILE-UKI.sh | 3 +++ 1 file changed, 3 insertions(+) diff --git a/test/units/TEST-86-MULTI-PROFILE-UKI.sh b/test/units/TEST-86-MULTI-PROFILE-UKI.sh index 5518cb6561..72fb7b6f55 100755 --- a/test/units/TEST-86-MULTI-PROFILE-UKI.sh +++ b/test/units/TEST-86-MULTI-PROFILE-UKI.sh @@ -64,6 +64,9 @@ elif [[ "$ID" == "profile1" ]]; then elif [[ "$ID" == "profile2" ]]; then grep testprofile2=1 /proc/cmdline rm /root/encrypted.raw + # Reset the default boot entry so a subsequent re-run of the test does not + # boot straight back into @profile2 (where encrypted.raw is now gone) and fail. + bootctl set-default "" else exit 1 fi