Daan De MeyerandYu Watanabe
ee6b3d1aa2
When a TTY is attached to the test unit, grep -q will generate SIGPIPE for the previous command in the pipeline which in combo with `pipefail` will cause the command to fail with exit status 141 which will fail the test. Replace with >/dev/null to avoid this from happening. See also https://www.gnu.org/software/grep/manual/html_node/Usage.html > There is a related problem with Bash’s set -e -o pipefail. Since grep > does not always read all its input, a command outputting to a pipe read > by grep can fail when grep exits before reading all its input, and the > command’s failure can cause Bash to exit. Co-authored-by: Yu Watanabe <watanabe.yu+github@gmail.com>
54 lines
2.0 KiB
Bash
Executable File
54 lines
2.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# SPDX-License-Identifier: LGPL-2.1-or-later
|
|
set -eux
|
|
set -o pipefail
|
|
|
|
# Forward Secure Sealing
|
|
|
|
if ! journalctl --version | grep -F +GCRYPT >/dev/null; then
|
|
echo "Built without gcrypt, skipping the FSS tests"
|
|
exit 0
|
|
fi
|
|
|
|
# output key and related info in json format
|
|
for mode in json json-pretty json-seq json-sse; do
|
|
journalctl --force --setup-keys --interval=2 --output="$mode" | jq . >/dev/null
|
|
done
|
|
|
|
# without --quiet, should be effectively equivalent to the below, as we are not on tty
|
|
journalctl --force --setup-keys --interval=2
|
|
|
|
FSS_VKEY=$(journalctl --force --setup-keys --interval=2 --quiet)
|
|
[[ -n "$FSS_VKEY" ]]
|
|
|
|
# Generate some buzz in the journal and wait until the FSS key is changed
|
|
# at least once
|
|
systemd-cat cat /etc/os-release
|
|
sleep 4
|
|
# Seal the journal
|
|
journalctl --rotate
|
|
# Verification should fail without a valid FSS key
|
|
(! journalctl --verify)
|
|
(! journalctl --verify --verify-key="")
|
|
(! journalctl --verify --verify-key="000000-000000-000000-000000/00000000-00000")
|
|
# FIXME: ignore --verify result until #27532 is resolved
|
|
journalctl --verify --verify-key="$FSS_VKEY" || :
|
|
|
|
# Sealing + systemd-journal-remote
|
|
/usr/lib/systemd/systemd-journal-remote --getter="journalctl -n 5 -o export" \
|
|
--split-mode=none \
|
|
--seal=yes \
|
|
--output=/tmp/sealed.journal
|
|
(! journalctl --file=/tmp/sealed.journal --verify)
|
|
(! journalctl --file=/tmp/sealed.journal --verify --verify-key="")
|
|
(! journalctl --file=/tmp/sealed.journal --verify --verify-key="000000-000000-000000-000000/00000000-00000")
|
|
# FIXME: ignore --verify result until #27532 is resolved
|
|
journalctl --file=/tmp/sealed.journal --verify --verify-key="$FSS_VKEY" || :
|
|
rm -f /tmp/sealed.journal
|
|
|
|
# Return back to a journal without FSS
|
|
rm -fv "/var/log/journal/$(</etc/machine-id)/fss"
|
|
journalctl --rotate --vacuum-size=1
|
|
# FIXME: ignore --verify result until #27532 is resolved
|
|
journalctl --verify || :
|