Bugzilla – Bug 1211068
[Build 20230503] openQA test fails in delete_module03
Last modified: 2023-07-20 06:01:28 UTC
## Observation TW was updated to kernel 6.3 # wait_serial expected: qr/### TEST delete_module03 COMPLETE >>> \d+\./u # Result: tst_test.c:1558: TINFO: Timeout per run is 0h 00m 30s insmod: ERROR: could not insert module dummy_del_mod.ko: Key was rejected by service tst_cmd.c:121: TBROK: 'insmod' exited with a non-zero code 1 at tst_cmd.c:121 Summary: passed 0 failed 0 broken 1 skipped 0 warnings 0 ### TEST delete_module03 COMPLETE >>> 2. delete_module03 tst_test.c:1558: TINFO: Timeout per run is 0h 00m 30s insmod: ERROR: could not insert module dummy_del_mod.ko: Key was rejected by service tst_cmd.c:121: TBROK: 'insmod' exited with a non-zero code 1 at tst_cmd.c:121 Summary: passed 0 failed 0 broken 1 skipped 0 warnings 0 ### TEST delete_module03 COMPLETE >>> 2. # vmstat -w; echo kQ8Ut-$?- --procs-- -----------------------memory---------------------- ---swap-- -----io---- -system-- --------cpu-------- r … dup01 passed # echo 'OpenQA::run_ltp.pm: Starting dup01' > /dev/ttyS0; echo tO3Qp-$?- tO3Qp openQA test in scenario opensuse-Tumbleweed-JeOS-for-kvm-and-xen-x86_64-jeos-ltp-syscalls@uefi_virtio-2G fails in [delete_module03](https://openqa.opensuse.org/tests/3261971/modules/delete_module03/steps/6) ## Test suite description ## Reproducible Fails since (at least) Build [20230503](https://openqa.opensuse.org/tests/3261645) ## Expected result Last good: [20230502](https://openqa.opensuse.org/tests/3259709) (or more recent) ## Further details Always latest result in this scenario: [latest](https://openqa.opensuse.org/tests/latest?arch=x86_64&distri=opensuse&flavor=JeOS-for-kvm-and-xen&machine=uefi_virtio-2G&test=jeos-ltp-syscalls&version=Tumbleweed)
"Loading of unsigned module is rejected" This is an outcome of some more tight lockdown, apparently. But trying to load an unsigned module (LTP's dummy_del_mod.ko) with secure boot enabled is not a good idea after all... The test needs tuning IMO.
Filed bug requesting to update QA tests: https://progress.opensuse.org/issues/132686
(In reply to Jiri Slaby from comment #1) > "Loading of unsigned module is rejected" > > This is an outcome of some more tight lockdown, apparently. > > But trying to load an unsigned module (LTP's dummy_del_mod.ko) with secure > boot enabled is not a good idea after all... The test needs tuning IMO. According to https://bugzilla.suse.com/show_bug.cgi?id=1209006#c46 there were some forth and back lockdown enablement changes. It looks like lockdown was finally re-enabled in 5ab030f1f07 ("Revert "Disable lockdown. (bsc#1209006)"") [1], which leaded to proper lockdown detection [2]: tst_test.c:1161: TCONF: Kernel is locked down, skipping test (verification of the kernel version: 5ab030f [3]). @Jiri were in previous kernel version b97b894 [4], where the detection was failing (thus LTP test tried loading unsigned module, which failed [5]) these 4 patches [1] applied? They had "jlee" before file names, I'd expect it would prevent applying them. But what else did the actual lockdown? Or did something else (enabled secure boot?) caused insmod error? (insmod: ERROR: could not insert module dummy_del_mod.ko: Key was rejected by service [5]). [1] https://kerncvs.suse.de/gitweb/?p=kernel-source.git;a=commit;h=5ab030f1f07fd96746960bce337ec62fc11b6a9a [2] https://openqa.opensuse.org/tests/3433978#step/delete_module01/8 [3] https://openqa.opensuse.org/tests/3433978#step/install_ltp/84 [4] https://openqa.opensuse.org/tests/3433493#step/install_ltp/84 [5] https://openqa.opensuse.org/tests/3433493#step/delete_module01/8
Previously /sys/kernel/security/lockdown had [none], now it has [integrity], IMHO it was not lockdown, but secureboot.
(In reply to Petr Vorel from comment #4) > Previously /sys/kernel/security/lockdown had [none], now it has [integrity], > IMHO it was not lockdown, but secureboot. Right, lockdown was not fully enabled. Either it was secureboot or some partial (upstream) lockdown.