Re: [PATCH] tests: Adjust path for swtpm state to use path under /var/tmp/

[Stefan Berger]

On 11/7/24 6:09 AM, Peter Maydell wrote:
> On Wed, 6 Nov 2024 at 18:08, Stefan Berger <stefanb@linux.vnet.ibm.com> wrote:
> > From: Stefan Berger <stefanb@linux.ibm.com>
> >
> > To avoid AppArmor-related test failures when functional test are run from
> > somewhere under /mnt, adjust the path to swtpm's state to use an AppArmor-
> > supported path, such as /var/tmp, which is provided by the python function
> > tempfile.TemporaryDirectory().
> >
> > An update to swtpm's AppArmor profile is also being done to support /var/tmp.
> >
> > Link: 
> > https://lore.kernel.org/qemu-devel/CAFEAcA8A=kWLtTZ+nua-MpzqkaEjW5srOYZruZnE2tB6vmoMig@mail.gmail.com/
> > Link: https://github.com/stefanberger/swtpm/pull/944
> > Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
>
> Thanks for writing this patch. I can confirm that the test now
> runs OK on my Ubuntu setup, so

That's good to hear. However, it surprises me because the tests probably 
use /var/tmp/ as temp dir and that's no supported in the AppArmor 
profile yet.

> Tested-by: Peter Maydell <peter.maydell@linaro.org>
>
> > ---
> >   tests/functional/test_arm_aspeed.py | 6 +++---
> >   1 file changed, 3 insertions(+), 3 deletions(-)
> >
> > diff --git a/tests/functional/test_arm_aspeed.py 
> > b/tests/functional/test_arm_aspeed.py
> > index 9761fc06a4..a574b1e521 100644
> > --- a/tests/functional/test_arm_aspeed.py
> > +++ b/tests/functional/test_arm_aspeed.py
> > @@ -227,11 +227,11 @@ def test_arm_ast2600_evb_buildroot_tpm(self):
> >
> >           image_path = self.ASSET_BR2_202302_AST2600_TPM_FLASH.fetch()
> >
> > -        socket_dir = tempfile.TemporaryDirectory(prefix="qemu_")
> > -        socket = os.path.join(socket_dir.name, 'swtpm-socket')
>
> I think it would be helpful to add a brief comment here:
>             # We must put the TPM state dir in /tmp/, not the build dir,
>             # because some distros use AppArmor to lock down swtpm and
>             # restrict the set of locations it can write to.
>
> just as a guard against somebody in future coming along and
> trying to clean up/rationalize where tests are creating their
> temporary files.
>
> > +        tpmstate_dir = tempfile.TemporaryDirectory(prefix="qemu_")
> > +        socket = os.path.join(tpmstate_dir.name, 'swtpm-socket')
> >
> >           subprocess.run(['swtpm', 'socket', '-d', '--tpm2',
> > -                        '--tpmstate', f'dir={self.vm.temp_dir}',
> > +                        '--tpmstate', f'dir={tpmstate_dir.name}',
> >                           '--ctrl', f'type=unixio,path={socket}'])
> >
> >           self.vm.add_args('-chardev', f'socket,id=chrtpm,path={socket}')
> > --
> > 2.34.1
>
> thanks
> -- PMM