Merge ~gavin.lin/plainbox-provider-checkbox:dbx-test into plainbox-provider-checkbox:master

[Gavin Lin]

Add test to check secure boot dbx for CVE-2020-10713.

[Jonathan Cave (jocave)]

I'm not too sure if this really represents a test of the CVE itself which if understand correctly was a vulnerability in GRUB.

It appears that this test makes sure that a particular signature is no longer trusted when enforcing secure boot? I think it would help to make the descriptions a little more clear on that.

It may also make sense to try and limit this job to running only on systems that use the grub bootloader and have secure boot enabled via requires fields.

review: Needs Fixing

[Jonathan Cave (jocave)]

@Gavin putting this back to work in progress as it has been dormant for a while. If you want to pick it up again than please respond to above or make changes.

[OEM Taipei Bot (oem-taipei-bot)]

Execute `curl -X POST http://10.102.135.31/api/v1/teams/self-contained/pipelines/plainbox-provider-checkbox/resources/merge-proposal-390182/check/webhook?webhook_token=merge-proposal-390182` within TW VPN to restart the test.
[autopkgtest]
$ cat plainbox-provider-checkbox-0.59.0-1-1c442be-in-linux-container-focal-summary.log
blame: .
badpkg: rules build failed with exit code 2
erroneous package: rules build failed with exit code 2
https://oem-share.canonical.com/partners/lyoncore/share/artifacts/plainbox-provider-checkbox-0.59.0-1-1c442be-in-linux-container-focal

Unmerged commits

1c442be... by Gavin Lin on 2020-09-02

Add test to check secure boot dbx for CVE-2020-10713

diff --git a/units/cve/category.pxu b/units/cve/category.pxu
new file mode 100644
index 0000000..57f52c1
--- /dev/null
+++ b/units/cve/category.pxu
@@ -0,0 +1,3 @@
+unit: category
+id: cve
+_name: CVE(Common Vulnerabilities and Exposures)
diff --git a/units/cve/cve-2020-10713.pxu b/units/cve/cve-2020-10713.pxu
new file mode 100644
index 0000000..0fa9a2c
--- /dev/null
+++ b/units/cve/cve-2020-10713.pxu
@@ -0,0 +1,10 @@
+plugin:shell
+category_id: com.canonical.plainbox::cve
+id: cve/CVE-2020-10713_secure_boot_dbx
+estimated_duration: 0.5
+requires: executable.name == 'mokutil'
+_description:
+ Check secure boot dbx for CVE-2020-10713
+_summary: Check secure boot dbx for CVE-2020-10713
+command:
+ mokutil --dbx |grep 59:4e:ce:20:59:16:48:f5:a0:0d:e3:0c:f6:1d:11:8d:be:ce:80:72
diff --git a/units/cve/test-plan.pxu b/units/cve/test-plan.pxu
new file mode 100644
index 0000000..7812bdb
--- /dev/null
+++ b/units/cve/test-plan.pxu
@@ -0,0 +1,7 @@
+id: cve-automated
+unit: test plan
+_name: Automated CVE Tests
+_description: Automated CVE(Common Vulnerabilities and Exposures) tests
+include:
+    cve/CVE-2020-10713_secure_boot_dbx
+