Merge ~rodsmith/plainbox-provider-checkbox:add-kernel-taint-test into plainbox-provider-checkbox:master

[Rod Smith]

Adds kernel taint test to Checkbox.

This adds the kernel taint test discussed at the Paris sprint. It checks /proc/sys/kernel/tainted and passes (return code 0) if that file contains a "0" value, or fails (return code 1) on any other value or if the file doesn't exist. In case of a failure, it presents information on the nature of the failure, as in:

Kernel taint value is 12289
Taint bit value: 0 (proprietary module was loaded)
Taint bit value: 12 (externally-built ('out-of-tree') module was loaded)
Taint bit value: 13 (unsigned module was loaded)

A passing result is here:

https://certification.canonical.com/hardware/201908-27304/submission/152762/

...specifically:

https://certification.canonical.com/hardware/201908-27304/submission/152762/test/84909/result/11550849/

I've added this as a non-blocking test to the server miscellanea tests.

The kernel_taint_test script requires no options; however, --taint-file may be used to specify a file other than /proc/sys/kernel/tainted from which to read the taint value. This is intended for testing, debugging, and development of the script itself.

[Sylvain Pineau (sylvain-pineau)]

LGTM

review: Approve

diff --git a/bin/kernel_taint_test b/bin/kernel_taint_test
new file mode 100755
index 0000000..976ccb6
--- /dev/null
+++ b/bin/kernel_taint_test
@@ -0,0 +1,93 @@
+#!/usr/bin/env python3
+"""
+Test that the kernel is not "tainted" by out-of-tree drivers, etc.
+
+Copyright (C) 2019 Canonical Ltd.
+
+Authors:
+  Rod Smith <[e-mail]>
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License version 3,
+as published by the Free Software Foundation.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+This script examines the /proc/sys/kernel/tainted file (or a user-specified
+file, for debugging purposes) and parses the contents to determine if the
+kernel is tainted. If so, the script reports the nature of the taint and
+returns a value of 1. The script also returns a value of 1 if
+# /proc/sys/kernel/tainted cannot be found or opened. If the kernel is NOT
+# tainted, the script notes this fact and returns 0.
+"""
+
+
+import sys
+from argparse import ArgumentParser
+
+
+# Note: If max_taints is increased, add descriptions to taint_meanings in
+# report_failures()
+max_taints = 17
+
+
+def find_taints(taint_file):
+    """Read the kernel-taint file."""
+    try:
+        f = open(taint_file, "r")
+        taints = int(f.read())
+    except OSError:
+        taints = 2**(max_taints+1)  # Set so we have a non-0 value to return
+        print("Kernel taint file ({}) not found!".format(taint_file))
+    print("Kernel taint value is {}".format(taints))
+    return(taints)
+
+
+def report_failures(taints):
+    """Report the failure code and its meaning(s)."""
+    # Below meaning strings are taken from
+    # https://www.kernel.org/doc/html/latest/admin-guide/tainted-kernels.html
+    taint_meanings = ["proprietary module was loaded",
+                      "module was force loaded",
+                      "SMP kernel oops on an officially SMP incapable CPU",
+                      "module was force unloaded",
+                      "processor reported a Machine Check Exception (MCE)",
+                      "bad page referenced or some unexpected page flags",
+                      "taint requested by userspace application",
+                      "kernel died recently, i.e. there was an OOPS or BUG",
+                      "ACPI table overridden by user",
+                      "kernel issued warning",
+                      "staging driver was loaded",
+                      "workaround for bug in platform firmware applied",
+                      "externally-built ('out-of-tree') module was loaded",
+                      "unsigned module was loaded",
+                      "soft lockup occurred",
+                      "kernel has been live patched",
+                      "auxiliary taint, defined for and used by distros",
+                      "kernel was built with the struct randomization plugin"]
+    for i in range(max_taints+1):
+        if (taints & (2 ** i)):
+            print("Taint bit value: {} ({})".format(i, taint_meanings[i]))
+    if taints == 0:
+        print("No kernel taints detected.")
+
+
+def main():
+    parser = ArgumentParser()
+    parser.add_argument('--taint-file',
+                        default="/proc/sys/kernel/tainted",
+                        help='The file that holds the taint information')
+    args = parser.parse_args()
+    taints = find_taints(args.taint_file)
+    report_failures(taints)
+    return(taints > 0)
+
+
+if __name__ == '__main__':
+    sys.exit(main())
diff --git a/units/miscellanea/jobs.pxu b/units/miscellanea/jobs.pxu
index 41c9253..bbb28bf 100644
--- a/units/miscellanea/jobs.pxu
+++ b/units/miscellanea/jobs.pxu
@@ -190,6 +190,16 @@ command: check-prerelease
 
 plugin: shell
 category_id: com.canonical.plainbox::miscellanea
+estimated_duration: 0.5
+id: miscellanea/kernel_taint_test
+_summary: Test that kernel is not tainted
+_description:
+ Test to verify that the kernel is not tainted by out-of-tree
+ drivers, live patches, proprietary modules, etc.
+command: kernel_taint_test
+
+plugin: shell
+category_id: com.canonical.plainbox::miscellanea
 id: miscellanea/bmc_info
 requires:
  package.name == 'ipmitool' or executable.name == 'ipmitool'
diff --git a/units/miscellanea/test-plan.pxu b/units/miscellanea/test-plan.pxu
index 1b119f1..5f7258d 100644
--- a/units/miscellanea/test-plan.pxu
+++ b/units/miscellanea/test-plan.pxu
@@ -67,6 +67,7 @@ mandatory_include:
     miscellanea/secure_boot_mode
     miscellanea/efi_pxeboot
     miscellanea/check_prerelease
+    miscellanea/kernel_taint_test
     miscellanea/cpus_are_not_samples
     miscellanea/ipmi_test                      certification-status=blocker
     miscellanea/bmc_info