Feature #8889: Automatically test that Tor runs with Seccomp enabled

Feature #8889

Automatically test that Tor runs with Seccomp enabled

Added by intrigeri 2015-02-11 11:46:04 . Updated 2015-02-24 22:52:40 .

Status:

Resolved

Priority:

Normal

Assignee:

Category:

Test suite

Target version:

Tails_1.3

Start date:

2015-02-11

Due date:

% Done:

100%

Feature Branch:

kytv:test/8889-tor-seccomp

Type of work:

Code

Blueprint:

Starter:

Affected tool:

Deliverable for:

Description

Unless the user has chosen advanced Tor configuration in the Greeter, thanks to ~~Bug #8174~~ Tor should run in seccomp “filter” mode. That is, the Seccomp entry in /proc/$(pidof tor)/status should have the value “2”. We should test that automatically, in order to identify regressions in this area.

Reference: http://man7.org/linux/man-pages/man5/proc.5.html

Subtasks

Related issues

Blocked by Tails - ~~Bug #8174~~: Build Tor with seccomp

Resolved

2014-10-26

History

#1 Updated by intrigeri 2015-02-11 11:46:34

Description updated

#2 Updated by intrigeri 2015-02-11 11:46:54

blocked by ~~Bug #8174~~: Build Tor with seccomp added

#3 Updated by kytv 2015-02-11 18:39:49

Status changed from Confirmed to In Progress
Assignee changed from kytv to anonym
% Done changed from 0 to 50
QA Check set to Ready for QA
Feature Branch set to kytv:test/8889-tor-seccomp

With an ISO built from the devel branch a few days ago:

call returned: [0, "", ""]
    And Tor is ready                                                     # features/step_definitions/common_steps.rb:297
calling as root: awk '/^Seccomp:/{print $2}' /proc/$(pidof tor)/status
call returned: [0, "0\n", ""]
    Then the running process "tor" is confined with Seccomp              # features/step_definitions/checks.rb:144
      tor not confined with Seccomp.
      <2> expected but was
      <0>. (MiniTest::Assertion)
      ./features/step_definitions/checks.rb:147:in `/^the running process "(.+)" is confined with Seccomp$/'
      features/checks.feature:51:in `Then the running process "tor" is confined with Seccomp'

With an ISO built from the devel branch today:

    And Tor is ready                                                     # features/step_definitions/common_steps.rb:297
calling as root: awk '/^Seccomp:/{print $2}' /proc/$(pidof tor)/status
call returned: [0, "2\n", ""]
    Then the running process "tor" is confined with Seccomp              # features/step_definitions/checks.rb:144

#4 Updated by intrigeri 2015-02-11 18:57:52

Assignee changed from anonym to kytv
QA Check changed from Ready for QA to Info Needed

Any reason to use execute instead of execute_successfully? Granted, the next assert will fail in some way if the command failed, but still, IMO it’s good to get into the habit of using the autodying wrapper instead of the laxist one.