Add RHEL9 gating configuration and CI tests
Resolves: rhbz#1959265
This commit is contained in:
Matus Marhefka
parent
02224b25c7
commit
f81285e2ad
|
|
@ -0,0 +1,6 @@
|
|||
--- !Policy
|
||||
product_versions:
|
||||
- rhel-9
|
||||
decision_context: osci_compose_gate
|
||||
rules:
|
||||
- !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}
|
||||
|
|
@ -0,0 +1,64 @@
|
|||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Makefile of /Sanity/dir-install
|
||||
# Description: Install using OAA into a directory, check that the results file from the final scan contains FIXED results, which proves that remediations were executed.
|
||||
# Author: Matej Tyc <matyc@redhat.com>
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2019 Red Hat, Inc.
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or
|
||||
# modify it under the terms of the GNU General Public License as
|
||||
# published by the Free Software Foundation, either version 2 of
|
||||
# the License, or (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
export TEST=/Sanity/dir-install
|
||||
export TESTVERSION=1.0
|
||||
|
||||
BUILT_FILES=
|
||||
|
||||
FILES=$(METADATA) runtest.sh Makefile PURPOSE kickstart.cfg test-ds.xml
|
||||
|
||||
.PHONY: all install download clean
|
||||
|
||||
run: $(FILES) build
|
||||
./runtest.sh
|
||||
|
||||
build: $(BUILT_FILES)
|
||||
test -x runtest.sh || chmod a+x runtest.sh
|
||||
|
||||
clean:
|
||||
rm -f *~ $(BUILT_FILES)
|
||||
|
||||
|
||||
include /usr/share/rhts/lib/rhts-make.include
|
||||
|
||||
$(METADATA): Makefile
|
||||
@echo "Owner: Matej Tyc <matyc@redhat.com>" > $(METADATA)
|
||||
@echo "Name: $(TEST)" >> $(METADATA)
|
||||
@echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
|
||||
@echo "Path: $(TEST_DIR)" >> $(METADATA)
|
||||
@echo "Description: Install using OAA into a directory, check that the results file from the final scan contains FIXED results, which proves that remediations were executed." >> $(METADATA)
|
||||
@echo "Type: Sanity" >> $(METADATA)
|
||||
@echo "TestTime: 1h" >> $(METADATA)
|
||||
@echo "RunFor: oscap-anaconda-addon" >> $(METADATA)
|
||||
@echo "Requires: oscap-anaconda-addon" >> $(METADATA)
|
||||
@echo "Priority: Normal" >> $(METADATA)
|
||||
@echo "License: GPLv2+" >> $(METADATA)
|
||||
@echo "Confidential: no" >> $(METADATA)
|
||||
@echo "Destructive: no" >> $(METADATA)
|
||||
@echo "Bug: 1653915" >> $(METADATA)
|
||||
@echo "Releases: -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA)
|
||||
|
||||
rhts-lint $(METADATA)
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
PURPOSE of /Sanity/dir-install
|
||||
Description: Install using OAA into a directory, check that the results file from the final scan contains FIXED results, which proves that remediations were executed.
|
||||
Author: Matej Tyc <matyc@redhat.com>
|
||||
|
|
@ -0,0 +1,37 @@
|
|||
lang en_US
|
||||
keyboard us
|
||||
timezone --utc America/New_York
|
||||
reboot
|
||||
url --url=@BASEOS_HTTP@
|
||||
bootloader --location=mbr --append="rhgb quiet crashkernel=auto"
|
||||
zerombr
|
||||
clearpart --all --initlabel
|
||||
autopart
|
||||
authselect --passalgo=sha512 --useshadow
|
||||
selinux --enforcing
|
||||
firewall --enabled --ssh
|
||||
skipx
|
||||
firstboot --disable
|
||||
repo --name=appstream --baseurl=@APPSTREAM_HTTP@
|
||||
|
||||
# Set the system's root password (required)
|
||||
# Plaintext password is: server
|
||||
# Refer to e.g. http://fedoraproject.org/wiki/Anaconda/Kickstart#rootpw to see how to create
|
||||
# encrypted password form for different plaintext password
|
||||
rootpw --iscrypted $6$rhel6usgcb$aS6oPGXcPKp3OtFArSrhRwu6sN8q2.yEGY7AIwDOQd23YCtiz9c5mXbid1BzX9bmXTEZi.hCzTEXFosVBI5ng0
|
||||
|
||||
# The selected profile will restrict root login
|
||||
# Add a user that can login and escalate privileges
|
||||
# Plaintext password is: admin123
|
||||
user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUafQM9jyHCY9BiE5/ahXLNWUMiVQnFGblu0WWGZ1e6icTaCGO4GNgZNtspp1Let/qpM7FMVB0 --iscrypted
|
||||
|
||||
# Packages selection (%packages section is required)
|
||||
%packages
|
||||
openscap-scanner
|
||||
%end
|
||||
|
||||
%addon org_fedora_oscap
|
||||
content-type = datastream
|
||||
content-url = http://localhost:8000/test-ds.xml
|
||||
profile = xccdf_org.ssgproject.content_profile_standard
|
||||
%end
|
||||
|
|
@ -0,0 +1,80 @@
|
|||
#!/bin/bash
|
||||
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# runtest.sh of /Sanity/dir-install
|
||||
# Description: Install using OAA into a directory, check that the results file from the final scan contains FIXED results, which proves that remediations were executed.
|
||||
# Author: Matej Tyc <matyc@redhat.com>
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2019 Red Hat, Inc.
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or
|
||||
# modify it under the terms of the GNU General Public License as
|
||||
# published by the Free Software Foundation, either version 2 of
|
||||
# the License, or (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||
|
||||
PACKAGE="oscap-anaconda-addon"
|
||||
KS=`pwd`/kickstart.cfg
|
||||
INSTALLDIR=`pwd`/install
|
||||
|
||||
|
||||
function get_fedora_repo_url {
|
||||
local rawhide_repo="/etc/yum.repos.d/fedora-rawhide.repo"
|
||||
|
||||
if [ -f "$rawhide_repo" ]; then
|
||||
dnf repoinfo rawhide 2>/dev/null | grep -i "baseurl" | awk '{print $3}'
|
||||
else
|
||||
dnf repoinfo fedora 2>/dev/null | grep -i "baseurl" | awk '{print $3}'
|
||||
fi
|
||||
}
|
||||
|
||||
|
||||
# $1: Channel (baseos|appstream)
|
||||
function get_rhel_repo_url {
|
||||
grep -Ri "baseurl=.*$1.*/os" /etc/yum.repos.d/ | sed -e 's/.*baseurl=//' | head -n 1
|
||||
}
|
||||
|
||||
|
||||
rlJournalStart
|
||||
rlPhaseStartSetup
|
||||
rlAssertRpm "$PACKAGE"
|
||||
if rlIsRHEL; then
|
||||
baseos_url=$(get_rhel_repo_url baseos)
|
||||
appstream_url=$(get_rhel_repo_url appstream)
|
||||
rlRun "sed -i 's|@BASEOS_HTTP@|$baseos_url|' $KS"
|
||||
rlRun "sed -i 's|@APPSTREAM_HTTP@|$appstream_url|' $KS"
|
||||
else
|
||||
baseos_url=$(get_fedora_repo_url)
|
||||
rlRun "sed -i 's|@BASEOS_HTTP@|$baseos_url|' $KS"
|
||||
rlRun "sed -i '/^.*@APPSTREAM_HTTP@.*$/d' $KS"
|
||||
fi
|
||||
python3 -m http.server &
|
||||
server_pid=$!
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartTest
|
||||
rlRun "mkdir install" 0 "Making install directory"
|
||||
rlRun "anaconda --dirinstall $INSTALLDIR --kickstart $KS" 0 "Installing into a directory"
|
||||
rlRun "test -f $INSTALLDIR/rh_baseos_test" 0 "Make sure that rh_baseos_test exists in the root of the installed system"
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartCleanup
|
||||
rlRun "kill $server_pid" 0 "Terminating the Python server that serves the datastream"
|
||||
rlRun "rm -rf $INSTALLDIR" 0 "Remove the directory with the system installation"
|
||||
rlPhaseEnd
|
||||
rlJournalPrintText
|
||||
rlJournalEnd
|
||||
|
|
@ -0,0 +1,55 @@
|
|||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<ds:data-stream-collection xmlns:ds="http://scap.nist.gov/schema/scap/source/1.2" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:cat="urn:oasis:names:tc:entity:xmlns:xml:catalog" id="scap_org.open-scap_collection_from_xccdf_xccdf.xml" schematron-version="1.2"><ds:data-stream id="scap_org.open-scap_datastream_from_xccdf_xccdf.xml" scap-version="1.2" use-case="OTHER"><ds:checklists><ds:component-ref id="scap_org.open-scap_cref_xccdf.xml" xlink:href="#scap_org.open-scap_comp_xccdf.xml"><cat:catalog><cat:uri name="oval.xml" uri="#scap_org.open-scap_cref_oval.xml"/></cat:catalog></ds:component-ref></ds:checklists><ds:checks><ds:component-ref id="scap_org.open-scap_cref_oval.xml" xlink:href="#scap_org.open-scap_comp_oval.xml"/></ds:checks></ds:data-stream><ds:component id="scap_org.open-scap_comp_oval.xml" timestamp="2016-09-07T20:50:46"><oval_definitions xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd">
|
||||
<generator>
|
||||
<oval:schema_version>5.10</oval:schema_version>
|
||||
<oval:timestamp>0001-01-01T00:00:00+00:00</oval:timestamp>
|
||||
</generator>
|
||||
|
||||
<definitions>
|
||||
<definition class="compliance" version="1" id="oval:x:def:1">
|
||||
<metadata>
|
||||
<title>x</title>
|
||||
<description>x</description>
|
||||
<affected family="unix">
|
||||
<platform>Minimal test environment</platform>
|
||||
</affected>
|
||||
</metadata>
|
||||
<criteria>
|
||||
<criterion test_ref="oval:x:tst:1" comment="always pass"/>
|
||||
</criteria>
|
||||
</definition>
|
||||
</definitions>
|
||||
|
||||
|
||||
<tests>
|
||||
<unix:file_test id="oval:x:tst:1" version="1" check="all" check_existence="all_exist" comment="check presence of file">
|
||||
<unix:object object_ref="oval:x:obj:1"/>
|
||||
</unix:file_test>
|
||||
</tests>
|
||||
|
||||
<objects>
|
||||
<unix:file_object id="oval:x:obj:1" version="1">
|
||||
<unix:filepath>/rh_baseos_test</unix:filepath>
|
||||
</unix:file_object>
|
||||
</objects>
|
||||
|
||||
</oval_definitions></ds:component><ds:component id="scap_org.open-scap_comp_xccdf.xml" timestamp="2016-09-07T21:00:59"><Benchmark xmlns="http://checklists.nist.gov/xccdf/1.2" id="xccdf_test_benchmark_container">
|
||||
<status>incomplete</status>
|
||||
<platform idref="cpe:/o:fedoraproject:fedora"/>
|
||||
<platform idref="cpe:/o:redhat:enterprise_linux"/>
|
||||
<version>1.0</version>
|
||||
<model system="urn:xccdf:scoring:default"/>
|
||||
<Profile id="xccdf_org.ssgproject.content_profile_standard">
|
||||
<title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Dummy standard profile</title>
|
||||
<select idref="xccdf_test_rule_check_test_file" selected="true"/>
|
||||
</Profile>
|
||||
|
||||
<Rule selected="true" id="xccdf_test_rule_check_test_file">
|
||||
<fix id="check_test_file" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">
|
||||
touch /rh_baseos_test
|
||||
</fix>
|
||||
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
|
||||
<check-content-ref href="oval.xml" name="oval:x:def:1"/>
|
||||
</check>
|
||||
</Rule>
|
||||
</Benchmark></ds:component></ds:data-stream-collection>
|
||||
|
|
@ -0,0 +1,29 @@
|
|||
---
|
||||
- hosts: localhost
|
||||
roles:
|
||||
- role: standard-test-source
|
||||
tags:
|
||||
- always
|
||||
|
||||
- role: standard-test-basic
|
||||
tags:
|
||||
- classic
|
||||
required_packages:
|
||||
- "python3-pytest"
|
||||
- "python3-mock"
|
||||
- "anaconda"
|
||||
tests:
|
||||
- smoke:
|
||||
run: "PYTHONPATH=/usr/share/anaconda/addons py.test-3 ."
|
||||
dir: "./source/tests"
|
||||
|
||||
- role: standard-test-beakerlib
|
||||
tags:
|
||||
- classic
|
||||
required_packages:
|
||||
- "python3-pytest" # Not needed for this test, it is just a temp workaround for an Ansible bug https://github.com/ansible/ansible/issues/57365
|
||||
- "python3-mock" # Not needed for this test, it is just a temp workaround for an Ansible bug https://github.com/ansible/ansible/issues/57365
|
||||
- "anaconda"
|
||||
tests:
|
||||
- Sanity/dir-install:
|
||||
timeout: 1h
|
||||
Loading…
Reference in New Issue