tests/kola: Add lockdown LSM test

See: https://bugzilla.redhat.com/show_bug.cgi?id=2333706
coreos · Jan 21, 2025 · 709c6cd · 709c6cd
1 parent b3d9313
commit 709c6cd
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 0 deletions.
diff --git a/tests/kola/security/data/commonlib.sh b/tests/kola/security/data/commonlib.sh
@@ -0,0 +1 @@
+../../data/commonlib.sh
diff --git a/tests/kola/security/lockdown b/tests/kola/security/lockdown
@@ -0,0 +1,21 @@
+#!/bin/bash
+## kola:
+##   exclusive: false
+##   description: Verify that the lockdown LSM is set to integrity.
+#
+# See https://bugzilla.redhat.com/show_bug.cgi?id=2333706
+
+set -xeuo pipefail
+
+. $KOLA_EXT_DATA/commonlib.sh
+
+if [[ "$(mokutil --sb)" != "SecureBoot enabled" ]]; then
+    # To be confirmed
+    ok "not checking systems without Secure Boot enabled"
+    exit 0
+fi
+if [[ "$(cat "/sys/kernel/security/lockdown")" == "none [integrity] confidentiality" ]]; then
+    ok "lockdown LSM set to integrity"
+else
+    fatal "lockdown LSM not set to integrity"
+fi