checks.rb 9.26 KB
Newer Older
1
def shipped_openpgp_keys
2
  shipped_gpg_keys = $vm.execute_successfully('gpg --batch --with-colons --fingerprint --list-key', :user => LIVE_USER).stdout
3
4
5
6
7
8
9
10
  openpgp_fingerprints = shipped_gpg_keys.scan(/^fpr:::::::::([A-Z0-9]+):$/).flatten
  return openpgp_fingerprints
end

Then /^the OpenPGP keys shipped with Tails will be valid for the next (\d+) months$/ do |months|
  invalid = Array.new
  shipped_openpgp_keys.each do |key|
    begin
kytv's avatar
kytv committed
11
      step "the shipped OpenPGP key #{key} will be valid for the next #{months} months"
12
13
14
15
16
17
18
19
    rescue Test::Unit::AssertionFailedError
      invalid << key
      next
    end
  end
  assert(invalid.empty?, "The following key(s) will not be valid in #{months} months: #{invalid.join(', ')}")
end

kytv's avatar
kytv committed
20
Then /^the shipped (?:Debian repository key|OpenPGP key ([A-Z0-9]+)) will be valid for the next (\d+) months$/ do |fingerprint, max_months|
21
  if fingerprint
22
    cmd = 'gpg'
23
    user = LIVE_USER
kytv's avatar
kytv committed
24
  else
kytv's avatar
kytv committed
25
    fingerprint = TAILS_DEBIAN_REPO_KEY
26
27
28
    cmd = 'apt-key adv'
    user = 'root'
  end
29
  shipped_sig_key_info = $vm.execute_successfully("#{cmd} --batch --list-key #{fingerprint}", :user => user).stdout
30
31
32
33
  m = /\[expire[ds]: ([0-9-]*)\]/.match(shipped_sig_key_info)
  if m
    expiration_date = Date.parse(m[1])
    assert((expiration_date << max_months.to_i) > DateTime.now,
kytv's avatar
kytv committed
34
           "The shipped key #{fingerprint} will not be valid #{max_months} months from now.")
35
  end
36
37
38
end

Then /^the live user has been setup by live\-boot$/ do
39
  assert($vm.execute("test -e /var/lib/live/config/user-setup").success?,
40
         "live-boot failed its user-setup")
41
  actual_username = $vm.execute(". /etc/live/config/username.conf; " +
42
                                "echo $LIVE_USERNAME").stdout.chomp
43
  assert_equal(LIVE_USER, actual_username)
44
45
46
end

Then /^the live user is a member of only its own group and "(.*?)"$/ do |groups|
47
  expected_groups = groups.split(" ") << LIVE_USER
48
  actual_groups = $vm.execute("groups #{LIVE_USER}").stdout.chomp.sub(/^#{LIVE_USER} : /, "").split(" ")
49
50
  unexpected = actual_groups - expected_groups
  missing = expected_groups - actual_groups
51
  assert_equal(0, unexpected.size,
52
         "live user in unexpected groups #{unexpected}")
53
  assert_equal(0, missing.size,
54
55
56
57
         "live user not in expected groups #{missing}")
end

Then /^the live user owns its home dir and it has normal permissions$/ do
58
  home = "/home/#{LIVE_USER}"
59
  assert($vm.execute("test -d #{home}").success?,
60
         "The live user's home doesn't exist or is not a directory")
61
62
  owner = $vm.execute("stat -c %U:%G #{home}").stdout.chomp
  perms = $vm.execute("stat -c %a #{home}").stdout.chomp
63
  assert_equal("#{LIVE_USER}:#{LIVE_USER}", owner)
64
  assert_equal("700", perms)
65
66
67
end

Then /^no unexpected services are listening for network connections$/ do
68
  for line in $vm.execute_successfully("ss -ltupn").stdout.chomp.split("\n") do
69
70
    splitted = line.split(/[[:blank:]]+/)
    proto = splitted[0]
71
72
73
    next unless ['tcp', 'udp'].include?(proto)
    laddr, lport = splitted[4].split(":")
    proc = /users:\(\("([^"]+)"/.match(splitted[6])[1]
74
75
    # Services listening on loopback is not a threat
    if /127(\.[[:digit:]]{1,3}){3}/.match(laddr).nil?
76
77
      if SERVICES_EXPECTED_ON_ALL_IFACES.include? [proc, laddr, lport] or
         SERVICES_EXPECTED_ON_ALL_IFACES.include? [proc, laddr, "*"]
78
79
80
81
82
83
84
85
86
        puts "Service '#{proc}' is listening on #{laddr}:#{lport} " +
             "but has an exception"
      else
        raise "Unexpected service '#{proc}' listening on #{laddr}:#{lport}"
      end
    end
  end
end

87
When /^Tails has booted a 64-bit kernel$/ do
88
  assert($vm.execute("uname -r | grep -qs 'amd64$'").success?,
89
         "Tails has not booted a 64-bit kernel.")
90
91
92
end

Then /^the VirtualBox guest modules are available$/ do
93
  assert($vm.execute("modinfo vboxguest").success?,
94
95
96
         "The vboxguest module is not available.")
end

kytv's avatar
kytv committed
97
Then /^the support documentation page opens in Tor Browser$/ do
98
99
100
101
102
103
104
105
  if @language == 'German'
    expected_title = 'Tails - Hilfe & Support'
    expected_heading = 'Die Dokumentation durchsuchen'
  else
    expected_title = 'Tails - Support'
    expected_heading = 'Search the documentation'
  end
  step "\"#{expected_title}\" has loaded in the Tor Browser"
106
  headings = @torbrowser
107
108
109
110
111
             .child(expected_title, roleName: 'document frame')
             .children(roleName: 'heading')
  assert(
    headings.any? { |heading| heading.text == expected_heading }
  )
kytv's avatar
kytv committed
112
113
end

114
115
116
117
Given /^I plug and mount a USB drive containing a sample PNG$/ do
  @png_dir = share_host_files(Dir.glob("#{MISC_FILES_DIR}/*.png"))
end

118
119
120
121
Then /^MAT can clean some sample PNG file$/ do
  for png_on_host in Dir.glob("#{MISC_FILES_DIR}/*.png") do
    png_name = File.basename(png_on_host)
    png_on_guest = "/home/#{LIVE_USER}/#{png_name}"
122
    step "I copy \"#{@png_dir}/#{png_name}\" to \"#{png_on_guest}\" as user \"#{LIVE_USER}\""
123
124
125
126
    raw_check_cmd = "grep --quiet --fixed-strings --text " +
                    "'Created with GIMP' '#{png_on_guest}'"
    assert($vm.execute(raw_check_cmd, user: LIVE_USER).success?,
           'The comment is not present in the PNG')
127
    check_before = $vm.execute_successfully("mat --check '#{png_on_guest}'",
anonym's avatar
anonym committed
128
                                            :user => LIVE_USER).stdout
129
130
131
132
    assert(check_before.include?("#{png_on_guest} is not clean"),
           "MAT failed to see that '#{png_on_host}' is dirty")
    $vm.execute_successfully("mat '#{png_on_guest}'", :user => LIVE_USER)
    check_after = $vm.execute_successfully("mat --check '#{png_on_guest}'",
anonym's avatar
anonym committed
133
                                           :user => LIVE_USER).stdout
134
135
    assert(check_after.include?("#{png_on_guest} is clean"),
           "MAT failed to clean '#{png_on_host}'")
136
137
    assert($vm.execute(raw_check_cmd, user: LIVE_USER).failure?,
           'The comment is still present in the PNG')
138
    $vm.execute_successfully("rm '#{png_on_guest}'")
139
140
  end
end
141

142
143


144
Then /^AppArmor is enabled$/ do
145
  assert($vm.execute("aa-status").success?, "AppArmor is not enabled")
146
147
148
end

Then /^some AppArmor profiles are enforced$/ do
149
  assert($vm.execute("aa-status --enforced").stdout.chomp.to_i > 0,
150
151
         "No AppArmor profile is enforced")
end
152

153
def get_seccomp_status(process)
154
155
156
  assert($vm.has_process?(process), "Process #{process} not running.")
  pid = $vm.pidof(process)[0]
  status = $vm.file_content("/proc/#{pid}/status")
157
158
159
  return status.match(/^Seccomp:\s+([0-9])/)[1].chomp.to_i
end

160
161
162
163
164
165
166
167
168
169
170
171
def get_apparmor_status(pid)
  apparmor_status = $vm.file_content("/proc/#{pid}/attr/current").chomp
  if apparmor_status.include?(')')
    # matches something like     /usr/sbin/cupsd (enforce)
    # and only returns what's in the parentheses
    return apparmor_status.match(/[^\s]+\s+\((.+)\)$/)[1].chomp
  else
    return apparmor_status
  end
end

Then /^the running process "(.+)" is confined with AppArmor in (complain|enforce) mode$/ do |process, mode|
anonym's avatar
anonym committed
172
173
  assert($vm.has_process?(process), "Process #{process} not running.")
  pid = $vm.pidof(process)[0]
174
  assert_equal(mode, get_apparmor_status(pid))
175
176
end

177
178
179
180
181
182
183
184
185
Then /^the running process "(.+)" is confined with Seccomp in (filter|strict) mode$/ do |process,mode|
  status = get_seccomp_status(process)
  if mode == 'strict'
    assert_equal(1, status, "#{process} not confined with Seccomp in strict mode")
  elsif mode == 'filter'
    assert_equal(2, status, "#{process} not confined with Seccomp in filter mode")
  else
    raise "Unsupported mode #{mode} passed"
  end
186
end
187
188
189
190
191
192
193
194
195
196

Then /^tails-debugging-info is not susceptible to symlink attacks$/ do
  secret_file = '/secret'
  secret_contents = 'T0P S3Cr1t -- 3yEs oN1y'
  $vm.file_append(secret_file, secret_contents)
  $vm.execute_successfully("chmod u=rw,go= #{secret_file}")
  $vm.execute_successfully("chown root:root #{secret_file}")
  script_path = '/usr/local/sbin/tails-debugging-info'
  script_lines = $vm.file_content(script_path).split("\n")
  script_lines.grep(/^debug_file\s+/).each do |line|
197
198
199
200
201
    _, user, debug_file = line.split
    # root can always mount symlink attacks
    next if user == 'root'
    # Remove quoting around the file
    debug_file.gsub!(/["']/, '')
202
203
204
205
206
207
    # Skip files that do not exist, or cannot be removed (e.g. the
    # ones in /proc).
    next if not($vm.execute("rm #{debug_file}").success?)
    # Check what would happen *if* the amnesia user managed to replace
    # the debugging file with a symlink to the secret.
    $vm.execute_successfully("ln -s #{secret_file} #{debug_file}")
anonym's avatar
anonym committed
208
    $vm.execute_successfully("chown --no-dereference #{LIVE_USER}:#{LIVE_USER} #{debug_file}")
209
210
211
    if $vm.execute("sudo /usr/local/sbin/tails-debugging-info | " +
                   "grep '#{secret_contents}'",
                   :user => LIVE_USER).success?
212
213
      raise "The secret was leaked by tails-debugging-info via '#{debug_file}'"
    end
214
215
216
    # Remove the secret so it cannot possibly interfere with the
    # following iterations (even though it should not).
    $vm.execute_successfully("echo > #{debug_file}")
217
218
  end
end
219
220

When /^I disable all networking in the Tails Greeter$/ do
221
  open_greeter_additional_settings()
222
223
224
  @screen.wait_and_click('TailsGreeterNetworkConnection.png', 30)
  @screen.wait_and_click('TailsGreeterDisableAllNetworking.png', 10)
  @screen.wait_and_click("TailsGreeterAdditionalSettingsAdd.png", 10)
225
end
226
227
228

Then /^the Tor Status icon tells me that Tor is( not)? usable$/ do |not_usable|
  picture = not_usable ? 'TorStatusNotUsable' : 'TorStatusUsable'
229
  @screen.find("#{picture}.png")
230
end