mirror of
https://github.com/opnsense/src.git
synced 2026-05-20 00:45:45 -04:00
eb52de783a
In the CheriBSD CI we reproducibly see the first test in sys/audit
(administrative:acct_failure) fail due to a missing startup message.
It appears this is caused by a race condition when starting auditd:
`service auditd onestart` returns as soon as the initial auditd() parent
exits (after the daemon(3) call).
We can avoid this problem by setting up the auditd infrastructure
in-process: libauditd contains audit_quick_{start,stop}() functions that
look like they are ideally suited to this task.
This patch also avoids forking lots of shell processes for each of the 418
tests by using `auditon(A_SENDTRIGGER, &trigger, sizeof(trigger))` to check
for a running auditd(8) instead of using `service auditd onestatus`.
With these two changes (and D28388 to fix the XFAIL'd test) I can now
boot and run `cd /usr/tests/sys/audit && kyua test` without any failures
in a single-core QEMU instance. Before there would always be at least one
failed test.
Besides making the tests more reliable in CI, a nice side-effect of this
change is that it also significantly speeds up running them by avoiding
lots of fork()/execve() caused by shell scripts:
Running kyua test on an AArch64 QEMU took 315s before and now takes 68s,
so it's roughly 3.5 times faster. This effect is even larger when running
on a CHERI-RISC-V QEMU since emulating CHERI instructions on an x86 host
is noticeably slower than emulating AArch64.
Test Plan: aarch64+amd64 QEMU no longer fail.
Reviewed By: asomers
Differential Revision: https://reviews.freebsd.org/D28451
(cherry picked from commit df093aa946)
68 lines
2.1 KiB
Makefile
68 lines
2.1 KiB
Makefile
# $FreeBSD$
|
|
|
|
TESTSDIR= ${TESTSBASE}/sys/audit
|
|
|
|
ATF_TESTS_C= file-attribute-access
|
|
ATF_TESTS_C+= file-attribute-modify
|
|
ATF_TESTS_C+= file-create
|
|
ATF_TESTS_C+= file-delete
|
|
ATF_TESTS_C+= file-close
|
|
ATF_TESTS_C+= file-write
|
|
ATF_TESTS_C+= file-read
|
|
ATF_TESTS_C+= open
|
|
ATF_TESTS_C+= ioctl
|
|
ATF_TESTS_C+= network
|
|
ATF_TESTS_C+= inter-process
|
|
ATF_TESTS_C+= administrative
|
|
ATF_TESTS_C+= process-control
|
|
ATF_TESTS_C+= miscellaneous
|
|
|
|
SRCS.file-attribute-access+= file-attribute-access.c
|
|
SRCS.file-attribute-access+= utils.c
|
|
SRCS.file-attribute-modify+= file-attribute-modify.c
|
|
SRCS.file-attribute-modify+= utils.c
|
|
SRCS.file-create+= file-create.c
|
|
SRCS.file-create+= utils.c
|
|
SRCS.file-delete+= file-delete.c
|
|
SRCS.file-delete+= utils.c
|
|
SRCS.file-close+= file-close.c
|
|
SRCS.file-close+= utils.c
|
|
SRCS.file-write+= file-write.c
|
|
SRCS.file-write+= utils.c
|
|
SRCS.file-read+= file-read.c
|
|
SRCS.file-read+= utils.c
|
|
SRCS.open+= open.c
|
|
SRCS.open+= utils.c
|
|
SRCS.ioctl+= ioctl.c
|
|
SRCS.ioctl+= utils.c
|
|
SRCS.network+= network.c
|
|
SRCS.network+= utils.c
|
|
SRCS.inter-process+= inter-process.c
|
|
SRCS.inter-process+= utils.c
|
|
SRCS.administrative+= administrative.c
|
|
SRCS.administrative+= utils.c
|
|
SRCS.process-control+= process-control.c
|
|
SRCS.process-control+= utils.c
|
|
SRCS.miscellaneous+= miscellaneous.c
|
|
SRCS.miscellaneous+= utils.c
|
|
|
|
TEST_METADATA+= timeout="30"
|
|
TEST_METADATA+= required_user="root"
|
|
# Only one process can be auditing, if we attempt to run these tests in parallel
|
|
# some of them will fail to start auditing.
|
|
# TODO: it would be nice to be able to run them in parallel with other non-audit
|
|
# tests using some internal form of synchronization.
|
|
# TODO: In addititon to test failures, running in parallel can trigger a kernel
|
|
# panic: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=253616
|
|
TEST_METADATA+= is_exclusive="true"
|
|
TEST_METADATA+= required_files="/etc/rc.d/auditd /dev/auditpipe"
|
|
|
|
MK_PIE:= no # XXX libprivateauditd.a is not PIE
|
|
LDFLAGS+= -lbsm -lutil
|
|
OPENBSMDIR=${SRCTOP}/contrib/openbsm
|
|
CFLAGS+= -I${OPENBSMDIR}
|
|
LDADD+= ${LIBAUDITD}
|
|
|
|
CFLAGS.process-control.c+= -I${SRCTOP}/tests
|
|
|
|
.include <bsd.test.mk>
|