From 76db86a22a23ccfed07d6160cfdab4ef60067ef0 Mon Sep 17 00:00:00 2001 From: sommerfeld Date: Wed, 30 Sep 2026 08:54:59 +0100 Subject: Mask unused NvPCR measurements on the Arch host --- tests/test_nvpcr_masks.py | 43 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) create mode 100644 tests/test_nvpcr_masks.py (limited to 'tests') diff --git a/tests/test_nvpcr_masks.py b/tests/test_nvpcr_masks.py new file mode 100644 index 0000000..b2ec429 --- /dev/null +++ b/tests/test_nvpcr_masks.py @@ -0,0 +1,43 @@ +import subprocess +import unittest +from pathlib import Path + +ROOT = Path(__file__).resolve().parents[1] +MASKS = [ + *( + f"etc/nvpcr/{name}.nvpcr" + for name in ("cryptsetup", "hardware", "login", "verity") + ), + "etc/systemd/system/systemd-pcrlogin@.service", + "etc/systemd/system/systemd-pcrproduct.service", +] + + +class NvPCRTests(unittest.TestCase): + def test_masks_are_empty_regular_files(self): + for name in MASKS: + path = ROOT / name + self.assertFalse(path.is_symlink()) + self.assertEqual(path.read_bytes(), b"") + + def test_initramfs_keeps_existing_files_and_includes_masks(self): + config = ROOT / "etc/mkinitcpio.conf.d/60-no-nvpcr.conf" + output = subprocess.check_output( + [ + "bash", + "-c", + 'FILES=(existing); source "$1"; printf "%s\\n" "${FILES[@]}"', + "bash", + str(config), + ], + text=True, + ).splitlines() + self.assertEqual(output, ["existing", *(f"/{name}" for name in MASKS)]) + + def test_srk_setup_and_pcr7_policy_remain_enabled(self): + for name in ("systemd-tpm2-setup.service", "systemd-tpm2-setup-early.service"): + self.assertFalse((ROOT / "etc/systemd/system" / name).exists()) + policy = ( + ROOT / "etc/systemd/system/systemd-pcrlock-make-policy.service.d/pcr7.conf" + ) + self.assertIn("--pcr=7 --location=770", policy.read_text()) -- cgit v1.3.1