Project

General

Profile

action #124251

[qe-core] Implement userspace livepatching tests for openssl

Added by vsvecova 4 months ago. Updated 26 days ago.

Status:
In Progress
Priority:
Normal
Assignee:
dzedro
Category:
New test
Target version:
QA - QE-Core: Ready
Start date:
2023-02-09
Due date:
% Done:

0%

Estimated time:
Difficulty:
Tags:
qe-core-march-sprint, qe-core-february-sprint

Description

  • Adapt existing openssl tests for livepatching
  • Bot has to be updated to schedule SLE-Module-Live-Patching:15-SP4
  • It needs to run tests with "older openssl" packages
  • LD_PRELOAD=libpulp.so needs to injected into the tested packages, otherwise livepatching does not get active
  • tests/kernel/ulp_openposix.pm has quite some wrapper baseline code already for glibc, but similar can be done for openssl

Related ticket: https://progress.opensuse.org/issues/112004 (ULP tests implemented by mdoucha for glibc-livepatches and libpulp0)

History

#1 Updated by msmeissn 4 months ago

sample long running openssl users:

apache2
openssh (daemon)
postfix

you would need to inject the LD_PRELOAD=libpulp.so howevert in their systemd config scripts via:

[Service]
Environment="LD_PRELOAD=libpulp.so.0"

#2 Updated by msmeissn 4 months ago

Sample manual testprocedure:

  • install all updates
  • configure apache2 for SSL support
  • configure apache2 for livepatch support, add in the [Service] section:

Environment="LD_PRELOAD=libpulp.so.0"

  • start apache2 and verify SSL access works.
  • verify libpulp.so is loaded in httpd using "lsof" lsof |grep http.*pulp

Then we need to test all variants that get livepatched:

LOOP over all released openssl-1_1 versions (GA, 1st Update, 2nd Update, ... last update)

  • install the selected libopenssl1_1 version
  • restart apache2 to use this version
  • test https access to the apache2 server
  • apply the openssl-livepatches RPM. it SHOULD report something like:

ulp: patches reverse-all failed in libpulp.so: Target library not loaded
httpd-prefork (pid: 22685): SUCCESS /usr/lib64/openssl-1_1-livepatches/0.1/libcrypto_1.1.1l-150400.7.10.5_livepatch1.so
ulp: patches reverse-all failed in libpulp.so: Target library not loaded
httpd-prefork (pid: 22691): SUCCESS /usr/lib64/openssl-1_1-livepatches/0.1/libcrypto_1.1.1l-150400.7.10.5_livepatch1.so
ulp: patches reverse-all failed in libpulp.so: Target library not loaded
httpd-prefork (pid: 22692): SUCCESS /usr/lib64/openssl-1_1-livepatches/0.1/libcrypto_1.1.1l-150400.7.10.5_livepatch1.so
ulp: patches reverse-all failed in libpulp.so: Target library not loaded
httpd-prefork (pid: 22693): SUCCESS /usr/lib64/openssl-1_1-livepatches/0.1/libcrypto_1.1.1l-150400.7.10.5_livepatch1.so
ulp: patches reverse-all failed in libpulp.so: Target library not loaded
httpd-prefork (pid: 22694): SUCCESS /usr/lib64/openssl-1_1-livepatches/0.1/libcrypto_1.1.1l-150400.7.10.5_livepatch1.so
ulp: patches reverse-all failed in libpulp.so: Target library not loaded
httpd-prefork (pid: 22695): SUCCESS /usr/lib64/openssl-1_1-livepatches/0.1/libcrypto_1.1.1l-150400.7.10.5_livepatch1.so
ulp: Processes patched: 0, Skipped: 6, Failed: 0.
(output is weird ... not sure if this is 100% ok)

  • test https access to the apache2 server again , if not FAIL
  • test if lp is really loaded ( it loads the shared module from the package), if not FAIL lsof |grep http.*livepatches httpd-pre 22685 root mem REG 253,2 6760 242393 /usr/lib64/openssl-1_1-livepatches/0.1/libcrypto_1.1.1l-150400.7.10.5_livepatch1.so

#3 Updated by pluskalm 3 months ago

My understanding is that in future qam-kernel/qam-sle groups are not to be assigned for such updates

#4 Updated by dzedro 3 months ago

  • Tags set to qe-core-february-sprint
  • Status changed from New to In Progress
  • Assignee set to dzedro
  • Target version set to QE-Core: Ready

#5 Updated by pluskalm 3 months ago

  • Assignee deleted (dzedro)
  • Target version deleted (QE-Core: Ready)

#6 Updated by szarate 3 months ago

  • Sprint set to QE-Core: February Sprint (Feb 08 - Mar 08)
  • Category set to New test
  • Assignee set to dzedro
  • Target version set to QE-Core: Ready

#7 Updated by szarate 3 months ago

  • Sprint changed from QE-Core: February Sprint (Feb 08 - Mar 08) to QE-Core: March Sprint (Mar 08 - Apr 05)

#8 Updated by szarate 2 months ago

  • Sprint changed from QE-Core: March Sprint (Mar 08 - Apr 05) to QE-Core: April Sprint 23 (Apr 05 - May 03)

#9 Updated by szarate 26 days ago

  • Sprint changed from QE-Core: April Sprint 23 (Apr 05 - May 03) to QE-Core: May Sprint 23 (May 10 - May 31)

Also available in: Atom PDF