kernel security test failures on Trusty arm64
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
QA Regression Testing |
Invalid
|
Undecided
|
Unassigned |
Bug Description
While trying to run the kernel security tests on the latest Trusty SRU kernel (3.13.0-97.144):
utils:0153| [stderr] test_000_make (__main_
utils:0153| [stderr] Prepare to build helper tools ... ok
utils:0153| [stderr] test_010_proc_maps (__main_
utils:0153| [stderr] /proc/$pid/maps is correctly protected (CVE-2013-2929) ... ok
utils:0153| [stderr] test_020_
utils:0153| [stderr] ASLR enabled ... ok
utils:0153| [stderr] test_020_
utils:0153| [stderr] ASLR of stack ... FAIL
utils:0153| [stderr] test_021_
utils:0153| [stderr] ASLR of libs ... FAIL
utils:0153| [stderr] test_021_
utils:0153| [stderr] ASLR of mmap ... FAIL
utils:0153| [stderr] test_022_
utils:0153| [stderr] ASLR of text ... FAIL
utils:0153| [stderr] test_022_
utils:0153| [stderr] ASLR of vdso ... FAIL
utils:0153| [stderr] test_022_
utils:0153| [stderr] ASLR of brk ... FAIL
utils:0153| [stderr] test_023_
utils:0153| [stderr] ASLR of text vs libs ... ok
utils:0153| [stderr] test_025_kaslr (__main_
utils:0153| [stderr] kernel ASLR enabled ... ok
utils:0153| [stderr] test_030_mmap_min (__main_
utils:0153| [stderr] Low memory allocation respects mmap_min_addr ... ok
utils:0153| [stderr] test_031_apparmor (__main_
utils:0153| [stderr] AppArmor loaded ... ok
utils:0153| [stderr] test_031_seccomp (__main_
utils:0153| [stderr] PR_SET_SECCOMP works ... ok
utils:0153| [stderr] test_032_dev_kmem (__main_
utils:0153| [stderr] /dev/kmem not available ... ok
utils:0153| [stderr] test_033_
utils:0153| [stderr] SYN cookies is enabled ... ok
utils:0153| [stderr] test_040_pcaps (__main_
utils:0153| [stderr] init's CAPABILITY list is clean ... ok
utils:0153| [stderr] test_050_
utils:0153| [stderr] init missing READ_IMPLIES_EXEC ... FAIL
utils:0153| [stderr] test_060_nx (__main_
utils:0153| [stderr] NX bit is working ... ok
utils:0153| [stderr] test_061_guard_page (__main_
utils:0153| [stderr] Userspace stack guard page exists (CVE-2010-2240) ... ok
utils:0153| [stderr] test_070_config_brk (__main_
utils:0153| [stderr] CONFIG_COMPAT_BRK disabled ... ok
utils:0153| [stderr] test_070_
utils:0153| [stderr] CONFIG_DEVKMEM disabled ... ok
utils:0153| [stderr] test_070_
utils:0153| [stderr] CONFIG_SECCOMP enabled ... ok
utils:0153| [stderr] test_070_
utils:0153| [stderr] CONFIG_SECURITY enabled ... ok
utils:0153| [stderr] test_070_
utils:0153| [stderr] CONFIG_
utils:0153| [stderr] test_070_
utils:0153| [stderr] CONFIG_SYN_COOKIES enabled ... ok
utils:0153| [stderr] test_072_
utils:0153| [stderr] CONFIG_COMPAT_VDSO disabled ... ok
utils:0153| [stderr] test_072_
utils:0153| [stderr] CONFIG_DEBUG_RODATA enabled ... FAIL
utils:0153| [stderr] test_072_
utils:0153| [stderr] CONFIG_
utils:0153| [stderr] test_072_
utils:0153| [stderr] CONFIG_
utils:0153| [stderr] test_072_
utils:0153| [stderr] CONFIG_
utils:0153| [stderr] test_072_
utils:0153| [stderr] /dev/mem unreadable for kernel memory ... FAIL
utils:0153| [stderr] test_073_
utils:0153| [stderr] CONFIG_
utils:0153| [stderr] test_073_
utils:0153| [stderr] CONFIG_
utils:0153| [stderr] test_073_
utils:0153| [stderr] CONFIG_
utils:0153| [stderr] test_074_
utils:0153| [stderr] CONFIG_
utils:0153| [stderr] test_075_
utils:0153| [stderr] CONFIG_
utils:0153| [stderr] test_076_
utils:0153| [stderr] CONFIG_
utils:0153| [stderr] test_076_
utils:0153| [stderr] CONFIG_
utils:0153| [stderr] test_077_
utils:0153| [stderr] CONFIG_ECRYPT_FS is set ... ok
utils:0153| [stderr] test_077_
utils:0153| [stderr] Config options for IPsec ... ok
utils:0153| [stderr] test_082_
utils:0153| [stderr] Kernel stack guard ... FAIL
utils:0153| [stderr] test_090_
utils:0153| [stderr] Sysctl to disable module loading exists ... ok
utils:0153| [stderr] test_091_
utils:0153| [stderr] Symlinks not followable across differing uids in sticky directories ... ok
utils:0153| [stderr] test_092_
utils:0153| [stderr] Hardlink disallowed for unreadable/
utils:0153| [stderr] test_093_
utils:0153| [stderr] ptrace allowed only on children or declared processes ... ok
utils:0153| [stderr] test_093_
utils:0153| [stderr] ptrace from thread on tracee that used prctl(PR_
utils:0153| [stderr] test_093_
utils:0153| [stderr] prctl(PR_
utils:0153| [stderr] test_094_
utils:0153| [stderr] rare network modules do not autoload ... ok
utils:0153| [stderr] test_095_
utils:0153| [stderr] /proc/sys/
utils:0153| [stderr] test_095_
utils:0153| [stderr] kernel addresses in kallsyms and modules are zeroed out ... ok
utils:0153| [stderr] test_096_
utils:0153| [stderr] kernel addresses in /boot are not world readable ... ok
utils:0153| [stderr] test_096_
utils:0153| [stderr] sensitive files in /proc are not world readable ... ok
utils:0153| [stderr] test_100_
utils:0153| [stderr] /sys/kernel/
utils:0153| [stderr] test_101_
utils:0153| [stderr] /proc/$pid/ DAC bypass on setuid (CVE-2011-1020) ... ok
utils:0153| [stderr] test_110_
utils:0153| [stderr] seccomp_filter works ... ok
utils:0153| [stderr] test_120_smep_works (__main_
utils:0153| [stderr] SMEP works ... ok
utils:0153| [stderr] test_130_
utils:0153| [stderr] kexec_disabled sysctl supported ... ok
utils:0153| [stderr] test_140_
utils:0153| [stderr] kernel modules are not marked with a taint flag (especially 'E' for TAINT_UNSIGNED_
utils:0153| [stderr] test_150_
utils:0153| [stderr] test whether user namespaces work at all (with root) ... ok
utils:0153| [stderr] test_150_
utils:0153| [stderr] unprivileged_
utils:0153| [stderr] test_150_
utils:0153| [stderr] test whether user namespaces work as unprivileged user ... ok
utils:0153| [stderr] test_151_
utils:0153| [stderr] unprivileged_
utils:0153| [stderr] test_152_
utils:0153| [stderr] unprivileged_
In this cycle (3.13.0-111.158), the failed test cases is a bit different:
test_021_ aslr_dapper_ libs (__main_ _.KernelSecurit yTest) aslr_dapper_ mmap (__main_ _.KernelSecurit yTest) aslr_hardy_ vdso (__main_ _.KernelSecurit yTest) personality (__main_ _.KernelSecurit yTest) config_ debug_rodata (__main_ _.KernelSecurit yTest) strict_ devmem (__main_ _.KernelSecurit yTest) config_ stack_protector (__main_ _.KernelSecurit yTest) CC_STACKPROTECT OR set ... FAIL stack_guard_ kernel (__main_ _.KernelSecurit yTest) kernel_ modules_ not_tainted (__main_ _.KernelSecurit yTest) MODULE) ... FAIL
ASLR of libs ... FAIL
test_021_
ASLR of mmap ... FAIL
test_022_
ASLR of vdso ... FAIL
test_050_
init missing READ_IMPLIES_EXEC ... FAIL
test_072_
CONFIG_DEBUG_RODATA enabled ... FAIL
test_072_
/dev/mem unreadable for kernel memory ... FAIL
test_075_
CONFIG_
test_082_
Kernel stack guard ... FAIL
test_140_
kernel modules are not marked with a taint flag (especially 'E' for TAINT_UNSIGNED_
Full log: http:// pastebin. ubuntu. com/24099998/