diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index db7e5d7..dca5636 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -11,8 +11,10 @@ # PE 2017.3.10 5.3.8 2.4.4 2018-12 (STS) # SIMP 6.3 5.5.7 2.4.4 TBD*** # PE 2018.1 5.5.6 2.4.4 2020-05 (LTS)*** +# PE 2019.0 6.0 2.5.1 2019-08-31^^^ # # *** = Modules created for SIMP 6.3+ are not required to support Puppet < 5.5 +# ^^^ = SIMP doesn't support 6 yet; tests are info-only and allowed to fail --- stages: - 'sanity' @@ -25,7 +27,7 @@ image: 'ruby:2.4' variables: PUPPET_VERSION: 'UNDEFINED' # <- Matrixed jobs MUST override this (or fail) - BUNDLER_VERSION: '1.16.1' + BUNDLER_VERSION: '1.17.1' # Force dependencies into a path the gitlab-runner user can write to. # (This avoids some failures on Runners with misconfigured ruby environments.) @@ -49,20 +51,20 @@ variables: - '.vendor' before_script: - 'ruby -e "puts %(Environment Variables:\n * #{ENV.keys.grep(/PUPPET|SIMP|BEAKER|MATRIX/).map{|v| %(#{v} = #{ENV[v]})}.join(%(\n * ))})"' - - 'declare GEM_BUNDLER_VER=(-v "~> ${BUNDLER_VERSION:-1.16.0}")' + - 'declare GEM_BUNDLER_VER=(-v "~> ${BUNDLER_VERSION:-1.17.0}")' - 'declare GEM_INSTALL_CMD=(gem install --no-document)' - 'declare BUNDLER_INSTALL_CMD=(bundle install --no-binstubs --jobs $(nproc) "${FLAGS[@]}")' - 'mkdir -p ${GEM_HOME} ${BUNDLER_BIN}' - 'gem list -ie "${GEM_BUNDLER_VER[@]}" --silent bundler || "${GEM_INSTALL_CMD[@]}" --local "${GEM_BUNDLER_VER[@]}" bundler || "${GEM_INSTALL_CMD[@]}" "${GEM_BUNDLER_VER[@]}" bundler' - 'rm -rf pkg/ || :' - - 'bundle check || rm -f Gemfile.lock && ("${BUNDLER_INSTALL_CMD[@]}" --local || "${BUNDLER_INSTALL_CMD[@]}" || bundle pristine || "${BUNDLER_INSTALL_CMD[@]}") || echo "PIPELINE: Bundler could not find everything"' + - 'bundle check || rm -f Gemfile.lock && ("${BUNDLER_INSTALL_CMD[@]}" --local || "${BUNDLER_INSTALL_CMD[@]}" || bundle pristine || "${BUNDLER_INSTALL_CMD[@]}") || { echo "PIPELINE: Bundler could not install everything (see log output above)" && exit 99 ; }' # To avoid running a prohibitive number of tests every commit, # don't set this env var in your gitlab instance .only_with_SIMP_FULL_MATRIX: &only_with_SIMP_FULL_MATRIX only: variables: - - $SIMP_FULL_MATRIX + - $SIMP_FULL_MATRIX == "yes" # Puppet Versions #----------------------------------------------------------------------- @@ -93,7 +95,6 @@ variables: BEAKER_PUPPET_COLLECTION: 'puppet5' MATRIX_RUBY_VERSION: '2.4' -# Puppet for SIMP 6.3, PE is at 5.5.6 but close enough .pup_5_5_7: &pup_5_5_7 image: 'ruby:2.4' variables: @@ -101,16 +102,14 @@ variables: BEAKER_PUPPET_COLLECTION: 'puppet5' MATRIX_RUBY_VERSION: '2.4' -# Experimental -#^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - .pup_6: &pup_6 allow_failure: true - image: 'ruby:2.4' + image: 'ruby:2.5' variables: PUPPET_VERSION: '~> 6.0' BEAKER_PUPPET_COLLECTION: 'puppet6' - MATRIX_RUBY_VERSION: '2.4' + MATRIX_RUBY_VERSION: '2.5' + # Testing Environments #----------------------------------------------------------------------- @@ -164,7 +163,7 @@ sanity_checks: #----------------------------------------------------------------------- pup4-lint: - <<: *pup_4_10 + <<: *pup_4 <<: *lint_tests pup5-lint: @@ -177,16 +176,15 @@ pup6-lint: # Unit Tests #----------------------------------------------------------------------- - pup4.10-unit: <<: *pup_4_10 <<: *unit_tests - + pup5-unit: <<: *pup_5 <<: *unit_tests -pup5_3-unit: +pup5.3-unit: <<: *pup_5_3 <<: *unit_tests @@ -198,9 +196,9 @@ pup6-unit: <<: *pup_6 <<: *unit_tests + # Acceptance Tests #----------------------------------------------------------------------- - pup4.10: <<: *pup_4_10 <<: *acceptance_tests @@ -231,3 +229,10 @@ pup5.5.7-oel: <<: *acceptance_tests script: - 'bundle exec rake beaker:suites[default,oel]' + +pup5.5.7-oel-fips: + <<: *pup_5_5_7 + <<: *acceptance_tests + <<: *only_with_SIMP_FULL_MATRIX + script: + - 'BEAKER_fips=yes bundle exec rake beaker:suites[default,oel]' \ No newline at end of file diff --git a/spec/acceptance/suites/default/00_ima_spec.rb b/spec/acceptance/suites/default/00_ima_spec.rb index 5556dd6..a9a4c48 100644 --- a/spec/acceptance/suites/default/00_ima_spec.rb +++ b/spec/acceptance/suites/default/00_ima_spec.rb @@ -49,50 +49,57 @@ end context 'stricter rules' do - hosts.each do |host| - manifest = <<-EOF - include 'ima' - class { 'ima::policy': - measure_root_read_files => true, - measure_file_mmap => true, - # This breaks 'puppet apply' immediately - measure_bprm_check => false, - measure_module_check => true, - appraise_fowner => true - } - EOF - - it 'should run puppet' do - apply_manifest_on(host, manifest, catch_failures: true) - end - - it 'should run puppet idempotently' do - apply_manifest_on(host, manifest, catch_changes: true) - end - - it 'locks up the filesystem after a reboot and new policy is applied' do - on(host, 'yum install -y telnet') - ssh_config = File.readlines(host[:ssh][:config]) - ssh_port = ssh_config.grep(/port/i).first.split(' ')[1] - - expect(on(host, 'ls')).to be_truthy - - tel = Net::Telnet::new("Port" => ssh_port) - result = tel.cmd('echo echo') - tel.close - expect(result).to match(/OpenSSH/) + if true + it 'fails to allow puppet to function in strict enforcing mode' + else + # This is kept around to show what *should* happen (and what did happen + # at some point). Unfortunately, flipping any of the items to 'true' + # below causes puppet to fail to apply afterwards. + hosts.each do |host| + manifest = <<-EOF + include 'ima' + class { 'ima::policy': + # The ones set to 'false' break 'puppet apply' immediately + appraise_fowner => true, + measure_bprm_check => false, + measure_file_mmap => true, + measure_module_check => true, + measure_root_read_files => true + } + EOF + + it 'should run puppet' do + apply_manifest_on(host, manifest, catch_failures: true) + end - host.reboot - sleep 30 + it 'should run puppet idempotently' do + apply_manifest_on(host, manifest, catch_changes: true) + end - tel2 = Net::Telnet::new("Port" => ssh_port) - begin - result2 = tel.cmd('echo echo') - rescue IOError => e - result2 = e + it 'locks up the filesystem after a reboot and new policy is applied' do + on(host, 'yum install -y telnet') + ssh_config = File.readlines(host[:ssh][:config]) + ssh_port = ssh_config.grep(/port/i).first.split(' ')[1] + + expect(on(host, 'ls')).to be_truthy + + tel = Net::Telnet::new("Port" => ssh_port) + result = tel.cmd('echo echo') + tel.close + expect(result).to match(/OpenSSH/) + + host.reboot + sleep 30 + + tel2 = Net::Telnet::new("Port" => ssh_port) + begin + result2 = tel.cmd('echo echo') + rescue IOError => e + result2 = e + end + tel2.close + expect(result2).to be_instance_of(IOError) end - tel2.close - expect(result2).to be_instance_of(IOError) end end end