Draft: Remove keylime.conf #1133

ansasaki · 2022-10-14T16:01:12Z

Remove all mentions to the old configuration file keylime.conf.

This also updates the configuration description. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>

Also update the options names used on the examples. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>

Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>

ansasaki · 2022-10-14T16:05:17Z

I need to fix the test scripts to generate the configuration files. Leaving this as a draft for now.

mpeters · 2022-10-14T16:10:32Z

installer.sh

@@ -409,7 +409,7 @@ echo "==========================================================================
 mkdir -p /etc/keylime
 mkdir -p config
 pushd scripts
-python3 convert_config.py --input ../keylime.conf --out ../config
+python3 convert_config.py --input /dev/null --out ../config


Why is this using /dev/null as input?

The goal is to provide an empty input to:

use the default values for all options

not use the system installed configuration files. If no input is provided, the convert_config.py script will try to use the system installed configuration.

I think I can modify the script to accept a new option to used default values for all options instead of using this workaround.

Use --input as optional, and it will default to None. This can signal what you want, and the cli will be clear: python3 convert_config --out ../config

The default behavior when no input is provided is to use the system installed configuration files as input to generate upgraded config without changing the user set options. This is already implemented.

What I want is to use the default values for the options ignoring any eventual system installed files. The workaround was to provide an empty file as input (so that it wouldn't search for the system installed files). But it is kind of ugly.

I decided to add a separate option --defaults to make the script to ignore any input.

When the '--defaults' option is provided, the script will ignore input files and the system installed files and will use the default value for all options. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>

The split configuration files can be generated without any input by using the default values for all options. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>

The resulting elements after the manual splitting of a list were not correctly stripped to remove leading/trailing white spaces. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>

Some of the default values in the mappings would result in a configuration not functional out of the box. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>

Install keylime using the installer.sh script instead of moving only the old configuration file. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>

Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>

Use the default values for all options. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>

codecov-commenter · 2022-10-17T10:41:10Z

Codecov Report

Merging #1133 (af36199) into master (f969d39) will decrease coverage by 15.83%.
The diff coverage is 0.00%.

❗ Current head af36199 differs from pull request most recent head 6d74a33. Consider uploading reports for the commit 6d74a33 to get more accurate results

Additional details and impacted files

Flag	Coverage Δ
packit-e2e	`55.36% <0.00%> (-17.05%)`	⬇️
testsuite	`48.92% <0.00%> (-5.22%)`	⬇️
unittests	`14.61% <0.00%> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
keylime/keylime_agent.py	`37.11% <0.00%> (-36.35%)`	⬇️
keylime/elchecking/example.py	`20.00% <0.00%> (-74.00%)`	⬇️
keylime/elchecking/tests.py	`26.20% <0.00%> (-55.77%)`	⬇️
keylime/tpm_ek_ca.py	`30.43% <0.00%> (-52.18%)`	⬇️
keylime/cloud_verifier_common.py	`32.16% <0.00%> (-48.26%)`	⬇️
keylime/measured_boot.py	`20.33% <0.00%> (-45.77%)`	⬇️
keylime/ima/file_signatures.py	`33.82% <0.00%> (-39.71%)`	⬇️
keylime/tpm/tpm_abstract.py	`47.00% <0.00%> (-34.62%)`	⬇️
keylime/revocation_notifier.py	`29.55% <0.00%> (-32.08%)`	⬇️
... and 21 more

Use a virtual environment for the python components and temporary directories for the generated files. The dependencies are still installed in the system. The used configuration files are generated in a temporary directory with the changes necessary to run the tests. The installed configuration files are not modified. The files generated when running run_tests.sh will be removed at the end of the execution unless the environment variable KEEP_TMP_FILES=1. If the tests are executed using the run_tests.sh script, all the necessary dependencies are installed and environment variables set. When running test_restful.py outside run_tests.sh with RUST_TEST=1, it expects the KEYLIME_RUST_AGENT and KEYLIME_RUST_CONF environment variables set, respectively, with the path to the rust agent binary and the rust agent configuration file. If the environment variables are not set, it tries to find the rust agent binary and configuration in an adjacent directory (i.e. in the same location run_tests.sh downloads it). Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>

THS-on · 2022-10-18T09:44:03Z

Only somewhat related: I think we should move the convert_config.py out of the scripts folder and into the keylime/cmd directory. Then we can add it as an binary to the setup.cfg. This makes it easier to ensure that this script is actually being packaged.

ansasaki · 2022-10-18T17:05:03Z

Only somewhat related: I think we should move the convert_config.py out of the scripts folder and into the keylime/cmd directory. Then we can add it as an binary to the setup.cfg. This makes it easier to ensure that this script is actually being packaged.

I think this is a good idea, to move this script and install along the others. In future the script relevance will only grow. Another change that we should consider is to have the configuration mappings/templates which are currently in scripts/templates installed somewhere in the system (maybe /usr/share/keylime) and use this local as the default.

stefanberger · 2022-11-06T19:55:52Z

To get rid of some of the test failures you may want to rebase on master.

THS-on · 2023-01-18T13:12:26Z

@ansasaki what is the state of this PR now that othe config PR was merged?

ansasaki · 2023-01-19T09:16:59Z

@ansasaki what is the state of this PR now that othe config PR was merged?

I'll get back to this, but I can't promise that it will be very soon. Hopefully I will get back to this and finish before 7.0.0, but I don't consider it a release blocker.

THS-on · 2023-05-26T16:29:52Z

@ansasaki do you have the time to complete this or should I pick up this PR?

I think the changes to the converter script are already in the master branch, so it should be just fixing the merge conflict issues and seeing if we not missed something.

stefanberger · 2023-05-26T21:11:37Z

scripts/templates/2.0/adjust.py

@@ -93,7 +93,7 @@ def adjust(config, mapping):
                v = value.strip("[]").split(",")

                # Eliminate surrounding blank space from each element
-                map(lambda x: x.strip(), v)
+                v = map(lambda x: x.strip(), v)


seems unnecessary to assign it to v.

ansasaki added 9 commits October 14, 2022 17:40

README: Remove mentions to keylime.conf

d6d2bb1

This also updates the configuration description. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>

Remove mentions to keylime.conf from secure payload user guide

1b90148

Also update the options names used on the examples. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>

Remove mentions to keylime.conf from runtime ima user guide

0c9f789

Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>

Remove mentions to keylime.conf from PCR monitoring user guide

8404105

Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>

demo: Remove mentions to keylime.conf from README

f01a482

Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>

docs/installation: Remove mentions to keylime.conf

eaa678e

Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>

Remove mentions to keylime.conf from measured boot user guide

15fa353

Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>

Remove mentions to keylime.conf from old agent tarball notes

b890f08

Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>

keylime_agent: Remove mentions to keylime.conf

b44bc0c

Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>

ansasaki changed the title ~~Remove keylime.conf~~ Draft: Remove keylime.conf Oct 14, 2022

mpeters reviewed Oct 14, 2022

View reviewed changes

ansasaki force-pushed the remove_keylime_conf branch from e405ca1 to af36199 Compare October 17, 2022 09:31

ansasaki added 7 commits October 17, 2022 11:40

convert_config: Add --defaults option to use default values

113937c

When the '--defaults' option is provided, the script will ignore input files and the system installed files and will use the default value for all options. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>

setup: Don't use keylime.conf to generate the split configuration

91b04c9

The split configuration files can be generated without any input by using the default values for all options. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>

Correctly strip elements of a list on config v2.0 adjust script

e0f1f5d

The resulting elements after the manual splitting of a list were not correctly stripped to remove leading/trailing white spaces. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>

Fix default values in mappings

ae85006

Some of the default values in the mappings would result in a configuration not functional out of the box. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>

docker/ci/Dockerfile: Remove mention to keylime.conf

9ab79ea

Install keylime using the installer.sh script instead of moving only the old configuration file. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>

Remove old keylime.conf file

b2c208b

Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>

installer: Remove mention to keylime.conf

6d74a33

Use the default values for all options. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>

ansasaki force-pushed the remove_keylime_conf branch from af36199 to 6d74a33 Compare October 17, 2022 09:42

ansasaki mentioned this pull request Oct 19, 2022

Draft: Do not install keylime nor configuration files during tests #1132

Closed

THS-on mentioned this pull request Nov 10, 2022

This commit implements most of the changes for #73 "Durable (Offline) Attestation". #1129

Merged

maugustosilva mentioned this pull request Nov 28, 2022

config: remove fallback config #1208

Merged

THS-on added the breaking-change This change requires user interaction during upgrades label Dec 2, 2022

THS-on added the cleanup label Dec 2, 2022

maugustosilva mentioned this pull request Feb 22, 2023

Meeting 22/02/23 keylime/meetings#60

Closed

21 tasks

stefanberger reviewed May 26, 2023

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Draft: Remove keylime.conf #1133

Draft: Remove keylime.conf #1133

ansasaki commented Oct 14, 2022

ansasaki commented Oct 14, 2022

mpeters Oct 14, 2022

ansasaki Oct 17, 2022

aplanas Oct 17, 2022

ansasaki Oct 17, 2022

codecov-commenter commented Oct 17, 2022

THS-on commented Oct 18, 2022

ansasaki commented Oct 18, 2022

stefanberger commented Nov 6, 2022

THS-on commented Jan 18, 2023

ansasaki commented Jan 19, 2023

THS-on commented May 26, 2023

stefanberger May 26, 2023

Draft: Remove keylime.conf #1133

Are you sure you want to change the base?

Draft: Remove keylime.conf #1133

Conversation

ansasaki commented Oct 14, 2022

ansasaki commented Oct 14, 2022

mpeters Oct 14, 2022

Choose a reason for hiding this comment

ansasaki Oct 17, 2022

Choose a reason for hiding this comment

aplanas Oct 17, 2022

Choose a reason for hiding this comment

ansasaki Oct 17, 2022

Choose a reason for hiding this comment

codecov-commenter commented Oct 17, 2022

Codecov Report

THS-on commented Oct 18, 2022

ansasaki commented Oct 18, 2022

stefanberger commented Nov 6, 2022

THS-on commented Jan 18, 2023

ansasaki commented Jan 19, 2023

THS-on commented May 26, 2023

stefanberger May 26, 2023

Choose a reason for hiding this comment