github.com/kata-containers/tests@v0.0.0-20240307153542-772105b56064/functional/tdx/run.sh (about)

     1  #!/bin/bash
     2  #
     3  # Copyright (c) 2022 Intel Corporation
     4  #
     5  # SPDX-License-Identifier: Apache-2.0
     6  #
     7  
     8  [ -z "${DEBUG:-}" ] || set -o xtrace
     9  set -o errexit
    10  set -o nounset
    11  set -o pipefail
    12  set -o errtrace
    13  
    14  script_path=$(dirname "$0")
    15  source "${script_path}/../../lib/common.bash"
    16  source "${script_path}/lib/common-tdx.bash"
    17  
    18  tmp_dir=$(mktemp -d)
    19  guest_memory_path="${tmp_dir}/guest_mem"
    20  runtime_type="io.containerd.kata.v2"
    21  config_file=""
    22  container_name=test
    23  KATA_HYPERVISOR="${KATA_HYPERVISOR:-qemu}"
    24  
    25  trap cleanup EXIT
    26  
    27  cleanup() {
    28  	local config_file="$(get_config_file)"
    29  	sudo mv -f "${config_file}.bak" "${config_file}"
    30  
    31  	sudo ctr t kill -s 15 ${container_name} || true
    32  	sudo ctr t rm -f ${container_name} || true
    33  	sudo ctr c rm ${container_name} || true
    34  
    35  	clean_env_ctr
    36  
    37  	sudo rm -rf ${tmp_dir}
    38  }
    39  
    40  run_test() {
    41  	local eid=0
    42  	local secret_data=verysecretdata
    43  	sudo -E ctr i pull mirror.gcr.io/library/ubuntu:latest
    44  	sudo -E ctr run -d --runtime ${runtime_type} mirror.gcr.io/library/ubuntu:latest ${container_name} \
    45  		 sh -c "export d=${secret_data}; tail -f /dev/null"
    46  	waitForProcess 30 5 "sudo ctr t exec --exec-id $((eid+=1)) ${container_name} true"
    47  	sudo ctr t exec --exec-id $((eid+=1)) ${container_name} sh -c 'dmesg | grep -qio "tdx: guest initialized"'
    48  	sudo ctr t exec --exec-id $((eid+=1)) ${container_name} grep -qio "tdx_guest" /proc/cpuinfo
    49  
    50  	# dump guest memory and look for secret data, it *must not* be visible
    51  	echo '{"execute":"qmp_capabilities"}{"execute":"dump-guest-memory","arguments":{"paging":false,"protocol":"file:'${guest_memory_path}'"}}'| \
    52  		sudo socat - unix-connect:"${container_qmp_socket}"
    53  	sudo fgrep -v ${secret_data} ${guest_memory_path} || die "very secret data is visible in guest memory!"
    54  }
    55  
    56  main() {
    57  	get_config_file
    58  	setup_tdx
    59  	install_qemu_tdx
    60  	install_kernel_tdx
    61  	enable_confidential_computing
    62  
    63  	run_test
    64  	remove_tdx_tmp_dir
    65  }
    66  
    67  main $@