simp-beaker-helpers 1.0.2 → 1.0.3

checksums.yaml

@@ -1,15 +1,15 @@
 ---
 !binary "U0hBMQ==":
   metadata.gz: !binary |-
-    ODM2YjI2ODAyMWI3MjEzOTY3YWRlNTUyYjRmMDcyOGM2YzlmOWU1YQ==
+    NjU0OTNiZTBhZDljMGNmYjU5ZWY1NjZmODA1NzY1MzhiMmJlZDdhMQ==
   data.tar.gz: !binary |-
-    MmZhNDZiMGE2ODQ3YTAwNTA4OTE3Y2FjYzYxZjliNGM4NmE3NDZjZQ==
+    OGRhN2E4YWRkODg3NTgyOGIwMGI4YjExZjk2NjA0Y2RlOTlhYmI3Mg==
 SHA512:
   metadata.gz: !binary |-
-    ZjM1MGNkZWQ0Nzg0N2M2YmY2MTk1YjI0ZmZkYzVlMWU5OGVmZDJmMDQ1NjU4
-    NWQ5MmU5ODE0OTAyN2NjNjRhNmE1NDM5OGY4NjM1NTMwNDc4MzNlNTg3ZjNl
-    ODBjYjgwNmU3YWE1MzFiN2NmZGM0OGRjNmFlMWJhYTQwOWUwYjU=
+    NDE3YmY3NDliNDM5YmQ1MzlkMWEwMDA5ODhjNWJkYmE4MTk4NjdkNDMxMzE0
+    YzFiNmY5ZDUwYWJiOTlkOWVhZWIyZDQwZTEyMmY5OWJkNzZlYzg1N2RjMWRj
+    ODcxZTQyYjllMzM2OWMzZTYyY2UyZTk5MjAwYmQ2N2ZlYzNkNWQ=
   data.tar.gz: !binary |-
-    MGEzZTk1ZWZhOTQyNjczY2YzYTZmZDUzNGQwNTViMTFjYjlmMjAyZGU0Zjk5
-    YzQwM2UxNmRlNGM4M2M3NTBkMGY0NTgxOTJkOWUyYzM2NTFhMmJiNzQ4N2Y2
-    MmE1YzcyMmIwM2JjYTdjNzBiYmI2ZTllYjNiOWQ1Y2Y3YThiZTY=
+    MjZlNzU1YzI4ZTkwYWYzNmI3N2IyYTNmYjIwYjcyNDIzOGU5MWEwYWIwMzNm
+    OWUzYjEzMGQ2ZGVmOTI1YWNmOGMxOGI3NGFmNGRlYzI1ZWFiNGQ5MzQ3Y2Fi
+    Y2Y5ZDBiMWFjOWQyYWE5YmI3OTJiZTAwMjgzMGQ2MzM4YmE5Y2M=

data/README.md

@@ -14,9 +14,14 @@ Methods to assist beaker acceptance tests for SIMP.
     * [`copy_keydist_to`](#copy_keydist_to)
     * [`set_hieradata_on`](#set_hieradata_on)
     * [`clear_temp_hieradata`](#clear_temp_hieradata)
-4. [Examples](#examples)
+4. [Environment variables](#environment-variables)
+    * [`BEAKER_fips`](#beaker_fips)
+    * [`BEAKER_spec_prep`](#beaker_spec_prep)
+    * [`BEAKER_stringify_facts`](#beaker_stringify_facts)
+    * [`BEAKER_use_fixtures_dir_for_modules`](#beaker_use_fixtures_dir_for_modules)
+5. [Examples](#examples)
     * [Prep OS, Generate and copy PKI certs to each SUT](#prep-os-generate-and-copy-pki-certs-to-each-sut)
-5. [License](#license)
+6. [License](#license)
 
 ## Overview
 
@@ -110,6 +115,21 @@ Clean up all temporary hiera data files; meant to be called from `after(:all)`
 `clear_temp_hieradata`
 
 
+## Environment variables
+#### `BEAKER_fips`
+
+SIMP acceptance tests enable [FIPS mode](https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/sect-Security_Guide-Federal_Standards_And_Regulations-Federal_Information_Processing_Standard.html) on all SUTs by default.  Acceptance tests can be run without FIPS mode when `BEAKER_fips` is set to `no`
+
+**NOTE:** FIPS mode is only enabled on RedHat family hosts
+
+#### `BEAKER_spec_prep`
+#
+
+
+#### `BEAKER_stringify_facts`
+#### `BEAKER_use_fixtures_dir_for_modules`
+
+
 ## Examples
 
 ### Prep OS, Generate and copy PKI certs to each SUT

data/Rakefile

@@ -66,7 +66,8 @@ namespace :pkg do
   task :gem => :chmod do
     Dir.chdir @rakefile_dir
     Dir['*.gemspec'].each do |spec_file|
-      cmd = %Q{SIMP_RPM_BUILD=1 bundle exec gem build "#{spec_file}"}
+      rpm_build = ENV.fetch('SIMP_RPM_BUILD', '1')
+      cmd = %Q{SIMP_RPM_BUILD=#{rpm_build} bundle exec gem build "#{spec_file}"}
       sh cmd
       FileUtils.mkdir_p 'dist'
       FileUtils.mv Dir.glob("#{@package}*.gem"), 'dist/'

data/lib/simp/beaker_helpers.rb

@@ -1,7 +1,7 @@
 module Simp; end
 
 module Simp::BeakerHelpers
-  VERSION = '1.0.2'
+  VERSION = '1.0.3'
 
   # Locates .fixture.yml in or above this directory.
   def fixtures_yml_path
@@ -35,6 +35,7 @@ module Simp::BeakerHelpers
   def ensure_fixture_modules
     unless ENV['BEAKER_spec_prep'] == 'no'
       puts "== checking prepped modules from .fixtures.yml"
+      puts "  -- (use BEAKER_spec_prep=no to disable)"
       missing_modules = []
       pupmods_in_fixtures_yml.each do |pupmod|
         mod_root = File.expand_path( "spec/fixtures/modules/#{pupmod}", File.dirname( fixtures_yml_path ))
@@ -66,6 +67,53 @@ module Simp::BeakerHelpers
   end
 
 
+  # Configure and reboot SUTs into FIPS mode
+  def enable_fips_mode_on( suts = hosts )
+    puts '== configuring FIPS mode on SUTs'
+    puts '  -- (use BEAKER_fips=no to disable)'
+    suts.each do |sut|
+      puts "  -- enabling FIPS on '#{sut}'"
+      if fact_on(sut, 'osfamily') == 'RedHat'
+        pp = <<-EOS
+        # This is necessary to prevent a kernel panic after rebooting into FIPS
+        # (last checked: 20150928)
+          package { ['kernel'] : ensure => 'latest' }
+
+          package { ['grubby'] : ensure => 'latest' }
+          ~>
+          exec{ 'setup_fips':
+            command     => '/bin/bash /root/setup_fips.sh',
+            refreshonly => true,
+          }
+
+          file{ '/root/setup_fips.sh':
+            ensure  => 'file',
+            owner   => 'root',
+            group   => 'root',
+            mode    => '0700',
+            content => "#!/bin/bash
+
+# FIPS
+if [ -e /sys/firmware/efi ]; then
+  BOOTDEV=`df /boot/efi | tail -1 | cut -f1 -d' '`
+else
+  BOOTDEV=`df /boot | tail -1 | cut -f1 -d' '`
+fi
+# In case you need a working fallback
+DEFAULT_KERNEL_INFO=`/sbin/grubby --default-kernel`
+DEFAULT_INITRD=`/sbin/grubby --info=\\\${DEFAULT_KERNEL_INFO} | grep initrd | cut -f2 -d'='`
+DEFAULT_KERNEL_TITLE=`/sbin/grubby --info=\\\${DEFAULT_KERNEL_INFO} | grep -m1 title | cut -f2 -d'='`
+/sbin/grubby --copy-default --make-default --args=\\\"boot=\\\${BOOTDEV} fips=1\\\" --add-kernel=`/sbin/grubby --default-kernel` --initrd=\\\${DEFAULT_INITRD} --title=\\\"FIPS \\\${DEFAULT_KERNEL_TITLE}\\\"
+",
+            notify => Exec['setup_fips']
+          }
+        EOS
+        apply_manifest_on(sut, pp, :catch_failures => false)
+        on( sut, 'shutdown -r now', { :expect_connection_failure => true } )
+      end
+    end
+  end
+
   # Apply known OS fixes we need to run Beaker on each SUT
   def fix_errata_on( suts = hosts )
     # SIMP uses structured facts, therefore stringify_facts must be disabled
@@ -74,14 +122,21 @@ module Simp::BeakerHelpers
     end
 
     suts.each do |sut|
-      # net-tools required for netstat utility being used by be_listening
-      if fact_on(sut, 'osfamily') == 'RedHat' && fact_on(sut, 'operatingsystemmajrelease') == '7'
-        pp = <<-EOS
-          package { 'net-tools': ensure => installed }
-        EOS
-        apply_manifest_on(sut, pp, :catch_failures => false)
+      if fact_on(sut, 'osfamily') == 'RedHat'
+        # net-tools required for netstat utility being used by be_listening
+        if fact_on(sut, 'operatingsystemmajrelease') == '7'
+          pp = <<-EOS
+            package { 'net-tools': ensure => installed }
+          EOS
+          apply_manifest_on(sut, pp, :catch_failures => false)
+        end
       end
     end
+
+    # Configure and reboot SUTs into FIPS mode
+    unless ENV['BEAKER_fips'] == 'no'
+      enable_fips_mode_on(suts)
+    end
   end
 
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: simp-beaker-helpers
 version: !ruby/object:Gem::Version
-  version: 1.0.2
+  version: 1.0.3
 platform: ruby
 authors:
 - Chris Tessmer
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-09-25 00:00:00.000000000 Z
+date: 2015-09-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: beaker