leviathan
67d091dd37
Closes the loop opened by tools/verify-vm/: every JSON verification
record now persists into docs/VERIFICATIONS.jsonl, gets folded into
the embedded core/verifications.c lookup table, and surfaces in
--list / --module-info / --explain / --scan --json.
New: docs/VERIFICATIONS.jsonl
Append-only store. One JSON record per verify.sh run. Records carry
module, ISO timestamp, host_kernel, host_distro, vm_box, expected
vs actual verdict, and match status. 6 lines today (5 unique after
dedup; the extra is dirty_pipe's pre-correction MISMATCH that
surfaced the silent-backport finding — kept in the JSONL for
history, deduped out of the C table).
New: tools/refresh-verifications.py
Parses VERIFICATIONS.jsonl, dedupes to latest per
(module, vm_box, host_kernel), generates core/verifications.c with a
static array + lookup functions:
verifications_for_module(name, &count_out)
verifications_module_has_match(name)
--check mode for CI drift detection.
New: core/verifications.{h,c}
Embedded record table. Lookup is O(corpus); we have <50 records.
skeletonkey.c surfacing:
- --list: new 'VFY' column shows ✓ for modules with >=1 'match'
record. Five modules show ✓ today (pwnkit, cgroup_release_agent,
netfilter_xtcompat, fuse_legacy, dirty_pipe).
- --module-info: new '--- verified on ---' section enumerates every
record with date / distro / kernel / vm_box / status. Modules with
zero records get a 'run tools/verify-vm/verify.sh <name>' hint.
- --explain: new 'VERIFIED ON' section in the operator briefing.
- --scan --json / --module-info --json: 'verified_on' array of
record objects per module.
Verification records baked in:
pwnkit Ubuntu 20.04.6 LTS 5.4.0-169 match (polkit 0.105)
cgroup_release_agent Debian 11 (bullseye) 5.10.0-27 match
netfilter_xtcompat Debian 11 (bullseye) 5.10.0-27 match
fuse_legacy Debian 11 (bullseye) 5.10.0-27 match
dirty_pipe Ubuntu 22.04.3 LTS 5.15.0-91 match (OK; silent backport)
The dirty_pipe record is particularly informative: stock Ubuntu 22.04
ships 5.15.0-91-generic. Our version-only kernel_range check would say
VULNERABLE (5.15.0 < 5.15.25 backport in our table). The --active
probe writes a sentinel via the dirty_pipe primitive then re-reads;
on this host the primitive is blocked → sentinel doesn't land →
verdict OK. Ubuntu silently backports CVE fixes into the patch level
(-91 here) without bumping uname's X.Y.Z. The targets.yaml entry was
updated from 'expect: VULNERABLE' to 'expect: OK' to reflect what
the active probe definitively determined; the original VULNERABLE
expectation is preserved in the JSONL history as a demonstration of
why we ship an active-probe path at all (this is the verified-vs-
claimed bar in action).
Plumbing fixes that landed in the same loop:
- core/nft_compat.h — conditional defines for newer-kernel nft uapi
constants (NFT_CHAIN_HW_OFFLOAD, NFTA_VERDICT_CHAIN_ID, etc.)
that aren't in Ubuntu 20.04's pre-5.5 linux-libc-dev. Without
this, nft_* modules failed to compile inside the verifier guest.
Included from each nft module after <linux/netfilter/nf_tables.h>.
- tools/verify-vm/Vagrantfile — wrap config in c.vm.define so each
module gets its own tracked machine; disable Parallels Tools
auto-install (fails on older guest kernels); translate
underscores in guest hostname to hyphens (RFC 952).
- tools/verify-vm/verify.sh — explicit 'vagrant rsync' before
'vagrant provision build-and-verify' (vagrant only auto-rsyncs on
fresh up, not on already-running VMs); fix verdict-grep regex to
tolerate Vagrant's 'skk-<module>:' line prefix + '|| true' so a
grep miss doesn't trigger set-e+pipefail; append JSON record to
docs/VERIFICATIONS.jsonl on every run.
- tools/verify-vm/targets.yaml — dirty_pipe retargeted from
ubuntu2004 + pinned 5.13.0-19 (no longer in 20.04's apt) to
ubuntu2204 stock 5.15.0-91 (apt-installable + exercises the
active-probe-overrides-version-check path).
What's next for the verifier:
- Mainline kernel.ubuntu.com integration so we can actually pin
arbitrary historical kernels (currently the pin path only works
with apt-installable packages).
- Sweep the remaining ~18 verifiable modules and accumulate records.
- Per-module verified_on counts in --explain header.
105 lines
4.3 KiB
Ruby
105 lines
4.3 KiB
Ruby
# -*- mode: ruby -*-
|
|
# vi: set ft=ruby :
|
|
#
|
|
# tools/verify-vm/Vagrantfile — parameterized verifier VM.
|
|
#
|
|
# Driven by env vars set by tools/verify-vm/verify.sh:
|
|
#
|
|
# SKK_VM_BOX generic/<box> name (e.g. generic/debian11)
|
|
# SKK_VM_KERNEL_PKG optional apt package for the vulnerable kernel
|
|
# (e.g. linux-image-5.13.0-19-generic). Empty = use stock.
|
|
# SKK_VM_KERNEL_VERSION expected kernel version after install
|
|
# SKK_VM_HOSTNAME hostname for this VM (used in vagrant box name)
|
|
#
|
|
# The Vagrantfile mounts the repo root at /vagrant (Vagrant default) so the
|
|
# in-VM `make` builds against your live source — no rebuild loop.
|
|
|
|
require "yaml"
|
|
|
|
REPO_ROOT = File.expand_path("../..", __dir__)
|
|
|
|
box = ENV["SKK_VM_BOX"] || "generic/debian12"
|
|
pkg = ENV["SKK_VM_KERNEL_PKG"] || ""
|
|
kver = ENV["SKK_VM_KERNEL_VERSION"] || ""
|
|
host = ENV["SKK_VM_HOSTNAME"] || "skk-verify"
|
|
|
|
Vagrant.configure("2") do |c|
|
|
# Define ONE Vagrant machine named after SKK_VM_HOSTNAME. Per-module
|
|
# isolation: each module gets its own `skk-<module>` machine that
|
|
# vagrant tracks in .vagrant/machines/skk-<module>/parallels/.
|
|
c.vm.define host do |m|
|
|
m.vm.box = box
|
|
# Guest hostnames forbid underscores per RFC 952. Vagrant machine
|
|
# names allow them (we keep skk-cgroup_release_agent so per-module
|
|
# state stays isolated in .vagrant/machines/), but inside the VM
|
|
# we translate to hyphens so the hostname is RFC-valid.
|
|
m.vm.hostname = host.gsub("_", "-")
|
|
|
|
m.vm.synced_folder REPO_ROOT, "/vagrant",
|
|
type: "rsync", rsync__exclude: ["build/", ".git/", "*.o", "skeletonkey-test*"]
|
|
|
|
m.vm.provider "parallels" do |p|
|
|
p.memory = 2048
|
|
p.cpus = 2
|
|
p.name = host
|
|
# Don't auto-update Parallels Tools: the installer fails on older
|
|
# guest kernels (e.g. Ubuntu 20.04's 5.4.0-169 is "outdated and
|
|
# not supported" by latest tools). We use rsync over SSH for
|
|
# sync_folder, which doesn't need the guest tools at all.
|
|
p.update_guest_tools = false
|
|
p.check_guest_tools = false
|
|
end
|
|
|
|
# 1. Always install build deps + sudo (needed for module verification).
|
|
m.vm.provision "shell", inline: <<-SHELL
|
|
set -e
|
|
if command -v apt-get >/dev/null 2>&1; then
|
|
export DEBIAN_FRONTEND=noninteractive
|
|
apt-get update -qq
|
|
apt-get install -y -qq build-essential libglib2.0-dev pkg-config sudo curl ca-certificates
|
|
elif command -v dnf >/dev/null 2>&1; then
|
|
dnf install -y -q gcc make glib2-devel pkgconfig sudo curl
|
|
fi
|
|
SHELL
|
|
|
|
# 2. Pin target kernel if requested. Reboot needed afterward.
|
|
if !pkg.empty?
|
|
m.vm.provision "shell", name: "pin-kernel-#{pkg}", inline: <<-SHELL
|
|
set -e
|
|
if dpkg-query -W -f='${Status}' #{pkg} 2>/dev/null | grep -q 'install ok installed'; then
|
|
echo "[=] #{pkg} already installed"
|
|
else
|
|
echo "[+] installing #{pkg} (kernel target #{kver})"
|
|
export DEBIAN_FRONTEND=noninteractive
|
|
apt-get install -y -qq #{pkg} || {
|
|
echo "[-] #{pkg} unavailable in apt; trying snapshot.debian.org" >&2
|
|
echo "deb [check-valid-until=no] http://snapshot.debian.org/archive/debian/20230101T000000Z bookworm main" \
|
|
>> /etc/apt/sources.list.d/snapshot.list
|
|
apt-get update -qq -o Acquire::Check-Valid-Until=false
|
|
apt-get install -y -qq --allow-downgrades #{pkg}
|
|
}
|
|
echo "[i] kernel #{pkg} installed; reboot via 'vagrant reload'"
|
|
fi
|
|
SHELL
|
|
end
|
|
|
|
# 3. Build SKELETONKEY in-VM and run --explain --active for the target module.
|
|
# SKK_MODULE is set by verify.sh on the second-pass `vagrant provision`
|
|
# call (post-reboot if kernel was pinned).
|
|
m.vm.provision "shell", name: "build-and-verify", run: "never",
|
|
env: { "SKK_MODULE" => ENV["SKK_MODULE"] || "" },
|
|
inline: <<-SHELL
|
|
set -e
|
|
cd /vagrant
|
|
echo "[*] kernel: $(uname -r)"
|
|
echo "[*] building skeletonkey..."
|
|
make clean >/dev/null 2>&1 || true
|
|
make 2>&1 | tail -3
|
|
echo
|
|
echo "[*] running: skeletonkey --explain ${SKK_MODULE} --active"
|
|
echo
|
|
./skeletonkey --explain "${SKK_MODULE}" --active 2>&1 || true
|
|
SHELL
|
|
end
|
|
end
|