test_082_stack_guard_kernel in ubuntu_qrt_kernel_security failed with J-oem-6.5 (compressed modules)

[Po-Hsu Lin]

Test failed with 6.5.0-1002.2.

 Running 'python3 ./test-kernel-security.py -v KernelSecurityTest.test_082_stack_guard_kernel'
 Running test: './test-kernel-security.py' distro: 'Ubuntu 22.04' kernel: '6.5.0-1002.2 (Ubuntu 6.5.0-1002.2-oem 6.5.0-rc4)' arch: 'amd64' init: 'systemd' uid: 0/0 SUDO_USER: 'ubuntu')
 test_082_stack_guard_kernel (__main__.KernelSecurityTest)
 Kernel stack guard ... FAIL

 ======================================================================
 FAIL: test_082_stack_guard_kernel (__main__.KernelSecurityTest)
 Kernel stack guard
 ----------------------------------------------------------------------
 Traceback (most recent call last):
   File "/home/ubuntu/autotest/client/tmp/ubuntu_qrt_kernel_security/src/qa-regression-testing/scripts/./test-kernel-security.py", line 758, in test_082_stack_guard_kernel
     self.assertTrue(module, 'Could not find a suitable kernel module to test')
 AssertionError: '' is not true : Could not find a suitable kernel module to test

 ----------------------------------------------------------------------
 Ran 1 test in 0.003s

 FAILED (failures=1)

Here is the test case:

    def test_082_stack_guard_kernel(self):
        '''Kernel stack guard'''

        expected = True
        if not self.kernel_at_least('2.6.31'):
            self._skipped("only Karmic and later")
            expected = False
        else:
            if self.dpkg_arch in self.arm_archs and \
               not self.kernel_at_least('2.6.35'):
                self._skipped("not available on ARM before 10.10")
                expected = False
            if self.dpkg_arch in ['arm64'] and \
               not self.kernel_at_least('4.4'):
                self._skipped("not available on ARM64 before xenial")
                expected = False
            if self.lsb_release['Release'] == 9.10 and self.kernel_version.endswith('-ec2'):
                self._skipped("ignored on Karmic EC2")
                expected = False
            if self.dpkg_arch in ['powerpc']:
                self._skipped("not available on 32-bit powerpc")
                expected = False
            if self.dpkg_arch in ['ppc64', 'ppc64el'] and \
               not self.kernel_at_least('4.20'):
                self._skipped("not available on powerpc before disco")
                expected = False
            if self.dpkg_arch in ['s390x']:
                self._skipped("not available on s390x")
                expected = False
        if self._get_config('MODULES') is None:
            self.announce("cannot check, non-modular")
            # Fall back to config test...
            self.assertTrue(self._get_config('CC_STACKPROTECTOR'))
            expected = False

        module = ""
        for m in ['fs/befs/befs.ko', 'crypto/tcrypt.ko', 'fs/cifs/cifs.ko',
                  'net/ipv4/netfilter/arp_tables.ko',
                  'net/bridge/netfilter/ebtables.ko']:
            m = os.path.join('/lib/modules/%s/kernel/' % (self.kernel_version), m)
            if os.path.exists(m):
                module = m
                break
        if expected:
            self.assertTrue(module, 'Could not find a suitable kernel module to test')

        rc, out = testlib.cmd(['readelf', '-s', module])
        if expected:
            self.assertEqual(rc, 0, out)
        self.assertEqual(expected, ' UND __stack_chk_fail\n' in out, '__stack_chk_fail missing from kernel (tested befs.ko)')

[Po-Hsu Lin (cypressyew)]

We're now using zstd compressed modules:
$ ls /lib/modules/6.5.0-1002-oem/kernel/fs/befs/befs.ko*
/lib/modules/6.5.0-1002-oem/kernel/fs/befs/befs.ko.zst
$ ls /lib/modules/6.5.0-1002-oem/kernel/fs/cifs/
ls: cannot access '/lib/modules/6.5.0-1002-oem/kernel/fs/cifs/cifs.ko*': No such file or directory
$ ls /lib/modules/6.5.0-1002-oem/kernel/crypto/tcrypt.ko*
/lib/modules/6.5.0-1002-oem/kernel/crypto/tcrypt.ko.zst
$ ls /lib/modules/6.5.0-1002-oem/kernel/net/ipv4/netfilter/arp_tables.ko*
/lib/modules/6.5.0-1002-oem/kernel/net/ipv4/netfilter/arp_tables.ko.zst
$ ls /lib/modules/6.5.0-1002-oem/kernel/net/bridge/netfilter/ebtables.ko*
/lib/modules/6.5.0-1002-oem/kernel/net/bridge/netfilter/ebtables.ko.zst

[Alex Murray (alexmurray)]

Proposed fix in https://code.launchpad.net/~alexmurray/qa-regression-testing/+git/qa-regression-testing/+merge/455095

[Po-Hsu Lin (cypressyew)]

Test passed, hints removed.
Thanks!