seccomp sandbox: allow riscv_hwprobe syscall if present #241
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # For testing, you can set variables in your repo (Repo -> Settings -> | |
| # Security -> Actions -> Variables) to restrict the tests that are run | |
| # The supported variables are: | |
| # | |
| # RUN_ONLY_TARGET_CONFIG: Run only the single matching target and config, | |
| # separated by spaces, eg "ubuntu-latest default". All other tests will | |
| # fail immediately. | |
| # | |
| # LTESTS: Override the set of tests run. | |
| name: CI VM | |
| on: | |
| push: | |
| paths: [ '**.c', '**.h', '**.m4', '**.sh', '**/Makefile.in', 'configure.ac', '.github/configs', '.github/workflows/vm.yml' ] | |
| pull_request: | |
| paths: [ '**.c', '**.h', '**.m4', '**.sh', '**/Makefile.in', 'configure.ac', '.github/configs', '.github/workflows/vm.yml' ] | |
| jobs: | |
| dragonflybsd: | |
| name: "dragonflybsd-${{ matrix.target }}" | |
| if: github.repository != 'openssh/openssh-portable-selfhosted' | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| target: | |
| - "6.4.2" | |
| config: [default] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@main | |
| - name: autoreconf | |
| run: sh -c autoreconf | |
| - name: start DragonFlyBSD ${{ matrix.target }} VM | |
| uses: vmactions/dragonflybsd-vm@v1 | |
| with: | |
| release: ${{ matrix.target }} | |
| usesh: true | |
| prepare: | | |
| pkg install -y sudo | |
| pw useradd builder -m | |
| echo "builder ALL=(ALL:ALL) NOPASSWD: ALL" >>/usr/local/etc/sudoers | |
| mkdir -p /var/empty /usr/local/etc | |
| cp $GITHUB_WORKSPACE/moduli /usr/local/etc/moduli | |
| - name: set file perms | |
| shell: dragonflybsd {0} | |
| run: cd $GITHUB_WORKSPACE && chown -R builder . | |
| - name: configure | |
| shell: dragonflybsd {0} | |
| run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure --with-ssl-dir=/usr/local | |
| - name: make clean | |
| shell: dragonflybsd {0} | |
| run: cd $GITHUB_WORKSPACE && sudo -u builder make clean | |
| - name: make | |
| shell: dragonflybsd {0} | |
| run: cd $GITHUB_WORKSPACE && sudo -u builder make -j4 | |
| - name: make tests | |
| shell: dragonflybsd {0} | |
| run: | | |
| cd $GITHUB_WORKSPACE | |
| sudo -u builder env SUDO=sudo make tests | |
| - name: "PAM: configure" | |
| shell: dragonflybsd {0} | |
| run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure --with-ssl-dir=/usr/local --with-pam | |
| - name: "PAM: make clean" | |
| shell: dragonflybsd {0} | |
| run: cd $GITHUB_WORKSPACE && sudo -u builder make clean | |
| - name: "PAM: make" | |
| shell: dragonflybsd {0} | |
| run: cd $GITHUB_WORKSPACE && sudo -u builder make -j4 | |
| - name: "PAM: make tests" | |
| shell: dragonflybsd {0} | |
| run: | | |
| cd $GITHUB_WORKSPACE | |
| sudo -u builder env SUDO=sudo SSHD_CONFOPTS="UsePam yes" make tests | |
| freebsd: | |
| name: "freebsd-${{ matrix.target }}" | |
| if: github.repository != 'openssh/openssh-portable-selfhosted' | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| target: | |
| - "13.5" | |
| - "14.3" | |
| # - "15.0" # "pkg" breaks with a libutil.so error... | |
| config: [default] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@main | |
| - name: autoreconf | |
| run: sh -c autoreconf | |
| - name: start FreeBSD ${{ matrix.target }} VM | |
| uses: vmactions/freebsd-vm@v1 | |
| with: | |
| release: ${{ matrix.target }} | |
| usesh: true | |
| prepare: | | |
| pkg install -y sudo | |
| pw useradd builder -m | |
| echo "builder ALL=(ALL:ALL) NOPASSWD: ALL" >>/usr/local/etc/sudoers | |
| mkdir -p /var/empty /usr/local/etc | |
| cp $GITHUB_WORKSPACE/moduli /usr/local/etc/moduli | |
| - name: set file perms | |
| shell: freebsd {0} | |
| run: cd $GITHUB_WORKSPACE && chown -R builder . | |
| - name: configure | |
| shell: freebsd {0} | |
| run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure | |
| - name: make clean | |
| shell: freebsd {0} | |
| run: cd $GITHUB_WORKSPACE && sudo -u builder make clean | |
| - name: make | |
| shell: freebsd {0} | |
| run: cd $GITHUB_WORKSPACE && sudo -u builder make -j4 | |
| - name: make tests | |
| shell: freebsd {0} | |
| run: | | |
| cd $GITHUB_WORKSPACE | |
| sudo -u builder env SUDO=sudo make tests | |
| - name: "PAM: configure" | |
| shell: freebsd {0} | |
| run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure --with-pam --with-audit=bsm | |
| - name: "PAM: make clean" | |
| shell: freebsd {0} | |
| run: cd $GITHUB_WORKSPACE && sudo -u builder make clean | |
| - name: "PAM: make" | |
| shell: freebsd {0} | |
| run: cd $GITHUB_WORKSPACE && sudo -u builder make -j4 | |
| - name: "PAM: make tests" | |
| shell: freebsd {0} | |
| run: | | |
| cd $GITHUB_WORKSPACE | |
| sudo -u builder env SUDO=sudo SSHD_CONFOPTS="UsePam yes" make tests | |
| netbsd: | |
| name: "netbsd-${{ matrix.target }}" | |
| if: github.repository != 'openssh/openssh-portable-selfhosted' | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| target: | |
| - "9.0" | |
| - "9.4" | |
| - "10.0" | |
| - "10.1" | |
| config: [default] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@main | |
| - name: autoreconf | |
| run: sh -c autoreconf | |
| - name: start NetBSD ${{ matrix.target }} VM | |
| uses: vmactions/netbsd-vm@v1 | |
| with: | |
| release: ${{ matrix.target }} | |
| usesh: true | |
| prepare: | | |
| /usr/sbin/pkg_add sudo | |
| /usr/sbin/useradd -m builder | |
| echo "builder ALL=(ALL:ALL) NOPASSWD: ALL" >>/usr/pkg/etc/sudoers | |
| mkdir -p /var/empty /usr/local/etc | |
| cp $GITHUB_WORKSPACE/moduli /usr/local/etc/moduli | |
| - name: set file perms | |
| shell: netbsd {0} | |
| run: cd $GITHUB_WORKSPACE && /sbin/chown -R builder . | |
| - name: configure | |
| shell: netbsd {0} | |
| run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure | |
| - name: make clean | |
| shell: netbsd {0} | |
| run: cd $GITHUB_WORKSPACE && sudo -u builder make clean | |
| - name: make | |
| shell: netbsd {0} | |
| run: cd $GITHUB_WORKSPACE && sudo -u builder make -j4 | |
| - name: make tests | |
| shell: netbsd {0} | |
| run: | | |
| cd $GITHUB_WORKSPACE | |
| sudo -u builder env SUDO=sudo make tests | |
| - name: "PAM: configure" | |
| shell: netbsd {0} | |
| run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure --with-pam | |
| - name: "PAM: make clean" | |
| shell: netbsd {0} | |
| run: cd $GITHUB_WORKSPACE && sudo -u builder make clean | |
| - name: "PAM: make" | |
| shell: netbsd {0} | |
| run: cd $GITHUB_WORKSPACE && sudo -u builder make -j4 | |
| - name: "PAM: make tests" | |
| shell: netbsd {0} | |
| run: | | |
| cd $GITHUB_WORKSPACE | |
| sudo -u builder env SUDO=sudo SSHD_CONFOPTS="UsePam yes" make tests | |
| omnios: | |
| name: "omnios-${{ matrix.target }}" | |
| if: github.repository != 'openssh/openssh-portable-selfhosted' | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| target: | |
| - "r151054" | |
| - "r151046" | |
| config: [default] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@main | |
| - name: autoreconf | |
| run: sh -c autoreconf | |
| - name: start OmniOS ${{ matrix.target }} VM | |
| uses: vmactions/omnios-vm@v1 | |
| with: | |
| release: ${{ matrix.target }} | |
| usesh: true | |
| prepare: | | |
| set -x | |
| pfexec pkg refresh | |
| pfexec pkg install build-essential | |
| useradd -m builder | |
| sed -e "s/^root.*ALL$/root ALL=(ALL) NOPASSWD: ALL/" /etc/sudoers >>/tmp/sudoers | |
| mv /tmp/sudoers /etc/sudoers | |
| echo "builder ALL=(ALL) NOPASSWD: ALL" >>/etc/sudoers | |
| mkdir -p /var/empty /usr/local/etc | |
| cp $GITHUB_WORKSPACE/moduli /usr/local/etc/moduli | |
| - name: set file perms | |
| shell: omnios {0} | |
| run: cd $GITHUB_WORKSPACE && chown -R builder . | |
| - name: configure | |
| shell: omnios {0} | |
| run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure | |
| - name: make clean | |
| shell: omnios {0} | |
| run: cd $GITHUB_WORKSPACE && sudo -u builder make clean | |
| - name: make | |
| shell: omnios {0} | |
| run: cd $GITHUB_WORKSPACE && sudo -u builder make | |
| - name: make tests | |
| shell: omnios {0} | |
| run: | | |
| cd $GITHUB_WORKSPACE | |
| sudo -u builder make tests | |
| openbsd: | |
| name: "openbsd-${{ matrix.target }}" | |
| if: github.repository != 'openssh/openssh-portable-selfhosted' | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| target: | |
| - "7.3" | |
| - "7.5" | |
| - "7.6" | |
| - "7.7" | |
| - "7.8" | |
| config: [default] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@main | |
| - name: autoreconf | |
| run: sh -c autoreconf | |
| - name: start OpenBSD ${{ matrix.target }} VM | |
| uses: vmactions/openbsd-vm@v1 | |
| with: | |
| release: ${{ matrix.target }} | |
| usesh: true | |
| prepare: | | |
| useradd -m builder | |
| echo "permit nopass keepenv root" >/etc/doas.conf | |
| echo "permit nopass keepenv builder" >>/etc/doas.conf | |
| ls -l /etc/doas.conf | |
| chown root:wheel /etc/doas.conf | |
| chmod 644 /etc/doas.conf | |
| mkdir -p /var/empty /usr/local/etc | |
| cp $GITHUB_WORKSPACE/moduli /usr/local/etc/moduli | |
| - name: set file perms | |
| shell: openbsd {0} | |
| run: cd $GITHUB_WORKSPACE && chown -R builder . | |
| - name: configure | |
| shell: openbsd {0} | |
| run: cd $GITHUB_WORKSPACE && doas -u builder ./configure | |
| - name: make clean | |
| shell: openbsd {0} | |
| run: cd $GITHUB_WORKSPACE && doas -u builder make clean | |
| - name: make | |
| shell: openbsd {0} | |
| run: cd $GITHUB_WORKSPACE && doas -u builder make -j4 | |
| - name: make tests | |
| shell: openbsd {0} | |
| run: | | |
| cd $GITHUB_WORKSPACE | |
| doas -u builder env SUDO=doas make tests | |
| openbsd-current-upstream: | |
| # This job is special, and tests OpenBSD -current, both the underlying | |
| # plaform (the latest snapshot) and most recent upstream code (or at least | |
| # the most recent code in the github mirror) instead of OpenSSH Portable. | |
| name: "openbsd-current-upstream" | |
| if: github.repository != 'openssh/openssh-portable-selfhosted' | |
| strategy: | |
| fail-fast: false | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: start OpenBSD VM | |
| uses: vmactions/openbsd-vm@v1 | |
| with: | |
| copyback: false | |
| nat: | | |
| "20022": "22" | |
| usesh: true | |
| prepare: | | |
| useradd -g wobj -m builder | |
| echo "permit nopass keepenv root" >/etc/doas.conf | |
| echo "permit nopass keepenv builder" >>/etc/doas.conf | |
| ls -l /etc/doas.conf | |
| chown root:wheel /etc/doas.conf | |
| chmod 644 /etc/doas.conf | |
| touch /etc/ssh/ssh_known_hosts | |
| pkg_add git | |
| - name: Fetch sysupgrade version | |
| run: | | |
| ver=$(curl -s https://cdn.openbsd.org/pub/OpenBSD/snapshots/amd64/BUILDINFO) | |
| echo "SNAPSHOT_VERSION=${ver}" >> $GITHUB_ENV | |
| - name: check for cached sysupgrade | |
| id: cache-sysupgrade | |
| uses: actions/cache@v4 | |
| with: | |
| key: openbsd-sysupgrade ${{ env.SNAPSHOT_VERSION }} | |
| path: /tmp/_sysupgrade/ | |
| - name: push sysupgrade from cache to VM | |
| if: steps.cache-sysupgrade.outputs.cache-hit == 'true' | |
| run: rsync -av /tmp/_sysupgrade/ openbsd:/home/_sysupgrade/ | |
| - name: upgrade to latest snapshot | |
| run: ssh -q openbsd sysupgrade -s -k || true | |
| - name: wait for upgrade | |
| run: | | |
| SECONDS=0; sleep 10; while ! ssh -q -oConnectTimeout=1 openbsd true; do sleep 10; echo waited ${SECONDS}s; done | |
| ssh -q openbsd uname -a | |
| - name: retrieve sysupgrade from VM to cache | |
| if: steps.cache-sysupgrade.outputs.cache-hit != 'true' | |
| run: | | |
| mkdir -p /tmp/_sysupgrade/ | |
| rsync -av openbsd:/home/_sysupgrade/ /tmp/_sysupgrade/ | |
| - name: save sysupgrade to cache | |
| if: steps.cache-sysupgrade.outputs.cache-hit != 'true' | |
| uses: actions/cache/save@v4 | |
| with: | |
| key: openbsd-sysupgrade ${{ env.SNAPSHOT_VERSION }} | |
| path: /tmp/_sysupgrade/ | |
| - name: checkout upstream source | |
| shell: openbsd {0} | |
| run: | | |
| umask 022 | |
| cd /usr | |
| rm -rf src/* | |
| git clone --no-checkout --depth=1 --filter=tree:0 https://github.com/openbsd/src.git | |
| cd /usr/src | |
| git sparse-checkout set --no-cone Makefile usr.bin/Makefile usr.bin/Makefile.inc usr.bin/ssh usr.bin/nc regress/usr.bin/ssh | |
| git checkout | |
| git log -n1 | |
| chown -R builder /usr/src | |
| chmod -R go-w /usr/src/ /usr/obj/ | |
| - name: make ssh | |
| shell: openbsd {0} | |
| run: | | |
| cd /usr/src/usr.bin/ssh && make -j4 || make | |
| make install | |
| /etc/rc.d/sshd restart | |
| - name: make nc | |
| shell: openbsd {0} | |
| run: cd /usr/src/usr.bin/nc && make && make install | |
| - name: make tests | |
| shell: openbsd {0} | |
| run: | | |
| cd /usr/src/regress/usr.bin/ssh | |
| make obj | |
| doas -u builder env SUDO=doas TEST_SSH_UNSAFE_PERMISSIONS=yes TEST_SSH_FAIL_FATAL=yes TEST_SSH_HOSTBASED_AUTH=setupandrun make | |
| - name: retrieve logs | |
| if: failure() | |
| run: | | |
| rsync -a openbsd:/usr/obj/regress/usr.bin/ssh/ regress-logs/ | |
| for i in regress-logs/failed*.log; do echo ===; echo LOGFILE: $i; echo ===; cat $i; echo; done | |
| - name: save logs | |
| if: failure() | |
| uses: actions/upload-artifact@main | |
| with: | |
| name: openbsd-current-upstream-logs | |
| path: regress-logs/*.log | |
| solaris: | |
| name: "solaris-${{ matrix.target }}" | |
| if: github.repository != 'openssh/openssh-portable-selfhosted' | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| target: | |
| - "11.4-gcc" | |
| config: [default] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@main | |
| - name: autoreconf | |
| run: sh -c autoreconf | |
| - name: start Solaris ${{ matrix.target }} VM | |
| uses: vmactions/solaris-vm@v1 | |
| with: | |
| release: ${{ matrix.target }} | |
| usesh: true | |
| prepare: | | |
| set -x | |
| useradd -m builder | |
| sed -e "s/^root.*ALL$/root ALL=(ALL) NOPASSWD: ALL/" /etc/sudoers >>/tmp/sudoers | |
| mv /tmp/sudoers /etc/sudoers | |
| echo "builder ALL=(ALL) NOPASSWD: ALL" >>/etc/sudoers | |
| mkdir -p /var/empty /usr/local/etc | |
| cp $GITHUB_WORKSPACE/moduli /usr/local/etc/moduli | |
| - name: set file perms | |
| shell: solaris {0} | |
| run: cd $GITHUB_WORKSPACE && chown -R builder . | |
| - name: configure | |
| shell: solaris {0} | |
| run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure | |
| - name: make clean | |
| shell: solaris {0} | |
| run: cd $GITHUB_WORKSPACE && sudo -u builder make clean | |
| - name: make | |
| shell: solaris {0} | |
| run: cd $GITHUB_WORKSPACE && sudo -u builder make | |
| - name: make tests | |
| shell: solaris {0} | |
| run: | | |
| cd $GITHUB_WORKSPACE | |
| sudo -u builder make tests | |
| - name: "PAM: configure" | |
| shell: solaris {0} | |
| run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure --with-pam | |
| - name: "PAM: make clean" | |
| shell: solaris {0} | |
| run: cd $GITHUB_WORKSPACE && sudo -u builder make clean | |
| - name: "PAM: make" | |
| shell: solaris {0} | |
| run: cd $GITHUB_WORKSPACE && sudo -u builder make | |
| - name: "PAM: make tests" | |
| shell: solaris {0} | |
| run: | | |
| cd $GITHUB_WORKSPACE | |
| sudo -u builder make tests | |