From 6b46c9f34436cf2bb1bcdc085402ec54353c80ed Mon Sep 17 00:00:00 2001 From: Satya Benson Date: Tue, 3 Nov 2026 10:59:42 -0500 Subject: [PATCH 1/4] soc: apple: sep: preserve the J613 26.6.2 existing-bag policy Keep the existing T8122 transport and sensor profile. On the owner-qualified OS-firmware lane, refuse writable attachment without the boot-forwarded identity and guard, and fail closed on host-store/index read errors. Add opt-outs for trusted-key and FileVault API registration with existing defaults preserved. No new provisioning or firmware protocol is introduced. Signed-off-by: Satya Benson --- .../ABI/testing/sysfs-driver-apple-sep | 20 ++++++++++ drivers/soc/apple/profile.rs | 27 ++++++++++++++ drivers/soc/apple/sep.rs | 37 +++++++++++++++++-- 3 files changed, 80 insertions(+), 4 deletions(-) diff --git a/Documentation/ABI/testing/sysfs-driver-apple-sep b/Documentation/ABI/testing/sysfs-driver-apple-sep index b48d26187f67d..5ee6cd0df614d 100644 --- a/Documentation/ABI/testing/sysfs-driver-apple-sep +++ b/Documentation/ABI/testing/sysfs-driver-apple-sep @@ -30,6 +30,26 @@ Description: by the boot-time bring-up, so the sensor and touchid attributes only move on once something has opened it. + This deployment uses the existing T8122 profile and v4 + /dev/sep-bio interface. It does not add a new sensor protocol. + OS firmware and system firmware are separate: qualify both. + + For an existing bag, select xart_writes=1, provision_keybag=0, + xart_guard=1 and xarm_trace=1. trusted_keys=0 and + filevault_api=0 omit the optional kernel APIs; both default + to 1 to preserve existing deployments. There is no boot_uuid + parameter: the OS identity comes from /chosen/apfs-preboot-uuid. + Writable J613 26.6.2 attachment rejects a missing DT identity, + explicit UUID override or disabled guard before opening xART. + Host-store or identity-index read failure refuses attachment. + + Preserve the current keybag, host store, reference key, three + Catacombs, ownership journal and fprint records. Different + Linux roots must share the same current files globally, before + module load; the kernel opens them from init_task's root. + Never replace them with a snapshot or enrol again to migrate. + Readiness diagnostics do not prove a successful finger match. + What: /sys/bus/platform/devices/.sep/diag/profile Date: October 2026 KernelVersion: 7.1 diff --git a/drivers/soc/apple/profile.rs b/drivers/soc/apple/profile.rs index aaefc62b9528b..2b9a1c9105953 100644 --- a/drivers/soc/apple/profile.rs +++ b/drivers/soc/apple/profile.rs @@ -710,3 +710,30 @@ mod dart_window_tests { } } } + +/// The owner-qualified J613 OS-firmware lane; system firmware may differ. +pub(crate) fn j613_26_6_2() -> bool { + machine_has(b"apple,j613") + && chosen_string(c"asahi,os-fw-version") + .as_deref() + .is_some_and(os_firmware_26_6_2) +} + +fn os_firmware_26_6_2(raw: &[u8]) -> bool { + raw == b"26.6.2" || raw == b"26.6.2\0" +} + +#[cfg(CONFIG_APPLE_SEP_KUNIT_TEST)] +#[kernel::macros::kunit_tests(apple_sep_j613_firmware)] +mod j613_firmware_tests { + use super::*; + + #[test] + fn exact_os_firmware_only() { + assert!(os_firmware_26_6_2(b"26.6.2")); + assert!(os_firmware_26_6_2(b"26.6.2\0")); + for raw in [&b"14.8.3"[..], &b"26.6.20"[..], &b"27.0"[..], &b""[..]] { + assert!(!os_firmware_26_6_2(raw)); + } + } +} diff --git a/drivers/soc/apple/sep.rs b/drivers/soc/apple/sep.rs index 5fd41c5bebf60..10fe16a9b79d4 100644 --- a/drivers/soc/apple/sep.rs +++ b/drivers/soc/apple/sep.rs @@ -857,6 +857,18 @@ impl SepData { let xart_start = module_parameters::xart_start_sector.value(); let xart_guard = xart_guard::level(module_parameters::xart_guard.value(), profile.xart_guard); + // The qualified 26.6.2 lane uses only the boot-forwarded identity. + // Check before opening the shared xART store writable. + if profile::j613_26_6_2() && xart_writes { + if dt::preboot_uuid().is_none() + || module_parameters::os_uuid_hi.value() != 0 + || module_parameters::os_uuid_lo.value() != 0 + || xart_guard.is_none() + { + dev_err!(dev, "J613 26.6.2 requires a DT identity and xART guard\n"); + return Err(EINVAL); + } + } let store = match xart_store::Store::open_owner(xart_writes, xart_start) { Ok(mut store) => { match xart_guard { @@ -897,6 +909,10 @@ impl SepData { let mut host_store = match store::Store::open() { Ok(store) => Some(store), Err(e) => { + if profile::j613_26_6_2() { + dev_err!(dev, "J613 26.6.2 host-state store unavailable: {:?}\n", e); + return Err(e); + } dev_warn!(dev, "Linux host-state store unavailable: {:?}\n", e); None } @@ -904,6 +920,7 @@ impl SepData { let bio_index = match host_store.as_mut().map(bio::IdentityIndex::load) { Some(Ok(index)) => index, + Some(Err(e)) if profile::j613_26_6_2() => return Err(e), Some(Err(_)) => bio::IdentityIndex::new(), None => bio::IdentityIndex::new(), }; @@ -2668,12 +2685,16 @@ impl platform::Driver for SepDriver { data.attach(&sep_node)?; - if let Err(e) = data.register_fv_kernel() { - dev_err!(dev, "could not register the FileVault kernel API: {:?}\n", e); + if module_parameters::filevault_api.value() != 0 { + if let Err(e) = data.register_fv_kernel() { + dev_err!(dev, "could not register the FileVault kernel API: {:?}\n", e); + } } - if let Err(e) = trusted::register(data.clone()) { - dev_warn!(data.dev, "trusted-keys: registration failed ({:?})\n", e); + if module_parameters::trusted_keys.value() != 0 { + if let Err(e) = trusted::register(data.clone()) { + dev_warn!(data.dev, "trusted-keys: registration failed ({:?})\n", e); + } } if let Err(e) = pm::register(data.clone()) { @@ -2740,6 +2761,14 @@ module! { description: "Apple SEP coprocessor: warm attach, endpoint discovery and tag-correlated control endpoint", license: "Dual MIT/GPL", params: { + trusted_keys: u8 { + default: 1, + description: "Register the SEP trusted-key source; 0 leaves it disabled", + }, + filevault_api: u8 { + default: 1, + description: "Register the SEP FileVault kernel API; 0 leaves it disabled", + }, xart_writes: u8 { default: 1, description: "Allow shared xART writes only if APFS proves a single unsnapshotted .gl extent; set to 0 for read-only operation", From b40f6bb15e73589d7b68deddcdb671638a2b224d Mon Sep 17 00:00:00 2001 From: Satya Benson Date: Tue, 3 Nov 2026 13:23:57 -0500 Subject: [PATCH 2/4] soc: apple: sep: expose passive selected-policy diagnostics Signed-off-by: Satya Benson --- .../ABI/testing/sysfs-driver-apple-sep | 29 ++++++- drivers/soc/apple/diag.rs | 44 ++++++++++ drivers/soc/apple/diag_shim.c | 58 ++++++++++++- drivers/soc/apple/sep.rs | 14 +++- drivers/soc/apple/shim.h | 4 + tools/aurora-sep/tests/test_diag_policy.py | 82 +++++++++++++++++++ 6 files changed, 226 insertions(+), 5 deletions(-) create mode 100644 tools/aurora-sep/tests/test_diag_policy.py diff --git a/Documentation/ABI/testing/sysfs-driver-apple-sep b/Documentation/ABI/testing/sysfs-driver-apple-sep index 5ee6cd0df614d..634f67162bc5c 100644 --- a/Documentation/ABI/testing/sysfs-driver-apple-sep +++ b/Documentation/ABI/testing/sysfs-driver-apple-sep @@ -3,9 +3,10 @@ Date: October 2026 KernelVersion: 7.1 Contact: Chris Kearney Description: - (RO) Version of the diag interface: "2" for the attributes + (RO) Version of the diag interface: "3" for the attributes and values described in this file. Version 2 added - sensor_attach and restore; version 1 had neither. + sensor_attach and restore; version 1 had neither. Version 3 + adds the policy snapshot. Within a version, attributes are only added, and an existing attribute keeps its values and their meaning. A reader tests @@ -19,7 +20,8 @@ Description: bring-up got without reading the kernel log. It exists while the driver is bound to the SEP: it is created at probe and removed at unbind. Every attribute in it is read-only and - reads as one ASCII token followed by a newline. + reads as ASCII followed by a newline. The policy snapshot + contains space-separated key=value tokens. Each value is the state the driver recorded when it made the corresponding decision. Reading an attribute sends nothing @@ -379,3 +381,24 @@ Description: tools/aurora-sep/XART-SAFETY.md. During a boot the value can only move from "unverified" to "blocked", once the guard refuses a write. + +What: /sys/bus/platform/devices/.sep/diag/policy +Date: November 2026 +KernelVersion: 7.2 +Contact: Satya Benson +Description: + (RO, ABI 3) A space-separated key=value snapshot of the + driver policy selected at probe: xart_writes (effective store + writability), provision_keybag, xart_guard (effective level), + trusted_keys, filevault_api, xarm_trace, refkey_v2 and + identity_override (0 or 1). API flags describe the selected + policy, not successful registration if that API later fails. + + identity_source is pending before the driver selects it, dt + for /chosen/apfs-preboot-uuid, override for explicit parameters, + or missing. It is updated at the actual identity decision. + No UUID value, state, identity or key bytes are exposed. + Reads only use cached facts and never contact the enclave. + Module-parameter sysfs files need not exist; their absence + is not evidence of a mismatched policy. Older diagnostic + ABIs retain xart/xart_guard and kernel decision messages. diff --git a/drivers/soc/apple/diag.rs b/drivers/soc/apple/diag.rs index 1b6fdd2288c52..b05b7b90c6e25 100644 --- a/drivers/soc/apple/diag.rs +++ b/drivers/soc/apple/diag.rs @@ -30,6 +30,15 @@ extern "C" { sepos13: bool, xart: bool, ) -> c_int; + fn sep_diag_set_policy( + provision_keybag: bool, + trusted_keys: bool, + filevault_api: bool, + xarm_trace: bool, + refkey_v2: bool, + identity_override: bool, + ); + fn sep_diag_set_identity_source(source: c_uint); fn sep_diag_set_attach(attached: bool); fn sep_diag_set_endpoints(count: c_uint); fn sep_diag_set_keystore_open(); @@ -66,6 +75,28 @@ pub(crate) enum Restore { Unproven = 3, } +/// Boot-time policy, without identity values or key material. +pub(crate) struct Policy { + pub provision_keybag: bool, + pub trusted_keys: bool, + pub filevault_api: bool, + pub xarm_trace: bool, + pub refkey_v2: bool, + pub identity_override: bool, +} + +/// The source selected by prepare_os_uuid, not the UUID itself. +pub(crate) enum IdentitySource { + DeviceTree = 1, + Override = 2, + Missing = 3, +} + +pub(crate) fn identity_source(source: IdentitySource) { + // SAFETY: this only stores the source enum in the passive cache. + unsafe { sep_diag_set_identity_source(source as c_uint) }; +} + /// Adds the `diag` group to the SEP device, with the facts fixed at probe. The /// group goes away when the driver unbinds. /// @@ -76,6 +107,7 @@ pub(crate) fn register( profile: &profile::PlatformProfile, xart_writable: bool, guard: Option<(u8, bool)>, + policy: Policy, ) -> Result { // Exhaustive, so a new bootstrap or key store fails to build here until // the ABI has a value for it. @@ -97,6 +129,18 @@ pub(crate) fn register( // SAFETY: no preconditions; stores three words. unsafe { sep_diag_set_xart_guard(c_uint::from(level), list_loaded, matching() as c_int) }; + // SAFETY: the facts are fixed before the attribute group is published. + unsafe { + sep_diag_set_policy( + policy.provision_keybag, + policy.trusted_keys, + policy.filevault_api, + policy.xarm_trace, + policy.refkey_v2, + policy.identity_override, + ) + }; + // SAFETY: `dev` is bound for the duration of the call, which is what devres // needs. `profile.name` is a `str`, valid for reads of `profile.name.len()` // bytes; the shim copies at most that many, needs no NUL terminator, and diff --git a/drivers/soc/apple/diag_shim.c b/drivers/soc/apple/diag_shim.c index 5c54d5d8410b3..9b8773b011260 100644 --- a/drivers/soc/apple/diag_shim.c +++ b/drivers/soc/apple/diag_shim.c @@ -23,7 +23,7 @@ #include "shim.h" /* The contract version; see Documentation/ABI/testing/sysfs-driver-apple-sep. */ -#define SEP_DIAG_ABI 2 +#define SEP_DIAG_ABI 3 #define SEP_DIAG_ATTACH_PENDING 0 #define SEP_DIAG_ATTACH_ATTACHED 1 @@ -64,6 +64,13 @@ static struct { bool cold; bool sepos13; bool xart; + bool provision_keybag; + bool trusted_keys; + bool filevault_api; + bool xarm_trace; + bool refkey_v2; + bool identity_override; + atomic_t identity_source; /* The xART guard's effective level (0: none runs), and its list. */ unsigned int xart_guard; bool xart_guard_list; @@ -120,6 +127,54 @@ static ssize_t xart_show(struct device *dev, struct device_attribute *attr, } static DEVICE_ATTR_RO(xart); +/* Parameter policy is captured at probe; the identity choice is cached later. */ +static ssize_t policy_show(struct device *dev, struct device_attribute *attr, + char *buf) +{ + const char *identity; + + switch (atomic_read(&sep_diag.identity_source)) { + case 1: + identity = "dt"; + break; + case 2: + identity = "override"; + break; + case 3: + identity = "missing"; + break; + default: + identity = "pending"; + break; + } + return sysfs_emit(buf, + "xart_writes=%u provision_keybag=%u xart_guard=%u " + "trusted_keys=%u filevault_api=%u xarm_trace=%u " + "refkey_v2=%u identity_override=%u identity_source=%s\n", + sep_diag.xart, sep_diag.provision_keybag, sep_diag.xart_guard, + sep_diag.trusted_keys, sep_diag.filevault_api, sep_diag.xarm_trace, + sep_diag.refkey_v2, sep_diag.identity_override, identity); +} +static DEVICE_ATTR_RO(policy); + +void sep_diag_set_policy(bool provision_keybag, bool trusted_keys, + bool filevault_api, bool xarm_trace, bool refkey_v2, + bool identity_override) +{ + sep_diag.provision_keybag = provision_keybag; + sep_diag.trusted_keys = trusted_keys; + sep_diag.filevault_api = filevault_api; + sep_diag.xarm_trace = xarm_trace; + sep_diag.refkey_v2 = refkey_v2; + sep_diag.identity_override = identity_override; + atomic_set(&sep_diag.identity_source, 0); +} + +void sep_diag_set_identity_source(unsigned int source) +{ + atomic_set(&sep_diag.identity_source, source); +} + static ssize_t attach_show(struct device *dev, struct device_attribute *attr, char *buf) { @@ -346,6 +401,7 @@ static struct attribute *sep_diag_attrs[] = { &dev_attr_boot.attr, &dev_attr_protocol.attr, &dev_attr_xart.attr, + &dev_attr_policy.attr, &dev_attr_attach.attr, &dev_attr_endpoints.attr, &dev_attr_keystore.attr, diff --git a/drivers/soc/apple/sep.rs b/drivers/soc/apple/sep.rs index 10fe16a9b79d4..e0f9f9a766e2f 100644 --- a/drivers/soc/apple/sep.rs +++ b/drivers/soc/apple/sep.rs @@ -1568,14 +1568,17 @@ impl SepData { match os_identity::select(hi, lo, dt::preboot_uuid) { os_identity::Selection::Explicit(uuid) => { self.xarm.lock().os_uuid = Some(uuid); + diag::identity_source(diag::IdentitySource::Override); dev_info!(self.dev, "xART: using explicit OS identity\n"); } os_identity::Selection::Chosen(uuid) => { self.xarm.lock().os_uuid = Some(uuid); + diag::identity_source(diag::IdentitySource::DeviceTree); dev_info!(self.dev, "xART: using /chosen/apfs-preboot-uuid\n"); } os_identity::Selection::Unavailable => { self.xarm.lock().os_uuid = None; + diag::identity_source(diag::IdentitySource::Missing); dev_warn!(self.dev, "xART: /chosen/apfs-preboot-uuid is unavailable\n"); } } @@ -2677,7 +2680,16 @@ impl platform::Driver for SepDriver { // As soon as the fixed facts are known, so a tool can watch the attach // from "pending" on. Diagnostics are not worth failing the probe for. let guard = data.with_store(|store| store.guard_state()).flatten(); - if let Err(e) = diag::register(dev, data.profile, data.xart_writable(), guard) { + let policy = diag::Policy { + provision_keybag: module_parameters::provision_keybag.value() != 0, + trusted_keys: module_parameters::trusted_keys.value() != 0, + filevault_api: module_parameters::filevault_api.value() != 0, + xarm_trace: module_parameters::xarm_trace.value() != 0, + refkey_v2: module_parameters::refkey_v2.value() != 0, + identity_override: module_parameters::os_uuid_hi.value() != 0 + || module_parameters::os_uuid_lo.value() != 0, + }; + if let Err(e) = diag::register(dev, data.profile, data.xart_writable(), guard, policy) { dev_warn!(dev, "diag: could not add the sysfs attributes ({:?})\n", e); } diff --git a/drivers/soc/apple/shim.h b/drivers/soc/apple/shim.h index ca0d3d8a797ee..e478deaddd0e7 100644 --- a/drivers/soc/apple/shim.h +++ b/drivers/soc/apple/shim.h @@ -179,6 +179,10 @@ struct device; int sep_diag_register(struct device *dev, const char *profile, size_t profile_len, bool cold, bool sepos13, bool xart); +void sep_diag_set_policy(bool provision_keybag, bool trusted_keys, + bool filevault_api, bool xarm_trace, bool refkey_v2, + bool identity_override); +void sep_diag_set_identity_source(unsigned int source); void sep_diag_set_attach(bool attached); void sep_diag_set_endpoints(unsigned int count); void sep_diag_set_keystore_open(void); diff --git a/tools/aurora-sep/tests/test_diag_policy.py b/tools/aurora-sep/tests/test_diag_policy.py new file mode 100644 index 0000000000000..be4b93f55c2bf --- /dev/null +++ b/tools/aurora-sep/tests/test_diag_policy.py @@ -0,0 +1,82 @@ +#!/usr/bin/env python3 +# SPDX-License-Identifier: GPL-2.0-only OR MIT +"""Compile the real passive policy cache/show bodies against synthetic flags.""" +from pathlib import Path +import re +import shutil +import subprocess +import tempfile +import unittest + +ROOT = Path(__file__).resolve().parents[3] +SOURCE = ROOT / 'drivers/soc/apple/diag_shim.c' + + +def function(text, name): + match = re.search(r'^(?:static ssize_t|void) ' + name + r'\(', text, re.M) + if not match: + raise AssertionError(name) + start = text.index('{', match.start()) + depth = 1 + at = start + 1 + while depth: + depth += (text[at] == '{') - (text[at] == '}') + at += 1 + return text[match.start():at] + + +class Tests(unittest.TestCase): + def test_selected_policy_and_identity_source_only(self): + compiler = shutil.which('cc') + self.assertIsNotNone(compiler, 'C compiler required; do not count a skip as a pass') + text = SOURCE.read_text() + state = re.search(r'static struct \{.*?\} sep_diag;', text, re.S).group(0) + body = '\n'.join(function(text, name) for name in + ('policy_show', 'sep_diag_set_policy', 'sep_diag_set_identity_source')) + prefix = '''#include +#include +#include +#include +typedef int atomic_t; +struct device { int unused; }; +struct device_attribute { int unused; }; +#define atomic_read(p) (*(p)) +#define atomic_set(p, v) (*(p) = (v)) +static int sysfs_emit(char *out, const char *fmt, ...) __attribute__((format(printf, 2, 3))); +static int sysfs_emit(char *out, const char *fmt, ...) { + va_list args; va_start(args, fmt); int n = vsnprintf(out, 4096, fmt, args); va_end(args); return n; +} +''' + main = '''int main(void) { + char out[4096]; sep_diag.xart = true; sep_diag.xart_guard = 1; + sep_diag_set_policy(false, false, false, true, false, false); + for (unsigned int i = 0; i < 4; i++) { + sep_diag_set_identity_source(i); policy_show(NULL, NULL, out); fputs(out, stdout); + } + sep_diag_set_policy(true, true, true, false, true, true); + sep_diag.xart = false; sep_diag.xart_guard = 0; + policy_show(NULL, NULL, out); fputs(out, stdout); return 0; +} +''' + with tempfile.TemporaryDirectory() as tmp: + source, program = Path(tmp) / 'policy.c', Path(tmp) / 'policy' + source.write_text(prefix + state + body + main) + subprocess.run([compiler, '-std=gnu11', '-Wall', '-Wextra', '-Werror', + '-Wno-unused-parameter', str(source), '-o', str(program)], check=True) + lines = subprocess.check_output([str(program)], text=True).splitlines() + expected = dict(xart_writes='1', provision_keybag='0', xart_guard='1', + trusted_keys='0', filevault_api='0', xarm_trace='1', + refkey_v2='0', identity_override='0') + for line, identity in zip(lines[:4], ('pending', 'dt', 'override', 'missing')): + self.assertEqual(dict(word.split('=') for word in line.split()), + {**expected, 'identity_source': identity}) + self.assertEqual(dict(word.split('=') for word in lines[4].split()), + dict(xart_writes='0', provision_keybag='1', xart_guard='0', + trusted_keys='1', filevault_api='1', xarm_trace='0', + refkey_v2='1', identity_override='1', identity_source='pending')) + self.assertNotIn('os_uuid_hi=', '\n'.join(lines)) + self.assertNotIn('os_uuid_lo=', '\n'.join(lines)) + + +if __name__ == '__main__': + unittest.main(verbosity=2) From 4a3e51627f70feaed5ad32c05b6ced7b91463572 Mon Sep 17 00:00:00 2001 From: Satya Benson Date: Tue, 3 Nov 2026 13:54:50 -0500 Subject: [PATCH 3/4] soc: apple: sep: update sensor host tests for diagnostic ABI 3 Signed-off-by: Satya Benson --- tools/aurora-sep/tests/test_diag_sensor.py | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/tools/aurora-sep/tests/test_diag_sensor.py b/tools/aurora-sep/tests/test_diag_sensor.py index 01c7a8c1d97ba..16623f1f3e358 100644 --- a/tools/aurora-sep/tests/test_diag_sensor.py +++ b/tools/aurora-sep/tests/test_diag_sensor.py @@ -160,7 +160,7 @@ sep_diag_set_xart_guard(0, false, SEP_DIAG_MATCHING_USABLE); sep_diag_register(&dev, "T8140/J700", 10, false, false, true); /* The guard's attributes were added within version 2. */ - expect("probe", "abi", "2"); + expect("probe", "abi", "3"); expect("probe", "sensor", "unbound"); expect("probe", "touchid", "unknown"); expect("probe", "xart_guard", "0"); @@ -295,14 +295,14 @@ def test_matching_follows_the_guard(self): usable, unverified, blocked = 1, 2, 3 # SEP_DIAG_MATCHING_* in shim.h cases = [ # level, list, matching at probe, refusals, matching after them - ((0, 0, usable, 0, 0), '2 0 none 0 usable'), # Neo, M1 Pro (pinned 0) - ((1, 1, unverified, 0, 0), '2 1 loaded 0 unverified'), # M2 under the guard - ((1, 1, unverified, 2, blocked), '2 1 loaded 2 blocked'), # ... after refusals - ((2, 1, unverified, 0, 0), '2 2 loaded 0 unverified'), - ((1, 0, blocked, 0, 0), '2 1 unavailable 0 blocked'), # no list - ((1, 1, blocked, 0, 0), '2 1 loaded 0 blocked'), # blocked at probe - ((0, 0, 0, 0, 0), '2 0 none 0 unknown'), # never set - ((0, 0, 7, 0, 0), '2 0 none 0 unknown'), # out of range + ((0, 0, usable, 0, 0), '3 0 none 0 usable'), # Neo, M1 Pro (pinned 0) + ((1, 1, unverified, 0, 0), '3 1 loaded 0 unverified'), # M2 under the guard + ((1, 1, unverified, 2, blocked), '3 1 loaded 2 blocked'), # ... after refusals + ((2, 1, unverified, 0, 0), '3 2 loaded 0 unverified'), + ((1, 0, blocked, 0, 0), '3 1 unavailable 0 blocked'), # no list + ((1, 1, blocked, 0, 0), '3 1 loaded 0 blocked'), # cold boot, level 1 + ((0, 0, 0, 0, 0), '3 0 none 0 unknown'), # never set + ((0, 0, 7, 0, 0), '3 0 none 0 unknown'), # out of range ] with tempfile.TemporaryDirectory() as directory: harness = self.build(Path(directory), GUARD_HARNESS, 'guard') From a2dbf7ecde3015d447341b1761d78a8bb6ab44f5 Mon Sep 17 00:00:00 2001 From: Satya Benson Date: Wed, 4 Nov 2026 21:49:04 -0500 Subject: [PATCH 4/4] ci: run the J613 selected-policy diagnostic regressions Signed-off-by: Satya Benson --- .github/workflows/sep-source.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/sep-source.yml b/.github/workflows/sep-source.yml index 114f5c240434e..fe24b285eb6b5 100644 --- a/.github/workflows/sep-source.yml +++ b/.github/workflows/sep-source.yml @@ -45,6 +45,10 @@ jobs: python3 -O -m unittest tools/aurora-sep/tests/test_store_open_errors.py -v python3 -m unittest tools/aurora-sep/tests/test_identity_preservation.py -v python3 -O -m unittest tools/aurora-sep/tests/test_identity_preservation.py -v + - name: Test selected-policy diagnostics + run: | + python3 -m unittest tools/aurora-sep/tests/test_diag_policy.py tools/aurora-sep/tests/test_diag_sensor.py -v + python3 -O -m unittest tools/aurora-sep/tests/test_diag_policy.py tools/aurora-sep/tests/test_diag_sensor.py -v - name: Test recovery utility and package sources run: | python3 -m unittest tools/aurora-sep/tests/test_sep_bio_identities.py -v