#!/bin/bash
## kola:
##   # qemu is the only platform where setting a 'secure-boot' tag will cause
##   # secureboot to get turned on for that instance.
##   platforms: qemu
##   # Mark as exclusive since we are requesting secureboot and that won't take effect when we're
##   # running non-exclusively.
##   exclusive: true
##   tags: secure-boot
##   architectures: x86_64
##   description: Verify that the lockdown LSM is set to integrity when booted using Secure Boot
#
# See https://bugzilla.redhat.com/show_bug.cgi?id=2333706

set -xeuo pipefail

. $KOLA_EXT_DATA/commonlib.sh

lockdown_state="$(cat "/sys/kernel/security/lockdown")"

if [[ "$(mokutil --sb)" != "SecureBoot enabled" ]]; then
    fatal "system is not running with Secure Boot enabled"
fi

if [[ "${lockdown_state}" != "none [integrity] confidentiality" ]]; then
    fatal "lockdown LSM not set to integrity on a Secure Boot system"
fi

ok "lockdown LSM set to integrity on a Secure Boot system"
