KMM: Add filesToSign glob pattern signing tests

tests/hw-accel/kmm/internal/check/check.go

@@ -208,6 +208,95 @@ func ModuleSigned(apiClient *clients.Settings, modName, message, nsname, image s
 	return err
 }
 
+// MultiModuleSigned verifies multiple modules in a single image are signed.
+// It creates one pod and checks each module, avoiding repeated pod creation.
+func MultiModuleSigned(apiClient *clients.Settings, modNames []string,
+	message, nsname, image, dirName string) error {
+	kernelVersion, err := get.KernelFullVersion(apiClient, GeneralConfig.WorkerLabelMap)
+	if err != nil {
+		return err
+	}
+
+	processedImage := strings.ReplaceAll(image, "$KERNEL_FULL_VERSION", kernelVersion)
+	testPod := pod.NewBuilder(apiClient, "multi-sign-checker", nsname, processedImage)
+
+	_, err = testPod.CreateAndWaitUntilRunning(2 * time.Minute)
+	if err != nil {
+		klog.V(kmmparams.KmmLogLevel).Infof("Could not create multi-sign verification pod. Got error: %v", err)
+
+		return err
+	}
+
+	defer func() {
+		_, _ = testPod.Delete()
+	}()
+
+	var errs []string
+
+	for _, modName := range modNames {
+		modulePath := fmt.Sprintf("modinfo %s/lib/modules/*/%s.ko", dirName, modName)
+		command := []string{"bash", "-c", modulePath}
+
+		buff, execErr := testPod.ExecCommand(command, "test")
+		if execErr != nil {
+			errs = append(errs, fmt.Sprintf("modinfo failed for %s: %v", modName, execErr))
+
+			continue
+		}
+
+		contents := buff.String()
+		klog.V(kmmparams.KmmLogLevel).Infof("modinfo %s: %s", modName, contents)
+
+		if !strings.Contains(contents, message) {
+			errs = append(errs, fmt.Sprintf("module %s is not signed with '%s'", modName, message))
+		}
+	}
+
+	if len(errs) > 0 {
+		return fmt.Errorf("signing verification failed: %s", strings.Join(errs, "; "))
+	}
+
+	return nil
+}
+
+// ModuleNotSigned verifies that a module in an image is NOT signed with the given signer.
+func ModuleNotSigned(apiClient *clients.Settings, modName, signerCN, nsname, image string) error {
+	modulePath := fmt.Sprintf("modinfo /opt/lib/modules/*/%s.ko", modName)
+	command := []string{"bash", "-c", modulePath}
+
+	kernelVersion, err := get.KernelFullVersion(apiClient, GeneralConfig.WorkerLabelMap)
+	if err != nil {
+		return err
+	}
+
+	processedImage := strings.ReplaceAll(image, "$KERNEL_FULL_VERSION", kernelVersion)
+	testPod := pod.NewBuilder(apiClient, "unsigned-checker", nsname, processedImage)
+
+	_, err = testPod.CreateAndWaitUntilRunning(2 * time.Minute)
+	if err != nil {
+		klog.V(kmmparams.KmmLogLevel).Infof("Could not create unsigned verification pod. Got error: %v", err)
+
+		return err
+	}
+
+	buff, err := testPod.ExecCommand(command, "test")
+
+	_, _ = testPod.Delete()
+
+	if err != nil {
+		return err
+	}
+
+	contents := buff.String()
+	klog.V(kmmparams.KmmLogLevel).Infof("modinfo %s: %s", modName, contents)
+
+	if strings.Contains(contents, signerCN) {
+		return fmt.Errorf("module %s is unexpectedly signed with '%s'", modName, signerCN)
+	}
+
+	return nil
+}
+
 // IntreeModuleLoaded makes sure the needed in-tree module is present on the nodes.
 func IntreeModuleLoaded(apiClient *clients.Settings, module string, timeout time.Duration) error {
 	return runCommandOnTestPods(apiClient, []string{"modprobe", module}, "", timeout)

tests/hw-accel/kmm/internal/define/configmap.go

@@ -88,3 +88,13 @@ func KmmScannerConfigMapContents() map[string]string {
 
 	return configMapContent
 }
+
+// MultiKoConfigMapContent returns the configmap contents for building 3 kernel modules.
+func MultiKoConfigMapContent() map[string]string {
+	return map[string]string{"dockerfile": kmmparams.MultiKoContents}
+}
+
+// MultiKoCustomDirConfigMapContent returns the configmap contents for building 3 kernel modules under /custom.
+func MultiKoCustomDirConfigMapContent() map[string]string {
+	return map[string]string{"dockerfile": kmmparams.MultiKoCustomDirContents}
+}

tests/hw-accel/kmm/internal/kmmparams/const.go

@@ -139,6 +139,47 @@ RUN microdnf -y install kmod
 COPY --from=builder /etc/driver-toolkit-release.json /etc/
 COPY --from=builder /build/kmm-kmod/*.ko /opt/lib/modules/${KERNEL_FULL_VERSION}/
 RUN depmod -b /opt ${KERNEL_FULL_VERSION}
+`
+
+	// MultiKoContents represents the Dockerfile for building 3 kernel modules for glob signing tests.
+	MultiKoContents = `ARG DTK_AUTO
+FROM ${DTK_AUTO} as builder
+ARG KERNEL_VERSION
+WORKDIR /build
+RUN git clone https://github.com/cdvultur/kmm-kmod.git
+WORKDIR /build/kmm-kmod
+RUN cp kmm_ci_a.c test_mod.c
+RUN echo "obj-m += test_mod.o" >> Makefile
+RUN make KVER=${KERNEL_VERSION}
+
+FROM registry.redhat.io/ubi9/ubi-minimal
+ARG KERNEL_VERSION
+RUN microdnf -y install kmod
+
+COPY --from=builder /etc/driver-toolkit-release.json /etc/
+COPY --from=builder /build/kmm-kmod/*.ko /opt/lib/modules/${KERNEL_VERSION}/
+RUN depmod -b /opt ${KERNEL_VERSION}
+`
+
+	// MultiKoCustomDirContents represents the Dockerfile for building 3 kernel modules under /custom dir.
+	MultiKoCustomDirContents = `ARG DTK_AUTO
+FROM ${DTK_AUTO} as builder
+ARG KERNEL_VERSION
+WORKDIR /build
+RUN git clone https://github.com/cdvultur/kmm-kmod.git
+WORKDIR /build/kmm-kmod
+RUN cp kmm_ci_a.c test_mod.c
+RUN echo "obj-m += test_mod.o" >> Makefile
+RUN make KVER=${KERNEL_VERSION}
+
+FROM registry.redhat.io/ubi9/ubi-minimal
+ARG KERNEL_VERSION
+RUN microdnf -y install kmod
+
+COPY --from=builder /etc/driver-toolkit-release.json /etc/
+RUN mkdir -p /custom/lib/modules/${KERNEL_VERSION}
+COPY --from=builder /build/kmm-kmod/*.ko /custom/lib/modules/${KERNEL_VERSION}/
+RUN depmod -b /custom ${KERNEL_VERSION}
 `
 
 	//nolint:lll
@@ -256,6 +297,8 @@ const (
 	TolerationModuleTestNamespace = "79205-tol"
 	// AutomountSATokenTestNamespace represents test case namespace name for automount SA token tests.
 	AutomountSATokenTestNamespace = "automount-satoken"
+	// FilesToSignGlobTestNamespace represents test case namespace name for filesToSign glob tests.
+	FilesToSignGlobTestNamespace = "filestosign-glob"
 	// DefaultNodesNamespace represents namespace of the nodes events.
 	DefaultNodesNamespace = "default"
 	// SimpleKmodImage represents the pre-built simple-kmod kernel module image.

tests/hw-accel/kmm/modules/internal/tsparams/kmm-vars.go

@@ -31,6 +31,7 @@ var (
 		kmmparams.ScannerTestNamespace:            "module",
 		kmmparams.TolerationModuleTestNamespace:   "module",
 		kmmparams.AutomountSATokenTestNamespace:   "module",
+		kmmparams.FilesToSignGlobTestNamespace:    "module",
 		kmmparams.DefaultNodesNamespace:           "nodes",
 	}