From 28a1975396076dda45e614d14da1170b23f497c1 Mon Sep 17 00:00:00 2001
From: Paul Meyer <katexochen0@gmail.com>
Date: Fri, 11 Sep 2026 11:48:34 +0200
Subject: [PATCH] test: coco credential transport on snp

Check that credentials passed via systemd-vmspawn --set-credential and
on the command line via systemd.set_credential= are successfully
delivered on a SNP coco guest.

Signed-off-by: Paul Meyer <katexochen0@gmail.com>
---
 test/units/TEST-94-COCO.snp-direct.sh | 13 ++++++++++---
 test/units/TEST-94-COCO.tdx-direct.sh |  2 +-
 test/units/TEST-94-COCO/fixtures.sh   | 22 ++++++++++++++++++++++
 test/units/TEST-94-COCO/guest-test.sh | 21 ++++++++++++++++++++-
 test/units/TEST-94-COCO/lib.sh        |  9 ++++++---
 5 files changed, 59 insertions(+), 8 deletions(-)
 create mode 100644 test/units/TEST-94-COCO/fixtures.sh

diff --git a/test/units/TEST-94-COCO.snp-direct.sh b/test/units/TEST-94-COCO.snp-direct.sh
index 32dda28cea..3bb9bda902 100755
--- a/test/units/TEST-94-COCO.snp-direct.sh
+++ b/test/units/TEST-94-COCO.snp-direct.sh
@@ -24,9 +24,16 @@ at_exit() {
 }
 trap at_exit EXIT
 
-vmspawn_boot_coco "$MACHINE" "$COCO_TYPE" "$WORKDIR" "" \
+# General test case for SNP direct boot, covers:
+#
+# - detect_virt: systemd-detect-virt --cvm detects SNP as the CVM type
+# - creds_vmspawn: credential transport by vmspawn is working (via initrd for SNP)
+# - creds_cmdline: credential transport via cmdline is working (cmdline is measured on SNP)
+vmspawn_boot_coco "$MACHINE" "$COCO_TYPE" "$WORKDIR" 'detect_virt creds_vmspawn creds_cmdline' \
     --image="$IMAGE_DIR/image.raw" \
     --linux="$IMAGE_DIR/image.vmlinuz" \
     --initrd="$IMAGE_DIR/image.initrd" \
-    selinux=0 systemd.firstboot=no rw
-echo "SEV-SNP direct-boot guest correctly reported confidential virtualization"
+    --set-credential="$COCO_CRED_TRUSTED_ID:$COCO_CRED_TRUSTED_VALUE" \
+    selinux=0 systemd.firstboot=no rw \
+    "systemd.set_credential=$COCO_CRED_CMDLINE_ID:$COCO_CRED_CMDLINE_VALUE"
+echo "SEV-SNP direct-boot guest correctly reported confidential virtualization and trusted credentials"
diff --git a/test/units/TEST-94-COCO.tdx-direct.sh b/test/units/TEST-94-COCO.tdx-direct.sh
index e378bb3ca1..3999ea96d0 100755
--- a/test/units/TEST-94-COCO.tdx-direct.sh
+++ b/test/units/TEST-94-COCO.tdx-direct.sh
@@ -24,7 +24,7 @@ at_exit() {
 }
 trap at_exit EXIT
 
-vmspawn_boot_coco "$MACHINE" "$COCO_TYPE" "$WORKDIR" "" \
+vmspawn_boot_coco "$MACHINE" "$COCO_TYPE" "$WORKDIR" 'detect_virt' \
     --image="$IMAGE_DIR/image.raw" \
     --linux="$IMAGE_DIR/image.vmlinuz" \
     --initrd="$IMAGE_DIR/image.initrd" \
diff --git a/test/units/TEST-94-COCO/fixtures.sh b/test/units/TEST-94-COCO/fixtures.sh
new file mode 100644
index 0000000000..c690537b18
--- /dev/null
+++ b/test/units/TEST-94-COCO/fixtures.sh
@@ -0,0 +1,22 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+# shellcheck shell=bash
+# Every constant here is consumed by whichever side sources this file, never by this file itself.
+# shellcheck disable=SC2034
+#
+# Fixtures for the confidential computing integration test (TEST-94-COCO). Shared by the host-side
+# boot scenarios, which deliver these credentials over trusted and untrusted channels alike, and by
+# the guest-side checks, which assert where each one ended up, so the two sides cannot drift apart.
+
+if [[ "${BASH_SOURCE[0]}" -ef "$0" ]]; then
+    echo >&2 "This file should not be executed directly"
+    exit 1
+fi
+
+# Name of the guest self-check unit lib.sh injects.
+COCO_GUEST_UNIT="coco-guest.service"
+
+# Credentials by channel
+COCO_CRED_TRUSTED_ID="coco.trusted"
+COCO_CRED_TRUSTED_VALUE="trusted-via-vmspawn"
+COCO_CRED_CMDLINE_ID="coco.cmdline"
+COCO_CRED_CMDLINE_VALUE="trusted-via-cmdline"
diff --git a/test/units/TEST-94-COCO/guest-test.sh b/test/units/TEST-94-COCO/guest-test.sh
index 3c8826422d..b7778c07db 100644
--- a/test/units/TEST-94-COCO/guest-test.sh
+++ b/test/units/TEST-94-COCO/guest-test.sh
@@ -3,15 +3,34 @@
 #
 # Guest-side checks for the confidential computing integration test (TEST-94-COCO). Sourced by
 # guest-test-runner.sh inside the confidential guest; each testcase_coco_* function is one
-# sub-subtest. The upcoming credential-trust checks land here as further functions.
+# sub-subtest, and a boot scenario names the checks it requires via $COCO_TESTCASES.
 
 if [[ "${BASH_SOURCE[0]}" -ef "$0" ]]; then
     echo >&2 "This file should not be executed directly"
     exit 1
 fi
 
+# shellcheck source=test/units/TEST-94-COCO/fixtures.sh
+. "$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")/fixtures.sh"
+
 # Assert the guest observes the confidential-virtualization technology the host launched it with.
 # COCO_TYPE is provided by the injected guest unit (Environment=, see lib.sh).
 testcase_coco_detect_virt() {
     assert_eq "$(systemd-detect-virt --cvm)" "${COCO_TYPE:?}"
 }
+
+# Assert a credential handed to systemd-vmspawn --set-credential lands in the trusted bucket.
+#
+# SNP: creds should be delivered via the initrd cpio channel.
+testcase_coco_creds_vmspawn() {
+    assert_eq "$(systemd-creds --system cat "$COCO_CRED_TRUSTED_ID")" "$COCO_CRED_TRUSTED_VALUE"
+    assert_not_in "$COCO_CRED_TRUSTED_ID" "$(</proc/cmdline)"
+}
+
+# Assert a credential passed on the kernel command line lands in the trusted bucket.
+#
+# Credentials passed on the cmdline should be accepted on every coco platform.
+testcase_coco_creds_cmdline() {
+    assert_in "systemd.set_credential=$COCO_CRED_CMDLINE_ID:$COCO_CRED_CMDLINE_VALUE" "$(</proc/cmdline)"
+    assert_eq "$(systemd-creds --system cat "$COCO_CRED_CMDLINE_ID")" "$COCO_CRED_CMDLINE_VALUE"
+}
diff --git a/test/units/TEST-94-COCO/lib.sh b/test/units/TEST-94-COCO/lib.sh
index e4e8166228..e67635e7da 100644
--- a/test/units/TEST-94-COCO/lib.sh
+++ b/test/units/TEST-94-COCO/lib.sh
@@ -9,6 +9,9 @@ if [[ "${BASH_SOURCE[0]}" -ef "$0" ]]; then
     exit 1
 fi
 
+# shellcheck source=test/units/TEST-94-COCO/fixtures.sh
+. "$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")/fixtures.sh"
+
 # Exit status the guest test runner reports on success (its unit's SuccessActionExitStatus=). vmspawn
 # forwards the guest PID1's EXIT_STATUS over the vsock notify socket and exits with it.
 _COCO_GUEST_PASS=123
@@ -44,8 +47,8 @@ EOF
 _coco_guest_dropin() {
     cat <<EOF
 [Unit]
-Wants=coco-guest.service
-After=coco-guest.service
+Wants=$COCO_GUEST_UNIT
+After=$COCO_GUEST_UNIT
 EOF
 }
 
@@ -83,7 +86,7 @@ vmspawn_boot_coco() {
         --ephemeral \
         --tpm=no \
         --console=read-only \
-        --set-credential="systemd.extra-unit.coco-guest.service:$guest_unit" \
+        --set-credential="systemd.extra-unit.$COCO_GUEST_UNIT:$guest_unit" \
         --set-credential="systemd.unit-dropin.multi-user.target:$guest_dropin" \
         "$@" \
         2>&1 | tee "$console" || rc="${PIPESTATUS[0]}"