Repository: freedomofpress/securedrop

Issue:
Several testinfra tests failing against 1.8.0-rc1 Focal production instances:
## Description
`./securedrop-admin verify` against a 1.8.0-rc1 instance results in 11 test failures (of which 2 are expected)

```
============================================================================================= short test summary info =============================================================================================
FAILED app/test_apparmor.py::test_apparmor_enforced[paramiko:/app-xenial] - AssertionError: assert 'xenial' in '   /usr/bin/man\n   /usr/lib/NetworkManager/nm-dhcp-client.action\n   /usr/lib/NetworkManager/nm...
FAILED app/test_apparmor.py::test_apparmor_enforced[paramiko:/app-focal] - AssertionError: assert 'focal' in '   /usr/bin/man\n   /usr/lib/NetworkManager/nm-dhcp-client.action\n   /usr/lib/NetworkManager/nm-d...
FAILED app-code/test_securedrop_rqrequeue.py::test_securedrop_rqrequeue_service[paramiko:/app] - assert '[Unit]\nDesc...user.target\n' == '[Unit]\nDesc...user.target\n'
FAILED app-code/test_securedrop_rqworker.py::test_securedrop_rqworker_service[paramiko:/app] - assert '[Unit]\nDesc...user.target\n' == '[Unit]\nDesc...user.target\n'
FAILED app-code/test_securedrop_shredder_configuration.py::test_securedrop_shredder_service[paramiko:/app] - assert '[Unit]\nDesc...user.target\n' == '[Unit]\nDesc...user.target\n'
FAILED app-code/test_securedrop_source_deleter_configuration.py::test_securedrop_source_deleter_service[paramiko:/app] - assert '[Unit]\nDesc...user.target\n' == '[Unit]\nDesc...user.target\n'
FAILED app-code/test_securedrop_app_code.py::test_securedrop_application_apt_dependencies[paramiko:/app-libpython3.5] - AssertionError: assert False
(expected failure) FAILED common/test_fpf_apt_repo.py::test_fpf_apt_repo_present[paramiko:/app] - AssertionError: Unexpected exit code 2 for CommandResult(command=b"grep -qs -- '^deb \\[arch=amd64\\] https://apt\\.freedom\\.pre...
(expected failure) FAILED common/test_fpf_apt_repo.py::test_fpf_apt_repo_present[paramiko:/mon] - AssertionError: Unexpected exit code 2 for CommandResult(command=b"grep -qs -- '^deb \\[arch=amd64\\] https://apt\\.freedom\\.pre...
FAILED common/test_grsecurity.py::test_paxctld_focal[paramiko:/mon] - RuntimeError: Ansible module is only available with ansible connection backend
FAILED common/test_grsecurity.py::test_paxctld_focal[paramiko:/app] - RuntimeError: Ansible module is only available with ansible connection backend
============================================================= 11 failed, 441 passed, 7 skipped, 3 xfailed, 1 xpassed, 8 warnings in 842.46s (0:14:02) =============================================================
```



Discussion:

Resolving patch:
diff --git a/molecule/testinfra/conftest.py b/molecule/testinfra/conftest.py
--- a/molecule/testinfra/conftest.py
+++ b/molecule/testinfra/conftest.py
@@ -43,9 +43,11 @@ def securedrop_import_testinfra_vars(hostname, with_header=False):
     if testing_focal:
         hostvars['securedrop_venv_site_packages'] = hostvars["securedrop_venv_site_packages"].format("3.8")  # noqa: E501
         hostvars['python_version'] = "3.8"
+        hostvars['apparmor_enforce_actual'] = hostvars['apparmor_enforce']['focal']
     else:
         hostvars['securedrop_venv_site_packages'] = hostvars["securedrop_venv_site_packages"].format("3.5")  # noqa: E501
         hostvars['python_version'] = "3.5"
+        hostvars['apparmor_enforce_actual'] = hostvars['apparmor_enforce']['xenial']
 
     if with_header:
         hostvars = dict(securedrop_test_vars=hostvars)


Test patch:
diff --git a/molecule/testinfra/app/test_apparmor.py b/molecule/testinfra/app/test_apparmor.py
--- a/molecule/testinfra/app/test_apparmor.py
+++ b/molecule/testinfra/app/test_apparmor.py
@@ -88,7 +88,7 @@ def test_app_apparmor_complain_count(host):
         assert c == str(len(sdvars.apparmor_complain))
 
 
-@pytest.mark.parametrize('aa_enforced', sdvars.apparmor_enforce)
+@pytest.mark.parametrize('aa_enforced', sdvars.apparmor_enforce_actual)
 def test_apparmor_enforced(host, aa_enforced):
     awk = ("awk '/[0-9]+ profiles.*enforce./"
            "{flag=1;next}/^[0-9]+.*/{flag=0}flag'")
diff --git a/molecule/testinfra/common/test_automatic_updates.py b/molecule/testinfra/common/test_automatic_updates.py
--- a/molecule/testinfra/common/test_automatic_updates.py
+++ b/molecule/testinfra/common/test_automatic_updates.py
@@ -192,9 +192,7 @@ def test_unattended_upgrades_config(host):
     Ensures the 50unattended-upgrades config is correct only under Ubuntu Focal
     """
     f = host.file('/etc/apt/apt.conf.d/50unattended-upgrades')
-    if host.system_info.codename == "xenial":
-        assert not f.exists
-    else:
+    if host.system_info.codename != "xenial":
         assert f.is_file
         assert f.user == "root"
         assert f.mode == 0o644
diff --git a/molecule/testinfra/common/test_grsecurity.py b/molecule/testinfra/common/test_grsecurity.py
--- a/molecule/testinfra/common/test_grsecurity.py
+++ b/molecule/testinfra/common/test_grsecurity.py
@@ -173,7 +173,10 @@ def test_paxctld_xenial(host):
     """
     if host.system_info.codename != "xenial":
         return True
-    hostname = host.ansible.get_variables()["inventory_hostname"]
+
+    hostname = host.check_output('hostname -s')
+    assert (("app" in hostname) or ("mon" in hostname))
+
     # Under Xenial, apache2 pax flags managed by securedrop-app-code.
     if "app" not in hostname:
         return True
@@ -209,7 +212,9 @@ def test_paxctld_focal(host):
     # out of /opt/ to ensure the file is always clobbered on changes.
     assert host.file("/opt/securedrop/paxctld.conf").is_file
 
-    hostname = host.ansible.get_variables()["inventory_hostname"]
+    hostname = host.check_output('hostname -s')
+    assert (("app" in hostname) or ("mon" in hostname))
+
     # Under Focal, apache2 pax flags managed by securedrop-grsec metapackage.
     # Both hosts, app & mon, should have the same exemptions. Check precedence
     # between install-local-packages & apt-test repo for securedrop-grsec.