Make support for legacy python revocation actions optional

Cargo.toml

@@ -50,9 +50,14 @@ wiremock = "0.5"
 
 [features]
 # The features enabled by default
-default = ["with-zmq"]
+default = ["with-zmq", "legacy-python-actions"]
 # this should change to dev-dependencies when we have integration testing
 testing = []
 # Whether the agent should be compiled with support to listen for notification
 # messages on ZeroMQ
 with-zmq = ["zmq"]
+# Whether the agent should be compiled with support for python revocation
+# actions loaded as modules, which is the only kind supported by the python
+# agent (unless the enhancement-55 is implemented). See:
+# https://github.com/keylime/enhancements/blob/master/55_revocation_actions_without_python.md
+legacy-python-actions = []

src/main.rs

@@ -424,15 +424,19 @@ async fn main() -> Result<()> {
         warn!("INSECURE: Only use Keylime in this mode for testing or debugging purposes.");
     }
 
-    // Verify if the python shim is installed in the expected location
-    let python_shim =
-        PathBuf::from(&config.revocation_actions_dir).join("shim.py");
-    if !python_shim.exists() {
-        error!("Could not find python shim at {}", python_shim.display());
-        return Err(Error::Configuration(format!(
-            "Could not find python shim at {}",
-            python_shim.display()
-        )));
+    cfg_if::cfg_if! {
+        if #[cfg(feature = "legacy-python-actions")] {
+            // Verify if the python shim is installed in the expected location
+            let python_shim =
+                PathBuf::from(&config.revocation_actions_dir).join("shim.py");
+            if !python_shim.exists() {
+                error!("Could not find python shim at {}", python_shim.display());
+                return Err(Error::Configuration(format!(
+                    "Could not find python shim at {}",
+                    python_shim.display()
+                )));
+            }
+        }
     }
 
     // Gather EK values and certs

src/revocation.rs

@@ -22,6 +22,7 @@ use serde_json::Value;
 /// The lookup goes in the following order:
 /// 1. Look for pre-installed action
 /// 2. Look for the action in the tenant-provided initial payload
+/// Then, if python revocation actions are allowed:
 /// 3. Look for pre-installed Python action
 /// 4. Look for the Python action in the tenant-provided initial payload
 fn lookup_action(
@@ -44,7 +45,9 @@ fn lookup_action(
     let possible_paths = [
         (actions_dir.join(action), false, false),
         (payload_dir.join(action), false, true),
+        #[cfg(feature = "legacy-python-actions")]
         (actions_dir.join(&py_action), true, false),
+        #[cfg(feature = "legacy-python-actions")]
         (payload_dir.join(&py_action), true, true),
     ];
 
@@ -460,7 +463,7 @@ mod tests {
         assert!(outputs.is_ok());
         let outputs = outputs.unwrap(); //#[allow_ci]
 
-        assert!(outputs.len() == 4);
+        assert!(outputs.len() == 2);
 
         for output in outputs {
             assert_eq!(
@@ -506,8 +509,16 @@ mod tests {
             env!("CARGO_MANIFEST_DIR"),
             "/tests/unzipped/test_ok.json"
         );
-        test_config.revocation_actions =
-            String::from("local_action_hello, local_action_payload");
+        cfg_if::cfg_if! {
+            if #[cfg(feature = "legacy-python-actions")] {
+                test_config.revocation_actions =
+                    String::from("local_action_hello, local_action_payload, local_action_stand_alone.py, local_action_rev_script1.py");
+            } else {
+                test_config.revocation_actions = String::from(
+                    "local_action_stand_alone.py, local_action_rev_script1.py",
+                );
+            }
+        }
         let json_str = std::fs::read_to_string(json_file).unwrap(); //#[allow_ci]
         let json = serde_json::from_str(&json_str).unwrap(); //#[allow_ci]
         let actions_dir =
@@ -531,7 +542,13 @@ mod tests {
         assert!(outputs.is_ok());
         let outputs = outputs.unwrap(); //#[allow_ci]
 
-        assert!(outputs.len() == 6);
+        cfg_if::cfg_if! {
+            if #[cfg(feature = "legacy-python-actions")] {
+                assert!(outputs.len() == 6);
+            } else {
+                assert!(outputs.len() == 4);
+            }
+        }
 
         for output in outputs {
             assert_eq!(
@@ -593,19 +610,24 @@ mod tests {
         let payload_dir = Path::new(&work_dir).join("unzipped/");
         let actions_dir = Path::new(&work_dir).join("actions/");
 
-        // Test local python action
-        let expected = format!("{}", &actions_dir.join("shim.py").display(),);
-
-        assert_eq!(
-            lookup_action(
-                &payload_dir,
-                &actions_dir,
-                "local_action_hello",
-                true
-            )
-            .unwrap(), //#[allow_ci]
-            (expected, true, false)
-        );
+        cfg_if::cfg_if! {
+            if #[cfg(feature = "legacy-python-actions")] {
+                // Test local python action
+                let expected =
+                    format!("{}", &actions_dir.join("shim.py").display(),);
+
+                assert_eq!(
+                    lookup_action(
+                        &payload_dir,
+                        &actions_dir,
+                        "local_action_hello",
+                        true
+                    )
+                    .unwrap(), //#[allow_ci]
+                    (expected, true, false)
+                );
+            }
+        }
 
         // Test local non-python action
         let expected = format!(
@@ -624,19 +646,24 @@ mod tests {
             (expected, false, false)
         );
 
-        // Test payload python action
-        let expected = format!("{}", &actions_dir.join("shim.py").display(),);
-
-        assert_eq!(
-            lookup_action(
-                &payload_dir,
-                &actions_dir,
-                "local_action_payload",
-                true,
-            )
-            .unwrap(), //#[allow_ci]
-            (expected, true, true),
-        );
+        cfg_if::cfg_if! {
+            if #[cfg(feature = "legacy-python-actions")] {
+                // Test payload python action
+                let expected =
+                    format!("{}", &actions_dir.join("shim.py").display(),);
+
+                assert_eq!(
+                    lookup_action(
+                        &payload_dir,
+                        &actions_dir,
+                        "local_action_payload",
+                        true,
+                    )
+                    .unwrap(), //#[allow_ci]
+                    (expected, true, true),
+                );
+            }
+        }
 
         // Test payload non-python action
         let expected = format!(

tests/actions/local_action_stand_alone.py

@@ -0,0 +1,26 @@
+#!/usr/bin/python3
+'''
+SPDX-License-Identifier: Apache-2.0
+Copyright 2021 Keylime Authors
+'''
+
+import argparse
+import json
+import sys
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument('json_file')
+    args = parser.parse_args()
+
+    with open(args.json_file, 'r') as f:
+        input_json = json.load(f)
+        value = input_json['hello']
+
+    print(value)
+
+
+if __name__ == "__main__":
+    main()
+

tests/unzipped/action_list

@@ -1,4 +1,2 @@
 local_action_rev_script1.py
 local_action_rev_script2.py
-local_action_payload
-local_action_hello