Add LVBS prod unsigned security profile

lisa/features/security_profile.py

@@ -16,13 +16,15 @@
 
 class SecurityProfileType(str, Enum):
     Standard = constants.SECURITY_PROFILE_NONE
+    LvbsProdUnsigned = constants.SECURITY_PROFILE_LVBS_PROD_UNSIGNED
     CVM = constants.SECURITY_PROFILE_CVM
     Stateless = constants.SECURITY_PROFILE_STATELESS
     SecureBoot = constants.SECURITY_PROFILE_BOOT
 
 
 security_profile_priority: List[SecurityProfileType] = [
     SecurityProfileType.Standard,
+    SecurityProfileType.LvbsProdUnsigned,
     SecurityProfileType.SecureBoot,
     SecurityProfileType.CVM,
     SecurityProfileType.Stateless,
@@ -42,6 +44,7 @@ class SecurityProfileSettings(schema.FeatureSettings):
             search_space.SetSpace,
             items=[
                 SecurityProfileType.Standard,
+                SecurityProfileType.LvbsProdUnsigned,
                 SecurityProfileType.SecureBoot,
                 SecurityProfileType.CVM,
                 SecurityProfileType.Stateless,
@@ -53,6 +56,7 @@ class SecurityProfileSettings(schema.FeatureSettings):
                 base_type=SecurityProfileType,
                 default_values=[
                     SecurityProfileType.Standard,
+                    SecurityProfileType.LvbsProdUnsigned,
                     SecurityProfileType.SecureBoot,
                     SecurityProfileType.CVM,
                     SecurityProfileType.Stateless,
@@ -156,7 +160,12 @@ def enabled(self) -> bool:
 CvmDisabled = partial(
     SecurityProfileSettings,
     security_profile=search_space.SetSpace(
-        True, [SecurityProfileType.Standard, SecurityProfileType.SecureBoot]
+        True,
+        [
+            SecurityProfileType.Standard,
+            SecurityProfileType.LvbsProdUnsigned,
+            SecurityProfileType.SecureBoot,
+        ],
     ),
     encrypt_disk=search_space.SetSpace(True, [False]),
 )

lisa/sut_orchestrator/azure/common.py

@@ -284,6 +284,7 @@ class AzureImageSchema(schema.ImageSchema):
                 is_allow_set=True,
                 default_values=[
                     SecurityProfileType.Standard,
+                    SecurityProfileType.LvbsProdUnsigned,
                     SecurityProfileType.SecureBoot,
                     SecurityProfileType.CVM,
                     SecurityProfileType.Stateless,
@@ -379,7 +380,11 @@ def _parse_security_profile(
         encrypt_capability: List[bool] = [False]
         if security_profile in ["TrustedLaunchSupported", "TrustedLaunch"]:
             security_profile_capabilities.extend(
-                [SecurityProfileType.Standard, SecurityProfileType.SecureBoot]
+                [
+                    SecurityProfileType.Standard,
+                    SecurityProfileType.LvbsProdUnsigned,
+                    SecurityProfileType.SecureBoot,
+                ]
             )
         elif (
             security_profile == "TrustedLaunchAndConfidentialVmSupported"
@@ -388,6 +393,7 @@ def _parse_security_profile(
             security_profile_capabilities.extend(
                 [
                     SecurityProfileType.Standard,
+                    SecurityProfileType.LvbsProdUnsigned,
                     SecurityProfileType.SecureBoot,
                     SecurityProfileType.CVM,
                     SecurityProfileType.Stateless,
@@ -587,6 +593,7 @@ def load_from_platform(self, platform: "AzurePlatform") -> None:
                 [
                     SecurityProfileType.CVM,
                     SecurityProfileType.Stateless,
+                    SecurityProfileType.LvbsProdUnsigned,
                     SecurityProfileType.SecureBoot,
                 ],
             )
@@ -596,6 +603,7 @@ def load_from_platform(self, platform: "AzurePlatform") -> None:
                 True,
                 [
                     SecurityProfileType.Standard,
+                    SecurityProfileType.LvbsProdUnsigned,
                     SecurityProfileType.SecureBoot,
                 ],
             )

lisa/sut_orchestrator/azure/features.py

@@ -2875,6 +2875,9 @@ def create_setting(
                 and ("V2" in str(gen_value))
                 and raw_capabilities.get("TrustedLaunchDisabled", "False") == "False"
             ):
+                security_profile_capabilities.append(
+                    SecurityProfileType.LvbsProdUnsigned
+                )
                 security_profile_capabilities.append(SecurityProfileType.SecureBoot)
 
         if cvm_value and cvm_value.casefold() == "snp":
@@ -2936,6 +2939,10 @@ def on_before_deployment(cls, *args: Any, **kwargs: Any) -> None:
             is_vhd = bool(node_parameters.vhd)
             if SecurityProfileType.Standard == settings.security_profile:
                 node_parameters.security_profile["security_type"] = ""
+            elif SecurityProfileType.LvbsProdUnsigned == settings.security_profile:
+                node_parameters.security_profile["secure_boot"] = False
+                node_parameters.security_profile["security_type"] = "TrustedLaunch"
+                node_parameters.security_profile["encryption_type"] = "TrustedLaunch"
             elif SecurityProfileType.SecureBoot == settings.security_profile:
                 node_parameters.security_profile["secure_boot"] = True
                 node_parameters.security_profile["security_type"] = "TrustedLaunch"

lisa/util/constants.py

@@ -116,6 +116,7 @@
 
 SECURITY_PROFILE_NONE = "none"
 SECURITY_PROFILE_BOOT = "secureboot"
+SECURITY_PROFILE_LVBS_PROD_UNSIGNED = "lvbs-prod-unsigned"
 SECURITY_PROFILE_CVM = "cvm"
 SECURITY_PROFILE_STATELESS = "stateless"
 

selftests/azure/test_security_profile.py

@@ -0,0 +1,104 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT license.
+
+from types import SimpleNamespace
+from unittest.case import TestCase
+from unittest.mock import Mock
+
+from lisa import search_space
+from lisa.features.security_profile import SecurityProfileType
+from lisa.sut_orchestrator.azure.common import (
+    AzureArmParameter,
+    AzureImageSchema,
+    AzureNodeArmParameter,
+)
+from lisa.sut_orchestrator.azure.features import (
+    SecurityProfile,
+    SecurityProfileSettings,
+)
+
+
+class AzureSecurityProfileTestCase(TestCase):
+    def test_lvbs_prod_unsigned_decodes(self) -> None:
+        settings = SecurityProfileSettings.from_dict(
+            {"security_profile": "lvbs-prod-unsigned"}
+        )
+
+        self.assertEqual(
+            SecurityProfileType.LvbsProdUnsigned, settings.security_profile
+        )
+
+    def test_trusted_launch_image_supports_lvbs_prod_unsigned(self) -> None:
+        image = AzureImageSchema()
+
+        image._parse_security_profile(
+            {"SecurityType": "TrustedLaunchSupported"}, Mock()
+        )
+
+        self.assertIsInstance(image.security_profile, search_space.SetSpace)
+        self.assertIn(
+            SecurityProfileType.LvbsProdUnsigned, image.security_profile.items
+        )
+
+    def test_trusted_launch_vm_size_supports_lvbs_prod_unsigned(self) -> None:
+        settings = SecurityProfile.create_setting(
+            raw_capabilities={
+                "HyperVGenerations": "V1,V2",
+                "TrustedLaunchDisabled": "False",
+            },
+            resource_sku=SimpleNamespace(family="standarddasv5family"),
+        )
+
+        self.assertIsInstance(settings, SecurityProfileSettings)
+        self.assertIsInstance(settings.security_profile, search_space.SetSpace)
+        self.assertIn(
+            SecurityProfileType.LvbsProdUnsigned,
+            settings.security_profile.items,
+        )
+
+    def test_lvbs_prod_unsigned_disables_secure_boot(self) -> None:
+        settings = SecurityProfileSettings(
+            security_profile=SecurityProfileType.LvbsProdUnsigned,
+            encrypt_disk=False,
+        )
+        node = SimpleNamespace(
+            capability=SimpleNamespace(features=SimpleNamespace(items=[settings]))
+        )
+        environment = SimpleNamespace(nodes=SimpleNamespace(_list=[node]))
+        node_parameters = AzureNodeArmParameter()
+        arm_parameters = AzureArmParameter(nodes=[node_parameters])
+
+        SecurityProfile.on_before_deployment(
+            environment=environment, arm_parameters=arm_parameters
+        )
+
+        self.assertEqual(
+            {
+                "secure_boot": False,
+                "security_type": "TrustedLaunch",
+                "encryption_type": "TrustedLaunch",
+                "disk_encryption_set_id": "",
+            },
+            node_parameters.security_profile,
+        )
+
+    def test_secure_boot_profile_remains_enabled(self) -> None:
+        settings = SecurityProfileSettings(
+            security_profile=SecurityProfileType.SecureBoot,
+            encrypt_disk=False,
+        )
+        node = SimpleNamespace(
+            capability=SimpleNamespace(features=SimpleNamespace(items=[settings]))
+        )
+        environment = SimpleNamespace(nodes=SimpleNamespace(_list=[node]))
+        node_parameters = AzureNodeArmParameter()
+        arm_parameters = AzureArmParameter(nodes=[node_parameters])
+
+        SecurityProfile.on_before_deployment(
+            environment=environment, arm_parameters=arm_parameters
+        )
+
+        self.assertTrue(node_parameters.security_profile["secure_boot"])
+        self.assertEqual(
+            "TrustedLaunch", node_parameters.security_profile["security_type"]
+        )