Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Build 27 for 8.13 with status FAILURE - ExtendedWin / auditbeat-windows-11-windows-11 / TestExeObjParser/executableObject_macho_garble – github.com/elastic/beats/v7/auditbeat/module/file_integrity #38211

Closed
elasticmachine opened this issue Mar 6, 2024 · 8 comments · Fixed by #38441
Closed

Build 27 for 8.13 with status FAILURE - ExtendedWin / auditbeat-windows-11-windows-11 / TestExeObjParser/executableObject_macho_garble – github.com/elastic/beats/v7/auditbeat/module/file_integrity #38211

elasticmachine opened this issue Mar 6, 2024 · 8 comments · Fixed by #38441
Labels
automation build-failures Build failures in the CI. ci-reported Issues that have been automatically reported from the CI Team:Security-Linux Platform Linux Platform Team in Security Solution

Comments

@elasticmachine
Copy link
Collaborator

💔 Tests Failed

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2024-03-06T19:53:44.578+0000

  • Duration: 190 min 5 sec

Test stats 🧪

Test Results
Failed 2
Passed 55375
Skipped 4941
Total 60318

Test errors 2

Expand to view the tests failures

ExtendedWin / auditbeat-windows-11-windows-11 / TestExeObjParser/executableObject_macho_garble – github.com/elastic/beats/v7/auditbeat/module/file_integrity
    Expand to view the error details

     Failed

    Expand to view the stacktrace

     === RUN   TestExeObjParser/executableObject_macho_garble
    exeobjparser_test.go:50: unexpected error calling exeObjParser.Parse: open ./testdata/garble_macho_executable: The system cannot find the file specified.
    exeobjparser_test.go:76: unexpected error for garble_macho macho.import_hash: got:key not found want:<nil>
    exeobjparser_test.go:76: unexpected error for garble_macho macho.symhash: got:key not found want:<nil>
    exeobjparser_test.go:76: unexpected error for garble_macho macho.imports: got:key not found want:<nil>
    exeobjparser_test.go:76: unexpected error for garble_macho macho.imports_names_entropy: got:key not found want:<nil>
    exeobjparser_test.go:76: unexpected error for garble_macho macho.imports_names_var_entropy: got:key not found want:<nil>
    exeobjparser_test.go:76: unexpected error for garble_macho macho.go_import_hash: got:key not found want:<nil>
    exeobjparser_test.go:76: unexpected error for garble_macho macho.go_imports: got:key not found want:<nil>
    exeobjparser_test.go:76: unexpected error for garble_macho macho.go_imports_names_entropy: got:key not found want:<nil>
    exeobjparser_test.go:76: unexpected error for garble_macho macho.go_imports_names_var_entropy: got:key not found want:<nil>
    exeobjparser_test.go:76: unexpected error for garble_macho macho.go_stripped: got:key not found want:<nil>
    exeobjparser_test.go:76: unexpected error for garble_macho macho.sections: got:key not found want:<nil>
--- FAIL: TestExeObjParser/executableObject_macho_garble (0.00s)

ExtendedWin / auditbeat-windows-11-windows-11 / TestExeObjParser – github.com/elastic/beats/v7/auditbeat/module/file_integrity
    Expand to view the error details

     Failed

    Expand to view the stacktrace

     === RUN   TestExeObjParser
--- FAIL: TestExeObjParser (0.04s)

Steps errors 4

Expand to view the steps failures

auditbeat-windows-11-windows-11 - mage build unitTest
  • Took 4 min 46 sec . View more details here
  • Description: mage build unitTest
auditbeat-windows-11-windows-11 - mage build unitTest
  • Took 1 min 53 sec . View more details here
  • Description: mage build unitTest
auditbeat-windows-11-windows-11 - mage build unitTest
  • Took 1 min 48 sec . View more details here
  • Description: mage build unitTest
Error signal
  • Took 0 min 0 sec . View more details here
  • Description: Error "hudson.AbortException: script returned exit code 1"

@elasticmachine elasticmachine added automation build-failures Build failures in the CI. ci-reported Issues that have been automatically reported from the CI Team:Elastic-Agent-Data-Plane Label for the Agent Data Plane team labels Mar 6, 2024
@elasticmachine
Copy link
Collaborator Author

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

@pierrehilbert pierrehilbert changed the title Build 27 for 8.13 with status FAILURE Build 27 for 8.13 with status FAILURE - ExtendedWin / auditbeat-windows-11-windows-11 / TestExeObjParser/executableObject_macho_garble – github.com/elastic/beats/v7/auditbeat/module/file_integrity Mar 7, 2024
@pierrehilbert
Copy link
Collaborator

@nfritts could we have someone to take a look here please?

@pierrehilbert pierrehilbert added the Team:Security-Linux Platform Linux Platform Team in Security Solution label Mar 7, 2024
@elasticmachine
Copy link
Collaborator Author

Pinging @elastic/sec-linux-platform (Team:Security-Linux Platform)

@pierrehilbert pierrehilbert removed the Team:Elastic-Agent-Data-Plane Label for the Agent Data Plane team label Mar 7, 2024
This was referenced Mar 7, 2024
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
@nfritts
Copy link

nfritts commented Mar 11, 2024

Will do

@andrewkroh
Copy link
Member

open ./testdata/garble_macho_executable: The system cannot find the file specified.

IMO the most likely explanation is that some security tool (e.g. MS Defender) has quarantined the files needed for this test to execute. This file is checked into the repo and should always be present. https://github.com/elastic/beats/tree/main/auditbeat/module/file_integrity/testdata

Can we disable MS Defender on this machine?

@pierrehilbert
Copy link
Collaborator

"Funny" thing: I receive a notif this morning saying that Elastic Endpoint blocked "macho_garble"

This was referenced Mar 12, 2024
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
This was referenced Mar 17, 2024
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
andrewkroh added a commit to andrewkroh/beats that referenced this issue Mar 19, 2024
@andrewkroh
auditbeat - skip TestExeObjParser on CI
85e62bf 
TestExeObjParser fails on Windows because Defender is removing the
testdata that is required by the test. This adds a conditional test
skip for CI when those files are missing.

Closes elastic#38211
@andrewkroh andrewkroh mentioned this issue Mar 19, 2024
Merged
6 tasks
andrewkroh added a commit that referenced this issue Mar 19, 2024
@andrewkroh
auditbeat - skip TestExeObjParser on CI (#38441)
08e5936 
TestExeObjParser fails on Windows because Defender is removing the
testdata that is required by the test. This adds a conditional test
skip for CI when those files are missing.

Closes #38211
mergify bot pushed a commit that referenced this issue Mar 20, 2024
@andrewkroh @mergify
auditbeat - skip TestExeObjParser on CI (#38441)
73d3c1e 
TestExeObjParser fails on Windows because Defender is removing the
testdata that is required by the test. This adds a conditional test
skip for CI when those files are missing.

Closes #38211

(cherry picked from commit 08e5936)
mergify bot pushed a commit that referenced this issue Mar 20, 2024
@andrewkroh @mergify
auditbeat - skip TestExeObjParser on CI (#38441)
e5a324e 
TestExeObjParser fails on Windows because Defender is removing the
testdata that is required by the test. This adds a conditional test
skip for CI when those files are missing.

Closes #38211

(cherry picked from commit 08e5936)
This was referenced Mar 20, 2024
Merged
Merged
pierrehilbert pushed a commit that referenced this issue Mar 20, 2024
@mergify @andrewkroh
auditbeat - skip TestExeObjParser on CI (#38441) (#38461)
845969b 
TestExeObjParser fails on Windows because Defender is removing the
testdata that is required by the test. This adds a conditional test
skip for CI when those files are missing.

Closes #38211

(cherry picked from commit 08e5936)

Co-authored-by: Andrew Kroh <andrew.kroh@elastic.co>
pierrehilbert pushed a commit that referenced this issue Mar 20, 2024
@mergify @andrewkroh
auditbeat - skip TestExeObjParser on CI (#38441) (#38462)
df06d9f 
TestExeObjParser fails on Windows because Defender is removing the
testdata that is required by the test. This adds a conditional test
skip for CI when those files are missing.

Closes #38211

(cherry picked from commit 08e5936)

Co-authored-by: Andrew Kroh <andrew.kroh@elastic.co>
andrewkroh added a commit to andrewkroh/beats that referenced this issue Mar 26, 2024
@andrewkroh
auditbeat TestExeObjParser - fix errors.Is argument order
e64a618 
The arguments to errors.Is are in the wrong order so the check
is not working as designed and test is never skipped.

Also stop the test after exeObjParser.Parse fails.

Relates: elastic#38211
@andrewkroh andrewkroh mentioned this issue Mar 26, 2024
Merged
andrewkroh added a commit that referenced this issue Mar 26, 2024
@andrewkroh
auditbeat TestExeObjParser - fix errors.Is argument order (#38606)
cd89cc4 
The arguments to errors.Is are in the wrong order so the check
is not working as designed and test is never skipped.

Also stop the test after exeObjParser.Parse fails.

Relates: #38211
mergify bot pushed a commit that referenced this issue Mar 26, 2024
@andrewkroh @mergify
auditbeat TestExeObjParser - fix errors.Is argument order (#38606)
755054f 
The arguments to errors.Is are in the wrong order so the check
is not working as designed and test is never skipped.

Also stop the test after exeObjParser.Parse fails.

Relates: #38211
(cherry picked from commit cd89cc4)
@mergify mergify bot mentioned this issue Mar 26, 2024
Merged
andrewkroh added a commit that referenced this issue Mar 26, 2024
@mergify @andrewkroh
auditbeat TestExeObjParser - fix errors.Is argument order (#38606) (#…
2793657 
…38630)

The arguments to errors.Is are in the wrong order so the check
is not working as designed and test is never skipped.

Also stop the test after exeObjParser.Parse fails.

Relates: #38211
(cherry picked from commit cd89cc4)

Co-authored-by: Andrew Kroh <andrew.kroh@elastic.co>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
automation build-failures Build failures in the CI. ci-reported Issues that have been automatically reported from the CI Team:Security-Linux Platform Linux Platform Team in Security Solution
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

auditbeat - skip TestExeObjParser on CI andrewkroh/beats
5 participants
@pierrehilbert @andrewkroh @elasticmachine @intxgo @nfritts