// docs

Self-test

redder-selftest checks, from inside the booted system, that the protections are actually active. It runs from the Self-test and shut down GRUB entry (redderos.selftest=1), prints each check with ✔ or ✘ and finishes with:

text

===== RESULTADO: PASS =====

or FAIL if any check fails. It then shuts the computer down. The published results are under Transparency.

What it checks

Block	Check
General status	Everything in `redder-status`: Tor, firewall, lockdown, AppArmor, IPv6, root in RAM, swap and MAC.
sysctl	Every key in the hardening file has the expected value.
Modules	`dccp`, `sctp`, `tipc`, `bluetooth`, `firewire-core`, `thunderbolt` and `cramfs` cannot be loaded.
Amnesia	Core dumps set to 0 and the journal kept in RAM only.
Privileges	`anon` does not have `sudo`.
Computer's disk	No partition on the computer's disk is mounted.
Tor	Listening on ports 9040, 9050 and 5353.
Leaks	As `anon`: a direct TCP connection and a DNS query end up in Tor (the firewall counters go up); `ping` does not get out; a direct UDP packet is dropped and logged.

Profiles across two boots

With redderos.selftest.profiles=create or =check and a test disk at /dev/vdb, the self-test also tests profiles:

First boot (create)

It initialises the vault and creates a profile in slot 5.
The profile's user writes a file in their /home and owns it.
When the profile is closed, the user disappears from the system.
Zero knowledge: blkid recognises nothing on the disk or in any of the 8 slots (neither LUKS nor ext4); neither the name, the label nor the file's contents appear in plain text; no trace is left in /etc/passwd, /etc/shadow or /etc/group.

Second boot (check)

The system does not know the profile exists before it is opened.
A wrong passphrase and a non-existent profile give exactly the same error, and nothing is mounted with the wrong passphrase.
With the right passphrase it opens and the file from the first boot is still there.
/home is mounted with nosuid and nodev.

Tests in QEMU

In the tests/ folder of the OS source code. They need qemu-system-x86; for UEFI, ovmf; for the graphical test, socat and ImageMagick.

First, an ISO that boots the self-test by default:

sudo BASE=ubuntu GRUB_DEFAULT=3 ISO_NAME=redderos-selftest ./build.sh

Script	What it does
`tests/run-qemu.sh`	Boots the ISO on BIOS and on UEFI with a "computer" disk that has a swap partition, and checks that the result is `PASS` (and that the swap is not used).
`tests/run-profiles.sh`	The two profile boots on the same 320 MB vault.
`tests/run-gui.sh`	Boots the normal GRUB entry with a standard VGA card, waits for the login screen, tries a wrong passphrase and then the right one, and saves screenshots.

tests/run-qemu.sh out/redderos-selftest.iso
tests/run-profiles.sh out/redderos-selftest.iso work/iso/casper
tests/run-gui.sh out/redderos-ubuntu-amd64.iso tests/logs/vault.img

Logs and screenshots are saved in tests/logs/.

What the self-test does not cover

It runs in QEMU, with a simulated network. It does not test Tor bootstrapping on a real network, or physical hardware (Wi-Fi, graphics, Secure Boot). The list of outstanding items is under Transparency.