From: Mimi Zohar <zohar@linux.ibm.com> To: Petr Vorel <pvorel@suse.cz>, ltp@lists.linux.it Cc: Mimi Zohar <zohar@linux.vnet.ibm.com>, Ignaz Forster <iforster@suse.de>, Fabian Vogt <FVogt@suse.com>, Weihua Du <WHDu@suse.com>, linux-integrity@vger.kernel.org Subject: Re: [PATCH 3/3] ima: Add overlay test Date: Fri, 29 Mar 2019 06:49:47 -0400 [thread overview] Message-ID: <1553856587.9420.44.camel@linux.ibm.com> (raw) In-Reply-To: <20190327161638.7407-4-pvorel@suse.cz> Hi Petr, On Wed, 2019-03-27 at 17:16 +0100, Petr Vorel wrote: > +setup() > +{ > + lower="$TST_MNTPOINT/lower" > + upper="$TST_MNTPOINT/upper" > + work="$TST_MNTPOINT/work" > + merged="$TST_MNTPOINT/merged" > + mkdir -p $lower $upper $work $merged > + > + device_backup="$TST_DEVICE" > + TST_DEVICE="overlay" > + > + fs_type_backup="$TST_FS_TYPE" > + TST_FS_TYPE="overlay" > + > + mntpoint_backup="$TST_MNTPOINT" > + TST_MNTPOINT="$merged" > + > + params_backup="$TST_MNT_PARAMS" > + TST_MNT_PARAMS="-o lowerdir=$lower,upperdir=$upper,workdir=$work" > + > + grep -q ima_appraise_tcb /proc/cmdline || \ > + tst_brk TCONF "Test requires ima_appraise_tcb kernel parameter" Instead of specifying individual policies separately, the newer method of specifying builtin IMA policies on the boot command line is "ima_policy=", with a list of policies. The builtin appraise policy would be specified as "ima_policy=appraise_tcb". Refer to Documentation/admin-guide/kernel-parameters.txt for the list of builtin policies. > +} > + > +do_test() > +{ > + local file="foo.txt" > + local f > + > + tst_mount > + mounted=1 > + > + ROD echo lower \> $lower/$file For some reason "mntpoint/lower" isn't loopback mounted. With the builtin appraise policy, because it is a tmpfs filesystem, security.ima does not exist. Writing to the merged directory then fails. + df -T mntpoint/lower Filesystem Type 1K-blocks Used Available Use% Mounted on tmpfs tmpfs 4020348 262316 3758032 7% /tmp + getfattr -m '^security' --dump mntpoint/lower/foo.txt # file: mntpoint/lower/foo.txt security.evm=0sAq8niNi4X7cYntKSAki1Woc+Y5Yq security.selinux="unconfined_u:object_r:user_tmp_t:s0" Mimi > + if ! echo overlay > $merged/$file 2>/dev/null; then > + tst_res TFAIL "Cannot write to merged layer" > + return > + fi > + > + for f in $(find $TST_MNTPOINT -type f); do > + EXPECT_PASS cat $f \> /dev/null 2\> /dev/null > + done > +}
WARNING: multiple messages have this Message-ID (diff)
From: Mimi Zohar <zohar@linux.ibm.com> To: ltp@lists.linux.it Subject: [LTP] [PATCH 3/3] ima: Add overlay test Date: Fri, 29 Mar 2019 06:49:47 -0400 [thread overview] Message-ID: <1553856587.9420.44.camel@linux.ibm.com> (raw) In-Reply-To: <20190327161638.7407-4-pvorel@suse.cz> Hi Petr, On Wed, 2019-03-27 at 17:16 +0100, Petr Vorel wrote: > +setup() > +{ > + lower="$TST_MNTPOINT/lower" > + upper="$TST_MNTPOINT/upper" > + work="$TST_MNTPOINT/work" > + merged="$TST_MNTPOINT/merged" > + mkdir -p $lower $upper $work $merged > + > + device_backup="$TST_DEVICE" > + TST_DEVICE="overlay" > + > + fs_type_backup="$TST_FS_TYPE" > + TST_FS_TYPE="overlay" > + > + mntpoint_backup="$TST_MNTPOINT" > + TST_MNTPOINT="$merged" > + > + params_backup="$TST_MNT_PARAMS" > + TST_MNT_PARAMS="-o lowerdir=$lower,upperdir=$upper,workdir=$work" > + > + grep -q ima_appraise_tcb /proc/cmdline || \ > + tst_brk TCONF "Test requires ima_appraise_tcb kernel parameter" Instead of specifying individual policies separately, the newer method of specifying builtin IMA policies on the boot command line is "ima_policy=", with a list of policies. The builtin appraise policy would be specified as "ima_policy=appraise_tcb". Refer to Documentation/admin-guide/kernel-parameters.txt for the list of builtin policies. > +} > + > +do_test() > +{ > + local file="foo.txt" > + local f > + > + tst_mount > + mounted=1 > + > + ROD echo lower \> $lower/$file For some reason "mntpoint/lower" isn't loopback mounted. With the builtin appraise policy, because it is a tmpfs filesystem, security.ima does not exist. Writing to the merged directory then fails. + df -T mntpoint/lower Filesystem Type 1K-blocks Used Available Use% Mounted on tmpfs tmpfs 4020348 262316 3758032 7% /tmp + getfattr -m '^security' --dump mntpoint/lower/foo.txt # file: mntpoint/lower/foo.txt security.evm=0sAq8niNi4X7cYntKSAki1Woc+Y5Yq security.selinux="unconfined_u:object_r:user_tmp_t:s0" Mimi > + if ! echo overlay > $merged/$file 2>/dev/null; then > + tst_res TFAIL "Cannot write to merged layer" > + return > + fi > + > + for f in $(find $TST_MNTPOINT -type f); do > + EXPECT_PASS cat $f \> /dev/null 2\> /dev/null > + done > +}
next prev parent reply other threads:[~2019-03-29 10:50 UTC|newest] Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top 2019-03-27 16:16 [PATCH 0/3] LTP reproducer on broken IMA on overlayfs Petr Vorel 2019-03-27 16:16 ` [LTP] " Petr Vorel 2019-03-27 16:16 ` [LTP] [PATCH 1/3] ima: Call test's cleanup inside ima_setup.sh cleanup Petr Vorel 2019-03-27 16:16 ` [LTP] [PATCH 2/3] shell: Add $TST_DEVICE as default parameter to tst_umount Petr Vorel 2019-03-27 16:16 ` [PATCH 3/3] ima: Add overlay test Petr Vorel 2019-03-27 16:16 ` [LTP] " Petr Vorel 2019-03-28 17:27 ` Ignaz Forster 2019-03-28 17:27 ` [LTP] " Ignaz Forster 2019-04-04 22:37 ` Petr Vorel 2019-04-04 22:37 ` [LTP] " Petr Vorel 2019-03-29 10:49 ` Mimi Zohar [this message] 2019-03-29 10:49 ` Mimi Zohar 2019-04-04 18:19 ` Petr Vorel 2019-04-04 18:19 ` [LTP] " Petr Vorel 2019-04-04 19:19 ` Mimi Zohar 2019-04-04 19:19 ` [LTP] " Mimi Zohar 2019-03-28 9:04 ` [PATCH 0/3] LTP reproducer on broken IMA on overlayfs Petr Vorel 2019-03-28 9:04 ` [LTP] " Petr Vorel
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=1553856587.9420.44.camel@linux.ibm.com \ --to=zohar@linux.ibm.com \ --cc=FVogt@suse.com \ --cc=WHDu@suse.com \ --cc=iforster@suse.de \ --cc=linux-integrity@vger.kernel.org \ --cc=ltp@lists.linux.it \ --cc=pvorel@suse.cz \ --cc=zohar@linux.vnet.ibm.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.