From: Petr Vorel <pvorel@suse.cz> To: ltp@lists.linux.it Cc: Petr Vorel <pvorel@suse.cz>, Mimi Zohar <zohar@linux.vnet.ibm.com>, Ignaz Forster <iforster@suse.de>, Fabian Vogt <FVogt@suse.com>, Weihua Du <WHDu@suse.com>, linux-integrity@vger.kernel.org Subject: [PATCH 3/3] ima: Add overlay test Date: Wed, 27 Mar 2019 17:16:38 +0100 [thread overview] Message-ID: <20190327161638.7407-4-pvorel@suse.cz> (raw) In-Reply-To: <20190327161638.7407-1-pvorel@suse.cz> Based on reproducer made by Ignaz Forster <iforster@suse.de> used for his not upstreamed patchset [1] and previous report [2]. NOTE: backup variables are needed because ima_setup.sh calling tst_mount as well when TMPDIR is on tmpfs device. [1] https://www.spinics.net/lists/linux-integrity/msg05926.html [2] https://www.spinics.net/lists/linux-integrity/msg03593.html Cc: Mimi Zohar <zohar@linux.vnet.ibm.com> Cc: Ignaz Forster <iforster@suse.de> Cc: Fabian Vogt <FVogt@suse.com> Cc: Weihua Du <WHDu@suse.com> Cc: linux-integrity@vger.kernel.org Signed-off-by: Petr Vorel <pvorel@suse.cz> --- runtest/ima | 1 + .../integrity/ima/tests/ima_overlay.sh | 65 +++++++++++++++++++ .../security/integrity/ima/tests/ima_setup.sh | 4 +- 3 files changed, 68 insertions(+), 2 deletions(-) create mode 100755 testcases/kernel/security/integrity/ima/tests/ima_overlay.sh diff --git a/runtest/ima b/runtest/ima index bcae16bb7..f96711a7d 100644 --- a/runtest/ima +++ b/runtest/ima @@ -3,3 +3,4 @@ ima_measurements ima_measurements.sh ima_policy ima_policy.sh ima_tpm ima_tpm.sh ima_violations ima_violations.sh +ima_overlay ima_overlay.sh diff --git a/testcases/kernel/security/integrity/ima/tests/ima_overlay.sh b/testcases/kernel/security/integrity/ima/tests/ima_overlay.sh new file mode 100755 index 000000000..eedcd3753 --- /dev/null +++ b/testcases/kernel/security/integrity/ima/tests/ima_overlay.sh @@ -0,0 +1,65 @@ +#!/bin/sh +# Copyright (c) 2019 Petr Vorel <pvorel@suse.cz> +# Based on reproducer made by Ignaz Forster <iforster@suse.de> + +TST_SETUP="setup" +TST_CLEANUP="cleanup" +. ima_setup.sh +TST_TESTFUNC="do_test" + +setup() +{ + lower="$TST_MNTPOINT/lower" + upper="$TST_MNTPOINT/upper" + work="$TST_MNTPOINT/work" + merged="$TST_MNTPOINT/merged" + mkdir -p $lower $upper $work $merged + + device_backup="$TST_DEVICE" + TST_DEVICE="overlay" + + fs_type_backup="$TST_FS_TYPE" + TST_FS_TYPE="overlay" + + mntpoint_backup="$TST_MNTPOINT" + TST_MNTPOINT="$merged" + + params_backup="$TST_MNT_PARAMS" + TST_MNT_PARAMS="-o lowerdir=$lower,upperdir=$upper,workdir=$work" + + grep -q ima_appraise_tcb /proc/cmdline || \ + tst_brk TCONF "Test requires ima_appraise_tcb kernel parameter" +} + +do_test() +{ + local file="foo.txt" + local f + + tst_mount + mounted=1 + + ROD echo lower \> $lower/$file + if ! echo overlay > $merged/$file 2>/dev/null; then + tst_res TFAIL "Cannot write to merged layer" + return + fi + + for f in $(find $TST_MNTPOINT -type f); do + EXPECT_PASS cat $f \> /dev/null 2\> /dev/null + done +} + +cleanup() +{ + [ -n "$mounted" ] || return 0 + + tst_umount $TST_DEVICE + + TST_DEVICE="$device_backup" + TST_FS_TYPE="$fs_type_backup" + TST_MNTPOINT="$mntpoint_backup" + TST_MNT_PARAMS="$params_backup" +} + +tst_run diff --git a/testcases/kernel/security/integrity/ima/tests/ima_setup.sh b/testcases/kernel/security/integrity/ima/tests/ima_setup.sh index da49eb1b2..08aa5300a 100644 --- a/testcases/kernel/security/integrity/ima/tests/ima_setup.sh +++ b/testcases/kernel/security/integrity/ima/tests/ima_setup.sh @@ -64,14 +64,14 @@ print_ima_config() local config="/boot/config-$(uname -r)" local i - tst_res TINFO "/proc/cmdline: $(cat /proc/cmdline)" - if [ -r "$config" ]; then tst_res TINFO "IMA kernel config:" for i in $(grep ^CONFIG_IMA $config); do tst_res TINFO "$i" done fi + + tst_res TINFO "/proc/cmdline: $(cat /proc/cmdline)" } ima_setup() -- 2.21.0
WARNING: multiple messages have this Message-ID (diff)
From: Petr Vorel <pvorel@suse.cz> To: ltp@lists.linux.it Subject: [LTP] [PATCH 3/3] ima: Add overlay test Date: Wed, 27 Mar 2019 17:16:38 +0100 [thread overview] Message-ID: <20190327161638.7407-4-pvorel@suse.cz> (raw) In-Reply-To: <20190327161638.7407-1-pvorel@suse.cz> Based on reproducer made by Ignaz Forster <iforster@suse.de> used for his not upstreamed patchset [1] and previous report [2]. NOTE: backup variables are needed because ima_setup.sh calling tst_mount as well when TMPDIR is on tmpfs device. [1] https://www.spinics.net/lists/linux-integrity/msg05926.html [2] https://www.spinics.net/lists/linux-integrity/msg03593.html Cc: Mimi Zohar <zohar@linux.vnet.ibm.com> Cc: Ignaz Forster <iforster@suse.de> Cc: Fabian Vogt <FVogt@suse.com> Cc: Weihua Du <WHDu@suse.com> Cc: linux-integrity@vger.kernel.org Signed-off-by: Petr Vorel <pvorel@suse.cz> --- runtest/ima | 1 + .../integrity/ima/tests/ima_overlay.sh | 65 +++++++++++++++++++ .../security/integrity/ima/tests/ima_setup.sh | 4 +- 3 files changed, 68 insertions(+), 2 deletions(-) create mode 100755 testcases/kernel/security/integrity/ima/tests/ima_overlay.sh diff --git a/runtest/ima b/runtest/ima index bcae16bb7..f96711a7d 100644 --- a/runtest/ima +++ b/runtest/ima @@ -3,3 +3,4 @@ ima_measurements ima_measurements.sh ima_policy ima_policy.sh ima_tpm ima_tpm.sh ima_violations ima_violations.sh +ima_overlay ima_overlay.sh diff --git a/testcases/kernel/security/integrity/ima/tests/ima_overlay.sh b/testcases/kernel/security/integrity/ima/tests/ima_overlay.sh new file mode 100755 index 000000000..eedcd3753 --- /dev/null +++ b/testcases/kernel/security/integrity/ima/tests/ima_overlay.sh @@ -0,0 +1,65 @@ +#!/bin/sh +# Copyright (c) 2019 Petr Vorel <pvorel@suse.cz> +# Based on reproducer made by Ignaz Forster <iforster@suse.de> + +TST_SETUP="setup" +TST_CLEANUP="cleanup" +. ima_setup.sh +TST_TESTFUNC="do_test" + +setup() +{ + lower="$TST_MNTPOINT/lower" + upper="$TST_MNTPOINT/upper" + work="$TST_MNTPOINT/work" + merged="$TST_MNTPOINT/merged" + mkdir -p $lower $upper $work $merged + + device_backup="$TST_DEVICE" + TST_DEVICE="overlay" + + fs_type_backup="$TST_FS_TYPE" + TST_FS_TYPE="overlay" + + mntpoint_backup="$TST_MNTPOINT" + TST_MNTPOINT="$merged" + + params_backup="$TST_MNT_PARAMS" + TST_MNT_PARAMS="-o lowerdir=$lower,upperdir=$upper,workdir=$work" + + grep -q ima_appraise_tcb /proc/cmdline || \ + tst_brk TCONF "Test requires ima_appraise_tcb kernel parameter" +} + +do_test() +{ + local file="foo.txt" + local f + + tst_mount + mounted=1 + + ROD echo lower \> $lower/$file + if ! echo overlay > $merged/$file 2>/dev/null; then + tst_res TFAIL "Cannot write to merged layer" + return + fi + + for f in $(find $TST_MNTPOINT -type f); do + EXPECT_PASS cat $f \> /dev/null 2\> /dev/null + done +} + +cleanup() +{ + [ -n "$mounted" ] || return 0 + + tst_umount $TST_DEVICE + + TST_DEVICE="$device_backup" + TST_FS_TYPE="$fs_type_backup" + TST_MNTPOINT="$mntpoint_backup" + TST_MNT_PARAMS="$params_backup" +} + +tst_run diff --git a/testcases/kernel/security/integrity/ima/tests/ima_setup.sh b/testcases/kernel/security/integrity/ima/tests/ima_setup.sh index da49eb1b2..08aa5300a 100644 --- a/testcases/kernel/security/integrity/ima/tests/ima_setup.sh +++ b/testcases/kernel/security/integrity/ima/tests/ima_setup.sh @@ -64,14 +64,14 @@ print_ima_config() local config="/boot/config-$(uname -r)" local i - tst_res TINFO "/proc/cmdline: $(cat /proc/cmdline)" - if [ -r "$config" ]; then tst_res TINFO "IMA kernel config:" for i in $(grep ^CONFIG_IMA $config); do tst_res TINFO "$i" done fi + + tst_res TINFO "/proc/cmdline: $(cat /proc/cmdline)" } ima_setup() -- 2.21.0
next prev parent reply other threads:[~2019-03-27 16:16 UTC|newest] Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top 2019-03-27 16:16 [PATCH 0/3] LTP reproducer on broken IMA on overlayfs Petr Vorel 2019-03-27 16:16 ` [LTP] " Petr Vorel 2019-03-27 16:16 ` [LTP] [PATCH 1/3] ima: Call test's cleanup inside ima_setup.sh cleanup Petr Vorel 2019-03-27 16:16 ` [LTP] [PATCH 2/3] shell: Add $TST_DEVICE as default parameter to tst_umount Petr Vorel 2019-03-27 16:16 ` Petr Vorel [this message] 2019-03-27 16:16 ` [LTP] [PATCH 3/3] ima: Add overlay test Petr Vorel 2019-03-28 17:27 ` Ignaz Forster 2019-03-28 17:27 ` [LTP] " Ignaz Forster 2019-04-04 22:37 ` Petr Vorel 2019-04-04 22:37 ` [LTP] " Petr Vorel 2019-03-29 10:49 ` Mimi Zohar 2019-03-29 10:49 ` [LTP] " Mimi Zohar 2019-04-04 18:19 ` Petr Vorel 2019-04-04 18:19 ` [LTP] " Petr Vorel 2019-04-04 19:19 ` Mimi Zohar 2019-04-04 19:19 ` [LTP] " Mimi Zohar 2019-03-28 9:04 ` [PATCH 0/3] LTP reproducer on broken IMA on overlayfs Petr Vorel 2019-03-28 9:04 ` [LTP] " Petr Vorel
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20190327161638.7407-4-pvorel@suse.cz \ --to=pvorel@suse.cz \ --cc=FVogt@suse.com \ --cc=WHDu@suse.com \ --cc=iforster@suse.de \ --cc=linux-integrity@vger.kernel.org \ --cc=ltp@lists.linux.it \ --cc=zohar@linux.vnet.ibm.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.