* [PATCH 0/3] LTP reproducer on broken IMA on overlayfs
@ 2019-03-27 16:16 ` Petr Vorel
0 siblings, 0 replies; 18+ messages in thread
From: Petr Vorel @ 2019-03-27 16:16 UTC (permalink / raw)
To: ltp
Cc: Petr Vorel, Mimi Zohar, Ignaz Forster, Fabian Vogt, Weihua Du,
linux-integrity
Hi,
based on reproducer made by Ignaz Forster <iforster@suse.de>
used for his not upstreamed patchset [1] and previous report [2].
Mimi: does this test make sense to you?
[1] https://www.spinics.net/lists/linux-integrity/msg05926.html
[2] https://www.spinics.net/lists/linux-integrity/msg03593.html
Cc: Mimi Zohar <zohar@linux.vnet.ibm.com>
Cc: Ignaz Forster <iforster@suse.de>
Cc: Fabian Vogt <FVogt@suse.com>
Cc: Weihua Du <WHDu@suse.com>
Cc: linux-integrity@vger.kernel.org
Petr Vorel (3):
ima: Call test's cleanup inside ima_setup.sh cleanup
shell: Add $TST_DEVICE as default parameter to tst_umount
ima: Add overlay test
doc/test-writing-guidelines.txt | 4 +-
runtest/ima | 1 +
testcases/commands/df/df01.sh | 7 +-
testcases/commands/mkfs/mkfs01.sh | 2 +-
.../integrity/ima/tests/ima_overlay.sh | 65 +++++++++++++++++++
.../security/integrity/ima/tests/ima_setup.sh | 12 ++--
.../integrity/ima/tests/ima_violations.sh | 2 -
testcases/lib/tst_test.sh | 2 +-
8 files changed, 79 insertions(+), 16 deletions(-)
create mode 100755 testcases/kernel/security/integrity/ima/tests/ima_overlay.sh
--
2.21.0
^ permalink raw reply [flat|nested] 18+ messages in thread
* [LTP] [PATCH 0/3] LTP reproducer on broken IMA on overlayfs
@ 2019-03-27 16:16 ` Petr Vorel
0 siblings, 0 replies; 18+ messages in thread
From: Petr Vorel @ 2019-03-27 16:16 UTC (permalink / raw)
To: ltp
Hi,
based on reproducer made by Ignaz Forster <iforster@suse.de>
used for his not upstreamed patchset [1] and previous report [2].
Mimi: does this test make sense to you?
[1] https://www.spinics.net/lists/linux-integrity/msg05926.html
[2] https://www.spinics.net/lists/linux-integrity/msg03593.html
Cc: Mimi Zohar <zohar@linux.vnet.ibm.com>
Cc: Ignaz Forster <iforster@suse.de>
Cc: Fabian Vogt <FVogt@suse.com>
Cc: Weihua Du <WHDu@suse.com>
Cc: linux-integrity@vger.kernel.org
Petr Vorel (3):
ima: Call test's cleanup inside ima_setup.sh cleanup
shell: Add $TST_DEVICE as default parameter to tst_umount
ima: Add overlay test
doc/test-writing-guidelines.txt | 4 +-
runtest/ima | 1 +
testcases/commands/df/df01.sh | 7 +-
testcases/commands/mkfs/mkfs01.sh | 2 +-
.../integrity/ima/tests/ima_overlay.sh | 65 +++++++++++++++++++
.../security/integrity/ima/tests/ima_setup.sh | 12 ++--
.../integrity/ima/tests/ima_violations.sh | 2 -
testcases/lib/tst_test.sh | 2 +-
8 files changed, 79 insertions(+), 16 deletions(-)
create mode 100755 testcases/kernel/security/integrity/ima/tests/ima_overlay.sh
--
2.21.0
^ permalink raw reply [flat|nested] 18+ messages in thread
* [LTP] [PATCH 1/3] ima: Call test's cleanup inside ima_setup.sh cleanup
2019-03-27 16:16 ` [LTP] " Petr Vorel
(?)
@ 2019-03-27 16:16 ` Petr Vorel
-1 siblings, 0 replies; 18+ messages in thread
From: Petr Vorel @ 2019-03-27 16:16 UTC (permalink / raw)
To: ltp
to work the same way as setup
Signed-off-by: Petr Vorel <pvorel@suse.cz>
---
testcases/kernel/security/integrity/ima/tests/ima_setup.sh | 6 +++++-
.../kernel/security/integrity/ima/tests/ima_violations.sh | 2 --
2 files changed, 5 insertions(+), 3 deletions(-)
diff --git a/testcases/kernel/security/integrity/ima/tests/ima_setup.sh b/testcases/kernel/security/integrity/ima/tests/ima_setup.sh
index 52551190a..cbded42c2 100644
--- a/testcases/kernel/security/integrity/ima/tests/ima_setup.sh
+++ b/testcases/kernel/security/integrity/ima/tests/ima_setup.sh
@@ -20,7 +20,8 @@
TST_TESTFUNC="test"
TST_SETUP_CALLER="$TST_SETUP"
TST_SETUP="ima_setup"
-TST_CLEANUP="${TST_CLEANUP:-ima_cleanup}"
+TST_CLEANUP_CALLER="$TST_CLEANUP"
+TST_CLEANUP="ima_cleanup"
TST_NEEDS_TMPDIR=1
TST_NEEDS_ROOT=1
@@ -95,6 +96,9 @@ ima_setup()
ima_cleanup()
{
local dir
+
+ [ -n "$TST_CLEANUP_CALLER" ] && $TST_CLEANUP_CALLER
+
for dir in $UMOUNT; do
umount $dir
done
diff --git a/testcases/kernel/security/integrity/ima/tests/ima_violations.sh b/testcases/kernel/security/integrity/ima/tests/ima_violations.sh
index 74223c221..a44bd1230 100755
--- a/testcases/kernel/security/integrity/ima/tests/ima_violations.sh
+++ b/testcases/kernel/security/integrity/ima/tests/ima_violations.sh
@@ -51,8 +51,6 @@ cleanup()
{
[ "$PRINTK_RATE_LIMIT" != "0" ] && \
sysctl -wq kernel.printk_ratelimit=$PRINTK_RATE_LIMIT
-
- ima_cleanup
}
open_file_read()
--
2.21.0
^ permalink raw reply related [flat|nested] 18+ messages in thread
* [LTP] [PATCH 2/3] shell: Add $TST_DEVICE as default parameter to tst_umount
2019-03-27 16:16 ` [LTP] " Petr Vorel
(?)
(?)
@ 2019-03-27 16:16 ` Petr Vorel
-1 siblings, 0 replies; 18+ messages in thread
From: Petr Vorel @ 2019-03-27 16:16 UTC (permalink / raw)
To: ltp
+ use it directly as a cleanup function in df01.sh
Signed-off-by: Petr Vorel <pvorel@suse.cz>
---
doc/test-writing-guidelines.txt | 4 ++--
testcases/commands/df/df01.sh | 7 +------
testcases/commands/mkfs/mkfs01.sh | 2 +-
testcases/kernel/security/integrity/ima/tests/ima_setup.sh | 2 +-
testcases/lib/tst_test.sh | 2 +-
5 files changed, 6 insertions(+), 11 deletions(-)
diff --git a/doc/test-writing-guidelines.txt b/doc/test-writing-guidelines.txt
index 3b8541e7a..a0709c4dc 100644
--- a/doc/test-writing-guidelines.txt
+++ b/doc/test-writing-guidelines.txt
@@ -2115,8 +2115,8 @@ The 'tst_mount' mounts '$TST_DEVICE' of '$TST_FS_TYPE' (optional) to
'$TST_MNT_PARAMS'. The '$TST_MNTPOINT' directory is created if it didn't
exist prior to the function call.
-If the path passed to the 'tst_umount' is not mounted (present in '/proc/mounts')
-it's noop.
+If the path passed (optional, defaults to '$TST_DEVICE') to the 'tst_umount' is
+not mounted (present in '/proc/mounts') it's noop.
Otherwise it retries to umount the filesystem a few times on a failure, which
is a workaround since there are a daemons dumb enough to probe all newly
mounted filesystems, which prevents them from umounting shortly after they
diff --git a/testcases/commands/df/df01.sh b/testcases/commands/df/df01.sh
index 9b0be76fe..3876816dc 100755
--- a/testcases/commands/df/df01.sh
+++ b/testcases/commands/df/df01.sh
@@ -18,7 +18,7 @@
TST_CNT=12
TST_SETUP=setup
-TST_CLEANUP=cleanup
+TST_CLEANUP=tst_umount
TST_TESTFUNC=test
TST_OPTS="f:"
TST_USAGE=usage
@@ -54,11 +54,6 @@ setup()
DF_FS_TYPE=$(mount | grep "$TST_DEVICE" | awk '{print $5}')
}
-cleanup()
-{
- tst_umount $TST_DEVICE
-}
-
df_test()
{
local cmd="$1 -P"
diff --git a/testcases/commands/mkfs/mkfs01.sh b/testcases/commands/mkfs/mkfs01.sh
index 88f7f0baa..28af890b3 100755
--- a/testcases/commands/mkfs/mkfs01.sh
+++ b/testcases/commands/mkfs/mkfs01.sh
@@ -71,7 +71,7 @@ mkfs_verify_size()
{
tst_mount
local blocknum=`df -P -B 1k mntpoint | tail -n1 | awk '{print $2}'`
- tst_umount "$TST_DEVICE"
+ tst_umount
if [ $blocknum -gt "$2" ]; then
return 1
diff --git a/testcases/kernel/security/integrity/ima/tests/ima_setup.sh b/testcases/kernel/security/integrity/ima/tests/ima_setup.sh
index cbded42c2..da49eb1b2 100644
--- a/testcases/kernel/security/integrity/ima/tests/ima_setup.sh
+++ b/testcases/kernel/security/integrity/ima/tests/ima_setup.sh
@@ -105,7 +105,7 @@ ima_cleanup()
if [ "$TST_NEEDS_DEVICE" = 1 ]; then
cd $TST_TMPDIR
- tst_umount $TST_DEVICE
+ tst_umount
fi
}
diff --git a/testcases/lib/tst_test.sh b/testcases/lib/tst_test.sh
index af16ce1cf..c624e27e5 100644
--- a/testcases/lib/tst_test.sh
+++ b/testcases/lib/tst_test.sh
@@ -259,7 +259,7 @@ tst_mount()
tst_umount()
{
- local device="$1"
+ local device="${1:-$TST_DEVICE}"
local i=0
if ! grep -q "$device" /proc/mounts; then
--
2.21.0
^ permalink raw reply related [flat|nested] 18+ messages in thread
* [PATCH 3/3] ima: Add overlay test
2019-03-27 16:16 ` [LTP] " Petr Vorel
@ 2019-03-27 16:16 ` Petr Vorel
-1 siblings, 0 replies; 18+ messages in thread
From: Petr Vorel @ 2019-03-27 16:16 UTC (permalink / raw)
To: ltp
Cc: Petr Vorel, Mimi Zohar, Ignaz Forster, Fabian Vogt, Weihua Du,
linux-integrity
Based on reproducer made by Ignaz Forster <iforster@suse.de>
used for his not upstreamed patchset [1] and previous report [2].
NOTE: backup variables are needed because ima_setup.sh calling
tst_mount as well when TMPDIR is on tmpfs device.
[1] https://www.spinics.net/lists/linux-integrity/msg05926.html
[2] https://www.spinics.net/lists/linux-integrity/msg03593.html
Cc: Mimi Zohar <zohar@linux.vnet.ibm.com>
Cc: Ignaz Forster <iforster@suse.de>
Cc: Fabian Vogt <FVogt@suse.com>
Cc: Weihua Du <WHDu@suse.com>
Cc: linux-integrity@vger.kernel.org
Signed-off-by: Petr Vorel <pvorel@suse.cz>
---
runtest/ima | 1 +
.../integrity/ima/tests/ima_overlay.sh | 65 +++++++++++++++++++
.../security/integrity/ima/tests/ima_setup.sh | 4 +-
3 files changed, 68 insertions(+), 2 deletions(-)
create mode 100755 testcases/kernel/security/integrity/ima/tests/ima_overlay.sh
diff --git a/runtest/ima b/runtest/ima
index bcae16bb7..f96711a7d 100644
--- a/runtest/ima
+++ b/runtest/ima
@@ -3,3 +3,4 @@ ima_measurements ima_measurements.sh
ima_policy ima_policy.sh
ima_tpm ima_tpm.sh
ima_violations ima_violations.sh
+ima_overlay ima_overlay.sh
diff --git a/testcases/kernel/security/integrity/ima/tests/ima_overlay.sh b/testcases/kernel/security/integrity/ima/tests/ima_overlay.sh
new file mode 100755
index 000000000..eedcd3753
--- /dev/null
+++ b/testcases/kernel/security/integrity/ima/tests/ima_overlay.sh
@@ -0,0 +1,65 @@
+#!/bin/sh
+# Copyright (c) 2019 Petr Vorel <pvorel@suse.cz>
+# Based on reproducer made by Ignaz Forster <iforster@suse.de>
+
+TST_SETUP="setup"
+TST_CLEANUP="cleanup"
+. ima_setup.sh
+TST_TESTFUNC="do_test"
+
+setup()
+{
+ lower="$TST_MNTPOINT/lower"
+ upper="$TST_MNTPOINT/upper"
+ work="$TST_MNTPOINT/work"
+ merged="$TST_MNTPOINT/merged"
+ mkdir -p $lower $upper $work $merged
+
+ device_backup="$TST_DEVICE"
+ TST_DEVICE="overlay"
+
+ fs_type_backup="$TST_FS_TYPE"
+ TST_FS_TYPE="overlay"
+
+ mntpoint_backup="$TST_MNTPOINT"
+ TST_MNTPOINT="$merged"
+
+ params_backup="$TST_MNT_PARAMS"
+ TST_MNT_PARAMS="-o lowerdir=$lower,upperdir=$upper,workdir=$work"
+
+ grep -q ima_appraise_tcb /proc/cmdline || \
+ tst_brk TCONF "Test requires ima_appraise_tcb kernel parameter"
+}
+
+do_test()
+{
+ local file="foo.txt"
+ local f
+
+ tst_mount
+ mounted=1
+
+ ROD echo lower \> $lower/$file
+ if ! echo overlay > $merged/$file 2>/dev/null; then
+ tst_res TFAIL "Cannot write to merged layer"
+ return
+ fi
+
+ for f in $(find $TST_MNTPOINT -type f); do
+ EXPECT_PASS cat $f \> /dev/null 2\> /dev/null
+ done
+}
+
+cleanup()
+{
+ [ -n "$mounted" ] || return 0
+
+ tst_umount $TST_DEVICE
+
+ TST_DEVICE="$device_backup"
+ TST_FS_TYPE="$fs_type_backup"
+ TST_MNTPOINT="$mntpoint_backup"
+ TST_MNT_PARAMS="$params_backup"
+}
+
+tst_run
diff --git a/testcases/kernel/security/integrity/ima/tests/ima_setup.sh b/testcases/kernel/security/integrity/ima/tests/ima_setup.sh
index da49eb1b2..08aa5300a 100644
--- a/testcases/kernel/security/integrity/ima/tests/ima_setup.sh
+++ b/testcases/kernel/security/integrity/ima/tests/ima_setup.sh
@@ -64,14 +64,14 @@ print_ima_config()
local config="/boot/config-$(uname -r)"
local i
- tst_res TINFO "/proc/cmdline: $(cat /proc/cmdline)"
-
if [ -r "$config" ]; then
tst_res TINFO "IMA kernel config:"
for i in $(grep ^CONFIG_IMA $config); do
tst_res TINFO "$i"
done
fi
+
+ tst_res TINFO "/proc/cmdline: $(cat /proc/cmdline)"
}
ima_setup()
--
2.21.0
^ permalink raw reply related [flat|nested] 18+ messages in thread
* [LTP] [PATCH 3/3] ima: Add overlay test
@ 2019-03-27 16:16 ` Petr Vorel
0 siblings, 0 replies; 18+ messages in thread
From: Petr Vorel @ 2019-03-27 16:16 UTC (permalink / raw)
To: ltp
Based on reproducer made by Ignaz Forster <iforster@suse.de>
used for his not upstreamed patchset [1] and previous report [2].
NOTE: backup variables are needed because ima_setup.sh calling
tst_mount as well when TMPDIR is on tmpfs device.
[1] https://www.spinics.net/lists/linux-integrity/msg05926.html
[2] https://www.spinics.net/lists/linux-integrity/msg03593.html
Cc: Mimi Zohar <zohar@linux.vnet.ibm.com>
Cc: Ignaz Forster <iforster@suse.de>
Cc: Fabian Vogt <FVogt@suse.com>
Cc: Weihua Du <WHDu@suse.com>
Cc: linux-integrity@vger.kernel.org
Signed-off-by: Petr Vorel <pvorel@suse.cz>
---
runtest/ima | 1 +
.../integrity/ima/tests/ima_overlay.sh | 65 +++++++++++++++++++
.../security/integrity/ima/tests/ima_setup.sh | 4 +-
3 files changed, 68 insertions(+), 2 deletions(-)
create mode 100755 testcases/kernel/security/integrity/ima/tests/ima_overlay.sh
diff --git a/runtest/ima b/runtest/ima
index bcae16bb7..f96711a7d 100644
--- a/runtest/ima
+++ b/runtest/ima
@@ -3,3 +3,4 @@ ima_measurements ima_measurements.sh
ima_policy ima_policy.sh
ima_tpm ima_tpm.sh
ima_violations ima_violations.sh
+ima_overlay ima_overlay.sh
diff --git a/testcases/kernel/security/integrity/ima/tests/ima_overlay.sh b/testcases/kernel/security/integrity/ima/tests/ima_overlay.sh
new file mode 100755
index 000000000..eedcd3753
--- /dev/null
+++ b/testcases/kernel/security/integrity/ima/tests/ima_overlay.sh
@@ -0,0 +1,65 @@
+#!/bin/sh
+# Copyright (c) 2019 Petr Vorel <pvorel@suse.cz>
+# Based on reproducer made by Ignaz Forster <iforster@suse.de>
+
+TST_SETUP="setup"
+TST_CLEANUP="cleanup"
+. ima_setup.sh
+TST_TESTFUNC="do_test"
+
+setup()
+{
+ lower="$TST_MNTPOINT/lower"
+ upper="$TST_MNTPOINT/upper"
+ work="$TST_MNTPOINT/work"
+ merged="$TST_MNTPOINT/merged"
+ mkdir -p $lower $upper $work $merged
+
+ device_backup="$TST_DEVICE"
+ TST_DEVICE="overlay"
+
+ fs_type_backup="$TST_FS_TYPE"
+ TST_FS_TYPE="overlay"
+
+ mntpoint_backup="$TST_MNTPOINT"
+ TST_MNTPOINT="$merged"
+
+ params_backup="$TST_MNT_PARAMS"
+ TST_MNT_PARAMS="-o lowerdir=$lower,upperdir=$upper,workdir=$work"
+
+ grep -q ima_appraise_tcb /proc/cmdline || \
+ tst_brk TCONF "Test requires ima_appraise_tcb kernel parameter"
+}
+
+do_test()
+{
+ local file="foo.txt"
+ local f
+
+ tst_mount
+ mounted=1
+
+ ROD echo lower \> $lower/$file
+ if ! echo overlay > $merged/$file 2>/dev/null; then
+ tst_res TFAIL "Cannot write to merged layer"
+ return
+ fi
+
+ for f in $(find $TST_MNTPOINT -type f); do
+ EXPECT_PASS cat $f \> /dev/null 2\> /dev/null
+ done
+}
+
+cleanup()
+{
+ [ -n "$mounted" ] || return 0
+
+ tst_umount $TST_DEVICE
+
+ TST_DEVICE="$device_backup"
+ TST_FS_TYPE="$fs_type_backup"
+ TST_MNTPOINT="$mntpoint_backup"
+ TST_MNT_PARAMS="$params_backup"
+}
+
+tst_run
diff --git a/testcases/kernel/security/integrity/ima/tests/ima_setup.sh b/testcases/kernel/security/integrity/ima/tests/ima_setup.sh
index da49eb1b2..08aa5300a 100644
--- a/testcases/kernel/security/integrity/ima/tests/ima_setup.sh
+++ b/testcases/kernel/security/integrity/ima/tests/ima_setup.sh
@@ -64,14 +64,14 @@ print_ima_config()
local config="/boot/config-$(uname -r)"
local i
- tst_res TINFO "/proc/cmdline: $(cat /proc/cmdline)"
-
if [ -r "$config" ]; then
tst_res TINFO "IMA kernel config:"
for i in $(grep ^CONFIG_IMA $config); do
tst_res TINFO "$i"
done
fi
+
+ tst_res TINFO "/proc/cmdline: $(cat /proc/cmdline)"
}
ima_setup()
--
2.21.0
^ permalink raw reply related [flat|nested] 18+ messages in thread
* Re: [PATCH 0/3] LTP reproducer on broken IMA on overlayfs
2019-03-27 16:16 ` [LTP] " Petr Vorel
@ 2019-03-28 9:04 ` Petr Vorel
-1 siblings, 0 replies; 18+ messages in thread
From: Petr Vorel @ 2019-03-28 9:04 UTC (permalink / raw)
To: ltp; +Cc: Mimi Zohar, Ignaz Forster, Fabian Vogt, Weihua Du, linux-integrity
Hi,
> Petr Vorel (3):
> ima: Call test's cleanup inside ima_setup.sh cleanup
> shell: Add $TST_DEVICE as default parameter to tst_umount
> ima: Add overlay test
NOTE: I've posted just the third patch (didn't want to bother with
LTP specific non-IMA stuff. These are in LTP ML [1] [2] and also
downloadable via patchwork pwclient [3] [4].
Kind regards,
Petr
[1] http://lists.linux.it/pipermail/ltp/2019-March/011512.html
[2] http://lists.linux.it/pipermail/ltp/2019-March/011513.html
[3] https://patchwork.ozlabs.org/patch/1067177/
[4] https://patchwork.ozlabs.org/patch/1067178/
^ permalink raw reply [flat|nested] 18+ messages in thread
* [LTP] [PATCH 0/3] LTP reproducer on broken IMA on overlayfs
@ 2019-03-28 9:04 ` Petr Vorel
0 siblings, 0 replies; 18+ messages in thread
From: Petr Vorel @ 2019-03-28 9:04 UTC (permalink / raw)
To: ltp
Hi,
> Petr Vorel (3):
> ima: Call test's cleanup inside ima_setup.sh cleanup
> shell: Add $TST_DEVICE as default parameter to tst_umount
> ima: Add overlay test
NOTE: I've posted just the third patch (didn't want to bother with
LTP specific non-IMA stuff. These are in LTP ML [1] [2] and also
downloadable via patchwork pwclient [3] [4].
Kind regards,
Petr
[1] http://lists.linux.it/pipermail/ltp/2019-March/011512.html
[2] http://lists.linux.it/pipermail/ltp/2019-March/011513.html
[3] https://patchwork.ozlabs.org/patch/1067177/
[4] https://patchwork.ozlabs.org/patch/1067178/
^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: [PATCH 3/3] ima: Add overlay test
2019-03-27 16:16 ` [LTP] " Petr Vorel
@ 2019-03-28 17:27 ` Ignaz Forster
-1 siblings, 0 replies; 18+ messages in thread
From: Ignaz Forster @ 2019-03-28 17:27 UTC (permalink / raw)
To: Petr Vorel, ltp; +Cc: Mimi Zohar, Fabian Vogt, Weihua Du, linux-integrity
Hi Petr,
thanks a lot for the LTP integration!
Am 27.03.19 um 17:16 Uhr schrieb Petr Vorel:
> Based on reproducer made by Ignaz Forster <iforster@suse.de>
> used for his not upstreamed patchset [1] and previous report [2].
Just for clarification, as the test is only referring to IMA: With IMA
everything should be working already, the problem during copy_up
operations was fixed by Mimi and Goldwyn in
https://patchwork.kernel.org/patch/10776231/.
As expected the test passes on my IMA-only setup.
My outstanding patchset is only necessary when combining IMA with EVM -
in this case the test will still fail. I hope I'll be able to resume my
work in the next few weeks.
The test itself is looking good and working as expected.
> NOTE: backup variables are needed because ima_setup.sh calling
> tst_mount as well when TMPDIR is on tmpfs device.
>
> [1] https://www.spinics.net/lists/linux-integrity/msg05926.html
> [2] https://www.spinics.net/lists/linux-integrity/msg03593.html
>
> Cc: Mimi Zohar <zohar@linux.vnet.ibm.com>
> Cc: Ignaz Forster <iforster@suse.de>
> Cc: Fabian Vogt <FVogt@suse.com>
> Cc: Weihua Du <WHDu@suse.com>
> Cc: linux-integrity@vger.kernel.org
> Signed-off-by: Petr Vorel <pvorel@suse.cz>
Tested-by: Ignaz Forster <iforster@suse.de>
> ---
> runtest/ima | 1 +
> .../integrity/ima/tests/ima_overlay.sh | 65 +++++++++++++++++++
> .../security/integrity/ima/tests/ima_setup.sh | 4 +-
> 3 files changed, 68 insertions(+), 2 deletions(-)
> create mode 100755 testcases/kernel/security/integrity/ima/tests/ima_overlay.sh
>
> diff --git a/runtest/ima b/runtest/ima
> index bcae16bb7..f96711a7d 100644
> --- a/runtest/ima
> +++ b/runtest/ima
> @@ -3,3 +3,4 @@ ima_measurements ima_measurements.sh
> ima_policy ima_policy.sh
> ima_tpm ima_tpm.sh
> ima_violations ima_violations.sh
> +ima_overlay ima_overlay.sh
> diff --git a/testcases/kernel/security/integrity/ima/tests/ima_overlay.sh b/testcases/kernel/security/integrity/ima/tests/ima_overlay.sh
> new file mode 100755
> index 000000000..eedcd3753
> --- /dev/null
> +++ b/testcases/kernel/security/integrity/ima/tests/ima_overlay.sh
> @@ -0,0 +1,65 @@
> +#!/bin/sh
> +# Copyright (c) 2019 Petr Vorel <pvorel@suse.cz>
> +# Based on reproducer made by Ignaz Forster <iforster@suse.de>
> +
> +TST_SETUP="setup"
> +TST_CLEANUP="cleanup"
> +. ima_setup.sh
> +TST_TESTFUNC="do_test"
> +
> +setup()
> +{
> + lower="$TST_MNTPOINT/lower"
> + upper="$TST_MNTPOINT/upper"
> + work="$TST_MNTPOINT/work"
> + merged="$TST_MNTPOINT/merged"
> + mkdir -p $lower $upper $work $merged
> +
> + device_backup="$TST_DEVICE"
> + TST_DEVICE="overlay"
> +
> + fs_type_backup="$TST_FS_TYPE"
> + TST_FS_TYPE="overlay"
> +
> + mntpoint_backup="$TST_MNTPOINT"
> + TST_MNTPOINT="$merged"
> +
> + params_backup="$TST_MNT_PARAMS"
> + TST_MNT_PARAMS="-o lowerdir=$lower,upperdir=$upper,workdir=$work"
> +
> + grep -q ima_appraise_tcb /proc/cmdline || \
> + tst_brk TCONF "Test requires ima_appraise_tcb kernel parameter"
> +}
> +
> +do_test()
> +{
> + local file="foo.txt"
> + local f
> +
> + tst_mount
> + mounted=1
> +
> + ROD echo lower \> $lower/$file
> + if ! echo overlay > $merged/$file 2>/dev/null; then
> + tst_res TFAIL "Cannot write to merged layer"
> + return
> + fi
I can think of two additional tests here:
1. Appending to a file (>> instead of >)
2. Creating a new file in the overlay
These cases are using different code paths and may fail independently,
so separate tests would be handy.
Ignaz
> + for f in $(find $TST_MNTPOINT -type f); do
> + EXPECT_PASS cat $f \> /dev/null 2\> /dev/null
> + done
> +}
> +
> +cleanup()
> +{
> + [ -n "$mounted" ] || return 0
> +
> + tst_umount $TST_DEVICE
> +
> + TST_DEVICE="$device_backup"
> + TST_FS_TYPE="$fs_type_backup"
> + TST_MNTPOINT="$mntpoint_backup"
> + TST_MNT_PARAMS="$params_backup"
> +}
> +
> +tst_run
> diff --git a/testcases/kernel/security/integrity/ima/tests/ima_setup.sh b/testcases/kernel/security/integrity/ima/tests/ima_setup.sh
> index da49eb1b2..08aa5300a 100644
> --- a/testcases/kernel/security/integrity/ima/tests/ima_setup.sh
> +++ b/testcases/kernel/security/integrity/ima/tests/ima_setup.sh
> @@ -64,14 +64,14 @@ print_ima_config()
> local config="/boot/config-$(uname -r)"
> local i
>
> - tst_res TINFO "/proc/cmdline: $(cat /proc/cmdline)"
> -
> if [ -r "$config" ]; then
> tst_res TINFO "IMA kernel config:"
> for i in $(grep ^CONFIG_IMA $config); do
> tst_res TINFO "$i"
> done
> fi
> +
> + tst_res TINFO "/proc/cmdline: $(cat /proc/cmdline)"
> }
>
> ima_setup()
>
^ permalink raw reply [flat|nested] 18+ messages in thread
* [LTP] [PATCH 3/3] ima: Add overlay test
@ 2019-03-28 17:27 ` Ignaz Forster
0 siblings, 0 replies; 18+ messages in thread
From: Ignaz Forster @ 2019-03-28 17:27 UTC (permalink / raw)
To: ltp
Hi Petr,
thanks a lot for the LTP integration!
Am 27.03.19 um 17:16 Uhr schrieb Petr Vorel:
> Based on reproducer made by Ignaz Forster <iforster@suse.de>
> used for his not upstreamed patchset [1] and previous report [2].
Just for clarification, as the test is only referring to IMA: With IMA
everything should be working already, the problem during copy_up
operations was fixed by Mimi and Goldwyn in
https://patchwork.kernel.org/patch/10776231/.
As expected the test passes on my IMA-only setup.
My outstanding patchset is only necessary when combining IMA with EVM -
in this case the test will still fail. I hope I'll be able to resume my
work in the next few weeks.
The test itself is looking good and working as expected.
> NOTE: backup variables are needed because ima_setup.sh calling
> tst_mount as well when TMPDIR is on tmpfs device.
>
> [1] https://www.spinics.net/lists/linux-integrity/msg05926.html
> [2] https://www.spinics.net/lists/linux-integrity/msg03593.html
>
> Cc: Mimi Zohar <zohar@linux.vnet.ibm.com>
> Cc: Ignaz Forster <iforster@suse.de>
> Cc: Fabian Vogt <FVogt@suse.com>
> Cc: Weihua Du <WHDu@suse.com>
> Cc: linux-integrity@vger.kernel.org
> Signed-off-by: Petr Vorel <pvorel@suse.cz>
Tested-by: Ignaz Forster <iforster@suse.de>
> ---
> runtest/ima | 1 +
> .../integrity/ima/tests/ima_overlay.sh | 65 +++++++++++++++++++
> .../security/integrity/ima/tests/ima_setup.sh | 4 +-
> 3 files changed, 68 insertions(+), 2 deletions(-)
> create mode 100755 testcases/kernel/security/integrity/ima/tests/ima_overlay.sh
>
> diff --git a/runtest/ima b/runtest/ima
> index bcae16bb7..f96711a7d 100644
> --- a/runtest/ima
> +++ b/runtest/ima
> @@ -3,3 +3,4 @@ ima_measurements ima_measurements.sh
> ima_policy ima_policy.sh
> ima_tpm ima_tpm.sh
> ima_violations ima_violations.sh
> +ima_overlay ima_overlay.sh
> diff --git a/testcases/kernel/security/integrity/ima/tests/ima_overlay.sh b/testcases/kernel/security/integrity/ima/tests/ima_overlay.sh
> new file mode 100755
> index 000000000..eedcd3753
> --- /dev/null
> +++ b/testcases/kernel/security/integrity/ima/tests/ima_overlay.sh
> @@ -0,0 +1,65 @@
> +#!/bin/sh
> +# Copyright (c) 2019 Petr Vorel <pvorel@suse.cz>
> +# Based on reproducer made by Ignaz Forster <iforster@suse.de>
> +
> +TST_SETUP="setup"
> +TST_CLEANUP="cleanup"
> +. ima_setup.sh
> +TST_TESTFUNC="do_test"
> +
> +setup()
> +{
> + lower="$TST_MNTPOINT/lower"
> + upper="$TST_MNTPOINT/upper"
> + work="$TST_MNTPOINT/work"
> + merged="$TST_MNTPOINT/merged"
> + mkdir -p $lower $upper $work $merged
> +
> + device_backup="$TST_DEVICE"
> + TST_DEVICE="overlay"
> +
> + fs_type_backup="$TST_FS_TYPE"
> + TST_FS_TYPE="overlay"
> +
> + mntpoint_backup="$TST_MNTPOINT"
> + TST_MNTPOINT="$merged"
> +
> + params_backup="$TST_MNT_PARAMS"
> + TST_MNT_PARAMS="-o lowerdir=$lower,upperdir=$upper,workdir=$work"
> +
> + grep -q ima_appraise_tcb /proc/cmdline || \
> + tst_brk TCONF "Test requires ima_appraise_tcb kernel parameter"
> +}
> +
> +do_test()
> +{
> + local file="foo.txt"
> + local f
> +
> + tst_mount
> + mounted=1
> +
> + ROD echo lower \> $lower/$file
> + if ! echo overlay > $merged/$file 2>/dev/null; then
> + tst_res TFAIL "Cannot write to merged layer"
> + return
> + fi
I can think of two additional tests here:
1. Appending to a file (>> instead of >)
2. Creating a new file in the overlay
These cases are using different code paths and may fail independently,
so separate tests would be handy.
Ignaz
> + for f in $(find $TST_MNTPOINT -type f); do
> + EXPECT_PASS cat $f \> /dev/null 2\> /dev/null
> + done
> +}
> +
> +cleanup()
> +{
> + [ -n "$mounted" ] || return 0
> +
> + tst_umount $TST_DEVICE
> +
> + TST_DEVICE="$device_backup"
> + TST_FS_TYPE="$fs_type_backup"
> + TST_MNTPOINT="$mntpoint_backup"
> + TST_MNT_PARAMS="$params_backup"
> +}
> +
> +tst_run
> diff --git a/testcases/kernel/security/integrity/ima/tests/ima_setup.sh b/testcases/kernel/security/integrity/ima/tests/ima_setup.sh
> index da49eb1b2..08aa5300a 100644
> --- a/testcases/kernel/security/integrity/ima/tests/ima_setup.sh
> +++ b/testcases/kernel/security/integrity/ima/tests/ima_setup.sh
> @@ -64,14 +64,14 @@ print_ima_config()
> local config="/boot/config-$(uname -r)"
> local i
>
> - tst_res TINFO "/proc/cmdline: $(cat /proc/cmdline)"
> -
> if [ -r "$config" ]; then
> tst_res TINFO "IMA kernel config:"
> for i in $(grep ^CONFIG_IMA $config); do
> tst_res TINFO "$i"
> done
> fi
> +
> + tst_res TINFO "/proc/cmdline: $(cat /proc/cmdline)"
> }
>
> ima_setup()
>
^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: [PATCH 3/3] ima: Add overlay test
2019-03-27 16:16 ` [LTP] " Petr Vorel
@ 2019-03-29 10:49 ` Mimi Zohar
-1 siblings, 0 replies; 18+ messages in thread
From: Mimi Zohar @ 2019-03-29 10:49 UTC (permalink / raw)
To: Petr Vorel, ltp
Cc: Mimi Zohar, Ignaz Forster, Fabian Vogt, Weihua Du, linux-integrity
Hi Petr,
On Wed, 2019-03-27 at 17:16 +0100, Petr Vorel wrote:
> +setup()
> +{
> + lower="$TST_MNTPOINT/lower"
> + upper="$TST_MNTPOINT/upper"
> + work="$TST_MNTPOINT/work"
> + merged="$TST_MNTPOINT/merged"
> + mkdir -p $lower $upper $work $merged
> +
> + device_backup="$TST_DEVICE"
> + TST_DEVICE="overlay"
> +
> + fs_type_backup="$TST_FS_TYPE"
> + TST_FS_TYPE="overlay"
> +
> + mntpoint_backup="$TST_MNTPOINT"
> + TST_MNTPOINT="$merged"
> +
> + params_backup="$TST_MNT_PARAMS"
> + TST_MNT_PARAMS="-o lowerdir=$lower,upperdir=$upper,workdir=$work"
> +
> + grep -q ima_appraise_tcb /proc/cmdline || \
> + tst_brk TCONF "Test requires ima_appraise_tcb kernel parameter"
Instead of specifying individual policies separately, the newer method
of specifying builtin IMA policies on the boot command line is
"ima_policy=", with a list of policies. The builtin appraise policy
would be specified as "ima_policy=appraise_tcb". Refer to
Documentation/admin-guide/kernel-parameters.txt for the list of
builtin policies.
> +}
> +
> +do_test()
> +{
> + local file="foo.txt"
> + local f
> +
> + tst_mount
> + mounted=1
> +
> + ROD echo lower \> $lower/$file
For some reason "mntpoint/lower" isn't loopback mounted. With the
builtin appraise policy, because it is a tmpfs filesystem,
security.ima does not exist. Writing to the merged directory then
fails.
+ df -T mntpoint/lower
Filesystem Type 1K-blocks Used Available Use% Mounted on
tmpfs tmpfs 4020348 262316 3758032 7% /tmp
+ getfattr -m '^security' --dump mntpoint/lower/foo.txt
# file: mntpoint/lower/foo.txt
security.evm=0sAq8niNi4X7cYntKSAki1Woc+Y5Yq
security.selinux="unconfined_u:object_r:user_tmp_t:s0"
Mimi
> + if ! echo overlay > $merged/$file 2>/dev/null; then
> + tst_res TFAIL "Cannot write to merged layer"
> + return
> + fi
> +
> + for f in $(find $TST_MNTPOINT -type f); do
> + EXPECT_PASS cat $f \> /dev/null 2\> /dev/null
> + done
> +}
^ permalink raw reply [flat|nested] 18+ messages in thread
* [LTP] [PATCH 3/3] ima: Add overlay test
@ 2019-03-29 10:49 ` Mimi Zohar
0 siblings, 0 replies; 18+ messages in thread
From: Mimi Zohar @ 2019-03-29 10:49 UTC (permalink / raw)
To: ltp
Hi Petr,
On Wed, 2019-03-27 at 17:16 +0100, Petr Vorel wrote:
> +setup()
> +{
> + lower="$TST_MNTPOINT/lower"
> + upper="$TST_MNTPOINT/upper"
> + work="$TST_MNTPOINT/work"
> + merged="$TST_MNTPOINT/merged"
> + mkdir -p $lower $upper $work $merged
> +
> + device_backup="$TST_DEVICE"
> + TST_DEVICE="overlay"
> +
> + fs_type_backup="$TST_FS_TYPE"
> + TST_FS_TYPE="overlay"
> +
> + mntpoint_backup="$TST_MNTPOINT"
> + TST_MNTPOINT="$merged"
> +
> + params_backup="$TST_MNT_PARAMS"
> + TST_MNT_PARAMS="-o lowerdir=$lower,upperdir=$upper,workdir=$work"
> +
> + grep -q ima_appraise_tcb /proc/cmdline || \
> + tst_brk TCONF "Test requires ima_appraise_tcb kernel parameter"
Instead of specifying individual policies separately, the newer method
of specifying builtin IMA policies on the boot command line is
"ima_policy=", with a list of policies. The builtin appraise policy
would be specified as "ima_policy=appraise_tcb". Refer to
Documentation/admin-guide/kernel-parameters.txt for the list of
builtin policies.
> +}
> +
> +do_test()
> +{
> + local file="foo.txt"
> + local f
> +
> + tst_mount
> + mounted=1
> +
> + ROD echo lower \> $lower/$file
For some reason "mntpoint/lower" isn't loopback mounted. With the
builtin appraise policy, because it is a tmpfs filesystem,
security.ima does not exist. Writing to the merged directory then
fails.
+ df -T mntpoint/lower
Filesystem Type 1K-blocks Used Available Use% Mounted on
tmpfs tmpfs 4020348 262316 3758032 7% /tmp
+ getfattr -m '^security' --dump mntpoint/lower/foo.txt
# file: mntpoint/lower/foo.txt
security.evm=0sAq8niNi4X7cYntKSAki1Woc+Y5Yq
security.selinux="unconfined_u:object_r:user_tmp_t:s0"
Mimi
> + if ! echo overlay > $merged/$file 2>/dev/null; then
> + tst_res TFAIL "Cannot write to merged layer"
> + return
> + fi
> +
> + for f in $(find $TST_MNTPOINT -type f); do
> + EXPECT_PASS cat $f \> /dev/null 2\> /dev/null
> + done
> +}
^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: [PATCH 3/3] ima: Add overlay test
2019-03-29 10:49 ` [LTP] " Mimi Zohar
@ 2019-04-04 18:19 ` Petr Vorel
-1 siblings, 0 replies; 18+ messages in thread
From: Petr Vorel @ 2019-04-04 18:19 UTC (permalink / raw)
To: Mimi Zohar
Cc: ltp, Mimi Zohar, Ignaz Forster, Fabian Vogt, Weihua Du, linux-integrity
Hi Mimi,
thanks for your comments!
> > + grep -q ima_appraise_tcb /proc/cmdline || \
> > + tst_brk TCONF "Test requires ima_appraise_tcb kernel parameter"
> Instead of specifying individual policies separately, the newer method
> of specifying builtin IMA policies on the boot command line is
> "ima_policy=", with a list of policies. The builtin appraise policy
> would be specified as "ima_policy=appraise_tcb". Refer to
> Documentation/admin-guide/kernel-parameters.txt for the list of
> builtin policies.
I guess grep for any policy (ima_policy=) or ima_appraise_tcb shold e enough.
Am I right?
BTW I guess ima_appraise_tcb should be deprecated in kernel-parameters.txt.
> > +}
> > +
> > +do_test()
> > +{
> > + local file="foo.txt"
> > + local f
> > +
> > + tst_mount
> > + mounted=1
> > +
> > + ROD echo lower \> $lower/$file
> For some reason "mntpoint/lower" isn't loopback mounted. With the
> builtin appraise policy, because it is a tmpfs filesystem,
> security.ima does not exist. Writing to the merged directory then
> fails.
> + df -T mntpoint/lower
> Filesystem Type 1K-blocks Used Available Use% Mounted on
> tmpfs tmpfs 4020348 262316 3758032 7% /tmp
My bad, I forged to add TST_NEEDS_DEVICE=1 to ima_overlay.sh (I'll add it into
v2). That was the missing piece to enable loop device (in the end of ima_setup.sh)
> + getfattr -m '^security' --dump mntpoint/lower/foo.txt
> # file: mntpoint/lower/foo.txt
> security.evm=0sAq8niNi4X7cYntKSAki1Woc+Y5Yq
> security.selinux="unconfined_u:object_r:user_tmp_t:s0"
> Mimi
Kind regards,
Petr
^ permalink raw reply [flat|nested] 18+ messages in thread
* [LTP] [PATCH 3/3] ima: Add overlay test
@ 2019-04-04 18:19 ` Petr Vorel
0 siblings, 0 replies; 18+ messages in thread
From: Petr Vorel @ 2019-04-04 18:19 UTC (permalink / raw)
To: ltp
Hi Mimi,
thanks for your comments!
> > + grep -q ima_appraise_tcb /proc/cmdline || \
> > + tst_brk TCONF "Test requires ima_appraise_tcb kernel parameter"
> Instead of specifying individual policies separately, the newer method
> of specifying builtin IMA policies on the boot command line is
> "ima_policy=", with a list of policies. The builtin appraise policy
> would be specified as "ima_policy=appraise_tcb". Refer to
> Documentation/admin-guide/kernel-parameters.txt for the list of
> builtin policies.
I guess grep for any policy (ima_policy=) or ima_appraise_tcb shold e enough.
Am I right?
BTW I guess ima_appraise_tcb should be deprecated in kernel-parameters.txt.
> > +}
> > +
> > +do_test()
> > +{
> > + local file="foo.txt"
> > + local f
> > +
> > + tst_mount
> > + mounted=1
> > +
> > + ROD echo lower \> $lower/$file
> For some reason "mntpoint/lower" isn't loopback mounted. With the
> builtin appraise policy, because it is a tmpfs filesystem,
> security.ima does not exist. Writing to the merged directory then
> fails.
> + df -T mntpoint/lower
> Filesystem Type 1K-blocks Used Available Use% Mounted on
> tmpfs tmpfs 4020348 262316 3758032 7% /tmp
My bad, I forged to add TST_NEEDS_DEVICE=1 to ima_overlay.sh (I'll add it into
v2). That was the missing piece to enable loop device (in the end of ima_setup.sh)
> + getfattr -m '^security' --dump mntpoint/lower/foo.txt
> # file: mntpoint/lower/foo.txt
> security.evm=0sAq8niNi4X7cYntKSAki1Woc+Y5Yq
> security.selinux="unconfined_u:object_r:user_tmp_t:s0"
> Mimi
Kind regards,
Petr
^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: [PATCH 3/3] ima: Add overlay test
2019-04-04 18:19 ` [LTP] " Petr Vorel
@ 2019-04-04 19:19 ` Mimi Zohar
-1 siblings, 0 replies; 18+ messages in thread
From: Mimi Zohar @ 2019-04-04 19:19 UTC (permalink / raw)
To: Petr Vorel
Cc: ltp, Mimi Zohar, Ignaz Forster, Fabian Vogt, Weihua Du, linux-integrity
On Thu, 2019-04-04 at 20:19 +0200, Petr Vorel wrote:
> Hi Mimi,
>
> thanks for your comments!
>
> > > + grep -q ima_appraise_tcb /proc/cmdline || \
> > > + tst_brk TCONF "Test requires ima_appraise_tcb kernel parameter"
>
> > Instead of specifying individual policies separately, the newer method
> > of specifying builtin IMA policies on the boot command line is
> > "ima_policy=", with a list of policies. The builtin appraise policy
> > would be specified as "ima_policy=appraise_tcb". Refer to
> > Documentation/admin-guide/kernel-parameters.txt for the list of
> > builtin policies.
> I guess grep for any policy (ima_policy=) or ima_appraise_tcb shold e enough.
> Am I right?
Yes
>
> BTW I guess ima_appraise_tcb should be deprecated in kernel-parameters.txt.
and yes
>
> > > +}
> > > +
> > > +do_test()
> > > +{
> > > + local file="foo.txt"
> > > + local f
> > > +
> > > + tst_mount
> > > + mounted=1
> > > +
> > > + ROD echo lower \> $lower/$file
>
> > For some reason "mntpoint/lower" isn't loopback mounted. With the
> > builtin appraise policy, because it is a tmpfs filesystem,
> > security.ima does not exist. Writing to the merged directory then
> > fails.
>
> > + df -T mntpoint/lower
> > Filesystem Type 1K-blocks Used Available Use% Mounted on
> > tmpfs tmpfs 4020348 262316 3758032 7% /tmp
> My bad, I forged to add TST_NEEDS_DEVICE=1 to ima_overlay.sh (I'll add it into
> v2). That was the missing piece to enable loop device (in the end of ima_setup.sh)
thanks!
>
>
> > + getfattr -m '^security' --dump mntpoint/lower/foo.txt
> > # file: mntpoint/lower/foo.txt
> > security.evm=0sAq8niNi4X7cYntKSAki1Woc+Y5Yq
> > security.selinux="unconfined_u:object_r:user_tmp_t:s0"
>
>
> Kind regards,
> Petr
>
^ permalink raw reply [flat|nested] 18+ messages in thread
* [LTP] [PATCH 3/3] ima: Add overlay test
@ 2019-04-04 19:19 ` Mimi Zohar
0 siblings, 0 replies; 18+ messages in thread
From: Mimi Zohar @ 2019-04-04 19:19 UTC (permalink / raw)
To: ltp
On Thu, 2019-04-04 at 20:19 +0200, Petr Vorel wrote:
> Hi Mimi,
>
> thanks for your comments!
>
> > > + grep -q ima_appraise_tcb /proc/cmdline || \
> > > + tst_brk TCONF "Test requires ima_appraise_tcb kernel parameter"
>
> > Instead of specifying individual policies separately, the newer method
> > of specifying builtin IMA policies on the boot command line is
> > "ima_policy=", with a list of policies. The builtin appraise policy
> > would be specified as "ima_policy=appraise_tcb". Refer to
> > Documentation/admin-guide/kernel-parameters.txt for the list of
> > builtin policies.
> I guess grep for any policy (ima_policy=) or ima_appraise_tcb shold e enough.
> Am I right?
Yes
>
> BTW I guess ima_appraise_tcb should be deprecated in kernel-parameters.txt.
and yes
>
> > > +}
> > > +
> > > +do_test()
> > > +{
> > > + local file="foo.txt"
> > > + local f
> > > +
> > > + tst_mount
> > > + mounted=1
> > > +
> > > + ROD echo lower \> $lower/$file
>
> > For some reason "mntpoint/lower" isn't loopback mounted. With the
> > builtin appraise policy, because it is a tmpfs filesystem,
> > security.ima does not exist. Writing to the merged directory then
> > fails.
>
> > + df -T mntpoint/lower
> > Filesystem Type 1K-blocks Used Available Use% Mounted on
> > tmpfs tmpfs 4020348 262316 3758032 7% /tmp
> My bad, I forged to add TST_NEEDS_DEVICE=1 to ima_overlay.sh (I'll add it into
> v2). That was the missing piece to enable loop device (in the end of ima_setup.sh)
thanks!
>
>
> > + getfattr -m '^security' --dump mntpoint/lower/foo.txt
> > # file: mntpoint/lower/foo.txt
> > security.evm=0sAq8niNi4X7cYntKSAki1Woc+Y5Yq
> > security.selinux="unconfined_u:object_r:user_tmp_t:s0"
>
>
> Kind regards,
> Petr
>
^ permalink raw reply [flat|nested] 18+ messages in thread
* Re: [PATCH 3/3] ima: Add overlay test
2019-03-28 17:27 ` [LTP] " Ignaz Forster
@ 2019-04-04 22:37 ` Petr Vorel
-1 siblings, 0 replies; 18+ messages in thread
From: Petr Vorel @ 2019-04-04 22:37 UTC (permalink / raw)
To: Ignaz Forster; +Cc: ltp, Mimi Zohar, Fabian Vogt, Weihua Du, linux-integrity
Hi Ignaz,
> thanks a lot for the LTP integration!
thanks for testing and your comments!
> Am 27.03.19 um 17:16 Uhr schrieb Petr Vorel:
> > Based on reproducer made by Ignaz Forster <iforster@suse.de>
> > used for his not upstreamed patchset [1] and previous report [2].
> Just for clarification, as the test is only referring to IMA: With IMA
> everything should be working already, the problem during copy_up operations
> was fixed by Mimi and Goldwyn in
> https://patchwork.kernel.org/patch/10776231/.
> As expected the test passes on my IMA-only setup.
> My outstanding patchset is only necessary when combining IMA with EVM - in
> this case the test will still fail. I hope I'll be able to resume my work in
> the next few weeks.
I'll rename it to evm_overlay.sh.
BTW I got (with TST_NEEDS_DEVICE=1 in ima_overlay.sh) failure with ima_appraise_tcb kernel parameter:
[ 741.070585] audit: type=1800 audit(1554415774.087:46): pid=1491 uid=0 auid=0 ses=3 op="appraise_data" cause="invalid-hash" comm="ima_overlay.sh" name="/tmp/LTP_ima_overlay.eZxnT8LMZ7/mntpoint/merged/foo.txt" dev="vda2" ino=3496 res=0
which looked to me as good error.
I didn't get any ima error with ima_policy=appraise_tcb, which is supposed to be
according to docs the same (and setup code in ima_policy.c looks to me like it:
both just set ima_use_appraise_tcb). I wonder, what is wrong in my setup.
BTW can you share your setup? ima_policy=appraise_tcb kernel parameter and
loading IMA and EVM keys over dracut-ima scripts? (IMA appraisal and EVM using
digital signatures? I guess using hashes for IMA appraisal would work as well)
> > +do_test()
> > +{
> > + local file="foo.txt"
> > + local f
> > +
> > + tst_mount
> > + mounted=1
> > +
> > + ROD echo lower \> $lower/$file
> > + if ! echo overlay > $merged/$file 2>/dev/null; then
> > + tst_res TFAIL "Cannot write to merged layer"
> > + return
> > + fi
> I can think of two additional tests here:
> 1. Appending to a file (>> instead of >)
> 2. Creating a new file in the overlay
> These cases are using different code paths and may fail independently, so
> separate tests would be handy.
I'll add them into v2.
> Ignaz
Kind regards,
Petr
^ permalink raw reply [flat|nested] 18+ messages in thread
* [LTP] [PATCH 3/3] ima: Add overlay test
@ 2019-04-04 22:37 ` Petr Vorel
0 siblings, 0 replies; 18+ messages in thread
From: Petr Vorel @ 2019-04-04 22:37 UTC (permalink / raw)
To: ltp
Hi Ignaz,
> thanks a lot for the LTP integration!
thanks for testing and your comments!
> Am 27.03.19 um 17:16 Uhr schrieb Petr Vorel:
> > Based on reproducer made by Ignaz Forster <iforster@suse.de>
> > used for his not upstreamed patchset [1] and previous report [2].
> Just for clarification, as the test is only referring to IMA: With IMA
> everything should be working already, the problem during copy_up operations
> was fixed by Mimi and Goldwyn in
> https://patchwork.kernel.org/patch/10776231/.
> As expected the test passes on my IMA-only setup.
> My outstanding patchset is only necessary when combining IMA with EVM - in
> this case the test will still fail. I hope I'll be able to resume my work in
> the next few weeks.
I'll rename it to evm_overlay.sh.
BTW I got (with TST_NEEDS_DEVICE=1 in ima_overlay.sh) failure with ima_appraise_tcb kernel parameter:
[ 741.070585] audit: type=1800 audit(1554415774.087:46): pid=1491 uid=0 auid=0 ses=3 op="appraise_data" cause="invalid-hash" comm="ima_overlay.sh" name="/tmp/LTP_ima_overlay.eZxnT8LMZ7/mntpoint/merged/foo.txt" dev="vda2" ino=3496 res=0
which looked to me as good error.
I didn't get any ima error with ima_policy=appraise_tcb, which is supposed to be
according to docs the same (and setup code in ima_policy.c looks to me like it:
both just set ima_use_appraise_tcb). I wonder, what is wrong in my setup.
BTW can you share your setup? ima_policy=appraise_tcb kernel parameter and
loading IMA and EVM keys over dracut-ima scripts? (IMA appraisal and EVM using
digital signatures? I guess using hashes for IMA appraisal would work as well)
> > +do_test()
> > +{
> > + local file="foo.txt"
> > + local f
> > +
> > + tst_mount
> > + mounted=1
> > +
> > + ROD echo lower \> $lower/$file
> > + if ! echo overlay > $merged/$file 2>/dev/null; then
> > + tst_res TFAIL "Cannot write to merged layer"
> > + return
> > + fi
> I can think of two additional tests here:
> 1. Appending to a file (>> instead of >)
> 2. Creating a new file in the overlay
> These cases are using different code paths and may fail independently, so
> separate tests would be handy.
I'll add them into v2.
> Ignaz
Kind regards,
Petr
^ permalink raw reply [flat|nested] 18+ messages in thread
end of thread, other threads:[~2019-04-04 22:37 UTC | newest]
Thread overview: 18+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-03-27 16:16 [PATCH 0/3] LTP reproducer on broken IMA on overlayfs Petr Vorel
2019-03-27 16:16 ` [LTP] " Petr Vorel
2019-03-27 16:16 ` [LTP] [PATCH 1/3] ima: Call test's cleanup inside ima_setup.sh cleanup Petr Vorel
2019-03-27 16:16 ` [LTP] [PATCH 2/3] shell: Add $TST_DEVICE as default parameter to tst_umount Petr Vorel
2019-03-27 16:16 ` [PATCH 3/3] ima: Add overlay test Petr Vorel
2019-03-27 16:16 ` [LTP] " Petr Vorel
2019-03-28 17:27 ` Ignaz Forster
2019-03-28 17:27 ` [LTP] " Ignaz Forster
2019-04-04 22:37 ` Petr Vorel
2019-04-04 22:37 ` [LTP] " Petr Vorel
2019-03-29 10:49 ` Mimi Zohar
2019-03-29 10:49 ` [LTP] " Mimi Zohar
2019-04-04 18:19 ` Petr Vorel
2019-04-04 18:19 ` [LTP] " Petr Vorel
2019-04-04 19:19 ` Mimi Zohar
2019-04-04 19:19 ` [LTP] " Mimi Zohar
2019-03-28 9:04 ` [PATCH 0/3] LTP reproducer on broken IMA on overlayfs Petr Vorel
2019-03-28 9:04 ` [LTP] " Petr Vorel
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.