From: Petr Vorel <pvorel@suse.cz> To: Ignaz Forster <iforster@suse.de> Cc: ltp@lists.linux.it, Mimi Zohar <zohar@linux.vnet.ibm.com>, Fabian Vogt <FVogt@suse.com>, Weihua Du <WHDu@suse.com>, linux-integrity@vger.kernel.org Subject: Re: [PATCH 3/3] ima: Add overlay test Date: Fri, 5 Apr 2019 00:37:15 +0200 [thread overview] Message-ID: <20190404223714.GA12544@dell5510> (raw) In-Reply-To: <854e62ce-5e5c-7ea7-0291-0d3eaadf3fca@suse.de> Hi Ignaz, > thanks a lot for the LTP integration! thanks for testing and your comments! > Am 27.03.19 um 17:16 Uhr schrieb Petr Vorel: > > Based on reproducer made by Ignaz Forster <iforster@suse.de> > > used for his not upstreamed patchset [1] and previous report [2]. > Just for clarification, as the test is only referring to IMA: With IMA > everything should be working already, the problem during copy_up operations > was fixed by Mimi and Goldwyn in > https://patchwork.kernel.org/patch/10776231/. > As expected the test passes on my IMA-only setup. > My outstanding patchset is only necessary when combining IMA with EVM - in > this case the test will still fail. I hope I'll be able to resume my work in > the next few weeks. I'll rename it to evm_overlay.sh. BTW I got (with TST_NEEDS_DEVICE=1 in ima_overlay.sh) failure with ima_appraise_tcb kernel parameter: [ 741.070585] audit: type=1800 audit(1554415774.087:46): pid=1491 uid=0 auid=0 ses=3 op="appraise_data" cause="invalid-hash" comm="ima_overlay.sh" name="/tmp/LTP_ima_overlay.eZxnT8LMZ7/mntpoint/merged/foo.txt" dev="vda2" ino=3496 res=0 which looked to me as good error. I didn't get any ima error with ima_policy=appraise_tcb, which is supposed to be according to docs the same (and setup code in ima_policy.c looks to me like it: both just set ima_use_appraise_tcb). I wonder, what is wrong in my setup. BTW can you share your setup? ima_policy=appraise_tcb kernel parameter and loading IMA and EVM keys over dracut-ima scripts? (IMA appraisal and EVM using digital signatures? I guess using hashes for IMA appraisal would work as well) > > +do_test() > > +{ > > + local file="foo.txt" > > + local f > > + > > + tst_mount > > + mounted=1 > > + > > + ROD echo lower \> $lower/$file > > + if ! echo overlay > $merged/$file 2>/dev/null; then > > + tst_res TFAIL "Cannot write to merged layer" > > + return > > + fi > I can think of two additional tests here: > 1. Appending to a file (>> instead of >) > 2. Creating a new file in the overlay > These cases are using different code paths and may fail independently, so > separate tests would be handy. I'll add them into v2. > Ignaz Kind regards, Petr
WARNING: multiple messages have this Message-ID (diff)
From: Petr Vorel <pvorel@suse.cz> To: ltp@lists.linux.it Subject: [LTP] [PATCH 3/3] ima: Add overlay test Date: Fri, 5 Apr 2019 00:37:15 +0200 [thread overview] Message-ID: <20190404223714.GA12544@dell5510> (raw) In-Reply-To: <854e62ce-5e5c-7ea7-0291-0d3eaadf3fca@suse.de> Hi Ignaz, > thanks a lot for the LTP integration! thanks for testing and your comments! > Am 27.03.19 um 17:16 Uhr schrieb Petr Vorel: > > Based on reproducer made by Ignaz Forster <iforster@suse.de> > > used for his not upstreamed patchset [1] and previous report [2]. > Just for clarification, as the test is only referring to IMA: With IMA > everything should be working already, the problem during copy_up operations > was fixed by Mimi and Goldwyn in > https://patchwork.kernel.org/patch/10776231/. > As expected the test passes on my IMA-only setup. > My outstanding patchset is only necessary when combining IMA with EVM - in > this case the test will still fail. I hope I'll be able to resume my work in > the next few weeks. I'll rename it to evm_overlay.sh. BTW I got (with TST_NEEDS_DEVICE=1 in ima_overlay.sh) failure with ima_appraise_tcb kernel parameter: [ 741.070585] audit: type=1800 audit(1554415774.087:46): pid=1491 uid=0 auid=0 ses=3 op="appraise_data" cause="invalid-hash" comm="ima_overlay.sh" name="/tmp/LTP_ima_overlay.eZxnT8LMZ7/mntpoint/merged/foo.txt" dev="vda2" ino=3496 res=0 which looked to me as good error. I didn't get any ima error with ima_policy=appraise_tcb, which is supposed to be according to docs the same (and setup code in ima_policy.c looks to me like it: both just set ima_use_appraise_tcb). I wonder, what is wrong in my setup. BTW can you share your setup? ima_policy=appraise_tcb kernel parameter and loading IMA and EVM keys over dracut-ima scripts? (IMA appraisal and EVM using digital signatures? I guess using hashes for IMA appraisal would work as well) > > +do_test() > > +{ > > + local file="foo.txt" > > + local f > > + > > + tst_mount > > + mounted=1 > > + > > + ROD echo lower \> $lower/$file > > + if ! echo overlay > $merged/$file 2>/dev/null; then > > + tst_res TFAIL "Cannot write to merged layer" > > + return > > + fi > I can think of two additional tests here: > 1. Appending to a file (>> instead of >) > 2. Creating a new file in the overlay > These cases are using different code paths and may fail independently, so > separate tests would be handy. I'll add them into v2. > Ignaz Kind regards, Petr
next prev parent reply other threads:[~2019-04-04 22:37 UTC|newest] Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top 2019-03-27 16:16 [PATCH 0/3] LTP reproducer on broken IMA on overlayfs Petr Vorel 2019-03-27 16:16 ` [LTP] " Petr Vorel 2019-03-27 16:16 ` [LTP] [PATCH 1/3] ima: Call test's cleanup inside ima_setup.sh cleanup Petr Vorel 2019-03-27 16:16 ` [LTP] [PATCH 2/3] shell: Add $TST_DEVICE as default parameter to tst_umount Petr Vorel 2019-03-27 16:16 ` [PATCH 3/3] ima: Add overlay test Petr Vorel 2019-03-27 16:16 ` [LTP] " Petr Vorel 2019-03-28 17:27 ` Ignaz Forster 2019-03-28 17:27 ` [LTP] " Ignaz Forster 2019-04-04 22:37 ` Petr Vorel [this message] 2019-04-04 22:37 ` Petr Vorel 2019-03-29 10:49 ` Mimi Zohar 2019-03-29 10:49 ` [LTP] " Mimi Zohar 2019-04-04 18:19 ` Petr Vorel 2019-04-04 18:19 ` [LTP] " Petr Vorel 2019-04-04 19:19 ` Mimi Zohar 2019-04-04 19:19 ` [LTP] " Mimi Zohar 2019-03-28 9:04 ` [PATCH 0/3] LTP reproducer on broken IMA on overlayfs Petr Vorel 2019-03-28 9:04 ` [LTP] " Petr Vorel
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20190404223714.GA12544@dell5510 \ --to=pvorel@suse.cz \ --cc=FVogt@suse.com \ --cc=WHDu@suse.com \ --cc=iforster@suse.de \ --cc=linux-integrity@vger.kernel.org \ --cc=ltp@lists.linux.it \ --cc=zohar@linux.vnet.ibm.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.