Linux-kselftest Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH] sefltest/ima: support appended signatures (modsig)
@ 2019-08-28 12:39 Mimi Zohar
  2019-08-28 13:01 ` Petr Vorel
                   ` (2 more replies)
  0 siblings, 3 replies; 5+ messages in thread
From: Mimi Zohar @ 2019-08-28 12:39 UTC (permalink / raw)
  To: linux-integrity
  Cc: Mimi Zohar, Thiago Jung Bauermann, Petr Vorel, Jessica Yu,
	Dave Young, shuah, linux-kselftest, linuxppc-dev, linux-kernel

Detect and allow appended signatures.

Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
---
 .../selftests/kexec/test_kexec_file_load.sh        | 38 +++++++++++++++++++---
 1 file changed, 34 insertions(+), 4 deletions(-)

diff --git a/tools/testing/selftests/kexec/test_kexec_file_load.sh b/tools/testing/selftests/kexec/test_kexec_file_load.sh
index fa7c24e8eefb..2ff600388c30 100755
--- a/tools/testing/selftests/kexec/test_kexec_file_load.sh
+++ b/tools/testing/selftests/kexec/test_kexec_file_load.sh
@@ -37,11 +37,20 @@ is_ima_sig_required()
 	# sequentially.  As a result, a policy rule may be defined, but
 	# might not necessarily be used.  This test assumes if a policy
 	# rule is specified, that is the intent.
+
+	# First check for appended signature (modsig), then xattr
 	if [ $ima_read_policy -eq 1 ]; then
 		check_ima_policy "appraise" "func=KEXEC_KERNEL_CHECK" \
-			"appraise_type=imasig"
+			"appraise_type=imasig|modsig"
 		ret=$?
-		[ $ret -eq 1 ] && log_info "IMA signature required";
+		if [ $ret -eq 1 ]; then
+			log_info "IMA or appended(modsig) signature required"
+		else
+			check_ima_policy "appraise" "func=KEXEC_KERNEL_CHECK" \
+				"appraise_type=imasig"
+			ret=$?
+			[ $ret -eq 1 ] && log_info "IMA signature required";
+		fi
 	fi
 	return $ret
 }
@@ -84,6 +93,22 @@ check_for_imasig()
 	return $ret
 }
 
+# Return 1 for appended signature (modsig) found and 0 for not found.
+check_for_modsig()
+{
+	local module_sig_string="~Module signature appended~"
+	local sig="$(tail --bytes $((${#module_sig_string} + 1)) $KERNEL_IMAGE)"
+	local ret=0
+
+	if [ "$sig" == "$module_sig_string" ]; then
+		ret=1
+		log_info "kexec kernel image modsig signed"
+	else
+		log_info "kexec kernel image not modsig signed"
+	fi
+	return $ret
+}
+
 kexec_file_load_test()
 {
 	local succeed_msg="kexec_file_load succeeded"
@@ -98,7 +123,8 @@ kexec_file_load_test()
 		# In secureboot mode with an architecture  specific
 		# policy, make sure either an IMA or PE signature exists.
 		if [ $secureboot -eq 1 ] && [ $arch_policy -eq 1 ] && \
-			[ $ima_signed -eq 0 ] && [ $pe_signed -eq 0 ]; then
+			[ $ima_signed -eq 0 ] && [ $pe_signed -eq 0 ] \
+			  && [ $ima_modsig -eq 0 ]; then
 			log_fail "$succeed_msg (missing sig)"
 		fi
 
@@ -107,7 +133,8 @@ kexec_file_load_test()
 			log_fail "$succeed_msg (missing PE sig)"
 		fi
 
-		if [ $ima_sig_required -eq 1 ] && [ $ima_signed -eq 0 ]; then
+		if [ $ima_sig_required -eq 1 ] && [ $ima_signed -eq 0 ] \
+		     && [ $ima_modsig -eq 0 ]; then
 			log_fail "$succeed_msg (missing IMA sig)"
 		fi
 
@@ -204,5 +231,8 @@ pe_signed=$?
 check_for_imasig
 ima_signed=$?
 
+check_for_modsig
+ima_modsig=$?
+
 # Test loading the kernel image via kexec_file_load syscall
 kexec_file_load_test
-- 
2.7.5


^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: [PATCH] sefltest/ima: support appended signatures (modsig)
  2019-08-28 12:39 [PATCH] sefltest/ima: support appended signatures (modsig) Mimi Zohar
@ 2019-08-28 13:01 ` Petr Vorel
  2019-08-28 14:45 ` shuah
  2019-08-29 16:38 ` Jordan Hand
  2 siblings, 0 replies; 5+ messages in thread
From: Petr Vorel @ 2019-08-28 13:01 UTC (permalink / raw)
  To: Mimi Zohar
  Cc: linux-integrity, Thiago Jung Bauermann, Jessica Yu, Dave Young,
	shuah, linux-kselftest, linuxppc-dev, linux-kernel

Hi Mimi,

> Detect and allow appended signatures.

> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Reviewed-by: Petr Vorel <pvorel@suse.cz>

Kind regards,
Petr

^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: [PATCH] sefltest/ima: support appended signatures (modsig)
  2019-08-28 12:39 [PATCH] sefltest/ima: support appended signatures (modsig) Mimi Zohar
  2019-08-28 13:01 ` Petr Vorel
@ 2019-08-28 14:45 ` shuah
  2019-08-28 15:19   ` Mimi Zohar
  2019-08-29 16:38 ` Jordan Hand
  2 siblings, 1 reply; 5+ messages in thread
From: shuah @ 2019-08-28 14:45 UTC (permalink / raw)
  To: Mimi Zohar, linux-integrity
  Cc: Thiago Jung Bauermann, Petr Vorel, Jessica Yu, Dave Young,
	linux-kselftest, linuxppc-dev, linux-kernel, shuah

Hi Mimi,

On 8/28/19 6:39 AM, Mimi Zohar wrote:
> Detect and allow appended signatures.
> 

Can you please add a couple of more sentences on the feature
and what happens without it? I know this is a test for the
feature, however, it will be useful for users and testers to
know more about this test and the feature it is testing.

Also, are there test skip conditions to be concerned about?

Is there a dependency on another tree or would like me to take
this through kselftest tree?

> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
> ---
>   .../selftests/kexec/test_kexec_file_load.sh        | 38 +++++++++++++++++++---
>   1 file changed, 34 insertions(+), 4 deletions(-)
> 
> diff --git a/tools/testing/selftests/kexec/test_kexec_file_load.sh b/tools/testing/selftests/kexec/test_kexec_file_load.sh
> index fa7c24e8eefb..2ff600388c30 100755
> --- a/tools/testing/selftests/kexec/test_kexec_file_load.sh
> +++ b/tools/testing/selftests/kexec/test_kexec_file_load.sh
> @@ -37,11 +37,20 @@ is_ima_sig_required()
>   	# sequentially.  As a result, a policy rule may be defined, but
>   	# might not necessarily be used.  This test assumes if a policy
>   	# rule is specified, that is the intent.
> +
> +	# First check for appended signature (modsig), then xattr
>   	if [ $ima_read_policy -eq 1 ]; then
>   		check_ima_policy "appraise" "func=KEXEC_KERNEL_CHECK" \
> -			"appraise_type=imasig"
> +			"appraise_type=imasig|modsig"
>   		ret=$?
> -		[ $ret -eq 1 ] && log_info "IMA signature required";
> +		if [ $ret -eq 1 ]; then
> +			log_info "IMA or appended(modsig) signature required"
> +		else
> +			check_ima_policy "appraise" "func=KEXEC_KERNEL_CHECK" \
> +				"appraise_type=imasig"
> +			ret=$?
> +			[ $ret -eq 1 ] && log_info "IMA signature required";
> +		fi
>   	fi
>   	return $ret
>   }
> @@ -84,6 +93,22 @@ check_for_imasig()
>   	return $ret
>   }
>   
> +# Return 1 for appended signature (modsig) found and 0 for not found.
> +check_for_modsig()
> +{
> +	local module_sig_string="~Module signature appended~"
> +	local sig="$(tail --bytes $((${#module_sig_string} + 1)) $KERNEL_IMAGE)"
> +	local ret=0
> +
> +	if [ "$sig" == "$module_sig_string" ]; then
> +		ret=1
> +		log_info "kexec kernel image modsig signed"
> +	else
> +		log_info "kexec kernel image not modsig signed"
> +	fi
> +	return $ret
> +}
> +
>   kexec_file_load_test()
>   {
>   	local succeed_msg="kexec_file_load succeeded"
> @@ -98,7 +123,8 @@ kexec_file_load_test()
>   		# In secureboot mode with an architecture  specific
>   		# policy, make sure either an IMA or PE signature exists.
>   		if [ $secureboot -eq 1 ] && [ $arch_policy -eq 1 ] && \
> -			[ $ima_signed -eq 0 ] && [ $pe_signed -eq 0 ]; then
> +			[ $ima_signed -eq 0 ] && [ $pe_signed -eq 0 ] \
> +			  && [ $ima_modsig -eq 0 ]; then
>   			log_fail "$succeed_msg (missing sig)"
>   		fi
>   
> @@ -107,7 +133,8 @@ kexec_file_load_test()
>   			log_fail "$succeed_msg (missing PE sig)"
>   		fi
>   
> -		if [ $ima_sig_required -eq 1 ] && [ $ima_signed -eq 0 ]; then
> +		if [ $ima_sig_required -eq 1 ] && [ $ima_signed -eq 0 ] \
> +		     && [ $ima_modsig -eq 0 ]; then
>   			log_fail "$succeed_msg (missing IMA sig)"
>   		fi
>   
> @@ -204,5 +231,8 @@ pe_signed=$?
>   check_for_imasig
>   ima_signed=$?
>   
> +check_for_modsig
> +ima_modsig=$?
> +
>   # Test loading the kernel image via kexec_file_load syscall
>   kexec_file_load_test
> 

thanks,
-- Shuah

^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: [PATCH] sefltest/ima: support appended signatures (modsig)
  2019-08-28 14:45 ` shuah
@ 2019-08-28 15:19   ` Mimi Zohar
  0 siblings, 0 replies; 5+ messages in thread
From: Mimi Zohar @ 2019-08-28 15:19 UTC (permalink / raw)
  To: shuah, linux-integrity
  Cc: Thiago Jung Bauermann, Petr Vorel, Jessica Yu, Dave Young,
	linux-kselftest, linuxppc-dev, linux-kernel

On Wed, 2019-08-28 at 08:45 -0600, shuah wrote:
> Hi Mimi,
> 
> On 8/28/19 6:39 AM, Mimi Zohar wrote:
> > Detect and allow appended signatures.
> > 
> 
> Can you please add a couple of more sentences on the feature
> and what happens without it? I know this is a test for the
> feature, however, it will be useful for users and testers to
> know more about this test and the feature it is testing.

I've updated the patch description as requested.  

> Also, are there test skip conditions to be concerned about?

The kexec selftests tests the coordination of the different methods of
verifying the kexec kernel image.  As the appended signature support
is part of IMA, there is no new skip conditions.

> Is there a dependency on another tree or would like me to take
> this through kselftest tree?

I would prefer upstreaming this test with the rest of IMA support for
appended signatures.

thanks,

Mimi


^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: [PATCH] sefltest/ima: support appended signatures (modsig)
  2019-08-28 12:39 [PATCH] sefltest/ima: support appended signatures (modsig) Mimi Zohar
  2019-08-28 13:01 ` Petr Vorel
  2019-08-28 14:45 ` shuah
@ 2019-08-29 16:38 ` Jordan Hand
  2 siblings, 0 replies; 5+ messages in thread
From: Jordan Hand @ 2019-08-29 16:38 UTC (permalink / raw)
  To: Mimi Zohar, linux-integrity
  Cc: Thiago Jung Bauermann, Petr Vorel, Jessica Yu, Dave Young, shuah,
	linux-kselftest, linuxppc-dev, linux-kernel

On 8/28/19 5:39 AM, Mimi Zohar wrote:
> Detect and allow appended signatures.

Ran the tests successfully on x86_64 QEMU

Reviewed-by: Jordan Hand <jorhand@linux.microsoft.com>
Tested-by: Jordan Hand <jorhand@linux.microsoft.com>

^ permalink raw reply	[flat|nested] 5+ messages in thread

end of thread, back to index

Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-08-28 12:39 [PATCH] sefltest/ima: support appended signatures (modsig) Mimi Zohar
2019-08-28 13:01 ` Petr Vorel
2019-08-28 14:45 ` shuah
2019-08-28 15:19   ` Mimi Zohar
2019-08-29 16:38 ` Jordan Hand

Linux-kselftest Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-kselftest/0 linux-kselftest/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-kselftest linux-kselftest/ https://lore.kernel.org/linux-kselftest \
		linux-kselftest@vger.kernel.org linux-kselftest@archiver.kernel.org
	public-inbox-index linux-kselftest

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-kselftest


AGPL code for this site: git clone https://public-inbox.org/ public-inbox