From: Petr Vorel <pvorel@suse.cz> To: ltp@lists.linux.it Cc: Petr Vorel <pvorel@suse.cz>, Mimi Zohar <zohar@linux.vnet.ibm.com>, Ignaz Forster <iforster@suse.de>, linux-integrity@vger.kernel.org Subject: [PATCH v4 3/4] ima/ima_measurements.sh: Require builtin IMA tcb policy Date: Thu, 13 Jun 2019 18:14:13 +0200 [thread overview] Message-ID: <20190613161414.29161-4-pvorel@suse.cz> (raw) In-Reply-To: <20190613161414.29161-1-pvorel@suse.cz> Although custom policy which may contain the equivalent measurement tcb rules can be loaded via dracut, systemd or later manually from user space, detecting it would require IMA_READ_POLICY=y. In order to simplify the check and avoid false positives lets ignore this option and require builtin IMA tcb policy. Create check_ima_policy() helper in ima_setup.sh, so it can be reused in other tests. + Use SPDX license identifier Signed-off-by: Petr Vorel <pvorel@suse.cz> --- .../integrity/ima/tests/ima_measurements.sh | 23 ++++---------- .../security/integrity/ima/tests/ima_setup.sh | 30 ++++++++++--------- 2 files changed, 21 insertions(+), 32 deletions(-) diff --git a/testcases/kernel/security/integrity/ima/tests/ima_measurements.sh b/testcases/kernel/security/integrity/ima/tests/ima_measurements.sh index 328affc43..1b9ed85b8 100755 --- a/testcases/kernel/security/integrity/ima/tests/ima_measurements.sh +++ b/testcases/kernel/security/integrity/ima/tests/ima_measurements.sh @@ -1,19 +1,7 @@ #!/bin/sh # Copyright (c) 2009 IBM Corporation -# Copyright (c) 2018 Petr Vorel <pvorel@suse.cz> -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of the GNU General Public License as -# published by the Free Software Foundation; either version 2 of -# the License, or (at your option) any later version. -# -# This program is distributed in the hope that it would be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program. If not, see <http://www.gnu.org/licenses/>. +# Copyright (c) 2018-2019 Petr Vorel <pvorel@suse.cz> +# SPDX-License-Identifier: GPL-2.0-or-later # # Author: Mimi Zohar, zohar@ibm.vnet.ibm.com # @@ -28,16 +16,17 @@ TST_NEEDS_DEVICE=1 setup() { - TEST_FILE="$PWD/test.txt" + check_ima_policy "tcb" + TEST_FILE="$PWD/test.txt" POLICY="$IMA_DIR/policy" [ -f "$POLICY" ] || tst_res TINFO "not using default policy" - DIGEST_INDEX= local template="$(tail -1 $ASCII_MEASUREMENTS | cut -d' ' -f 3)" local i + # parse digest index # https://www.kernel.org/doc/html/latest/security/IMA-templates.html#use case "$template" in ima|ima-ng|ima-sig) DIGEST_INDEX=4 ;; @@ -56,8 +45,6 @@ setup() [ -z "$DIGEST_INDEX" ] && tst_brk TCONF \ "Cannot find digest index (template: '$template')" - - tst_res TINFO "IMA measurement tests assume tcb policy to be loaded (ima_policy=tcb)" } # TODO: find support for rmd128 rmd256 rmd320 wp256 wp384 tgr128 tgr160 diff --git a/testcases/kernel/security/integrity/ima/tests/ima_setup.sh b/testcases/kernel/security/integrity/ima/tests/ima_setup.sh index da49eb1b2..606034fec 100644 --- a/testcases/kernel/security/integrity/ima/tests/ima_setup.sh +++ b/testcases/kernel/security/integrity/ima/tests/ima_setup.sh @@ -1,19 +1,7 @@ #!/bin/sh # Copyright (c) 2009 IBM Corporation -# Copyright (c) 2018 Petr Vorel <pvorel@suse.cz> -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of the GNU General Public License as -# published by the Free Software Foundation; either version 2 of -# the License, or (at your option) any later version. -# -# This program is distributed in the hope that it would be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program. If not, see <http://www.gnu.org/licenses/>. +# Copyright (c) 2018-2019 Petr Vorel <pvorel@suse.cz> +# SPDX-License-Identifier: GPL-2.0-or-later # # Author: Mimi Zohar, zohar@ibm.vnet.ibm.com @@ -31,6 +19,20 @@ SYSFS="/sys" UMOUNT= TST_FS_TYPE="ext3" +check_ima_policy() +{ + local policy="$1" + local i + + grep -q "ima_$policy" /proc/cmdline && return + for i in $(cat /proc/cmdline); do + if grep -q '^ima_policy=' $i; then + grep -e "|[ ]*$policy" -e "$policy[ ]*|" -e "=$policy" $i && return + fi + done + tst_brk TCONF "IMA measurement tests require builtin IMA $policy policy (e.g. ima_policy=$policy kernel parameter)" +} + mount_helper() { local type="$1" -- 2.21.0
WARNING: multiple messages have this Message-ID (diff)
From: Petr Vorel <pvorel@suse.cz> To: ltp@lists.linux.it Subject: [LTP] [PATCH v4 3/4] ima/ima_measurements.sh: Require builtin IMA tcb policy Date: Thu, 13 Jun 2019 18:14:13 +0200 [thread overview] Message-ID: <20190613161414.29161-4-pvorel@suse.cz> (raw) In-Reply-To: <20190613161414.29161-1-pvorel@suse.cz> Although custom policy which may contain the equivalent measurement tcb rules can be loaded via dracut, systemd or later manually from user space, detecting it would require IMA_READ_POLICY=y. In order to simplify the check and avoid false positives lets ignore this option and require builtin IMA tcb policy. Create check_ima_policy() helper in ima_setup.sh, so it can be reused in other tests. + Use SPDX license identifier Signed-off-by: Petr Vorel <pvorel@suse.cz> --- .../integrity/ima/tests/ima_measurements.sh | 23 ++++---------- .../security/integrity/ima/tests/ima_setup.sh | 30 ++++++++++--------- 2 files changed, 21 insertions(+), 32 deletions(-) diff --git a/testcases/kernel/security/integrity/ima/tests/ima_measurements.sh b/testcases/kernel/security/integrity/ima/tests/ima_measurements.sh index 328affc43..1b9ed85b8 100755 --- a/testcases/kernel/security/integrity/ima/tests/ima_measurements.sh +++ b/testcases/kernel/security/integrity/ima/tests/ima_measurements.sh @@ -1,19 +1,7 @@ #!/bin/sh # Copyright (c) 2009 IBM Corporation -# Copyright (c) 2018 Petr Vorel <pvorel@suse.cz> -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of the GNU General Public License as -# published by the Free Software Foundation; either version 2 of -# the License, or (at your option) any later version. -# -# This program is distributed in the hope that it would be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program. If not, see <http://www.gnu.org/licenses/>. +# Copyright (c) 2018-2019 Petr Vorel <pvorel@suse.cz> +# SPDX-License-Identifier: GPL-2.0-or-later # # Author: Mimi Zohar, zohar@ibm.vnet.ibm.com # @@ -28,16 +16,17 @@ TST_NEEDS_DEVICE=1 setup() { - TEST_FILE="$PWD/test.txt" + check_ima_policy "tcb" + TEST_FILE="$PWD/test.txt" POLICY="$IMA_DIR/policy" [ -f "$POLICY" ] || tst_res TINFO "not using default policy" - DIGEST_INDEX= local template="$(tail -1 $ASCII_MEASUREMENTS | cut -d' ' -f 3)" local i + # parse digest index # https://www.kernel.org/doc/html/latest/security/IMA-templates.html#use case "$template" in ima|ima-ng|ima-sig) DIGEST_INDEX=4 ;; @@ -56,8 +45,6 @@ setup() [ -z "$DIGEST_INDEX" ] && tst_brk TCONF \ "Cannot find digest index (template: '$template')" - - tst_res TINFO "IMA measurement tests assume tcb policy to be loaded (ima_policy=tcb)" } # TODO: find support for rmd128 rmd256 rmd320 wp256 wp384 tgr128 tgr160 diff --git a/testcases/kernel/security/integrity/ima/tests/ima_setup.sh b/testcases/kernel/security/integrity/ima/tests/ima_setup.sh index da49eb1b2..606034fec 100644 --- a/testcases/kernel/security/integrity/ima/tests/ima_setup.sh +++ b/testcases/kernel/security/integrity/ima/tests/ima_setup.sh @@ -1,19 +1,7 @@ #!/bin/sh # Copyright (c) 2009 IBM Corporation -# Copyright (c) 2018 Petr Vorel <pvorel@suse.cz> -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of the GNU General Public License as -# published by the Free Software Foundation; either version 2 of -# the License, or (at your option) any later version. -# -# This program is distributed in the hope that it would be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program. If not, see <http://www.gnu.org/licenses/>. +# Copyright (c) 2018-2019 Petr Vorel <pvorel@suse.cz> +# SPDX-License-Identifier: GPL-2.0-or-later # # Author: Mimi Zohar, zohar@ibm.vnet.ibm.com @@ -31,6 +19,20 @@ SYSFS="/sys" UMOUNT= TST_FS_TYPE="ext3" +check_ima_policy() +{ + local policy="$1" + local i + + grep -q "ima_$policy" /proc/cmdline && return + for i in $(cat /proc/cmdline); do + if grep -q '^ima_policy=' $i; then + grep -e "|[ ]*$policy" -e "$policy[ ]*|" -e "=$policy" $i && return + fi + done + tst_brk TCONF "IMA measurement tests require builtin IMA $policy policy (e.g. ima_policy=$policy kernel parameter)" +} + mount_helper() { local type="$1" -- 2.21.0
next prev parent reply other threads:[~2019-06-13 16:14 UTC|newest] Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top 2019-06-13 16:14 [PATCH v4 0/4] LTP reproducer on broken IMA on overlayfs Petr Vorel 2019-06-13 16:14 ` [LTP] " Petr Vorel 2019-06-13 16:14 ` [PATCH v4 1/4] ima: Call test's cleanup inside ima_setup.sh cleanup Petr Vorel 2019-06-13 16:14 ` [LTP] " Petr Vorel 2019-06-13 16:14 ` [PATCH v4 2/4] shell: Add $TST_DEVICE as default parameter to tst_umount Petr Vorel 2019-06-13 16:14 ` [LTP] " Petr Vorel 2019-06-13 16:14 ` Petr Vorel [this message] 2019-06-13 16:14 ` [LTP] [PATCH v4 3/4] ima/ima_measurements.sh: Require builtin IMA tcb policy Petr Vorel 2019-06-13 16:42 ` Ignaz Forster 2019-06-13 16:42 ` [LTP] " Ignaz Forster 2019-06-13 16:14 ` [PATCH v4 4/4] ima: Add overlay test + doc Petr Vorel 2019-06-13 16:14 ` [LTP] " Petr Vorel 2019-06-13 17:00 ` Ignaz Forster 2019-06-13 17:00 ` [LTP] " Ignaz Forster 2019-06-14 14:14 ` Petr Vorel 2019-06-14 14:14 ` [LTP] " Petr Vorel 2019-06-14 14:37 ` Ignaz Forster 2019-06-14 14:37 ` [LTP] " Ignaz Forster 2019-06-14 14:46 ` Petr Vorel 2019-06-14 14:46 ` [LTP] " Petr Vorel 2019-06-18 13:59 ` Petr Vorel 2019-06-18 13:59 ` Petr Vorel
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20190613161414.29161-4-pvorel@suse.cz \ --to=pvorel@suse.cz \ --cc=iforster@suse.de \ --cc=linux-integrity@vger.kernel.org \ --cc=ltp@lists.linux.it \ --cc=zohar@linux.vnet.ibm.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.