Rewrite tests into new API + fixes

Hi,

changes v2->v3:
* Fixed some of errors caused by test order.

* ima_boot_aggregate
- max event size is now 1MB according to spec

* ima_mmap
- reduce sleep + log it
- rewritten into new API

* ima_measurements.sh
- don't require iversion for kernel >= 4.16
- avoid using tmpfs

* ima_policy.sh
- improved detection of policy writability
- merge test2 and test3

* ima_violations.sh
- avoid using tmpfs
- improved grepping logs (no sleep is needed)

* ima_tpm.sh
- Improve error messages

TODO:
* fix problems with violations tests (see patch 02/10).
* detect whether policy must be signed (currently tests assume the policy does not need to be signed):
https://lists.linux.it/pipermail/ltp/2018-April/007702.html
http://lists.linux.it/pipermail/ltp/2018-January/006970.html

Comments and patches are welcome.

Kind regards,
Petr

Petr Vorel (10):
security/ima: Rewrite tests into new API + fixes security/ima: Change order of tests ima/ima_policy.sh: Improve check of policy writability ima/ima_policy.sh: Load whole policy with cat ima/ima_boot_aggregate: Increase MAX_EVENT_SIZE to 1MB ima/tpm.sh: Use evmctl + other fixes
ima/ima_mmap: Reduce sleep + log it ima/{ima_measurements,ima_violations}.sh: Avoid running on tmpfs
ima: CRYPTO_LIBS are needed only for ima_boot_aggregate ima/ima_mmap: Rewrite to new library

 runtest/ima                                        |   8 +-
 testcases/kernel/security/integrity/.gitignore     |   1 -
 .../kernel/security/integrity/ima/src/Makefile     |   2 +-
 .../integrity/ima/src/ima_boot_aggregate.c         |  16 +-
 .../security/integrity/ima/src/ima_measure.c       | 219 ------------------
 .../kernel/security/integrity/ima/src/ima_mmap.c   |  82 +++----
 .../integrity/ima/tests/ima_measurements.sh        | 247 +++++++++++----------
 .../security/integrity/ima/tests/ima_policy.sh     | 169 ++++++--------
 .../security/integrity/ima/tests/ima_setup.sh      | 141 ++++++------
 .../kernel/security/integrity/ima/tests/ima_tpm.sh | 165 ++++++--------
 .../security/integrity/ima/tests/ima_violations.sh | 228 ++++++++++---------
 11 files changed, 530 insertions(+), 748 deletions(-)
 delete mode 100644 testcases/kernel/security/integrity/ima/src/ima_measure.c
 mode change 100755 => 100644 testcases/kernel/security/integrity/ima/tests/ima_setup.sh

2.16.3

* simplify code, remove duplicity

* ima_measurements.sh:
- add support for "ima-ng" and "ima-sig" IMA measurement templates
- add support for most of hash algorithms is defined in include/uapi/linux/hash_info.h (kernel headers); algorithms are detected from last occurrence of tested file in /sys/kernel/security/ima/ascii_runtime_measurements
- Improve iversion check:
* check i_version mount option only for ext[2-4] filesystems (other filesystems don't report it), TCONF when not mounted with it
* XFS has iversion support from >= V5, TCONF when older version
* previous 2 checks are only for kernel < 4.16 (kernel with commit ac0bf025d2c0 "ima: Use i_version only when filesystem supports it" files on filesystems, which do not support i_version, will now *always* be re-measured, i_version is in this case only a performance improvement)
- chown only UID (GID of nobody is different on some OS, so it's better not to set it as it's not necessary for the test)

* ima_policy.sh:
- break tests instead of print TINFO when kernel is not configured to enable multiple writes to the IMA policy (IMA_WRITE_POLICY)
- add warning when policy has been updated that reboot is needed

* ima_violations.sh:
- change check to measure occurrence of messages in log (previous way to grep tail of the log was buggy)
- verification: add 5 attempts to check log before fail

* ima_tpm.sh
- change TCONF to TINFO in test1 (code behind that was never run)
- make variables local

* runtest file
- rename the test ids to match the shell script names (more descriptive) and remove duplicate whitespace
- change TCONF to TINFO in test2 when TPM not enabled

Thanks a lot to Mimi Zohar for patient review and tips.

---
 runtest/ima                                        |   8 +-
 .../integrity/ima/tests/ima_measurements.sh        | 246 +++++++++++----------
 .../security/integrity/ima/tests/ima_policy.sh     | 153 ++++++-------
 .../security/integrity/ima/tests/ima_setup.sh      | 113 ++++------
 .../kernel/security/integrity/ima/tests/ima_tpm.sh | 142 +++++-------
 .../security/integrity/ima/tests/ima_violations.sh | 224 +++++++++----------
 6 files changed, 423 insertions(+), 463 deletions(-)
 mode change 100755 => 100644 testcases/kernel/security/integrity/ima/tests/ima_setup.sh

index 251458af4..bcae16bb7 100644
@@ -1,5 +1,5 @@
 #DESCRIPTION:Integrity Measurement Architecture (IMA)
-ima01   ima_measurements.sh
-ima02   ima_policy.sh
-ima03   ima_tpm.sh
-ima04   ima_violations.sh
+ima_measurements ima_measurements.sh
+ima_policy ima_policy.sh
+ima_tpm ima_tpm.sh
+ima_violations ima_violations.sh

2.16.3

Hi Mimi,

...

Sorry, I haven't setup machine with IMA signature support yet. So booting with ima_template_fmt=d-ng|n-ng|sig (or kernel with CONFIG_IMA_DEFAULT_TEMPLATE="ima-sig") without any keys generated with evmctl obviously doesn't bring any signatures.

It could be a solution to detect presence of signature for 'ima-sig' with simple counting parameters (5: no signature, 6: signature when ima_template_fmt is not used). And good thing is that line without signature is different: signature part isn't left, but there is and space (' ') for it.

The detection of both indexes (the hash itself and the digest) needs to be bit smarter anyway as imagine someone crazy using ima_template_fmt=d-ng|n-ng|sig|d-ng|n-ng|sig parameter.

Kind regards,
Petr

Unfortunately in some circumstances there are interdependencies between tests.
measurements test require loaded IMA policy. If it's not loaded, policy test do it for us => run measurements test after policy test.

Policy test somehow breaks violations test => run it before policy test.
TODO: this does not help if CONFIG_IMA_WRITE_POLICY=y and without auditd daemon. Maybe we should require auditd for violation tests.

---
Is it caused by using unsigned policy?
This problem haven't been solved by avoiding tmpfs.

---
 runtest/ima | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

index bcae16bb7..e7824a62a 100644
@@ -1,5 +1,5 @@
 #DESCRIPTION:Integrity Measurement Architecture (IMA)
-ima_measurements ima_measurements.sh
+ima_violations ima_violations.sh
 ima_policy ima_policy.sh
+ima_measurements ima_measurements.sh
 ima_tpm ima_tpm.sh
-ima_violations ima_violations.sh

2.16.3

Hi,

...

The original tests assumed a builtin IMA-measurement policy.  Either the boot command line "ima_tcb" or "ima_policy=tcb" options should work.  When checking the "ima_policy" for "tcb", it could be specified anywhere in the list of builtin policies (eg. ima_policy=appraise_tcb|secure_boot|ima).

Mimi

[...]

oops, ima_policy=appraise_tcb|secure_boot|tcb.

Mimi

Hi Mimi,

Thanks for clarification. I'll grep /proc/cmdline it in ima_setup.sh and TCONF if it's not met (I suppose this requirement/assumption is for all 4 tests).

Kind regards,
Petr

+ merge test3 into test2 as we test multiple writes already in test2.

Kernel without CONFIG_IMA_WRITE_POLICY is not possible to repeat writing into policy. Add check to TCONF in this case.

It's not easy to detect disabled CONFIG_IMA_WRITE_POLICY for different behavior across kernel versions.
On older kernels (before CONFIG_IMA_WRITE_POLICY enabled) or on new ones with enabled both CONFIG_IMA_READ_POLICY and CONFIG_IMA_WRITE_POLICY policy file after writing disappears.

Kernels with enabled CONFIG_IMA_READ_POLICY and (regardless of CONFIG_IMA_WRITE_POLICY) keeps policy file with the same permissions
600. The only way to detect is is to echo empty string into policy and detect errno:

       | OLD    | WRITE       | READ && !WRITE | !READ && !WRITE
------------------------------------------------------------------
before | ENOENT | exit code 0 | exit code 0    | exit code 0
after  | EACCES | exit code 0 | EBUSY	       | EACCES

OLD: kernels before CONFIG_IMA_WRITE_POLICY introduced (kernel < 4.5)
READ: CONFIG_IMA_READ_POLICY
WRITE: CONFIG_IMA_WRITE_POLICY

---
 .../security/integrity/ima/tests/ima_policy.sh     | 38 ++++++++++------------
 1 file changed, 17 insertions(+), 21 deletions(-)

index 2efa90038..35eb4055b 100755
@@ -20,15 +20,24 @@
 # Test replacing the default integrity measurement policy.
 
 TST_SETUP="setup"
-TST_CNT=3
+TST_CNT=2
 
 . ima_setup.sh
 
+check_policy_writable()
+{
+	local err="IMA policy already loaded and kernel not configured to enable multiple writes to it (need CONFIG_IMA_WRITE_POLICY=y)"
+
+	[ -f /sys/kernel/security/ima/policy ] || tst_brk TCONF "$err"
+	# CONFIG_IMA_READ_POLICY
+	echo "" 2> log > $IMA_POLICY
+	grep -q "Device or resource busy" log && tst_brk TCONF "$err"
+}
+
 setup()
 {
 	IMA_POLICY="$IMA_DIR/policy"
-	[ -f $IMA_POLICY ] || \
-		tst_brk TCONF "IMA policy already loaded and kernel not configured to enable multiple writes it"
+	check_policy_writable
 
 	VALID_POLICY="$TST_DATAROOT/measure.policy"
 	[ -f $VALID_POLICY ] || tst_brk TCONF "missing $VALID_POLICY"

@@ -68,6 +77,7 @@ test1()
 
 	local p1
 
+	check_policy_writable
 	load_policy $INVALID_POLICY & p1=$!
 	wait "$p1"
 	if [ $? -ne 0 ]; then

@@ -79,10 +89,11 @@ test1()
 
 test2()
 {
-	tst_res TINFO "verify that policy file is not opened concurrently"
+	tst_res TINFO "verify that policy file is not opened concurrently and able to loaded multiple times"
 
 	local p1 p2 rc1 rc2
 
+	check_policy_writable
 	load_policy $VALID_POLICY & p1=$!
 	load_policy $VALID_POLICY & p2=$!
 	wait "$p1"; rc1=$?

@@ -90,24 +101,9 @@ test2()
 	if [ $rc1 -eq 0 ] && [ $rc2 -eq 0 ]; then
 		tst_res TFAIL "policy opened concurrently"
 	elif [ $rc1 -eq 0 ] || [ $rc2 -eq 0 ]; then
-		tst_res TPASS "policy was loaded just by one process"
-	else
-		tst_res TFAIL "problem loading policy"
-	fi
-}
-
-test3()
-{
-	tst_res TINFO "verify that invalid policy isn't loaded"
-
-	local p1
-
-	load_policy $INVALID_POLICY & p1=$!
-	wait "$p1"
-	if [ $? -ne 0 ]; then
-		tst_res TPASS "didn't replace valid policy"
+		tst_res TPASS "policy was loaded just by one process and able to loaded multiple times"
 	else
-		tst_res TFAIL "replaced valid policy"
+		tst_res TFAIL "problem with loading policy (policy should be able to load multiple times)"
 	fi
 }
 

2.16.3

Originally writing the policy was done one rule at a time, but that's not required since kernel 2.6.35 (6ccd04563005 "ima: handle multiple rules per write")

---
 testcases/kernel/security/integrity/ima/tests/ima_policy.sh | 12 ++----------
 1 file changed, 2 insertions(+), 10 deletions(-)

index 35eb4055b..1c4a0b922 100755
@@ -53,17 +53,9 @@ load_policy()
 	exec 2>/dev/null 4>$IMA_POLICY
 	[ $? -eq 0 ] || exit 1
 
-	cat $1 |
-	while read line; do
-		if [ "${line#\#}" = "${line}" ]; then
-			echo "$line" >&4 2> /dev/null
-			if [ $? -ne 0 ]; then
-				exec 4>&-
-				return 1
-			fi
-		fi
-	done
+	cat $1 >&4 2> /dev/null
 	ret=$?
+	exec 4>&-
 
 	[ $ret -eq 0 ] && \
 		tst_res TINFO "IMA policy updated, please reboot after testing to restore settings"

2.16.3

This is needed as according IMA developers there are BIOS events larger than 4k [1]. Actual size for TPM 1.2 is undefined, TPM 2.0 specifies:
"For software parsing the event log, the parser can choose an arbitrary maximum size, but this specification recommends a maximum value for the TCG_PCR_EVENT2.eventSize field of 1MB." [2].

So lets follow the specification and allocate 1MB.

[1] http://lists.linux.it/pipermail/ltp/2018-January/006970.html
[2] http://lists.linux.it/pipermail/ltp/2018-January/007002.html

---
 .../security/integrity/ima/src/ima_boot_aggregate.c      | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

index f7ae77cb1..862cc07ba 100644
@@ -21,6 +21,7 @@
 #include <fcntl.h>
 #include <string.h>
 #include <unistd.h>
+#include <limits.h>
 
 #include "config.h"
 #include "test.h"

@@ -30,7 +31,7 @@ char *TCID = "ima_boot_aggregate";
 #if HAVE_LIBCRYPTO
 #include <openssl/sha.h>
 
-#define MAX_EVENT_SIZE 500
+#define MAX_EVENT_SIZE (1024*1024)
 #define EVENT_HEADER_SIZE 32
 #define MAX_EVENT_DATA_SIZE (MAX_EVENT_SIZE - EVENT_HEADER_SIZE)
 #define NUM_PCRS 8		/*  PCR registers 0-7 in boot aggregate */

@@ -56,7 +57,7 @@ int main(int argc, char *argv[])
 			unsigned char digest[SHA_DIGEST_LENGTH];
 			u_int16_t len;
 		} header;
-		unsigned char data[MAX_EVENT_DATA_SIZE];
+		char *data;
 	} event;
 	struct {
 		unsigned char digest[SHA_DIGEST_LENGTH];

@@ -80,6 +81,12 @@ int main(int argc, char *argv[])
 	for (i = 0; i < NUM_PCRS; i++)
 		memset(&pcr[i].digest, 0, SHA_DIGEST_LENGTH);
 
+	event.data = (char *) malloc(MAX_EVENT_DATA_SIZE);
+	if (!event.data) {
+		printf("Cannot allocate memory\n");
+		return 1;
+	}
+
 	/* Extend the pseudo PCRs with the event digest */
 	while (fread(&event, sizeof(event.header), 1, fp)) {
 		if (debug) {

@@ -90,13 +97,16 @@ int main(int argc, char *argv[])
 		SHA1_Update(&c, pcr[event.header.pcr].digest, 20);
 		SHA1_Update(&c, event.header.digest, 20);
 		SHA1_Final(pcr[event.header.pcr].digest, &c);
+#if MAX_EVENT_DATA_SIZE < USHRT_MAX
 		if (event.header.len > MAX_EVENT_DATA_SIZE) {
-			printf("Error event too long");
+			printf("Error event too long\n");
 			break;
 		}
+#endif
 		fread(event.data, event.header.len, 1, fp);
 	}
 	fclose(fp);
+	free(event.data);
 
 	/* Extend the boot aggregate with the pseudo PCR digest values */
 	memset(&boot_aggregate, 0, SHA_DIGEST_LENGTH);

2.16.3

Hi!

Cyril Hrubis
[email protected]

* Improve TCONF "no TMP support" messages

test1
* Fix reading boot_aggregate for ima-ng

test2
* Fix pcrs paths
* Drop ima_measure binary, use upstream tool evmctl from ima-evm-utils instead
https://git.code.sf.net/p/linux-ima/ima-evm-utils
* Check evmctl in test2 (if it's missing test1 is still being run)

test3
* Dropped, as evmctl has no 'ima_measure --validate` equivalent

---
 testcases/kernel/security/integrity/.gitignore     |   1 -
 .../security/integrity/ima/src/ima_measure.c       | 219 ---------------------
 .../kernel/security/integrity/ima/tests/ima_tpm.sh |  67 ++++---
 3 files changed, 33 insertions(+), 254 deletions(-)
 delete mode 100644 testcases/kernel/security/integrity/ima/src/ima_measure.c

index 1759bc98b..184aa78ce 100644
@@ -1,3 +1,2 @@
 /ima/src/ima_boot_aggregate
-/ima/src/ima_measure
 /ima/src/ima_mmap

2.16.3

Sleep reduced to 3s (30s is way too much).

---
 testcases/kernel/security/integrity/ima/src/ima_mmap.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

index 335f8525c..9045e79a0 100644
@@ -25,6 +25,8 @@
 char *TCID = "ima_mmap";
 int TST_TOTAL = 1;
 
+#define SLEEP_AFTER_CLOSE 3
+
 int main(int argc, char *argv[])
 {
 	int fd;

@@ -47,7 +49,10 @@ int main(int argc, char *argv[])
 		return (-1);
 	}
 	close(fd);
-	sleep(30);
+
+	tst_resm(TINFO, "sleep %ds", SLEEP_AFTER_CLOSE);
+	sleep(SLEEP_AFTER_CLOSE);
+
 	if (munmap(file, 1024) < 0) {
 		perror("unmap");
 		return (-1);

2.16.3

Hi!
Proper synchronization between the processes wouldn't harm here.

FIY: we do have checkpoints for the shell library that can be used both
from C sources as well as shell.

But given how big this patchset is at this point, it can wait for v2 I guess.

Cyril Hrubis
[email protected]

If $TMPDIR is on tmpfs, create loop device, format it to ext3 and run tests in it.

The reason is that measure.policy excludes tmpfs (TMPFS_MAGIC, "dont_measure fsmagic=0x01021994"), but TST_TMPDIR is often on tmpfs filesystem. Lets test on ext3 created on loop device.

http://lists.linux.it/pipermail/ltp/2018-January/006970.html
http://lists.linux.it/pipermail/ltp/2018-March/007488.html

---
 .../integrity/ima/tests/ima_measurements.sh        |  1 +
 .../security/integrity/ima/tests/ima_setup.sh      | 40 ++++++++++++++++++++--
 .../security/integrity/ima/tests/ima_violations.sh |  4 +++
 3 files changed, 42 insertions(+), 3 deletions(-)

index 0bceeb71f..294e29d30 100755
@@ -22,6 +22,7 @@
 TST_NEEDS_CMDS="awk"
 TST_SETUP="setup"
 TST_CNT=3
+TST_NEEDS_DEVICE=1
 
 . ima_setup.sh
 

index c08e2579e..03851167f 100644
@@ -28,6 +28,7 @@ TST_NEEDS_ROOT=1
 
 SYSFS="/sys"
 UMOUNT=
+FS_TYPE="ext3"
 
 mount_helper()
 {

@@ -39,15 +40,30 @@ mount_helper()
 	[ -n "$dir" ] && { echo "$dir"; return; }
 
 	if ! mkdir -p $default_dir; then
-		tst_brk TBROK "Failed to create $default_dir"
+		tst_brk TBROK "failed to create $default_dir"
 	fi
 	if ! mount -t $type $type $default_dir; then
-		tst_brk TBROK "Failed to mount $type"
+		tst_brk TBROK "failed to mount $type"
 	fi
 	UMOUNT="$default_dir $UMOUNT"
 	echo $default_dir
 }
 
+mount_loop_device()
+{
+	local ret
+
+	tst_check_cmds mkfs.$FS_TYPE
+	tst_mkfs $FS_TYPE $TST_DEVICE
+	ROD_SILENT mkdir -p mntpoint
+	mount ${TST_DEVICE} mntpoint
+	ret=$?
+	if [ $ret -ne 0 ]; then
+		tst_brk TBROK "failed to mount device (mount exit = $ret)"
+	fi
+	cd mntpoint
+}
+
 ima_setup()
 {
 	SECURITYFS="$(mount_helper securityfs $SYSFS/kernel/security)"

@@ -57,7 +73,14 @@ ima_setup()
 	ASCII_MEASUREMENTS="$IMA_DIR/ascii_runtime_measurements"
 	BINARY_MEASUREMENTS="$IMA_DIR/binary_runtime_measurements"
 
-	[ -n "$TST_SETUP_CALLER" ] && $TST_SETUP_CALLER
+	if [ "$TST_NEEDS_DEVICE" = 1 ]; then
+		tst_res TINFO "\$TMPDIR is on tmpfs => run on loop device"
+		mount_loop_device
+	fi
+
+	if [ -n "$TST_SETUP_CALLER" ]; then
+		$TST_SETUP_CALLER
+	fi
 }
 
 ima_cleanup()

@@ -66,4 +89,15 @@ ima_cleanup()
 	for dir in $UMOUNT; do
 		umount $dir
 	done
+
+	if [ "$TST_NEEDS_DEVICE" = 1 ]; then
+		cd $TST_TMPDIR
+		tst_umount $TST_DEVICE
+	fi
 }
+
+# loop device is needed to use only for tmpfs
+TMPDIR="${TMPDIR:-/tmp}"
+if [ "$(df -T $TMPDIR | tail -1 | awk '{print $2}')" != "tmpfs" -a -n "$TST_NEEDS_DEVICE" ]; then
+	unset TST_NEEDS_DEVICE
+fi

index 0e9afa7ff..8742f4593 100755
@@ -21,6 +21,7 @@
 
 TST_SETUP="setup"
 TST_CNT=3
+TST_NEEDS_DEVICE=1
 
 . ima_setup.sh
 . daemonlib.sh

@@ -149,6 +150,9 @@ test3()
 	close_file_read
 
 	validate $num_violations $count $search
+
+	# wait for ima_mmap to exit, so we can umount
+	tst_sleep 2s
 }
 
 tst_run

2.16.3

---
 testcases/kernel/security/integrity/ima/src/Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 0f4cf8c12..f7a818578 100644
@@ -24,6 +24,6 @@ top_srcdir		?= ../../../../../..
 
 include $(top_srcdir)/include/mk/testcases.mk
 
-LDLIBS			+= $(CRYPTO_LIBS) -ldl
+ima_boot_aggregate: LDLIBS += $(CRYPTO_LIBS) -ldl
 
 include $(top_srcdir)/include/mk/generic_leaf_target.mk

2.16.3

Filename passed as getopt parameter.

---
 .../kernel/security/integrity/ima/src/ima_mmap.c   | 75 +++++++++++-----------
 .../security/integrity/ima/tests/ima_violations.sh |  2 +-
 2 files changed, 39 insertions(+), 38 deletions(-)

index 9045e79a0..5bc688bd4 100644
@@ -14,48 +14,49 @@
  * Open and mmap a file and sleep. Another process will open the
  * mmapped file in read mode, resulting in a open_writer violation.
  */
-#include <stdio.h>
-#include <string.h>
-#include <unistd.h>
-#include <sys/stat.h>
-#include <sys/mman.h>
-#include <fcntl.h>
-#include "test.h"
 
-char *TCID = "ima_mmap";
-int TST_TOTAL = 1;
+#include "tst_test.h"
 
 #define SLEEP_AFTER_CLOSE 3
+#define MMAPSIZE 1024
 
-int main(int argc, char *argv[])
+static char *filename;
+static void *file;
+static int fd;
+
+static struct tst_option options[] = {
+	{"f:", &filename,
+	 "-f file  File to mmap"},
+	{NULL, NULL, NULL}
+};
+
+static void cleanup(void)
+{
+	if (file)
+		SAFE_MUNMAP(file, MMAPSIZE);
+
+	if (fd > 0)
+		SAFE_CLOSE(fd);
+}
+
+static void run(void)
 {
-	int fd;
-	void *file;
-	char *filename;
-
-	if (argc != 2)
-		printf("%s: filename\n", argv[1]);
-	filename = argv[1];
-
-	fd = open(filename, O_CREAT | O_RDWR, S_IRWXU);
-	if (fd < 0) {
-		perror("open");
-		return (-1);
-	}
-
-	file = mmap(NULL, 1024, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
-	if (file == (void *)-1) {
-		perror("mmap");
-		return (-1);
-	}
-	close(fd);
-
-	tst_resm(TINFO, "sleep %ds", SLEEP_AFTER_CLOSE);
+	if (!filename)
+		tst_brk(TBROK, "Usage: %s -f filename", TCID);
+
+	fd = SAFE_OPEN(filename, O_CREAT | O_RDWR, S_IRWXU);
+
+	file = SAFE_MMAP(NULL, MMAPSIZE, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
+	SAFE_CLOSE(fd);
+
+	tst_res(TINFO, "sleep %ds", SLEEP_AFTER_CLOSE);
 	sleep(SLEEP_AFTER_CLOSE);
 
-	if (munmap(file, 1024) < 0) {
-		perror("unmap");
-		return (-1);
-	}
-	tst_exit();
+	tst_res(TPASS, "test completed");
 }
+
+static struct tst_test test = {
+	.options = options,
+	.test_all = run,
+	.cleanup = cleanup,
+};

index 8742f4593..f3f40d455 100755
@@ -142,7 +142,7 @@ test3()
 
 	echo 'testing testing' > $FILE
 
-	ima_mmap $FILE &
+	ima_mmap -f $FILE &
 	# wait for violations appear in logs
 	tst_sleep 1s
 

2.16.3

Hi!

Cyril Hrubis
[email protected]

This is working nicely!

test: cmdline="ima_policy.sh"
contacts=""
analysis=exit
<<<test_output>>>
ima_policy 1 TINFO: verify that invalid policy isn't loaded ima_policy 1 TPASS: didn't load invalid policy
ima_policy 2 TINFO: verify that policy file is not opened concurrently and able to loaded multiple times
ima_policy 2 TFAIL: problem with loading policy (policy should be able to load multiple times)

For now, could we change "problem with loading policy (policy should be able to load multiple times)" to say, "problem loading or extending policy (may require policy to be signed)"?

I'm also seeing,Â

test: ima_tpm
<<<test_output>>>
ima_tpm 1 TINFO: verify boot aggregate
ima_tpm 1 TPASS: bios aggregate matches IMA boot aggregate ima_tpm 2 TINFO: verify PCR values
ima_tpm 2 TINFO: evmctl version: evmctl 1.0 ima_tpm 2 TINFO: new PCRS path, evmctl >= 1.1 required ima_tpm 2 TINFO: verify PCR (Process Control Register) ima_tpm 2 TFAIL: failed to get PCR-10
ima_tpm 2 TPASS: aggregate PCR value matches real PCR value

It's unclear how the script could fail to get PCR-10, but pass the following test.

Mimi

Hi,

:).

...

Sure, thanks!

Thanks, fixed (wrong return).

Kind regards,
Petr

Hi,

Merged. See diff against v3, if interested. Thanks a lot Mimi for your comments, tips and review.

TODO:

* detect whether policy must be signed (currently tests assume the policy does not need to be signed):
https://lists.linux.it/pipermail/ltp/2018-April/007702.html
http://lists.linux.it/pipermail/ltp/2018-January/006970.html

* ima_violations are failing on logging into /var/log/messages (without auditd):

tst_device.c:83: INFO: Found free device '/dev/loop0'
ima_violations 1 TINFO: /proc/cmdline: BOOT_IMAGE=/vmlinuz-4.10.0-rc6-kaiser root=/dev/mapp er/debian--testing--vg-root ro quiet ima_policy=secure_boot
ima_violations 1 TINFO: IMA kernel config
ima_violations 1 TINFO: CONFIG_IMA=y
ima_violations 1 TINFO: CONFIG_IMA_MEASURE_PCR_IDX=10
ima_violations 1 TINFO: CONFIG_IMA_LSM_RULES=y
ima_violations 1 TINFO: CONFIG_IMA_NG_TEMPLATE=y
ima_violations 1 TINFO: CONFIG_IMA_DEFAULT_TEMPLATE="ima-ng" ima_violations 1 TINFO: CONFIG_IMA_DEFAULT_HASH_SHA1=y
ima_violations 1 TINFO: CONFIG_IMA_DEFAULT_HASH="sha1"
ima_violations 1 TINFO: CONFIG_IMA_WRITE_POLICY=y
ima_violations 1 TINFO: CONFIG_IMA_READ_POLICY=y
ima_violations 1 TINFO: CONFIG_IMA_APPRAISE=y
ima_violations 1 TINFO: CONFIG_IMA_TRUSTED_KEYRING=y
ima_violations 1 TINFO: CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY=y ima_violations 1 TINFO: CONFIG_IMA_BLACKLIST_KEYRING=y
ima_violations 1 TINFO: $TMPDIR is on tmpfs => run on loop device ima_violations 1 TINFO: Formatting /dev/loop0 with ext3 extra opts='' ima_violations 1 TINFO: using log /var/log/messages
ima_violations 1 TINFO: verify open writers violation
ima_violations 1 TINFO: open_writers not found in /var/log/messages (1/3 attempt)... ima_violations 1 TINFO: open_writers not found in /var/log/messages (2/3 attempt)... ima_violations 1 TINFO: open_writers not found in /var/log/messages (3/3 attempt)... ima_violations 1 TFAIL: open_writers not found in /var/log/messages ima_violations 2 TINFO: verify ToMToU violation
ima_violations 2 TINFO: ToMToU not found in /var/log/messages (1/3 attempt)... ima_violations 2 TINFO: ToMToU not found in /var/log/messages (2/3 attempt)... ima_violations 2 TINFO: ToMToU not found in /var/log/messages (3/3 attempt)... ima_violations 2 TFAIL: ToMToU not found in /var/log/messages
...
This is due previous test ima_policy running (when there is not
possible write to policy, e.g. second run of the testsuites on CONFIG_IMA_WRITE_POLICY=n it's ok)
I wonder if we should just TCONF when logging into /var/log/messages with combination of policy being writable (or TCONF when logging into /var/log/messages in any case).

* Check whether current policy has tbc (i.e. presence of "ima_tcb" or "tcb" being part of ima_policy in /proc/cmdline) [1]. I wonder if we should TCONF all tests without tcb (some tests are working

* Getting record with old kernels (tested on both deprecated ima_tbc and ima_policy=tcb):
ima_measurements 1 TINFO: /proc/cmdline: BOOT_IMAGE=/vmlinuz-3.10.0-693.2.2.el7.x86_64 root=/dev/mapper/centos-root ro crashkernel=auto rd.lvm.lv=centos/root rd.lvm.lv=centos/swap rhgb quiet ima_tbc ima_measurements 1 TINFO: IMA kernel config:
ima_measurements 1 TINFO: CONFIG_IMA=y
ima_measurements 1 TINFO: CONFIG_IMA_MEASURE_PCR_IDX=10
ima_measurements 1 TINFO: CONFIG_IMA_AUDIT=y
ima_measurements 1 TINFO: CONFIG_IMA_LSM_RULES=y
ima_measurements 1 TINFO: CONFIG_IMA_APPRAISE=y
ima_measurements 1 TINFO: CONFIG_IMA_TRUSTED_KEYRING=y
ima_measurements 1 TINFO: verify adding record to the IMA measurement list
ima_measurements 1 TFAIL: cannot find measurement for '/tmp/netpan-1253/LTP_ima_measurements.P2uyOze2J4/test.txt'
awk: cmd. line:1: (FILENAME=- FNR=1) fatal: attempt to access field -1
ima_measurements 1 TINFO: computing hash for sha1 digest
ima_measurements 1 TFAIL: hash not found
ima_measurements 2 TINFO: verify updating record in the IMA measurement list
ima_measurements 2 TCONF: XFS Filesystem >= V5 required for iversion support
ima_measurements 3 TINFO: verify not measuring user files
ima_measurements 3 TPASS: grep /tmp/netpan-1253/LTP_ima_measurements.P2uyOze2J4/user/test.txt /sys/kernel/security/ima/ascii_runtime_measurements failed as expected

Not sure if this is caused by different IMA behavior in old kernels or due configuration.

Kind regards,
Petr

[1] https://lists.linux.it/pipermail/ltp/2018-April/007906.html

Diff against v3:

index e7824a62a..bcae16bb7 100644
@@ -1,5 +1,5 @@
 #DESCRIPTION:Integrity Measurement Architecture (IMA)
-ima_violations ima_violations.sh
-ima_policy ima_policy.sh
 ima_measurements ima_measurements.sh
+ima_policy ima_policy.sh
 ima_tpm ima_tpm.sh
+ima_violations ima_violations.sh

index 862cc07ba..f6e7be041 100644
@@ -81,7 +81,7 @@ int main(int argc, char *argv[])
 	for (i = 0; i < NUM_PCRS; i++)
 		memset(&pcr[i].digest, 0, SHA_DIGEST_LENGTH);
 
-	event.data = (char *) malloc(MAX_EVENT_DATA_SIZE);
+	event.data = malloc(MAX_EVENT_DATA_SIZE);
 	if (!event.data) {
 		printf("Cannot allocate memory\n");
 		return 1;

index 1c4a0b922..64aa8cb7a 100755
@@ -95,7 +95,7 @@ test2()
 	elif [ $rc1 -eq 0 ] || [ $rc2 -eq 0 ]; then
 		tst_res TPASS "policy was loaded just by one process and able to loaded multiple times"
 	else
-		tst_res TFAIL "problem with loading policy (policy should be able to load multiple times)"
+		tst_res TFAIL "problem loading or extending policy (may require policy to be signed)"
 	fi
 }
 

index 03851167f..8ea7aec18 100644
@@ -64,6 +64,21 @@ mount_loop_device()
 	cd mntpoint
 }
 
+print_ima_config()
+{
+	local config="/boot/config-$(uname -r)"
+	local i
+
+	tst_res TINFO "/proc/cmdline: $(cat /proc/cmdline)"
+
+	if [ -r "$config" ]; then
+		tst_res TINFO "IMA kernel config:"
+		for i in $(grep ^CONFIG_IMA $config); do
+			tst_res TINFO "$i"
+		done
+	fi
+}
+
 ima_setup()
 {
 	SECURITYFS="$(mount_helper securityfs $SYSFS/kernel/security)"

@@ -73,14 +88,14 @@ ima_setup()
 	ASCII_MEASUREMENTS="$IMA_DIR/ascii_runtime_measurements"
 	BINARY_MEASUREMENTS="$IMA_DIR/binary_runtime_measurements"
 
+	print_ima_config
+
 	if [ "$TST_NEEDS_DEVICE" = 1 ]; then
 		tst_res TINFO "\$TMPDIR is on tmpfs => run on loop device"
 		mount_loop_device
 	fi
 
-	if [ -n "$TST_SETUP_CALLER" ]; then
-		$TST_SETUP_CALLER
-	fi
+	[ -n "$TST_SETUP_CALLER" ] && $TST_SETUP_CALLER
 }
 
 ima_cleanup()

index 0124c338f..0ffc3c022 100755
@@ -69,7 +69,7 @@ validate_pcr()
 		grep 'HW PCR-10:' | awk '{print $3}')"
 	if [ -z "$aggregate_pcr" ]; then
 		tst_res TFAIL "failed to get PCR-10"
-		return
+		return 1
 	fi
 
 	while read line; do

On Fri, 2018-04-27 at 11:51 +0200, Petr Vorel wrote:
[...]

Thank you for working on this and cleaning it up!

If there isn't any policy, then these results would be expected.

For the case of no policy, you could still run the boot-aggregate test.  I'm not sure about any of the other tests.

Even if the system was booted with either of the "tcb" policies, it could still have been replaced with a custom policy.  If we're able to cat the policy, we could verify that the loaded policy includes the "tcb" policy and emit a TCONF warning message for non tcb policies.

For now, perhaps add a general message indicating that the tests assume a tcb policy.

^ima_tcb

Maybe just a typo - ima_tcb, not ima_tbc.

Mimi

Hi Mimi,

No, ima_violations with /var/log/messages are failing even with tcb policy loaded (on kernels >= 4.x).

I'll check which ones are working and not issue TCONF for them.

I understand you as checking /sys/kernel/security/ima/policy (assumes CONFIG_IMA_READ_POLICY) to have content defined in kernel ima_rule_entry default_measurement_rules[] (from ima_policy.c from kernel).

Make sense, I'll add it now.

Yes, that was the reason (silly mistake). On older kernels 3.x only ima_tbc (I'll check kernel versions and let user to know correct variable in TCONF).