Skip to contentSkip to conversation

ima: Add test for selinux measurement

PATCH In review Lakshmi Ramasubramanian 2 participants 8 messages Sep 28, 2020 – Dec 22, 2020 Keys-trusted

lore
Share & tools
lore

Lakshmi Ramasubramanian

author
#0 lore raw

cover ima: Add test for selinux measurement

New functionality is being added to IMA to measure data provided by kernel components. With this feature, IMA policy can be set to enable measuring data provided by Linux Security Modules (LSM). Currently one such LSM namely selinux is being updated to use this functionality. This new functionality needs test automation in LTP.

This patch set adds tests which verify that the IMA subsystem correctly measures the data provided by selinux.

This patch is based on
commit 286401a1c1f3 ("thp04: Add linux tag")
in "master" branch in https://github.com/linux-test-project/ltp

This patch is dependent on the following patch series in LTP
https://patchwork.kernel.org/patch/11802771/

This series needs a kernel built on the following repo/branch/patches:
repo: https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux.git
branch: next
commit 8861d0af642c ("selinux: Add helper functions to get and set checkreqprot")

And the following patch series should be applied in the following order:
1, https://patchwork.kernel.org/patch/11709527/
2, https://patchwork.kernel.org/patch/11795559/
3, https://patchwork.kernel.org/patch/11801525/
4, https://patchwork.kernel.org/patch/11801585/

Lakshmi Ramasubramanian (1):
ima: Add test for selinux measurement

 runtest/ima                                   |   2 +
 .../kernel/security/integrity/ima/README.md   |  19 +++
 .../integrity/ima/tests/ima_selinux_policy.sh |  72 ++++++++++
 .../integrity/ima/tests/ima_selinux_state.sh  | 136 ++++++++++++++++++
 .../security/integrity/ima/tests/ima_setup.sh |  28 ++++
 5 files changed, 257 insertions(+)
 create mode 100755 testcases/kernel/security/integrity/ima/tests/ima_selinux_policy.sh
 create mode 100755 testcases/kernel/security/integrity/ima/tests/ima_selinux_state.sh
Signature · 1 line
2.28.0
author
#1 lore raw

PATCH 1/1 ima: Add test for selinux measurement

New functionality is being added to IMA to measure data provided by kernel components. With this feature, IMA policy can be set to enable measuring data provided by Linux Security Modules (LSM). Currently one such LSM namely selinux is being updated to use this functionality. This new functionality needs test automation in LTP.

Add test cases which verify that the IMA subsystem correctly measures the data provided by selinux.

Signed-off-by Lakshmi Ramasubramanian <[email protected]>
---
 runtest/ima                                   |   2 +
 .../kernel/security/integrity/ima/README.md   |  19 +++
 .../integrity/ima/tests/ima_selinux_policy.sh |  72 ++++++++++
 .../integrity/ima/tests/ima_selinux_state.sh  | 136 ++++++++++++++++++
 .../security/integrity/ima/tests/ima_setup.sh |  28 ++++
 5 files changed, 257 insertions(+)
 create mode 100755 testcases/kernel/security/integrity/ima/tests/ima_selinux_policy.sh
 create mode 100755 testcases/kernel/security/integrity/ima/tests/ima_selinux_state.sh
runtest/ima +2 -0
index 123b6c8b0..8e60bf629 100644
@@ -5,5 +5,7 @@ ima_tpm ima_tpm.sh
 ima_violations ima_violations.sh
 ima_keys ima_keys.sh
 ima_kexec ima_kexec.sh
+ima_selinux_state ima_selinux_state.sh
+ima_selinux_policy ima_selinux_policy.sh
 ima_dm_crypt ima_dm_crypt.sh
 evm_overlay evm_overlay.sh
testcases/kernel/security/integrity/ima/README.md +19 -0
index 007662fae..c0644b083 100644
@@ -37,6 +37,25 @@ see example in `kexec.policy`.
 The test attempts to kexec the existing running kernel image.
 To kexec a different kernel image export `IMA_KEXEC_IMAGE=<pathname>`.
 
+### IMA SELinux test
+
+To enable IMA to measure SELinux state and policy, `ima_selinux_policy.sh`
+and `ima_selinux_state.sh` require a readable IMA policy, as well as
+a loaded measure policy with
+`measure func=CRITICAL_DATA data_sources=selinux template=ima-buf`
+
+As well as what's required for the IMA tests, SELinux tests require reading
+the IMA policy allowed in the kernel configuration:
+```
+CONFIG_IMA_READ_POLICY=y
+
+```
+The following kernel configuration is also required. It enables compiling
+the Linux Security Module (LSM) namely SELinux.
+```
+CONFIG_SECURITY_SELINUX=y
+```
+
 ### IMA DM target (dm-crypt) measurement test
 
 To enable IMA to measure device-mapper target - dm-crypt,
testcases/kernel/security/integrity/ima/tests/ima_selinux_policy.sh new file +72 -0

72 lines not on this page · raw message

testcases/kernel/security/integrity/ima/tests/ima_selinux_state.sh new file +136 -0

136 lines not on this page · raw message

testcases/kernel/security/integrity/ima/tests/ima_setup.sh +28 -0
index 2841d7df5..1d7dca086 100644
@@ -186,6 +186,33 @@ require_ima_policy_cmdline()
 	tst_brk TCONF "IMA measurement tests require builtin IMA $policy policy (e.g. ima_policy=$policy kernel parameter)"
 }
 
+#
+# Update selinux state. This is used for validating IMA
+# measurement of selinux constructs.
+#
+update_selinux_state()
+{
+	local cur_val new_val
+
+	cur_val=$(cat $SELINUX_FOLDER/checkreqprot)
+
+	if [ $cur_val = 1 ]; then
+		new_val=0
+	else
+		new_val=1
+	fi
+
+	echo $new_val > $SELINUX_FOLDER/checkreqprot
+}
+
+#
+# Verify selinux is enabled in the system
+#
+check_selinux_state()
+{
+	[ -d $SELINUX_FOLDER ] || tst_brk TCONF "selinux is not enabled"
+}
+
 mount_helper()
 {
 	local type="$1"

@@ -238,6 +265,7 @@ ima_setup()
 	ASCII_MEASUREMENTS="$IMA_DIR/ascii_runtime_measurements"
 	BINARY_MEASUREMENTS="$IMA_DIR/binary_runtime_measurements"
 	IMA_POLICY="$IMA_DIR/policy"
+	SELINUX_FOLDER="$SYSFS/fs/selinux"
 
 	# hack to support running tests locally from ima/tests directory
 	if [ ! -d "$TST_DATAROOT" ]; then
Signature · 1 line
2.28.0
#2 lore raw

Hi Lakshmi, Mimi, all,

@Lakshmi
TL;DR: I added some fixes in my fork, branch ima/selinux.v2.draft,
https://github.com/pevik/ltp/commits/ima/selinux.v2.draft

+ added 3 additional commits, one of them as you as the author. I moved some functions to testcases/lib/tst_security.sh, renamed them. Can you please have a look and test? I don't have any SELinux machine.

@Mimi, all: any comment to this test? My changes are just LTP cleanup so you can comment it on this patchset.
I suppose you get to this in January.

Some notes for my changes:

As files are quite similar (checks etc), I put both tests into single file ima_selinux.sh.

Quoted 8 lines

New functionality is being added to IMA to measure data provided by kernel components. With this feature, IMA policy can be set to enable measuring data provided by Linux Security Modules (LSM). Currently one such LSM namely selinux is being updated to use this functionality. This new functionality needs test automation in LTP.

Add test cases which verify that the IMA subsystem correctly measures the data provided by selinux.

Could you please put into commit message and test kernel commit hash relevant for the test. Is that 8861d0af642c646c8e148ce34c294bdef6f32f6a (merged into v5.10-rc1) or there are more relevant commits?

...

testcases/kernel/security/integrity/ima/README.md see example in `kexec.policy`. · line 45

Quoted 6 lines
testcases/kernel/security/integrity/ima/README.md +6 -0
+### IMA SELinux test
+
+To enable IMA to measure SELinux state and policy, `ima_selinux_policy.sh`
+and `ima_selinux_state.sh` require a readable IMA policy, as well as
+a loaded measure policy with
+`measure func=CRITICAL_DATA data_sources=selinux template=ima-buf`

I put this into testcases/kernel/security/integrity/ima/datafiles/ima_selinux/selinux.policy and mention it in docs.

Quoted 5 lines
testcases/kernel/security/integrity/ima/tests/ima_selinux_policy.sh new file +5 -0
+test1()
+{
+	local policy_digest expected_policy_digest algorithm
+	local data_source_name="selinux"
+	local pattern="data_sources=[^[:space:]]*$data_source_name"

testcases/kernel/security/integrity/ima/tests/ima_selinux_policy.sh line 45

Quoted 10 lines
testcases/kernel/security/integrity/ima/tests/ima_selinux_policy.sh new file +10 -0
+	local tmp_file="$TST_TMPDIR/selinux_policy_tmp_file.txt"
+
+	check_policy_pattern "$pattern" $FUNC_CRITICAL_DATA $TEMPLATE_BUF > $tmp_file || return
+
+	tst_res TINFO "Verifying selinux policy measurement"
+
+	#
+	# Trigger a measurement by changing selinux state
+	#
+	update_selinux_state

Here I used tst_update_selinux_state.

...

Quoted 18 lines

--- a/testcases/kernel/security/integrity/ima/tests/ima_setup.sh

testcases/kernel/security/integrity/ima/tests/ima_setup.sh +16 -0
+#
+# Update selinux state. This is used for validating IMA
+# measurement of selinux constructs.
+#
+update_selinux_state()
+{
+	local cur_val new_val
+
+	cur_val=$(cat $SELINUX_FOLDER/checkreqprot)
+
+	if [ $cur_val = 1 ]; then
+		new_val=0
+	else
+		new_val=1
+	fi
+

testcases/kernel/security/integrity/ima/tests/ima_setup.sh require_ima_policy_cmdline() · line 214

Quoted 10 lines
testcases/kernel/security/integrity/ima/tests/ima_setup.sh +10 -0
+	echo $new_val > $SELINUX_FOLDER/checkreqprot
+}
+
+#
+# Verify selinux is enabled in the system
+#
+check_selinux_state()
+{
+	[ -d $SELINUX_FOLDER ] || tst_brk TCONF "selinux is not enabled"
+}

As I mentioned above, this is not needed as I put them under different names in testcases/lib/tst_security.sh.

testcases/kernel/security/integrity/ima/tests/ima_setup.sh ima_setup() · line 268

Quoted 8 lines

mount_helper()
{

testcases/kernel/security/integrity/ima/tests/ima_setup.sh +1 -0
 	local type="$1"

@@ -238,6 +265,7 @@ ima_setup()
 	ASCII_MEASUREMENTS="$IMA_DIR/ascii_runtime_measurements"
 	BINARY_MEASUREMENTS="$IMA_DIR/binary_runtime_measurements"
 	IMA_POLICY="$IMA_DIR/policy"
+	SELINUX_FOLDER="$SYSFS/fs/selinux"

nit: I renamed it to $SELINUX_DIR (for consistency with $IMA_DIR) and moved to ima_selinux.sh.

Kind regards,
Petr

author
#3 lore raw

On 12/18/20 10:37 AM, Petr Vorel wrote:

Hi Petr,

Quoted 8 lines

@Lakshmi
TL;DR: I added some fixes in my fork, branch ima/selinux.v2.draft,
https://github.com/pevik/ltp/commits/ima/selinux.v2.draft

+ added 3 additional commits, one of them as you as the author. I moved some functions to testcases/lib/tst_security.sh, renamed them. Can you please have a look and test? I don't have any SELinux machine.

I'll take a look at the changes in your branch and test it with SELinux enabled.

Quoted 9 lines

@Mimi, all: any comment to this test? My changes are just LTP cleanup so you can comment it on this patchset.
I suppose you get to this in January.

Some notes for my changes:

As files are quite similar (checks etc), I put both tests into single file ima_selinux.sh.

This should be fine.

The reason I put the tests in different files was because I couldn't find a way to run the tests independently (i mean - say, run the SELinux policy measurement test but not the state measurement test or vice-versa).

Quoted 7 lines
Quoted 6 lines

New functionality is being added to IMA to measure data provided by kernel components. With this feature, IMA policy can be set to enable measuring data provided by Linux Security Modules (LSM). Currently one such LSM namely selinux is being updated to use this functionality. This new functionality needs test automation in LTP.

Quoted 6 lines
Quoted 2 lines

Add test cases which verify that the IMA subsystem correctly measures the data provided by selinux.

Could you please put into commit message and test kernel commit hash relevant for the test. Is that 8861d0af642c646c8e148ce34c294bdef6f32f6a (merged into v5.10-rc1) or there are more relevant commits?

The IMA hook to measure kernel critical data + SELinux measurement changes are still being reviewed. Tushar has posted v9 of the patch set.

Quoted 11 lines

...

testcases/kernel/security/integrity/ima/README.md see example in `kexec.policy`. · line 45

Quoted 6 lines
testcases/kernel/security/integrity/ima/README.md +6 -0
+### IMA SELinux test
+
+To enable IMA to measure SELinux state and policy, `ima_selinux_policy.sh`
+and `ima_selinux_state.sh` require a readable IMA policy, as well as
+a loaded measure policy with
+`measure func=CRITICAL_DATA data_sources=selinux template=ima-buf`

I put this into testcases/kernel/security/integrity/ima/datafiles/ima_selinux/selinux.policy and mention it in docs.

Sounds good - Thanks.

"template=ima_buf" is no longer needed in the IMA policy rule since "ima_buf" is the default template for buffer measurement now. I will update "datafiles/ima_selinux/selinux.policy" file.

Quoted 17 lines
Quoted 6 lines
testcases/kernel/security/integrity/ima/tests/ima_selinux_policy.sh new file +5 -0
+test1()
+{
+	local policy_digest expected_policy_digest algorithm
+	local data_source_name="selinux"
+	local pattern="data_sources=[^[:space:]]*$data_source_name"

testcases/kernel/security/integrity/ima/tests/ima_selinux_policy.sh line 45

Quoted 10 lines
testcases/kernel/security/integrity/ima/tests/ima_selinux_policy.sh new file +10 -0
+	local tmp_file="$TST_TMPDIR/selinux_policy_tmp_file.txt"
+
+	check_policy_pattern "$pattern" $FUNC_CRITICAL_DATA $TEMPLATE_BUF > $tmp_file || return
+
+	tst_res TINFO "Verifying selinux policy measurement"
+
+	#
+	# Trigger a measurement by changing selinux state
+	#
+	update_selinux_state

Here I used tst_update_selinux_state.

okay.

Quoted 25 lines

...

Quoted 23 lines

--- a/testcases/kernel/security/integrity/ima/tests/ima_setup.sh

testcases/kernel/security/integrity/ima/tests/ima_setup.sh +21 -0
+#
+# Update selinux state. This is used for validating IMA
+# measurement of selinux constructs.
+#
+update_selinux_state()
+{
+	local cur_val new_val
+
+	cur_val=$(cat $SELINUX_FOLDER/checkreqprot)
+
+	if [ $cur_val = 1 ]; then
+		new_val=0
+	else
+		new_val=1
+	fi
+
+	echo $new_val > $SELINUX_FOLDER/checkreqprot
+}
+
+#
+# Verify selinux is enabled in the system
Quoted 8 lines

testcases/kernel/security/integrity/ima/tests/ima_setup.sh require_ima_policy_cmdline() · line 214

Quoted 5 lines
testcases/kernel/security/integrity/ima/tests/ima_setup.sh +5 -0
+#
+check_selinux_state()
+{
+	[ -d $SELINUX_FOLDER ] || tst_brk TCONF "selinux is not enabled"
+}

As I mentioned above, this is not needed as I put them under different names in testcases/lib/tst_security.sh.

okay.

Quoted 12 lines

testcases/kernel/security/integrity/ima/tests/ima_setup.sh ima_setup() · line 268

Quoted 9 lines
  mount_helper()
  {
  	local type="$1"
testcases/kernel/security/integrity/ima/tests/ima_setup.sh +1 -0
@@ -238,6 +265,7 @@ ima_setup()
  	ASCII_MEASUREMENTS="$IMA_DIR/ascii_runtime_measurements"
  	BINARY_MEASUREMENTS="$IMA_DIR/binary_runtime_measurements"
  	IMA_POLICY="$IMA_DIR/policy"
+	SELINUX_FOLDER="$SYSFS/fs/selinux"

nit: I renamed it to $SELINUX_DIR (for consistency with $IMA_DIR) and moved to ima_selinux.sh.

okay.

Thanks a lot for your help Petr. Appreciate it.

-lakshmi

#4 lore raw

Hi Lakshmi,

Quoted 8 lines · Petr Vorel

Hi Petr,

Quoted 3 lines

@Lakshmi
TL;DR: I added some fixes in my fork, branch ima/selinux.v2.draft,
https://github.com/pevik/ltp/commits/ima/selinux.v2.draft

Quoted 6 lines
Quoted 3 lines

+ added 3 additional commits, one of them as you as the author. I moved some functions to testcases/lib/tst_security.sh, renamed them. Can you please have a look and test? I don't have any SELinux machine.

I'll take a look at the changes in your branch and test it with SELinux enabled.

Thanks!

Quoted 6 lines
Quoted 5 lines

@Mimi, all: any comment to this test? My changes are just LTP cleanup so you can comment it on this patchset.
I suppose you get to this in January.

Some notes for my changes:

Quoted 7 lines
Quoted 2 lines

As files are quite similar (checks etc), I put both tests into single file ima_selinux.sh.

This should be fine.

The reason I put the tests in different files was because I couldn't find a way to run the tests independently (i mean - say, run the SELinux policy measurement test but not the state measurement test or vice-versa).

Why do you need to run just one of them?
If you really need to separate them (e.g. to require different OS setup for each) you could have 2 functions in single file, but run only one of them (TST_CNT not set, which means TST_CNT=1), doing selection with getopt switch?
https://github.com/linux-test-project/ltp/wiki/Test-Writing-Guidelines#233-optional-command-line-parameters

Quoted 9 lines
Quoted 8 lines
Quoted 8 lines

New functionality is being added to IMA to measure data provided by kernel components. With this feature, IMA policy can be set to enable measuring data provided by Linux Security Modules (LSM). Currently one such LSM namely selinux is being updated to use this functionality. This new functionality needs test automation in LTP.

Add test cases which verify that the IMA subsystem correctly measures the data provided by selinux.

Quoted 6 lines
Quoted 3 lines

Could you please put into commit message and test kernel commit hash relevant for the test. Is that 8861d0af642c646c8e148ce34c294bdef6f32f6a (merged into v5.10-rc1) or there are more relevant commits?

The IMA hook to measure kernel critical data + SELinux measurement changes are still being reviewed. Tushar has posted v9 of the patch set.

Thanks for info (note for myself:
https://lore.kernel.org/linux-integrity/[email protected]/)
OK, not yet merged to mainline. It's good you send patches early (speed up the inclusion to LTP), but we should merge them into LTP once it's at least already in Mimi tree prepared for sending to Linus.

Feel free to Cc me in your next kernel patches (It *can* help to speedup the inclusion to LTP).

Quoted 10 lines
Quoted 10 lines

...

testcases/kernel/security/integrity/ima/README.md see example in `kexec.policy`. · line 45

Quoted 6 lines
testcases/kernel/security/integrity/ima/README.md +6 -0
+### IMA SELinux test
+
+To enable IMA to measure SELinux state and policy, `ima_selinux_policy.sh`
+and `ima_selinux_state.sh` require a readable IMA policy, as well as
+a loaded measure policy with
+`measure func=CRITICAL_DATA data_sources=selinux template=ima-buf`

I put this into testcases/kernel/security/integrity/ima/datafiles/ima_selinux/selinux.policy and mention it in docs.

Quoted 5 lines

Sounds good - Thanks.

"template=ima_buf" is no longer needed in the IMA policy rule since "ima_buf" is the default template for buffer measurement now. I will update "datafiles/ima_selinux/selinux.policy" file.

+1

...

Quoted 1 line

Thanks a lot for your help Petr. Appreciate it.

yw, thanks for your contributions.

Quoted 1 line

-lakshmi

Petr

author
#5 lore raw
Quoted 27 lines · Petr Vorel
Quoted 11 lines
Quoted 8 lines

@Lakshmi
TL;DR: I added some fixes in my fork, branch ima/selinux.v2.draft,
https://github.com/pevik/ltp/commits/ima/selinux.v2.draft

+ added 3 additional commits, one of them as you as the author. I moved some functions to testcases/lib/tst_security.sh, renamed them. Can you please have a look and test? I don't have any SELinux machine.

I'll take a look at the changes in your branch and test it with SELinux enabled.

Thanks!

Quoted 6 lines
Quoted 5 lines

@Mimi, all: any comment to this test? My changes are just LTP cleanup so you can comment it on this patchset.
I suppose you get to this in January.

Some notes for my changes:

Quoted 7 lines
Quoted 2 lines

As files are quite similar (checks etc), I put both tests into single file ima_selinux.sh.

This should be fine.

The reason I put the tests in different files was because I couldn't find a way to run the tests independently (i mean - say, run the SELinux policy measurement test but not the state measurement test or vice-versa).

Quoted 5 lines

Why do you need to run just one of them?
If you really need to separate them (e.g. to require different OS setup for each) you could have 2 functions in single file, but run only one of them (TST_CNT not set, which means TST_CNT=1), doing selection with getopt switch?
https://github.com/linux-test-project/ltp/wiki/Test-Writing-Guidelines#233-optional-command-line-parameters

This is good to know Petr. Thanks for the info.

Quoted 16 lines
Quoted 10 lines
Quoted 9 lines
Quoted 9 lines

New functionality is being added to IMA to measure data provided by kernel components. With this feature, IMA policy can be set to enable measuring data provided by Linux Security Modules (LSM). Currently one such LSM namely selinux is being updated to use this functionality. This new functionality needs test automation in LTP.

Add test cases which verify that the IMA subsystem correctly measures the data provided by selinux.

Quoted 6 lines
Quoted 3 lines

Could you please put into commit message and test kernel commit hash relevant for the test. Is that 8861d0af642c646c8e148ce34c294bdef6f32f6a (merged into v5.10-rc1) or there are more relevant commits?

The IMA hook to measure kernel critical data + SELinux measurement changes are still being reviewed. Tushar has posted v9 of the patch set.

Quoted 7 lines

Thanks for info (note for myself:
https://lore.kernel.org/linux-integrity/[email protected]/)
OK, not yet merged to mainline. It's good you send patches early (speed up the inclusion to LTP), but we should merge them into LTP once it's at least already in Mimi tree prepared for sending to Linus.

Feel free to Cc me in your next kernel patches (It *can* help to speedup the inclusion to LTP).

Definitely.

Quoted 17 lines
Quoted 11 lines
Quoted 11 lines

...

testcases/kernel/security/integrity/ima/README.md see example in `kexec.policy`. · line 45

Quoted 6 lines
testcases/kernel/security/integrity/ima/README.md +6 -0
+### IMA SELinux test
+
+To enable IMA to measure SELinux state and policy, `ima_selinux_policy.sh`
+and `ima_selinux_state.sh` require a readable IMA policy, as well as
+a loaded measure policy with
+`measure func=CRITICAL_DATA data_sources=selinux template=ima-buf`

I put this into testcases/kernel/security/integrity/ima/datafiles/ima_selinux/selinux.policy and mention it in docs.

Quoted 5 lines

Sounds good - Thanks.

"template=ima_buf" is no longer needed in the IMA policy rule since "ima_buf" is the default template for buffer measurement now. I will update "datafiles/ima_selinux/selinux.policy" file.

Quoted 7 lines

+1

...

Quoted 1 line

Thanks a lot for your help Petr. Appreciate it.

yw, thanks for your contributions.

thanks,
-lakshmi

#6 lore raw
In reply to Lakshmi Ramasubramanian

Hi Lakshmi,

Thanks for your patch. FYI I'll try to have look ASAP, but as there is LTP freeze and work needed to review fixes before release I'll probably review this after the release (1, max. 2 weeks).

Could you please have a look at fix planned to be part of the release?
https://patchwork.ozlabs.org/project/ltp/list/?series=204230

Kind regards,
Petr

Quoted 9 lines

New functionality is being added to IMA to measure data provided by kernel components. With this feature, IMA policy can be set to enable measuring data provided by Linux Security Modules (LSM). Currently one such LSM namely selinux is being updated to use this functionality. This new functionality needs test automation in LTP.

This patch set adds tests which verify that the IMA subsystem correctly measures the data provided by selinux.

Quoted 6 lines

This patch is based on
commit 286401a1c1f3 ("thp04: Add linux tag")
in "master" branch in https://github.com/linux-test-project/ltp

This patch is dependent on the following patch series in LTP
https://patchwork.kernel.org/patch/11802771/

I put link to LTP patchwork to avoid the confusion.
https://patchwork.ozlabs.org/project/ltp/list/?series=204486

Quoted 4 lines

This series needs a kernel built on the following repo/branch/patches:
repo: https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux.git
branch: next
commit 8861d0af642c ("selinux: Add helper functions to get and set checkreqprot")

Thanks for adding this info. It'd be great if it were part of kernel commit message and also added as a comment in the test itself (we don't want to get it lost).

BTW LTP has 2 kind ways of handling of kernel versions:

* fixes which are meant to be backported to the stable trees:
In C API it looks like (here also with CVE entry):
https://github.com/linux-test-project/ltp/blob/master/testcases/kernel/syscalls/bpf/bpf_prog03.c#L187

.tags = (const struct tst_tag[]) {
		{"linux-git", "95a762e2c8c9"},
		{"CVE", "2017-16995"},
		{}

This is not part of shell API, but I'll add it after the release. Thus we don't want to loose this info.

* new kernel features, which are likely not to be backported
You either have some way to detect this feature is presented (ideally) or you specify kernel version since it should be run
This is used in shell API as:
https://github.com/linux-test-project/ltp/blob/master/testcases/network/tcp_cc/bbr02.sh#L8
TST_MIN_KVER="4.13"

Quoted 5 lines

And the following patch series should be applied in the following order:
1, https://patchwork.kernel.org/patch/11709527/
2, https://patchwork.kernel.org/patch/11795559/
3, https://patchwork.kernel.org/patch/11801525/
4, https://patchwork.kernel.org/patch/11801585/

Kind regards,
Petr

author
#7 lore raw
Quoted 9 lines · Petr Vorel

Hi Lakshmi,

Thanks for your patch. FYI I'll try to have look ASAP, but as there is LTP freeze and work needed to review fixes before release I'll probably review this after the release (1, max. 2 weeks).

Could you please have a look at fix planned to be part of the release?
https://patchwork.ozlabs.org/project/ltp/list/?series=204230

Will do Petr.

Quoted 10 lines
Quoted 9 lines

New functionality is being added to IMA to measure data provided by kernel components. With this feature, IMA policy can be set to enable measuring data provided by Linux Security Modules (LSM). Currently one such LSM namely selinux is being updated to use this functionality. This new functionality needs test automation in LTP.

This patch set adds tests which verify that the IMA subsystem correctly measures the data provided by selinux.

Quoted 8 lines
Quoted 6 lines

This patch is based on
commit 286401a1c1f3 ("thp04: Add linux tag")
in "master" branch in https://github.com/linux-test-project/ltp

This patch is dependent on the following patch series in LTP
https://patchwork.kernel.org/patch/11802771/

I put link to LTP patchwork to avoid the confusion.
https://patchwork.ozlabs.org/project/ltp/list/?series=204486

Thanks. On the next update I'll add the LTP patchwork URL.

Quoted 21 lines
Quoted 5 lines

This series needs a kernel built on the following repo/branch/patches:
repo: https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux.git
branch: next
commit 8861d0af642c ("selinux: Add helper functions to get and set checkreqprot")

Thanks for adding this info. It'd be great if it were part of kernel commit message and also added as a comment in the test itself (we don't want to get it lost).

BTW LTP has 2 kind ways of handling of kernel versions:

* fixes which are meant to be backported to the stable trees:
In C API it looks like (here also with CVE entry):
https://github.com/linux-test-project/ltp/blob/master/testcases/kernel/syscalls/bpf/bpf_prog03.c#L187

.tags = (const struct tst_tag[]) {
		{"linux-git", "95a762e2c8c9"},
		{"CVE", "2017-16995"},
		{}

This is not part of shell API, but I'll add it after the release. Thus we don't want to loose this info.

Quoted 6 lines

* new kernel features, which are likely not to be backported
You either have some way to detect this feature is presented (ideally) or you specify kernel version since it should be run
This is used in shell API as:
https://github.com/linux-test-project/ltp/blob/master/testcases/network/tcp_cc/bbr02.sh#L8
TST_MIN_KVER="4.13"

Thanks for the info.

-lakshmi

Quoted 7 lines
Quoted 6 lines

And the following patch series should be applied in the following order:

   1, https://patchwork.kernel.org/patch/11709527/
   2, https://patchwork.kernel.org/patch/11795559/
   3, https://patchwork.kernel.org/patch/11801525/
   4, https://patchwork.kernel.org/patch/11801585/