On Wed, Dec 2, 2020 at 4:58 PM KP Singh <kpsingh@xxxxxxxxxxxx> wrote:
>
> From: KP Singh <kpsingh@xxxxxxxxxx>
>
> SecurityFS may not be mounted even if it is enabled in the kernel
> config.
>
> Fixes: 34b82d3ac105 ("bpf: Add a selftest for bpf_ima_inode_hash")
> Reported-by: Andrii Nakryiko <andrii@xxxxxxxxxx>
> Signed-off-by: KP Singh <kpsingh@xxxxxxxxxx>
> ---
Acked-by: Andrii Nakryiko <andrii@xxxxxxxxxx>
> tools/testing/selftests/bpf/ima_setup.sh | 15 +++++++++++++++
> 1 file changed, 15 insertions(+)
>
> diff --git a/tools/testing/selftests/bpf/ima_setup.sh b/tools/testing/selftests/bpf/ima_setup.sh
> index 137f2d32598f..b1ee4bf06996 100755
> --- a/tools/testing/selftests/bpf/ima_setup.sh
> +++ b/tools/testing/selftests/bpf/ima_setup.sh
> @@ -14,6 +14,20 @@ usage()
> exit 1
> }
>
> +ensure_mount_securityfs()
> +{
> + local securityfs_dir=$(grep "securityfs" /proc/mounts | awk '{print $2}')
> +
> + if [ -z "${securityfs_dir}" ]; then
> + securityfs_dir=/sys/kernel/security
> + mount -t securityfs security "${securityfs_dir}"
> + fi
> +
> + if [ ! -d "${securityfs_dir}" ]; then
> + echo "${securityfs_dir}: securityfs is not mounted" && exit 1
> + fi
> +}
> +
> setup()
> {
> local tmp_dir="$1"
> @@ -33,6 +47,7 @@ setup()
> cp "${TEST_BINARY}" "${mount_dir}"
> local mount_uuid="$(blkid ${loop_device} | sed 's/.*UUID="\([^"]*\)".*/\1/')"
>
> + ensure_mount_securityfs
> echo "measure func=BPRM_CHECK fsuuid=${mount_uuid}" > ${IMA_POLICY_FILE}
> }
>
> --
> 2.29.2.576.ga3fc446d84-goog
>
