On 3/5/21 8:15 AM, Petr Vorel wrote:
Hi Petr,
A small change is needed:
In the while loop, for each line of the KEY_CHECK policy, we need to
check if a "template" is specified, and if it is then verify if it is
"ima-buf".
You need to do:
while read line; do
if ! echo $line | grep -q $template; then
tst_res TCONF "only $template can be specified for $func"
return 1
fi
done < $TST_TMPDIR/policy.txt
return 0
Please see the change below:
while read line; do
if echo $line | grep -q 'template=' && ! echo $line | grep -q $template
; then
tst_res TCONF "only $template can be specified for $func"
return 1
fi
done < $TST_TMPDIR/policy.txt
return 0
With check_policy_template() moved from ima_setup.sh to ima_keys.sh, the
test works fine
When the policy contains the following
measure func=KEY_CHECK keyrings=key_import_test template=ima-buf
measure func=KEY_CHECK keyrings=.builtin_trusted_keys
the test passes:
ima_keys 1 TINFO: verify key measurement for keyrings and templates
specified in IMA policy
ima_keys 1 TINFO: keyrings: 'key_import_test|\.builtin_trusted_keys'
ima_keys 1 TINFO: templates: 'ima-buf'
ima_keys 1 TPASS: specified keyrings were measured correctly
But if the policy is changed to below:
measure func=KEY_CHECK keyrings=key_import_test template=ima-buf
measure func=KEY_CHECK keyrings=.builtin_trusted_keys template=ima-sig
the test fails as expected.
ima_keys 1 TINFO: verify key measurement for keyrings and templates
specified in IMA policy
ima_keys 1 TCONF: only template=ima-buf can be specified for func=KEY_CHECK
I'll post the updated patch shortly.
thanks,
-lakshmi
