Hi Alex,
...
> --- a/testcases/kernel/security/integrity/ima/tests/ima_setup.sh
As it's now a generally used function I'll add a comment:
# Because we don't grep kernel config for CONFIG_IMA_WRITE_POLICY, we just try
# to write empty string (invalid), thus policy must be repeatedly checked.
# Because after first write to policy policy will be removed on systems without
# CONFIG_IMA_WRITE_POLICY.
> +require_policy_writable()
> +{
> + local err="IMA policy already loaded and kernel not configured to enable multiple writes to it (need CONFIG_IMA_WRITE_POLICY=y)"
> +
> + [ -f $IMA_POLICY ] || tst_brk TCONF "$err"
> + # CONFIG_IMA_READ_POLICY
> + echo "" 2> log > $IMA_POLICY
> + grep -q "Device or resource busy" log && tst_brk TCONF "$err"
> +}
> +
Kind regards,
Petr
