Requires "ima: add gid support".
Signed-off-by: Alex Henrie <alexh@xxxxxxxxxxx>
---
v5: Omit awk and cut from TST_NEEDS_CMDS
---
runtest/ima | 1 +
.../integrity/ima/tests/ima_conditionals.sh | 57 +++++++++++++++++++
2 files changed, 58 insertions(+)
create mode 100755 testcases/kernel/security/integrity/ima/tests/ima_conditionals.sh
diff --git a/runtest/ima b/runtest/ima
index 29caa034a..01942eefa 100644
--- a/runtest/ima
+++ b/runtest/ima
@@ -6,4 +6,5 @@ ima_violations ima_violations.sh
ima_keys ima_keys.sh
ima_kexec ima_kexec.sh
ima_selinux ima_selinux.sh
+ima_conditionals ima_conditionals.sh
evm_overlay evm_overlay.sh
diff --git a/testcases/kernel/security/integrity/ima/tests/ima_conditionals.sh b/testcases/kernel/security/integrity/ima/tests/ima_conditionals.sh
new file mode 100755
index 000000000..657f4d244
--- /dev/null
+++ b/testcases/kernel/security/integrity/ima/tests/ima_conditionals.sh
@@ -0,0 +1,57 @@
+#!/bin/sh
+# SPDX-License-Identifier: GPL-2.0-or-later
+# Copyright (c) 2021 VPI Technology
+# Author: Alex Henrie <alexh@xxxxxxxxxxx>
+#
+# Verify that conditional rules work.
+
+TST_NEEDS_CMDS="chgrp chown sg sudo"
+TST_CNT=1
+TST_NEEDS_DEVICE=1
+
+. ima_setup.sh
+
+test1()
+{
+ local user="nobody"
+
+ require_policy_writable
+ ROD rm -f $TEST_FILE
+ tst_res TINFO "verify measuring user files when requested via uid"
+ ROD echo "measure uid=$(id -u $user)" \> $IMA_POLICY
+ ROD echo "$(date) uid test" \> $TEST_FILE
+ sudo -n -u $user sh -c "cat $TEST_FILE > /dev/null"
+ ima_check
+
+ require_policy_writable
+ ROD rm -f $TEST_FILE
+ tst_res TINFO "verify measuring user files when requested via fowner"
+ ROD echo "measure fowner=$(id -u $user)" \> $IMA_POLICY
+ ROD echo "$(date) fowner test" \> $TEST_FILE
+ chown $user $TEST_FILE
+ cat $TEST_FILE > /dev/null
+ ima_check
+
+ if tst_kvcmp -lt 5.16; then
+ tst_brk TCONF "gid and fgroup options require kernel 5.16 or newer"
+ fi
+
+ require_policy_writable
+ ROD rm -f $TEST_FILE
+ tst_res TINFO "verify measuring user files when requested via gid"
+ ROD echo "measure gid=$(id -g $user)" \> $IMA_POLICY
+ ROD echo "$(date) gid test" \> $TEST_FILE
+ sudo sg $user "sh -c 'cat $TEST_FILE > /dev/null'"
+ ima_check
+
+ require_policy_writable
+ ROD rm -f $TEST_FILE
+ tst_res TINFO "verify measuring user files when requested via fgroup"
+ ROD echo "measure fgroup=$(id -g $user)" \> $IMA_POLICY
+ ROD echo "$(date) fgroup test" \> $TEST_FILE
+ chgrp $user $TEST_FILE
+ cat $TEST_FILE > /dev/null
+ ima_check
+}
+
+tst_run
--
2.33.0
