Hi Mimi, ... > > Do I understand correctly you talk about policy containing func=POLICY_CHECK [1]? > Yes. On a secure boot enabled system, the architecture specific policy might > require the IMA policy itself to be signed. > Snippet from ima_fs.c: > #if IS_ENABLED(CONFIG_INTEGRITY_MACHINE_KEYRING) && > IS_ENABLED(CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY) > "appraise func=POLICY_CHECK appraise_type=imasig", > #endif > > Maybe there could be a test based on example [2]. > > echo /home/user/tmpfile > /sys/kernel/security/ima/policy > > cp tmpfile /sys/kernel/security/ima/policy > > cat tmpfile > /sys/kernel/security/ima/policy > All of the above will load a policy, assuming the policy itself doesn't need to > be signed. Only "echo /home/user/tmpfile > /sys/kernel/security/ima/policy" can > load a signed policy. > Loading a CA key (mokutil), signing (evmctl)[1] and loading (keyctl) an IMA > policy is probably beyond LTP. The purpose of this test would be to detect > whether policies need to be signed. The most advanced for LTP is currently solving reboot [3]. FYI we plan to add support [4] to our kirk tool [5] (currently supports running LTP, kselftest and liburing, testing via SSH, qemu). I suppose given how sparse is IMA/EVM testing in LTP this can wait (there are more basic features not covered by testing). I suppose most of the testing you have in ima-evm-utils repo (at least I found only IMA related code in kselftest in BPF tests). > Going forward what's probably needed is a new package containing a set of pre- > defined sample custom policies, which are signed by the distro. Please let me now once you or other IMA devs are doing any work in this. Kind regards, Petr > [1] Directions for signing and loading a custom policy, > https://ima-doc.readthedocs.io/en/latest/ima-utilities.html#sign-and-install-a-custom-policy > Thanks, > Mimi > > Kind regards, > > Petr > > [1] https://ima-doc.readthedocs.io/en/latest/policy-syntax.html#func-policy-check > > [2] https://ima-doc.readthedocs.io/en/latest/ima-policy.html#runtime-custom-policy [3] https://github.com/linux-test-project/ltp/issues/868 [4] https://github.com/linux-test-project/kirk/issues/12 [5] https://github.com/linux-test-project/kirk > > > > +} > > > Mimi
