Taken from IMA docs [1], removed dont_measure fsmagic=0x1021994 (tmpfs) as suggested by Mimi. [1] https://ima-doc.readthedocs.io/en/latest/ima-policy.html#ima-tcb Signed-off-by: Petr Vorel <pvorel@xxxxxxx> --- .../security/integrity/ima/datafiles/Makefile | 4 ++-- .../ima/datafiles/ima_measurements/Makefile | 11 ++++++++++ .../ima/datafiles/ima_measurements/tcb.policy | 20 +++++++++++++++++++ 3 files changed, 33 insertions(+), 2 deletions(-) create mode 100644 testcases/kernel/security/integrity/ima/datafiles/ima_measurements/Makefile create mode 100644 testcases/kernel/security/integrity/ima/datafiles/ima_measurements/tcb.policy diff --git a/testcases/kernel/security/integrity/ima/datafiles/Makefile b/testcases/kernel/security/integrity/ima/datafiles/Makefile index 200fd3f4d3..0f2b4fdb11 100644 --- a/testcases/kernel/security/integrity/ima/datafiles/Makefile +++ b/testcases/kernel/security/integrity/ima/datafiles/Makefile @@ -1,5 +1,5 @@ # SPDX-License-Identifier: GPL-2.0-or-later -# Copyright (c) Linux Test Project, 2019-2020 +# Copyright (c) Linux Test Project, 2019-2025 # Copyright (c) 2020 Microsoft Corporation # Copyright (C) 2009, Cisco Systems Inc. # Ngie Cooper, July 2009 @@ -8,6 +8,6 @@ top_srcdir ?= ../../../../../.. include $(top_srcdir)/include/mk/env_pre.mk -SUBDIRS := ima_kexec ima_keys ima_policy ima_selinux +SUBDIRS := ima_kexec ima_keys ima_measurements ima_policy ima_selinux include $(top_srcdir)/include/mk/generic_trunk_target.mk diff --git a/testcases/kernel/security/integrity/ima/datafiles/ima_measurements/Makefile b/testcases/kernel/security/integrity/ima/datafiles/ima_measurements/Makefile new file mode 100644 index 0000000000..6317f2bf85 --- /dev/null +++ b/testcases/kernel/security/integrity/ima/datafiles/ima_measurements/Makefile @@ -0,0 +1,11 @@ +# SPDX-License-Identifier: GPL-2.0-or-later +# Copyright (c) Linux Test Project, 2025 + +top_srcdir ?= ../../../../../../.. + +include $(top_srcdir)/include/mk/env_pre.mk + +INSTALL_DIR := testcases/data/ima_measurements +INSTALL_TARGETS := *.policy + +include $(top_srcdir)/include/mk/generic_leaf_target.mk diff --git a/testcases/kernel/security/integrity/ima/datafiles/ima_measurements/tcb.policy b/testcases/kernel/security/integrity/ima/datafiles/ima_measurements/tcb.policy new file mode 100644 index 0000000000..1e4a932bf0 --- /dev/null +++ b/testcases/kernel/security/integrity/ima/datafiles/ima_measurements/tcb.policy @@ -0,0 +1,20 @@ +dont_measure fsmagic=0x9fa0 +dont_measure fsmagic=0x62656572 +dont_measure fsmagic=0x64626720 +dont_measure fsmagic=0x1021994 func=FILE_CHECK +dont_measure fsmagic=0x1cd1 +dont_measure fsmagic=0x42494e4d +dont_measure fsmagic=0x73636673 +dont_measure fsmagic=0xf97cff8c +dont_measure fsmagic=0x43415d53 +dont_measure fsmagic=0x27e0eb +dont_measure fsmagic=0x63677270 +dont_measure fsmagic=0x6e736673 +dont_measure fsmagic=0xde5e81e4 +measure func=MMAP_CHECK mask=MAY_EXEC +measure func=BPRM_CHECK mask=MAY_EXEC +measure func=FILE_CHECK mask=^MAY_READ euid=0 +measure func=FILE_CHECK mask=^MAY_READ uid=0 +measure func=MODULE_CHECK +measure func=FIRMWARE_CHECK +measure func=POLICY_CHECK -- 2.47.1
