On Tue, 2025-03-04 at 18:43 +0100, Petr Vorel wrote:
> > On Tue, 2025-03-04 at 09:44 -0500, Mimi Zohar wrote:
> > > On Tue, 2025-03-04 at 14:31 +0100, Petr Vorel wrote:
> > > > Hi Mimi,
>
> > > > > Add support for the number of expected violations. Include the
> > > > > expected number of violations in the output.
>
> > > > Unfortunately this works only on fixed kernel (e.g. the one with v1 of your
> > > > "ima: limit both open-writers and ToMToU violations" kernel patchset [1]
> > > > (I haven't built v2 [2], but it's really just
> > > > s/IMA_LIMIT_VIOLATIONS/IMA_EMITTED_OPENWRITERS/ => it will work)
>
> > > > Testing on any other kernel it fails on first testing after reboot:
>
> > > Hi Petr,
>
> > > I only tested by specifying the "ima_policy=tcb" on the boot command line. This
> > > failure happens when loading the test specific policy rules. If setup() is
> > > called before loading the test specific policy rules, forcing the $LOG file
> > > violation at setup() would be too early.
>
> > Sorry, that doesn't seem to be the case.
>
> > With the changes to validate(), even the original tests will only work on a new
> > kernel. I'll rework the patch set, so at least the original tests will continue
> > to work.
>
> +1, thank you!
Hi Petr,
Since the original three tests don't provide the expected number of violations,
the following should work for them. The new tests will fail without the kernel
patch. The assumption is that LTP can handle some of the tests, not all of
them, succeeding. On a new kernel, all of the tests should succeed. Tested
only with bash.
diff --git a/testcases/kernel/security/integrity/ima/tests/ima_violations.sh b/testcases/kernel/security/integrity/ima/tests/ima_violations.sh
index 2fbffc5da..0395f8d0a 100755
--- a/testcases/kernel/security/integrity/ima/tests/ima_violations.sh
+++ b/testcases/kernel/security/integrity/ima/tests/ima_violations.sh
@@ -87,12 +87,13 @@ validate()
local max_attempt=3
local count2 i num_violations_new
- [ -z "$expected_violations" ] && expected_violations=1
-
for i in $(seq 1 $max_attempt); do
read num_violations_new < $IMA_VIOLATIONS
count2="$(get_count $search)"
- if [ $(($num_violations_new - $num_violations)) -eq $expected_violations ]; then
+ if [ -z "$expected_violations" ] && \
+ [ $(($num_violations_new - $num_violations)) -gt 0 ] || \
+ [ $(($num_violations_new - $num_violations)) -eq $expected_violations ]; then
+ [ -z "$expected_violations" ] && expected_violations=1
if [ $count2 -gt $count ]; then
tst_res TPASS "$expected_violations $search violation(s) added"
return
thanks,
Mimi
