Hi Mimi, Ignaz, > On Fri, 2025-03-07 at 11:24 +0100, Petr Vorel wrote: > > Hi Mimi, Ignaz, > > > Proof of concept, it was never fixed in the kernel. > > > Instead we should have some basic EVM tests. > > gently ping. Is evm_overlay.sh test useful for you? > > Otherwise I'll delete it. > Requiring the "ima_policy=appraise_tcb" default policy to run the tests limits > its usefulness. Perhaps REQUIRED_POLICY_CONTENT could be defined. I'll let you > know. For now, please don't remove the test. Sure, I'll keep the test if you want. Also adding REQUIRED_POLICY_CONTENT would help. But the reason why I wanted to delete the test is the fact, that it's a proof of concept that 1) It's a reproducer for patchset which haven't been fixed. 2) It requires test setup first "ima_policy=tcb|appraise_tcb ima_appraise=fix evm=fix". [2] 3) I'm not sure if the test even work as expected. But I try to test it again and test if it will work with REQUIRED_POLICY_CONTENT. Kind regards, Petr [1] https://lore.kernel.org/linux-integrity/20190211165323.9369-1-iforster@xxxxxxxx/ [2] https://github.com/linux-test-project/ltp/tree/master/testcases/kernel/security/integrity/ima#evm-tests > thanks, > Mimi
