Commit 91e8fa25 authored by Roberto Sassu's avatar Roberto Sassu Committed by Alexei Starovoitov
Browse files

selftests/bpf: Check if the digest is refreshed after a file write 



Verify that bpf_ima_inode_hash() returns a non-fresh digest after a file
write, and that bpf_ima_file_hash() returns a fresh digest. Verification is
done by requesting the digest from the bprm_creds_for_exec hook, called
before ima_bprm_check().

Signed-off-by: default avatarRoberto Sassu <roberto.sassu@huawei.com>
Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20220302111404.193900-7-roberto.sassu@huawei.com
parent 27a77d0d

tools/testing/selftests/bpf/ima_setup.sh

+23 −1
Original line number Diff line number Diff line
@@ -12,7 +12,7 @@ LOG_FILE="$(mktemp /tmp/ima_setup.XXXX.log)" 


usage()

{

	echo "Usage: $0 <setup|cleanup|run> <existing_tmp_dir>"

	echo "Usage: $0 <setup|cleanup|run|modify-bin|restore-bin> <existing_tmp_dir>"

	exit 1

}
@@ -77,6 +77,24 @@ run() 
	exec "${copied_bin_path}"

}



modify_bin()

{

	local tmp_dir="$1"

	local mount_dir="${tmp_dir}/mnt"

	local copied_bin_path="${mount_dir}/$(basename ${TEST_BINARY})"



	echo "mod" >> "${copied_bin_path}"

}



restore_bin()

{

	local tmp_dir="$1"

	local mount_dir="${tmp_dir}/mnt"

	local copied_bin_path="${mount_dir}/$(basename ${TEST_BINARY})"



	truncate -s -4 "${copied_bin_path}"

}



catch()

{

	local exit_code="$1"
@@ -105,6 +123,10 @@ main() 
		cleanup "${tmp_dir}"

	elif [[ "${action}" == "run" ]]; then

		run "${tmp_dir}"

	elif [[ "${action}" == "modify-bin" ]]; then

		modify_bin "${tmp_dir}"

	elif [[ "${action}" == "restore-bin" ]]; then

		restore_bin "${tmp_dir}"

	else

		echo "Unknown action: ${action}"

		exit 1

tools/testing/selftests/bpf/prog_tests/test_ima.c

+69 −3
Original line number Diff line number Diff line
@@ -13,16 +13,17 @@ 


#include "ima.skel.h"



#define MAX_SAMPLES 2

#define MAX_SAMPLES 4



static int run_measured_process(const char *measured_dir, u32 *monitored_pid)

static int _run_measured_process(const char *measured_dir, u32 *monitored_pid,

				 const char *cmd)

{

	int child_pid, child_status;



	child_pid = fork();

	if (child_pid == 0) {

		*monitored_pid = getpid();

		execlp("./ima_setup.sh", "./ima_setup.sh", "run", measured_dir,

		execlp("./ima_setup.sh", "./ima_setup.sh", cmd, measured_dir,

		       NULL);

		exit(errno);
@@ -34,6 +35,11 @@ static int run_measured_process(const char *measured_dir, u32 *monitored_pid) 
	return -EINVAL;

}



static int run_measured_process(const char *measured_dir, u32 *monitored_pid)

{

	return _run_measured_process(measured_dir, monitored_pid, "run");

}



static u64 ima_hash_from_bpf[MAX_SAMPLES];

static int ima_hash_from_bpf_idx;
@@ -51,6 +57,7 @@ static void test_init(struct ima__bss *bss) 
	ima_hash_from_bpf_idx = 0;



	bss->use_ima_file_hash = false;

	bss->enable_bprm_creds_for_exec = false;

}



void test_test_ima(void)
@@ -58,6 +65,7 @@ void test_test_ima(void) 
	char measured_dir_template[] = "/tmp/ima_measuredXXXXXX";

	struct ring_buffer *ringbuf = NULL;

	const char *measured_dir;

	u64 bin_true_sample;

	char cmd[256];



	int err, duration = 0;
@@ -114,6 +122,64 @@ void test_test_ima(void) 
	ASSERT_EQ(err, 2, "num_samples_or_err");

	ASSERT_NEQ(ima_hash_from_bpf[0], 0, "ima_hash");

	ASSERT_NEQ(ima_hash_from_bpf[1], 0, "ima_hash");

	bin_true_sample = ima_hash_from_bpf[1];



	/*

	 * Test #3

	 * - Goal: confirm that bpf_ima_inode_hash() returns a non-fresh digest

	 * - Expected result: 2 samples (/bin/true: non-fresh, fresh)

	 */

	test_init(skel->bss);



	err = _run_measured_process(measured_dir, &skel->bss->monitored_pid,

				    "modify-bin");

	if (CHECK(err, "modify-bin #3", "err = %d\n", err))

		goto close_clean;



	skel->bss->enable_bprm_creds_for_exec = true;

	err = run_measured_process(measured_dir, &skel->bss->monitored_pid);

	if (CHECK(err, "run_measured_process #3", "err = %d\n", err))

		goto close_clean;



	err = ring_buffer__consume(ringbuf);

	ASSERT_EQ(err, 2, "num_samples_or_err");

	ASSERT_NEQ(ima_hash_from_bpf[0], 0, "ima_hash");

	ASSERT_NEQ(ima_hash_from_bpf[1], 0, "ima_hash");

	ASSERT_EQ(ima_hash_from_bpf[0], bin_true_sample, "sample_equal_or_err");

	/* IMA refreshed the digest. */

	ASSERT_NEQ(ima_hash_from_bpf[1], bin_true_sample,

		   "sample_different_or_err");



	/*

	 * Test #4

	 * - Goal: verify that bpf_ima_file_hash() returns a fresh digest

	 * - Expected result: 4 samples (./ima_setup.sh: fresh, fresh;

	 *                               /bin/true: fresh, fresh)

	 */

	test_init(skel->bss);

	skel->bss->use_ima_file_hash = true;

	skel->bss->enable_bprm_creds_for_exec = true;

	err = run_measured_process(measured_dir, &skel->bss->monitored_pid);

	if (CHECK(err, "run_measured_process #4", "err = %d\n", err))

		goto close_clean;



	err = ring_buffer__consume(ringbuf);

	ASSERT_EQ(err, 4, "num_samples_or_err");

	ASSERT_NEQ(ima_hash_from_bpf[0], 0, "ima_hash");

	ASSERT_NEQ(ima_hash_from_bpf[1], 0, "ima_hash");

	ASSERT_NEQ(ima_hash_from_bpf[2], 0, "ima_hash");

	ASSERT_NEQ(ima_hash_from_bpf[3], 0, "ima_hash");

	ASSERT_NEQ(ima_hash_from_bpf[2], bin_true_sample,

		   "sample_different_or_err");

	ASSERT_EQ(ima_hash_from_bpf[3], ima_hash_from_bpf[2],

		  "sample_equal_or_err");



	skel->bss->use_ima_file_hash = false;

	skel->bss->enable_bprm_creds_for_exec = false;

	err = _run_measured_process(measured_dir, &skel->bss->monitored_pid,

				    "restore-bin");

	if (CHECK(err, "restore-bin #3", "err = %d\n", err))

		goto close_clean;



close_clean:

	snprintf(cmd, sizeof(cmd), "./ima_setup.sh cleanup %s", measured_dir);

tools/testing/selftests/bpf/progs/ima.c

+11 −0
Original line number Diff line number Diff line
@@ -19,6 +19,7 @@ struct { 
char _license[] SEC("license") = "GPL";



bool use_ima_file_hash;

bool enable_bprm_creds_for_exec;



static void ima_test_common(struct file *file)

{
@@ -54,3 +55,13 @@ void BPF_PROG(bprm_committed_creds, struct linux_binprm *bprm) 
{

	ima_test_common(bprm->file);

}



SEC("lsm.s/bprm_creds_for_exec")

int BPF_PROG(bprm_creds_for_exec, struct linux_binprm *bprm)

{

	if (!enable_bprm_creds_for_exec)

		return 0;



	ima_test_common(bprm->file);

	return 0;

}