Commit a8b415c9 authored by Andrii Nakryiko's avatar Andrii Nakryiko
Browse files

Merge branch 'Fixes for ima selftest' 



KP Singh says:

====================

From: KP Singh <kpsingh@google.com>

# v3 -> v4

* Fix typos.
* Update commit message for the indentation patch.
* Added Andrii's acks.

# v2 -> v3

* Added missing tags.
* Indentation fixes + some other fixes suggested by Andrii.
* Re-indent file to tabs.

The selftest for the bpf_ima_inode_hash helper uses a shell script to
setup the system for ima. While this worked without an issue on recent
desktop distros, it failed on environments with stripped out shells like
busybox which is also used by the bpf CI.

This series fixes the assumptions made on the availablity of certain
command line switches and the expectation that securityfs being mounted
by default.

It also adds the missing kernel config dependencies in
tools/testing/selftests/bpf and, lastly, changes the indentation of
ima_setup.sh to use tabs.
====================

Signed-off-by: default avatarAndrii Nakryiko <andrii@kernel.org>
parents 61b75948 ffebecd9

tools/testing/selftests/bpf/config

+1 −0
Original line number Diff line number Diff line
@@ -43,3 +43,4 @@ CONFIG_IMA=y 
CONFIG_SECURITYFS=y

CONFIG_IMA_WRITE_POLICY=y

CONFIG_IMA_READ_POLICY=y

CONFIG_BLK_DEV_LOOP=y

tools/testing/selftests/bpf/ima_setup.sh

+63 −44
Original line number Diff line number Diff line
@@ -3,6 +3,7 @@ 


set -e

set -u

set -o pipefail



IMA_POLICY_FILE="/sys/kernel/security/ima/policy"

TEST_BINARY="/bin/true"
@@ -13,6 +14,20 @@ usage() 
	exit 1

}



ensure_mount_securityfs()

{

	local securityfs_dir=$(grep "securityfs" /proc/mounts | awk '{print $2}')



	if [ -z "${securityfs_dir}" ]; then

		securityfs_dir=/sys/kernel/security

		mount -t securityfs security "${securityfs_dir}"

	fi



	if [ ! -d "${securityfs_dir}" ]; then

		echo "${securityfs_dir}: securityfs is not mounted" && exit 1

	fi

}



setup()

{

	local tmp_dir="$1"
@@ -23,13 +38,16 @@ setup() 


	dd if=/dev/zero of="${mount_img}" bs=1M count=10



        local loop_device="$(losetup --find --show ${mount_img})"

	losetup -f "${mount_img}"

	local loop_device=$(losetup -a | grep ${mount_img:?} | cut -d ":" -f1)



        mkfs.ext4 "${loop_device}"

	mkfs.ext2 "${loop_device:?}"

	mount "${loop_device}" "${mount_dir}"



	cp "${TEST_BINARY}" "${mount_dir}"

        local mount_uuid="$(blkid -s UUID -o value ${loop_device})"

	local mount_uuid="$(blkid ${loop_device} | sed 's/.*UUID="\([^"]*\)".*/\1/')"



	ensure_mount_securityfs

	echo "measure func=BPRM_CHECK fsuuid=${mount_uuid}" > ${IMA_POLICY_FILE}

}
@@ -38,7 +56,8 @@ cleanup() { 
	local mount_img="${tmp_dir}/test.img"

	local mount_dir="${tmp_dir}/mnt"



        local loop_devices=$(losetup -j ${mount_img} -O NAME --noheadings)

	local loop_devices=$(losetup -a | grep ${mount_img:?} | cut -d ":" -f1)



	for loop_dev in "${loop_devices}"; do

		losetup -d $loop_dev

	done