[ima-evm-utils] Introduce expect_pass_if() and expect_fail_if()

Commit Message

Roberto Sassu Jan. 31, 2023, 8:59 a.m. UTC

From: Roberto Sassu <[e-mail]>

Introduce these functions to let the developer specify which kernel patches
are required for the tests to be successful (either pass or fail). If a
test is not successful, print those patches in the test result summary.

First, the developer should declare an array, named PATCHES, with the list
of all kernel patches that are required by the tests. For example:

PATCHES=(
'patch 1 title'
...
'patch N title'
)

Second, the developer could replace the existing expect_pass() and
expect_fail() respectively with expect_pass_if() and expect_fail_if(), and
add the indexes in the PATCHES array as the first argument, enclosed with
quotes. The other parameters of expect_pass() and expect_fail() remain the
same.

In the following example, the PATCHES array has been added to a new test
script, tests/mmap_check.test:

PATCHES=(
'ima: Align ima_file_mmap() parameters with mmap_file LSM hook'
'ima: Introduce MMAP_CHECK_REQPROT hook'
)

Then, expect_pass() has been replaced with expect_pass_if():

expect_pass_if '0' check_mmap "MMAP_CHECK" "read_implies_exec"

The resulting output when a test fails (if the required patch is not
applied) is:

Test: check_mmap (hook="MMAP_CHECK", test_mmap arg: "read_implies_exec")
Result (expect found): not found
Possibly missing patches:
 - ima: Align ima_file_mmap() parameters with mmap_file LSM hook

Signed-off-by: Roberto Sassu <[e-mail]>
---
 tests/functions.sh | 38 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)

Comments

Mimi Zohar Jan. 31, 2023, 3:22 p.m. UTC | #1

On Tue, 2023-01-31 at 09:59 +0100, Roberto Sassu wrote:
> From: Roberto Sassu <[e-mail]>
> 
> Introduce these functions to let the developer specify which kernel patches
> are required for the tests to be successful (either pass or fail). If a
> test is not successful, print those patches in the test result summary.
> 
> First, the developer should declare an array, named PATCHES, with the list
> of all kernel patches that are required by the tests. For example:
> 
> PATCHES=(
> 'patch 1 title'
> ...
> 'patch N title'
> )
> 
> Second, the developer could replace the existing expect_pass() and
> expect_fail() respectively with expect_pass_if() and expect_fail_if(), and
> add the indexes in the PATCHES array as the first argument, enclosed with
> quotes. The other parameters of expect_pass() and expect_fail() remain the
> same.
> 
> In the following example, the PATCHES array has been added to a new test
> script, tests/mmap_check.test:
> 
> PATCHES=(
> 'ima: Align ima_file_mmap() parameters with mmap_file LSM hook'
> 'ima: Introduce MMAP_CHECK_REQPROT hook'
> )
> 
> Then, expect_pass() has been replaced with expect_pass_if():
> 
> expect_pass_if '0' check_mmap "MMAP_CHECK" "read_implies_exec"
> 
> The resulting output when a test fails (if the required patch is not
> applied) is:
> 
> Test: check_mmap (hook="MMAP_CHECK", test_mmap arg: "read_implies_exec")
> Result (expect found): not found
> Possibly missing patches:
>  - ima: Align ima_file_mmap() parameters with mmap_file LSM hook
> 
> Signed-off-by: Roberto Sassu <[e-mail]>

Keeping it simple like this works for now.   Based on Stefan's previous
comments, the variable 'idx' should probably be defined as local.

Otherwise,
Reviewed-by: Mimi Zohar <[e-mail]>

Patch

diff --git a/tests/functions.sh b/tests/functions.sh
index 2c4d20536316..3cc5a792a5e7 100755
--- a/tests/functions.sh
+++ b/tests/functions.sh
@@ -100,6 +100,25 @@  expect_pass() {
   return $ret
 }
 
+expect_pass_if() {
+  local indexes="$1"
+  local ret
+
+  shift
+
+  expect_pass "$@"
+  ret=$?
+
+  if [ $ret -ne 0 ] && [ $ret -ne 77 ] && [ -n "$PATCHES" ]; then
+    echo $YELLOW"Possibly missing patches:"$NORM
+    for idx in $indexes; do
+      echo $YELLOW" - ${PATCHES[$((idx))]}"$NORM
+    done
+  fi
+
+  return $ret
+}
+
 # Eval negative test (one that should fail) and account its result
 expect_fail() {
   local ret
@@ -137,6 +156,25 @@  expect_fail() {
   return $ret
 }
 
+expect_fail_if() {
+  local indexes="$1"
+  local ret
+
+  shift
+
+  expect_fail "$@"
+  ret=$?
+
+  if { [ $ret -eq 0 ] || [ $ret -eq 99 ]; } && [ -n "$PATCHES" ]; then
+    echo $YELLOW"Possibly missing patches:"$NORM
+    for idx in $indexes; do
+      echo $YELLOW" - ${PATCHES[$((idx))]}"$NORM
+    done
+  fi
+
+  return $ret
+}
+
 # return true if current test is positive
 _test_expected_to_pass() {
   [ ! $TFAIL ]