@@ -8,6 +8,18 @@ CONFIG_INTEGRITY=y
CONFIG_IMA=y
```
+### Loading policy for testing (optional)
+Setting environment variable `LTP_IMA_LOAD_POLICY=1` tries to load example
+policy if available. This should be used only if tooling running LTP tests
+allows to reboot afterwards because policy may be writable only once, e.g.
+missing `CONFIG_IMA_WRITE_POLICY=y`, or policies can influence each other.
+
+Loading may fail due various reasons (e.g. previously mentioned missing
+`CONFIG_IMA_WRITE_POLICY=y` and policy already loaded or when secure boot is
+enabled and the kernel is configured with `CONFIG_IMA_ARCH_POLICY` enabled, an
+`appraise func=POLICY_CHECK appraise_type=imasig` rule is loaded, requiring the
+IMA policy itself to be signed).
+
### IMA measurement tests
`ima_measurements.sh` require builtin IMA tcb policy to be loaded
(`ima_policy=tcb` kernel parameter).
@@ -1,7 +1,7 @@
#!/bin/sh
# SPDX-License-Identifier: GPL-2.0-or-later
# Copyright (c) 2009 IBM Corporation
-# Copyright (c) 2018-2021 Petr Vorel <pvorel@suse.cz>
+# Copyright (c) 2018-2024 Petr Vorel <pvorel@suse.cz>
# Author: Mimi Zohar <zohar@linux.ibm.com>
#
# Verify that measurements are added to the measurement list based on policy.
@@ -12,10 +12,23 @@ TST_CNT=3
setup()
{
- require_ima_policy_cmdline "tcb"
+ local policy="tcb"
TEST_FILE="$PWD/test.txt"
[ -f "$IMA_POLICY" ] || tst_res TINFO "not using default policy"
+
+ if [ "$LTP_IMA_LOAD_POLICY" != 1 ]; then
+ require_ima_policy_cmdline $policy
+ return
+ elif check_ima_policy_cmdline $policy; then
+ return
+ fi
+
+ if ! check_ima_policy_cmdline $policy &&
+ ! require_ima_policy_content '^measure func=FILE_CHECK mask=^MAY_READ uid=0' &&
+ ! require_ima_policy_content 'measure func=POLICY_CHECK'; then
+ tst_brk TCONF "IMA measurement tests require builtin IMA $policy policy (e.g. ima_policy=$policy kernel parameter) or it's equivalent (try LTP_IMA_LOAD_POLICY=1)"
+ fi
}
check_iversion_support()
@@ -1,7 +1,7 @@
#!/bin/sh
# SPDX-License-Identifier: GPL-2.0-or-later
# Copyright (c) 2009 IBM Corporation
-# Copyright (c) 2018-2020 Petr Vorel <pvorel@suse.cz>
+# Copyright (c) 2018-2024 Petr Vorel <pvorel@suse.cz>
# Author: Mimi Zohar <zohar@linux.ibm.com>
TST_TESTFUNC="test"
@@ -72,14 +72,20 @@ require_policy_readable()
fi
}
-require_policy_writable()
+check_policy_writable()
{
- local err="IMA policy already loaded and kernel not configured to enable multiple writes to it (need CONFIG_IMA_WRITE_POLICY=y)"
-
- [ -f $IMA_POLICY ] || tst_brk TCONF "$err"
- # CONFIG_IMA_READ_POLICY
+ [ -f $IMA_POLICY ] || return 1
+ # workaround for kernels < v4.18 without fix
+ # ffb122de9a60b ("ima: Reflect correct permissions for policy")
echo "" 2> log > $IMA_POLICY
- grep -q "Device or resource busy" log && tst_brk TCONF "$err"
+ grep -q "Device or resource busy" log && return 1
+ return 0
+}
+
+require_policy_writable()
+{
+ check_policy_writable || tst_brk TCONF \
+ "IMA policy already loaded and kernel not configured to enable multiple writes to it (need CONFIG_IMA_WRITE_POLICY=y)"
}
check_ima_policy_content()
@@ -158,6 +164,34 @@ print_ima_config()
tst_res TINFO "/proc/cmdline: $(cat /proc/cmdline)"
}
+load_ima_policy()
+{
+ local policy="$(ls $TST_DATAROOT/*.policy 2>/dev/null)"
+
+ if [ "$LTP_IMA_LOAD_POLICY" != 1 -a "$policy" -a -f "$policy" ]; then
+ tst_res TINFO "NOTE: set LTP_IMA_LOAD_POLICY=1 to load policy for this test"
+ return
+ fi
+
+ if [ -z "$policy" -o ! -f "$policy" ]; then
+ tst_res TINFO "no policy for this test"
+ LTP_IMA_LOAD_POLICY=
+ return
+ fi
+
+ tst_res TINFO "trying to load '$policy' policy:"
+ cat $policy
+ if ! check_policy_writable; then
+ tst_res TINFO "WARNING: IMA policy already loaded and kernel not configured to enable multiple writes to it (need CONFIG_IMA_WRITE_POLICY=y), reboot required"
+ LTP_IMA_LOAD_POLICY=
+ return
+ fi
+
+ cat "$policy" 2> log > $IMA_POLICY
+ if grep -q "Device or resource busy" log; then
+ tst_brk TBROK "Loading policy failed"
+ fi
+}
ima_setup()
{
SECURITYFS="$(mount_helper securityfs $SYSFS/kernel/security)"
@@ -180,6 +214,8 @@ ima_setup()
cd "$TST_MNTPOINT"
fi
+ load_ima_policy
+
[ -n "$TST_SETUP_CALLER" ] && $TST_SETUP_CALLER
}
@@ -192,6 +228,10 @@ ima_cleanup()
for dir in $UMOUNT; do
umount $dir
done
+
+ if [ "$LTP_IMA_LOAD_POLICY" = 1 ]; then
+ tst_res TINFO "WARNING: policy loaded via LTP_IMA_LOAD_POLICY=1, reboot recommended"
+ fi
}
set_digest_index()
environment variable LTP_IMA_LOAD_POLICY=1 tries to load example policy if available. This should be used only if tooling running LTP tests allows to reboot afterwards because policy may be writable only once, e.g. missing CONFIG_IMA_WRITE_POLICY=y, or policies can influence each other. Loading may fail due various reasons (e.g. previously mentioned missing CONFIG_IMA_WRITE_POLICY=y and policy already loaded or when secure boot is enabled and the kernel is configured with CONFIG_IMA_ARCH_POLICY enabled, an appraise func=POLICY_CHECK appraise_type=imasig rule is loaded, requiring the IMA policy itself to be signed). Signed-off-by: Petr Vorel <pvorel@suse.cz> --- .../kernel/security/integrity/ima/README.md | 12 +++++ .../integrity/ima/tests/ima_measurements.sh | 17 +++++- .../security/integrity/ima/tests/ima_setup.sh | 54 ++++++++++++++++--- 3 files changed, 74 insertions(+), 9 deletions(-)