| Message ID | 20250314124242.459072-1-pvorel@suse.cz (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | ima_violations.sh: Fix condition evaluation | expand |
Hi Li, > On Fri, Mar 14, 2025 at 8:43 PM Petr Vorel <pvorel@suse.cz> wrote: > > Evaluation "-gt 0" needs to be together with expectation of empty > > $expected_violations. Therefore use [ ... -a ... ] comparator to avoid > > -eq comparison against empty $expected_violations. > > # LTPROOT=/opt/ltp PATH="/opt/ltp/testcases/bin:$PATH" > > LTP_IMA_LOAD_POLICY=1 ima_keys.sh > > ima_keys 1 TINFO: /proc/cmdline: > > BOOT_IMAGE=/boot/vmlinuz-6.14.0-rc3-1.gb6b4102-default security=apparmor > > ignore_loglevel ima_policy=tcb > > # LTPROOT=/opt/ltp PATH="/opt/ltp/testcases/bin:$PATH" > > ima_violations.sh > > ... > > /opt/ltp/testcases/bin/ima_violations.sh: line 95: [: 0: unary > > operator expected > > ima_violations 1 TFAIL: open_writers violation not added > > ima_violations 2 TINFO: verify ToMToU violation > > /opt/ltp/testcases/bin/ima_violations.sh: line 95: [: 0: unary > > operator expected > > ima_violations 2 TFAIL: ToMToU violation not added > > ima_violations 3 TINFO: verify open_writers using mmapped files > > tst_test.c:1900: TINFO: LTP version: 20250130-22-gcd2215702f > > tst_test.c:1904: TINFO: Tested kernel: 6.14.0-rc3-1.gb6b4102-default > > #1 SMP PREEMPT_DYNAMIC Thu Feb 20 12:26:55 UTC 2025 (b6b4102) x86_64 > > tst_kconfig.c:88: TINFO: Parsing kernel config '/proc/config.gz' > > tst_kconfig.c:676: TINFO: CONFIG_FAULT_INJECTION kernel option > > detected which might slow the execution > > tst_test.c:1722: TINFO: Overall timeout per run is 0h 02m 00s > > ima_mmap.c:38: TINFO: sleep 3s > > /opt/ltp/testcases/bin/ima_violations.sh: line 95: [: 0: unary > > operator expected > > ima_violations 3 TFAIL: open_writers violation not added > > NOTE: This does not fix ima_violations.sh fails after caused by user > > defined policy loaded by ima_keys.sh (via LTP_IMA_LOAD_POLICY=1). > > Fixes: 726ed71905 ("ima_violations.sh: Update validate() to support > > multiple violations") > > Signed-off-by: Petr Vorel <pvorel@suse.cz> > Reviewed-by: Li Wang <liwang@redhat.com> thanks for your review, merged! Kind regards, Petr > --- > > .../kernel/security/integrity/ima/tests/ima_violations.sh | 3 +-- > > 1 file changed, 1 insertion(+), 2 deletions(-) > > diff --git > > a/testcases/kernel/security/integrity/ima/tests/ima_violations.sh > > b/testcases/kernel/security/integrity/ima/tests/ima_violations.sh > > index 63346e9489..c6b929a233 100755 > > --- a/testcases/kernel/security/integrity/ima/tests/ima_violations.sh > > +++ b/testcases/kernel/security/integrity/ima/tests/ima_violations.sh > > @@ -90,8 +90,7 @@ validate() > > for i in $(seq 1 $max_attempt); do > > read num_violations_new < $IMA_VIOLATIONS > > count2="$(get_count $search)" > > - if [ -z "$expected_violations" ] && \ > > - [ $(($num_violations_new - $num_violations)) -gt 0 ] || > > \ > > + if [ -z "$expected_violations" -a $(($num_violations_new - > > $num_violations)) -gt 0 ] || \ > > [ $(($num_violations_new - $num_violations)) -eq > > $expected_violations ]; then > > [ -z "$expected_violations" ] && > > expected_violations=1 > > if [ $count2 -gt $count ]; then > > -- > > 2.47.2 > > -- > > Mailing list info: https://lists.linux.it/listinfo/ltp
diff --git a/testcases/kernel/security/integrity/ima/tests/ima_violations.sh b/testcases/kernel/security/integrity/ima/tests/ima_violations.sh index 63346e9489..c6b929a233 100755 --- a/testcases/kernel/security/integrity/ima/tests/ima_violations.sh +++ b/testcases/kernel/security/integrity/ima/tests/ima_violations.sh @@ -90,8 +90,7 @@ validate() for i in $(seq 1 $max_attempt); do read num_violations_new < $IMA_VIOLATIONS count2="$(get_count $search)" - if [ -z "$expected_violations" ] && \ - [ $(($num_violations_new - $num_violations)) -gt 0 ] || \ + if [ -z "$expected_violations" -a $(($num_violations_new - $num_violations)) -gt 0 ] || \ [ $(($num_violations_new - $num_violations)) -eq $expected_violations ]; then [ -z "$expected_violations" ] && expected_violations=1 if [ $count2 -gt $count ]; then
Evaluation "-gt 0" needs to be together with expectation of empty $expected_violations. Therefore use [ ... -a ... ] comparator to avoid -eq comparison against empty $expected_violations. # LTPROOT=/opt/ltp PATH="/opt/ltp/testcases/bin:$PATH" LTP_IMA_LOAD_POLICY=1 ima_keys.sh ima_keys 1 TINFO: /proc/cmdline: BOOT_IMAGE=/boot/vmlinuz-6.14.0-rc3-1.gb6b4102-default security=apparmor ignore_loglevel ima_policy=tcb # LTPROOT=/opt/ltp PATH="/opt/ltp/testcases/bin:$PATH" ima_violations.sh ... /opt/ltp/testcases/bin/ima_violations.sh: line 95: [: 0: unary operator expected ima_violations 1 TFAIL: open_writers violation not added ima_violations 2 TINFO: verify ToMToU violation /opt/ltp/testcases/bin/ima_violations.sh: line 95: [: 0: unary operator expected ima_violations 2 TFAIL: ToMToU violation not added ima_violations 3 TINFO: verify open_writers using mmapped files tst_test.c:1900: TINFO: LTP version: 20250130-22-gcd2215702f tst_test.c:1904: TINFO: Tested kernel: 6.14.0-rc3-1.gb6b4102-default #1 SMP PREEMPT_DYNAMIC Thu Feb 20 12:26:55 UTC 2025 (b6b4102) x86_64 tst_kconfig.c:88: TINFO: Parsing kernel config '/proc/config.gz' tst_kconfig.c:676: TINFO: CONFIG_FAULT_INJECTION kernel option detected which might slow the execution tst_test.c:1722: TINFO: Overall timeout per run is 0h 02m 00s ima_mmap.c:38: TINFO: sleep 3s /opt/ltp/testcases/bin/ima_violations.sh: line 95: [: 0: unary operator expected ima_violations 3 TFAIL: open_writers violation not added NOTE: This does not fix ima_violations.sh fails after caused by user defined policy loaded by ima_keys.sh (via LTP_IMA_LOAD_POLICY=1). Fixes: 726ed71905 ("ima_violations.sh: Update validate() to support multiple violations") Signed-off-by: Petr Vorel <pvorel@suse.cz> --- .../kernel/security/integrity/ima/tests/ima_violations.sh | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)