| Message ID | 20201203005807.486320-3-kpsingh@chromium.org (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | BPF |
| Headers | show |
| Series | Fixes for ima selftest | expand |
| Context | Check | Description |
|---|---|---|
| netdev/cover_letter | success | Link |
| netdev/fixes_present | success | Link |
| netdev/patch_count | success | Link |
| netdev/tree_selection | success | Clearly marked for bpf-next |
| netdev/subject_prefix | success | Link |
| netdev/source_inline | success | Was 0 now: 0 |
| netdev/verify_signedoff | success | Link |
| netdev/module_param | success | Was 0 now: 0 |
| netdev/build_32bit | success | Errors and warnings before: 0 this patch: 0 |
| netdev/kdoc | success | Errors and warnings before: 0 this patch: 0 |
| netdev/verify_fixes | success | Link |
| netdev/checkpatch | warning | WARNING: line length of 81 exceeds 80 columns |
| netdev/build_allmodconfig_warn | success | Errors and warnings before: 0 this patch: 0 |
| netdev/header_inline | success | Link |
| netdev/stable | success | Stable not CCed |
On Wed, Dec 2, 2020 at 4:58 PM KP Singh <kpsingh@chromium.org> wrote: > > From: KP Singh <kpsingh@google.com> > > SecurityFS may not be mounted even if it is enabled in the kernel > config. > > Fixes: 34b82d3ac105 ("bpf: Add a selftest for bpf_ima_inode_hash") > Reported-by: Andrii Nakryiko <andrii@kernel.org> > Signed-off-by: KP Singh <kpsingh@google.com> > --- Acked-by: Andrii Nakryiko <andrii@kernel.org> > tools/testing/selftests/bpf/ima_setup.sh | 15 +++++++++++++++ > 1 file changed, 15 insertions(+) > > diff --git a/tools/testing/selftests/bpf/ima_setup.sh b/tools/testing/selftests/bpf/ima_setup.sh > index 137f2d32598f..b1ee4bf06996 100755 > --- a/tools/testing/selftests/bpf/ima_setup.sh > +++ b/tools/testing/selftests/bpf/ima_setup.sh > @@ -14,6 +14,20 @@ usage() > exit 1 > } > > +ensure_mount_securityfs() > +{ > + local securityfs_dir=$(grep "securityfs" /proc/mounts | awk '{print $2}') > + > + if [ -z "${securityfs_dir}" ]; then > + securityfs_dir=/sys/kernel/security > + mount -t securityfs security "${securityfs_dir}" > + fi > + > + if [ ! -d "${securityfs_dir}" ]; then > + echo "${securityfs_dir}: securityfs is not mounted" && exit 1 > + fi > +} > + > setup() > { > local tmp_dir="$1" > @@ -33,6 +47,7 @@ setup() > cp "${TEST_BINARY}" "${mount_dir}" > local mount_uuid="$(blkid ${loop_device} | sed 's/.*UUID="\([^"]*\)".*/\1/')" > > + ensure_mount_securityfs > echo "measure func=BPRM_CHECK fsuuid=${mount_uuid}" > ${IMA_POLICY_FILE} > } > > -- > 2.29.2.576.ga3fc446d84-goog >
diff --git a/tools/testing/selftests/bpf/ima_setup.sh b/tools/testing/selftests/bpf/ima_setup.sh index 137f2d32598f..b1ee4bf06996 100755 --- a/tools/testing/selftests/bpf/ima_setup.sh +++ b/tools/testing/selftests/bpf/ima_setup.sh @@ -14,6 +14,20 @@ usage() exit 1 } +ensure_mount_securityfs() +{ + local securityfs_dir=$(grep "securityfs" /proc/mounts | awk '{print $2}') + + if [ -z "${securityfs_dir}" ]; then + securityfs_dir=/sys/kernel/security + mount -t securityfs security "${securityfs_dir}" + fi + + if [ ! -d "${securityfs_dir}" ]; then + echo "${securityfs_dir}: securityfs is not mounted" && exit 1 + fi +} + setup() { local tmp_dir="$1" @@ -33,6 +47,7 @@ setup() cp "${TEST_BINARY}" "${mount_dir}" local mount_uuid="$(blkid ${loop_device} | sed 's/.*UUID="\([^"]*\)".*/\1/')" + ensure_mount_securityfs echo "measure func=BPRM_CHECK fsuuid=${mount_uuid}" > ${IMA_POLICY_FILE} }