From patchwork Wed Mar 5 14:54:17 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 14002869 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A97E024DFF4 for ; Wed, 5 Mar 2025 14:54:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1741186478; cv=none; b=sUY3n84JhDxyJlCm1NPNDjs6Q/WqjJGEQO2Geitnt3iuTWanmwZ1WeFUwEAn4H2V0ISxQVyImRWlOql6APsIQD4zSdCnHH3Nf8AZCaDdW1X8fo7EcL5RawAZnWFvKSFs1YZgoWbV7NipaH1NDF1ih8JBj0+IceUbH7PRGrYeIUg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1741186478; c=relaxed/simple; bh=KUo9wQlmv9/QzJPGNoYq36h1ywrzW0R3JyxWK1ltRE0=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=VkwsxP+xSxiZNVidlVbgGvLP3p1o9/wI/A89GJMZZTV5ak300BiO25u8HEETevobBCkDM5aplCRbB4ORaZeoFyuTwx/aHCRP1hqxloTqtvfvYcNItgF1hPS9CZC/KXVjslNSUjVx6x+7Io1InQQn72gFjdz4Uh11mndKJF/eq6o= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=igYb5oIt; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="igYb5oIt" Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 525CSVob032499; Wed, 5 Mar 2025 14:54:31 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:message-id:mime-version :subject:to; s=pp1; bh=dIsUEWCxqhEdj+mTgGu8xdt/PVIOMBGgS/hEVPIwg wE=; b=igYb5oItdSb0xnE+GdQpgH9i320UNZefULGnQaraOpVyR2swfTVobD4bM x4wTS6/RW4IdswzkCxdWJ//JiDiIjGEU7gX9JqXarzQHOCKGY1zuB3Wb6Kvghcil hLwCGYVTjZqzQnkBiUhsUAcFAapQcp2fIfsxIGfPalbguti+O5LXA3wJv4d0jQEa 7lmSO4kuun00OpyRuWn9b0aMdOr/og66VsuXi9hYuu5e0bE+59AZX5wB2+dQpGoc r4ecl2YC3dfdOKzLqB14Y/SJJBppRCJ2kpgUYZmXTual/RrM/UIXFdo88OHr1b0w GFuHeLwJ2zspEIwfg2xszZTL33EAA== Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 456pnarqdh-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 05 Mar 2025 14:54:30 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 525EVnfb009015; Wed, 5 Mar 2025 14:54:29 GMT Received: from smtprelay03.fra02v.mail.ibm.com ([9.218.2.224]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 454cxyke6m-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 05 Mar 2025 14:54:29 +0000 Received: from smtpav02.fra02v.mail.ibm.com (smtpav02.fra02v.mail.ibm.com [10.20.54.101]) by smtprelay03.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 525EsPt656230392 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 5 Mar 2025 14:54:25 GMT Received: from smtpav02.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id AC2EF2004B; Wed, 5 Mar 2025 14:54:25 +0000 (GMT) Received: from smtpav02.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 0F8D320040; Wed, 5 Mar 2025 14:54:24 +0000 (GMT) Received: from li-43857255-d5e6-4659-90f1-fc5cee4750ad.ibm.com.com (unknown [9.61.124.31]) by smtpav02.fra02v.mail.ibm.com (Postfix) with ESMTP; Wed, 5 Mar 2025 14:54:23 +0000 (GMT) From: Mimi Zohar To: ltp@lists.linux.it Cc: Mimi Zohar , Stefan Berger , Petr Vorel , linux-integrity@vger.kernel.org Subject: [PATCH v3 1/5] ima_violations.sh: force $LOG ToMToU violation earlier Date: Wed, 5 Mar 2025 09:54:17 -0500 Message-ID: <20250305145421.638857-1-zohar@linux.ibm.com> X-Mailer: git-send-email 2.48.1 Precedence: bulk X-Mailing-List: linux-integrity@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: 08Wrky9M1XQegqMomOuHwtwvuqwf27t1 X-Proofpoint-GUID: 08Wrky9M1XQegqMomOuHwtwvuqwf27t1 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1093,Hydra:6.0.680,FMLib:17.12.68.34 definitions=2025-03-05_06,2025-03-05_01,2024-11-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 malwarescore=0 phishscore=0 spamscore=0 adultscore=0 lowpriorityscore=0 mlxlogscore=806 bulkscore=0 impostorscore=0 priorityscore=1501 suspectscore=0 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.19.0-2502100000 definitions=main-2503050114 Violation tests are dependent on searching the $LOG file, which may itself result in a ToMToU violation. Preempt getting an additional violation during the tests by forcing the $LOG ToMToU violation earlier. Signed-off-by: Mimi Zohar --- testcases/kernel/security/integrity/ima/tests/ima_violations.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/testcases/kernel/security/integrity/ima/tests/ima_violations.sh b/testcases/kernel/security/integrity/ima/tests/ima_violations.sh index 37d8d473c..22863fb72 100755 --- a/testcases/kernel/security/integrity/ima/tests/ima_violations.sh +++ b/testcases/kernel/security/integrity/ima/tests/ima_violations.sh @@ -30,6 +30,7 @@ setup() if [ ! -e "$LOG" ]; then tst_brk TCONF "log file not found, install auditd" fi + exec 3< $LOG || tst_brk TBROK "failed to read log file" tst_res TINFO "using log $LOG" } From patchwork Wed Mar 5 14:54:18 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 14002868 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 91B1784D02 for ; Wed, 5 Mar 2025 14:54:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1741186478; cv=none; b=QdGQ6mdaEXJRuiJjE2U7bazLqSDmy8sgpLerlSEU6iraORu4sRcxnBEAoQTI8rlWZv8FtBRE3tZGuwl/RlogeOSOva6BUsVGCyyMcYLZpHttRuMDUq6bDQriEGH0Eu8X9pa2ARtthzY5RDg2H0d1QN9kyBh3uVZn/Miwf1QcDVk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1741186478; c=relaxed/simple; bh=GsrXhSENdrMO5MXohV7m3HcfVHNkqHsjudRy/bdUsqs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=MHYgAIpd5mZISXtDQQfULyQ/pTCL7pSp0d0IQL4AvSnNBIZPqmZQtZv2FAZQstFxlM9XBh8eIgrjKm8mt1BoyT0UuShuWg8tg+by4p+lM789y4pF2Aq7Y7q414JIjqxKvz2EZSoZr/gtMFfIKg61O86q3Hi0i7/phJUMvppWUq4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=mtbaNAdb; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="mtbaNAdb" Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 525AJLM9025087; Wed, 5 Mar 2025 14:54:32 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=gC84LdE35S4K++oOO gPsesF6e7Hj9gWh2zwcBlqZMa8=; b=mtbaNAdbbr/TAYoQBPiRGbXgLlkccW+jN VqxFUaKlV9VPEOm9nDoQIOCMUySW9yFCsC+1K37L2CTQYtz/4h1lRCmV6tOYrZGH hd1LP1Mh2tVcfIhlEke2VHwBei/Bk3AJjuxlzOXDqjJy9nvsTrF/joE/WrUVwP0i TjjAx8nvDVuSVR1RcQVUWX8BioXIsJwLE4GGNLjAW17HzUqxxuJPa+98g68VRFfs VzvgzMmpJYiW1m2+5HnCpX8HWTJg/WV01umnMLSY69OuPkR8hYcxxEYvhyzsng29 Z29E9OKgBd8IzSFz/vItYPa7pzst8lrhFkzlEV/nd2McO0sVnjAUg== Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4568x545rk-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 05 Mar 2025 14:54:31 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 525BABxF020871; Wed, 5 Mar 2025 14:54:31 GMT Received: from smtprelay01.fra02v.mail.ibm.com ([9.218.2.227]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 454djnkanf-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 05 Mar 2025 14:54:31 +0000 Received: from smtpav02.fra02v.mail.ibm.com (smtpav02.fra02v.mail.ibm.com [10.20.54.101]) by smtprelay01.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 525EsR6t57934102 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 5 Mar 2025 14:54:27 GMT Received: from smtpav02.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 6D04A2004B; Wed, 5 Mar 2025 14:54:27 +0000 (GMT) Received: from smtpav02.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 070EC20040; Wed, 5 Mar 2025 14:54:26 +0000 (GMT) Received: from li-43857255-d5e6-4659-90f1-fc5cee4750ad.ibm.com.com (unknown [9.61.124.31]) by smtpav02.fra02v.mail.ibm.com (Postfix) with ESMTP; Wed, 5 Mar 2025 14:54:25 +0000 (GMT) From: Mimi Zohar To: ltp@lists.linux.it Cc: Mimi Zohar , Stefan Berger , Petr Vorel , linux-integrity@vger.kernel.org Subject: [PATCH v3 2/5] ima_violations.sh: Update validate() to support multiple violations Date: Wed, 5 Mar 2025 09:54:18 -0500 Message-ID: <20250305145421.638857-2-zohar@linux.ibm.com> X-Mailer: git-send-email 2.48.1 In-Reply-To: <20250305145421.638857-1-zohar@linux.ibm.com> References: <20250305145421.638857-1-zohar@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-integrity@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: VDHbSiairrhqdRnfPdw1UelQJwUWZpMd X-Proofpoint-ORIG-GUID: VDHbSiairrhqdRnfPdw1UelQJwUWZpMd X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1093,Hydra:6.0.680,FMLib:17.12.68.34 definitions=2025-03-05_06,2025-03-05_01,2024-11-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 spamscore=0 lowpriorityscore=0 adultscore=0 phishscore=0 mlxlogscore=999 suspectscore=0 impostorscore=0 priorityscore=1501 malwarescore=0 bulkscore=0 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.19.0-2502100000 definitions=main-2503050114 Add optional support for the number of expected violations. Include the expected number of violations in the output. Limit the new expected violations to the new tests, so that the existing tests continue to work properly with/without the kernel changes. Signed-off-by: Mimi Zohar --- .../security/integrity/ima/tests/ima_violations.sh | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/testcases/kernel/security/integrity/ima/tests/ima_violations.sh b/testcases/kernel/security/integrity/ima/tests/ima_violations.sh index 22863fb72..37bf2182b 100755 --- a/testcases/kernel/security/integrity/ima/tests/ima_violations.sh +++ b/testcases/kernel/security/integrity/ima/tests/ima_violations.sh @@ -72,20 +72,27 @@ validate() local num_violations="$1" local count="$2" local search="$3" + local expected_violations="$4" local max_attempt=3 local count2 i num_violations_new for i in $(seq 1 $max_attempt); do read num_violations_new < $IMA_VIOLATIONS count2="$(get_count $search)" - if [ $(($num_violations_new - $num_violations)) -gt 0 ]; then + if [ -z "$expected_violations" ] && \ + [ $(($num_violations_new - $num_violations)) -gt 0 ] || \ + [ $(($num_violations_new - $num_violations)) -eq $expected_violations ]; then + [ -z "$expected_violations" ] && expected_violations=1 if [ $count2 -gt $count ]; then - tst_res TPASS "$search violation added" + tst_res TPASS "$expected_violations $search violation(s) added" return else tst_res TINFO "$search not found in $LOG ($i/$max_attempt attempt)..." tst_sleep 1s fi + elif [ $(($num_violations_new - $num_violations)) -gt 0 ]; then + tst_res $IMA_FAIL "$search too many violations added: $num_violations_new - $num_violations" + return else tst_res $IMA_FAIL "$search violation not added" return From patchwork Wed Mar 5 14:54:19 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 14002871 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C6C8A24CEE1 for ; Wed, 5 Mar 2025 14:54:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1741186482; cv=none; b=m3nywKotJzZgSflYKguKLQhC0y6y/TPpPsEVvXDut/uke/3tUn5PgE5gV4hY5iUypF+mooPAccEG5IpdwOCGzrnHHVZA7cRj4Tw5fsbVTMT6xgNusy9xBGq3/A0lLiF8M8GMpij88MhUKnsW0ro4tCfFEy+pbgpRy1559QIdlQo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1741186482; c=relaxed/simple; bh=geUBIfzmjU3t+1SqSik0uD5luPJg9WVZQBrRmU4TFk0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=b36qSYFCTSwBe7WC+KC3VgpEvedTmBWjzQ1m+pRnx6ZvsTbds+lfatxEiFh0dD6tpPBNZ+Xi1PAJStEW5eIsDewC8NzYH1dO8Hn7GjKeqHNwudQzxIY3Fkto6CxAWV+C16gCguvX9gU9HsD6CCd0GGXftHLHxmFU7y0XSp1YMWA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=Tg7Kx+Ch; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="Tg7Kx+Ch" Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 525Aux0G014524; Wed, 5 Mar 2025 14:54:36 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=wzBYCtoFjoQzKoLWG ylW8AnaF+6J8BCZPX7uWvWMduA=; b=Tg7Kx+Ch/VsnsWjVVzvVIUGrTRyGO8dKo XyrwjSdLppxpgy6f7OVRnCbzYt1qCsLt2IyWNQvraTLuP+w6Y64H/U0qbba5qFR3 bZmWuRpRrnPVEQlQFqXtr+2/YopSLkGViStrV1Azw9bdqiMSwc+o77kl5lN/AlVS DeGjHDxbQ7E5fCuyuwI5g5Ocwk0GIObUuvKdyPzWq/sfRGaL3msEC/vdQgssC3th le4BcA/BcG0996i90JTk+9W8OLOQXtuE2fSFZCL9VIwwQk/oZLQmdMt36L2/AAUz /aTcdV4ZIARHzZ7RmOQL7OO7FH9Ct1R5hjyBum0v4zSqDdSeBrHsg== Received: from ppma23.wdc07v.mail.ibm.com (5d.69.3da9.ip4.static.sl-reverse.com [169.61.105.93]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4568r0m6m2-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 05 Mar 2025 14:54:36 +0000 (GMT) Received: from pps.filterd (ppma23.wdc07v.mail.ibm.com [127.0.0.1]) by ppma23.wdc07v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 525BE4C3013805; Wed, 5 Mar 2025 14:54:33 GMT Received: from smtprelay05.fra02v.mail.ibm.com ([9.218.2.225]) by ppma23.wdc07v.mail.ibm.com (PPS) with ESMTPS id 454e2ku7e0-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 05 Mar 2025 14:54:33 +0000 Received: from smtpav02.fra02v.mail.ibm.com (smtpav02.fra02v.mail.ibm.com [10.20.54.101]) by smtprelay05.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 525EsTEt56361224 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 5 Mar 2025 14:54:29 GMT Received: from smtpav02.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 5F0C720043; Wed, 5 Mar 2025 14:54:29 +0000 (GMT) Received: from smtpav02.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id D264420040; Wed, 5 Mar 2025 14:54:27 +0000 (GMT) Received: from li-43857255-d5e6-4659-90f1-fc5cee4750ad.ibm.com.com (unknown [9.61.124.31]) by smtpav02.fra02v.mail.ibm.com (Postfix) with ESMTP; Wed, 5 Mar 2025 14:54:27 +0000 (GMT) From: Mimi Zohar To: ltp@lists.linux.it Cc: Mimi Zohar , Stefan Berger , Petr Vorel , linux-integrity@vger.kernel.org Subject: [PATCH v3 3/5] ima_violations.sh: additional open-writer violation tests Date: Wed, 5 Mar 2025 09:54:19 -0500 Message-ID: <20250305145421.638857-3-zohar@linux.ibm.com> X-Mailer: git-send-email 2.48.1 In-Reply-To: <20250305145421.638857-1-zohar@linux.ibm.com> References: <20250305145421.638857-1-zohar@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-integrity@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: guUI_ohwhEFLzwUAx0Mjg9khRZB5spg9 X-Proofpoint-ORIG-GUID: guUI_ohwhEFLzwUAx0Mjg9khRZB5spg9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1093,Hydra:6.0.680,FMLib:17.12.68.34 definitions=2025-03-05_06,2025-03-05_01,2024-11-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 mlxlogscore=984 suspectscore=0 impostorscore=0 priorityscore=1501 bulkscore=0 spamscore=0 mlxscore=0 phishscore=0 clxscore=1015 adultscore=0 lowpriorityscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.19.0-2502100000 definitions=main-2503050114 Kernel patch "ima: limit the number of open-writers integrity violations" prevents superfluous "open-writers" violations. Add corresponding LTP tests. Link: https://lore.kernel.org/linux-integrity/20250228205505.476845-2-zohar@linux.ibm.com/ Signed-off-by: Mimi Zohar --- .../integrity/ima/tests/ima_violations.sh | 87 ++++++++++++++++++- 1 file changed, 86 insertions(+), 1 deletion(-) diff --git a/testcases/kernel/security/integrity/ima/tests/ima_violations.sh b/testcases/kernel/security/integrity/ima/tests/ima_violations.sh index 37bf2182b..d3081a4d1 100755 --- a/testcases/kernel/security/integrity/ima/tests/ima_violations.sh +++ b/testcases/kernel/security/integrity/ima/tests/ima_violations.sh @@ -8,7 +8,7 @@ TST_SETUP="setup" TST_CLEANUP="cleanup" -TST_CNT=3 +TST_CNT=6 REQUIRED_BUILTIN_POLICY="tcb" REQUIRED_POLICY_CONTENT='violations.policy' @@ -61,6 +61,17 @@ close_file_write() exec 4>&- } +open_file_write2() +{ + exec 5> $FILE || tst_brk TBROK "exec 5> $FILE failed" + echo 'test writing2' >&5 +} + +close_file_write2() +{ + exec 5>&- +} + get_count() { local search="$1" @@ -162,6 +173,80 @@ test3() tst_sleep 2s } +test4() +{ + tst_res TINFO "verify limiting single open writer violation" + + local search="open_writers" + local count num_violations + + read num_violations < $IMA_VIOLATIONS + count="$(get_count $search)" + + open_file_write + open_file_read + close_file_read + + open_file_read + close_file_read + + close_file_write + + validate "$num_violations" "$count" "$search" 1 +} + +test5() +{ + tst_res TINFO "verify limiting multiple open writers violations" + + local search="open_writers" + local count num_violations + + read num_violations < $IMA_VIOLATIONS + count="$(get_count $search)" + + open_file_write + open_file_read + close_file_read + + open_file_write2 + open_file_read + close_file_read + close_file_write2 + + open_file_read + close_file_read + + close_file_write + + validate "$num_violations" "$count" "$search" 1 +} + +test6() +{ + tst_res TINFO "verify new open writer causes additional violation" + + local search="open_writers" + local count num_violations + + read num_violations < $IMA_VIOLATIONS + count="$(get_count $search)" + + open_file_write + open_file_read + close_file_read + + open_file_read + close_file_read + close_file_write + + open_file_write + open_file_read + close_file_read + close_file_write + validate "$num_violations" "$count" "$search" 2 +} + . ima_setup.sh . daemonlib.sh tst_run From patchwork Wed Mar 5 14:54:20 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 14002870 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4FC7184D02 for ; Wed, 5 Mar 2025 14:54:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1741186481; cv=none; b=aISMA9KGWiwddTVAPqn3brX1B+oH1Z5UdxOWCkGb3982xh/yVuYeExHeLOaXL3FccCkmA/bbkpPve1yzkPEAO5FSJ2dpd9bq0KtGsGVGz9kr4WJEasPGcbPCDEs3vxKdrvneRVCGDEbZtYTovWy4IMDzzuTUZObcrTd464bviO0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1741186481; c=relaxed/simple; bh=C9WPBqCBsvb60Kewv63GjBRP8dEq7WOImigolFppzoY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=OuBgbVTZYPP5MmCNe1htiu8uqG5yzORCv36ZT6vrp5UDzmy2PntuXtv0hVW3luK0059GHWyjdC+qoUytkw2XSEpMV/fJYFgSH8Z7W1lCz7hIGoMgf5py/KjqBD2rRXieHfq6rc7twyNvyKxb4bSoSB1nga3qI9Gev2C2LdLR2Ho= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=Bqdr6cPy; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="Bqdr6cPy" Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 525AsFCZ028235; Wed, 5 Mar 2025 14:54:35 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=K3BIVVofhQVjkD+94 1L35A8B/+mxTg7bA9YUtM1C09s=; b=Bqdr6cPynsjhT51Xb1QX0jCLKbQbZrtUG Utqr6ZqKsJWnhmIjU3ce2mpPnol9ZjiQhD6h3jTXsWhrAGZggbLKUEyAqoCeo4ck eCQ6rYqTQ9DSnYHLPjBT6PgMGHoso3x6XHypsvDhodFH84hxFHhSJE5RcmXNcfsa szP+zWogqFXedIOHbQlW0Q6VCFIhRU7CrPzvit6vZRXKUpJWd8E8kzM6pANXxKhq 4db1iE2mEOux0wWIKwS4hU5YuFHbdqsgqygRtc3+GGUGAb6mqtddp03NuBXDd1TQ lb3Ri71/K0NaZzpYX+DgtyoZujGBdYMMQT9RkxAu+RRyGw9Dm/4dw== Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4568x545s4-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 05 Mar 2025 14:54:35 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 525EMo6o032219; Wed, 5 Mar 2025 14:54:34 GMT Received: from smtprelay07.fra02v.mail.ibm.com ([9.218.2.229]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 454cjt3gyn-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 05 Mar 2025 14:54:34 +0000 Received: from smtpav02.fra02v.mail.ibm.com (smtpav02.fra02v.mail.ibm.com [10.20.54.101]) by smtprelay07.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 525EsVNv31654350 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 5 Mar 2025 14:54:31 GMT Received: from smtpav02.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 51DA520043; Wed, 5 Mar 2025 14:54:31 +0000 (GMT) Received: from smtpav02.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id DB66920040; Wed, 5 Mar 2025 14:54:29 +0000 (GMT) Received: from li-43857255-d5e6-4659-90f1-fc5cee4750ad.ibm.com.com (unknown [9.61.124.31]) by smtpav02.fra02v.mail.ibm.com (Postfix) with ESMTP; Wed, 5 Mar 2025 14:54:29 +0000 (GMT) From: Mimi Zohar To: ltp@lists.linux.it Cc: Mimi Zohar , Stefan Berger , Petr Vorel , linux-integrity@vger.kernel.org Subject: [PATCH v3 4/5] ima_violations.sh: additional ToMToU violation tests Date: Wed, 5 Mar 2025 09:54:20 -0500 Message-ID: <20250305145421.638857-4-zohar@linux.ibm.com> X-Mailer: git-send-email 2.48.1 In-Reply-To: <20250305145421.638857-1-zohar@linux.ibm.com> References: <20250305145421.638857-1-zohar@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-integrity@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: n8T14XmXTmSQFopoHdMl1jOLZIdc_dkW X-Proofpoint-ORIG-GUID: n8T14XmXTmSQFopoHdMl1jOLZIdc_dkW X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1093,Hydra:6.0.680,FMLib:17.12.68.34 definitions=2025-03-05_06,2025-03-05_01,2024-11-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 spamscore=0 lowpriorityscore=0 adultscore=0 phishscore=0 mlxlogscore=649 suspectscore=0 impostorscore=0 priorityscore=1501 malwarescore=0 bulkscore=0 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.19.0-2502100000 definitions=main-2503050114 Kernel patch "ima: limit the number of ToMToU integrity violations" prevents superfluous ToMToU violations. Add corresponding LTP tests. Link: https://lore.kernel.org/linux-integrity/20250228205505.476845-3-zohar@linux.ibm.com/ Signed-off-by: Mimi Zohar --- .../integrity/ima/tests/ima_violations.sh | 46 ++++++++++++++++++- 1 file changed, 45 insertions(+), 1 deletion(-) diff --git a/testcases/kernel/security/integrity/ima/tests/ima_violations.sh b/testcases/kernel/security/integrity/ima/tests/ima_violations.sh index d3081a4d1..0395f8d0a 100755 --- a/testcases/kernel/security/integrity/ima/tests/ima_violations.sh +++ b/testcases/kernel/security/integrity/ima/tests/ima_violations.sh @@ -8,7 +8,7 @@ TST_SETUP="setup" TST_CLEANUP="cleanup" -TST_CNT=6 +TST_CNT=8 REQUIRED_BUILTIN_POLICY="tcb" REQUIRED_POLICY_CONTENT='violations.policy' @@ -247,6 +247,50 @@ test6() validate "$num_violations" "$count" "$search" 2 } +test7() +{ + tst_res TINFO "verify limiting single open reader ToMToU violations" + + local search="ToMToU" + local count num_violations + + read num_violations < $IMA_VIOLATIONS + count="$(get_count $search)" + + open_file_read + open_file_write + close_file_write + + open_file_write + close_file_write + close_file_read + + validate "$num_violations" "$count" "$search" 1 +} + +test8() +{ + tst_res TINFO "verify new open reader causes additional violation" + + local search="ToMToU" + local count num_violations + + read num_violations < $IMA_VIOLATIONS + count="$(get_count $search)" + + open_file_read + open_file_write + close_file_write + close_file_read + + open_file_read + open_file_write + close_file_write + close_file_read + + validate "$num_violations" "$count" "$search" 2 +} + . ima_setup.sh . daemonlib.sh tst_run From patchwork Wed Mar 5 14:54:21 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 14002872 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3FA8524C073 for ; Wed, 5 Mar 2025 14:54:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1741186483; cv=none; b=NzsfWUjgG3eYKWciqdL/Wr/TZhN5qa0uSkF0eYQj6ifcSn420YX/RpojOIzo/pyz3sTKg7gCaFhz8g3lYAXKtFWbpMOwcES79MdLrrP4ve+greA/A4lTGaSZ6XxCU9uSZ2civ3IZZ1m+EWdJ8PI3y6IRsN8GXVeQDR6NmfHEivE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1741186483; c=relaxed/simple; bh=WcT6gW3waZSLQDz9wvyo03jU/ECl597orI3QxOjn2b4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=A13o7Y4EQapwv84rGGRWPtsg59C57PfSMmbUbca+JXT3SQpOCrV2A0ve0X9p+rxtNUqQcaVk0hlZQihexWdmDB0kzsS7WrfM6BlyfP1DWim2jsOE5viBLgOeQiZqiIGuBQ2WVR3yywV3qlSi/MUiDkz94Wpz/kV1weUDxZM9/fQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=KsCJJDF7; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="KsCJJDF7" Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 525ArSPg008101; Wed, 5 Mar 2025 14:54:38 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=yHHRBDZIJVgbFSknx YrXzeJC0MQmU4oIq3enwGgiPx8=; b=KsCJJDF7LrwhTFUDWgme2BrM0WaiOSB7E rpY+WFnzoeaotqTkhPvuUfVjjPOpX8AmSa9FStCZX98wGo8Sz2r2XJ8Av+DoGPOe cVllZrCMaQQzcmRyRIbxHantxLeSTJVilCSXHB3yNuDgrH5u71Y94fVBvzKEWqjC 95l4NVH91sAVHdJCHHtc9CNNAzhysnPIStfuCSV1/Z/Ma/UdOC3G4TUcfqztpAms 1RkZ4O2mTNz/W4NTEFy0Xqpx4CbK/r675FvqhzY8IkLE4i5LLqQTjubXeBEAXXFK RxqPDMHGN8IskIMxkUhXMSKdXvfxYOt+qssSkpzzAUmm1Ul1yjVew== Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4568ppc75q-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 05 Mar 2025 14:54:37 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 525BLN9v020841; Wed, 5 Mar 2025 14:54:37 GMT Received: from smtprelay04.fra02v.mail.ibm.com ([9.218.2.228]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 454djnkanu-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 05 Mar 2025 14:54:37 +0000 Received: from smtpav02.fra02v.mail.ibm.com (smtpav02.fra02v.mail.ibm.com [10.20.54.101]) by smtprelay04.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 525EsXED13304092 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 5 Mar 2025 14:54:33 GMT Received: from smtpav02.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 7734F20043; Wed, 5 Mar 2025 14:54:33 +0000 (GMT) Received: from smtpav02.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id B55D220040; Wed, 5 Mar 2025 14:54:31 +0000 (GMT) Received: from li-43857255-d5e6-4659-90f1-fc5cee4750ad.ibm.com.com (unknown [9.61.124.31]) by smtpav02.fra02v.mail.ibm.com (Postfix) with ESMTP; Wed, 5 Mar 2025 14:54:31 +0000 (GMT) From: Mimi Zohar To: ltp@lists.linux.it Cc: Mimi Zohar , Stefan Berger , Petr Vorel , linux-integrity@vger.kernel.org Subject: [PATCH v3 5/5] ima_violations.sh: require kernel v6.14 for minimizing violations tests Date: Wed, 5 Mar 2025 09:54:21 -0500 Message-ID: <20250305145421.638857-5-zohar@linux.ibm.com> X-Mailer: git-send-email 2.48.1 In-Reply-To: <20250305145421.638857-1-zohar@linux.ibm.com> References: <20250305145421.638857-1-zohar@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-integrity@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: 4KSx66GJD6S1wY-3ISK4BhfUVdxi_uHn X-Proofpoint-ORIG-GUID: 4KSx66GJD6S1wY-3ISK4BhfUVdxi_uHn X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1093,Hydra:6.0.680,FMLib:17.12.68.34 definitions=2025-03-05_06,2025-03-05_01,2024-11-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 phishscore=0 bulkscore=0 lowpriorityscore=0 suspectscore=0 clxscore=1015 malwarescore=0 mlxscore=0 impostorscore=0 adultscore=0 priorityscore=1501 mlxlogscore=999 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.19.0-2502100000 definitions=main-2503050114 Depending on the IMA policy and the number of violations, the kernel patches for minimizing the number of open-writers and ToMToU (Time of Measure Time of Use) violations may be a major performance improvement. Most likely the kernel patches will be back ported, but for now limit the new tests to new kernels with the applied patches. Bail after the first new test. Signed-off-by: Mimi Zohar --- .../kernel/security/integrity/ima/tests/ima_violations.sh | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/testcases/kernel/security/integrity/ima/tests/ima_violations.sh b/testcases/kernel/security/integrity/ima/tests/ima_violations.sh index 0395f8d0a..8e988fca6 100755 --- a/testcases/kernel/security/integrity/ima/tests/ima_violations.sh +++ b/testcases/kernel/security/integrity/ima/tests/ima_violations.sh @@ -177,6 +177,10 @@ test4() { tst_res TINFO "verify limiting single open writer violation" + if tst_kvcmp -lt 6.14; then + tst_brk TCONF "Minimizing violations requires kernel 6.14 or newer" + fi + local search="open_writers" local count num_violations