mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-29 05:44:11 +00:00
34b82d3ac1
The test does the following:
- Mounts a loopback filesystem and appends the IMA policy to measure
executions only on this file-system. Restricting the IMA policy to
a particular filesystem prevents a system-wide IMA policy change.
- Executes an executable copied to this loopback filesystem.
- Calls the bpf_ima_inode_hash in the bprm_committed_creds hook and
checks if the call succeeded and checks if a hash was calculated.
The test shells out to the added ima_setup.sh script as the setup is
better handled in a shell script and is more complicated to do in the
test program or even shelling out individual commands from C.
The list of required configs (i.e. IMA, SECURITYFS,
IMA_{WRITE,READ}_POLICY) for running this test are also updated.
Suggested-by: Mimi Zohar <zohar@linux.ibm.com> (limit policy rule to loopback mount)
Signed-off-by: KP Singh <kpsingh@google.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/bpf/20201124151210.1081188-4-kpsingh@chromium.org
74 lines
1.7 KiB
C
74 lines
1.7 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
|
|
/*
|
|
* Copyright (C) 2020 Google LLC.
|
|
*/
|
|
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <unistd.h>
|
|
#include <sys/wait.h>
|
|
#include <test_progs.h>
|
|
|
|
#include "ima.skel.h"
|
|
|
|
static int run_measured_process(const char *measured_dir, u32 *monitored_pid)
|
|
{
|
|
int child_pid, child_status;
|
|
|
|
child_pid = fork();
|
|
if (child_pid == 0) {
|
|
*monitored_pid = getpid();
|
|
execlp("./ima_setup.sh", "./ima_setup.sh", "run", measured_dir,
|
|
NULL);
|
|
exit(errno);
|
|
|
|
} else if (child_pid > 0) {
|
|
waitpid(child_pid, &child_status, 0);
|
|
return WEXITSTATUS(child_status);
|
|
}
|
|
|
|
return -EINVAL;
|
|
}
|
|
|
|
void test_test_ima(void)
|
|
{
|
|
char measured_dir_template[] = "/tmp/ima_measuredXXXXXX";
|
|
const char *measured_dir;
|
|
char cmd[256];
|
|
|
|
int err, duration = 0;
|
|
struct ima *skel = NULL;
|
|
|
|
skel = ima__open_and_load();
|
|
if (CHECK(!skel, "skel_load", "skeleton failed\n"))
|
|
goto close_prog;
|
|
|
|
err = ima__attach(skel);
|
|
if (CHECK(err, "attach", "attach failed: %d\n", err))
|
|
goto close_prog;
|
|
|
|
measured_dir = mkdtemp(measured_dir_template);
|
|
if (CHECK(measured_dir == NULL, "mkdtemp", "err %d\n", errno))
|
|
goto close_prog;
|
|
|
|
snprintf(cmd, sizeof(cmd), "./ima_setup.sh setup %s", measured_dir);
|
|
if (CHECK_FAIL(system(cmd)))
|
|
goto close_clean;
|
|
|
|
err = run_measured_process(measured_dir, &skel->bss->monitored_pid);
|
|
if (CHECK(err, "run_measured_process", "err = %d\n", err))
|
|
goto close_clean;
|
|
|
|
CHECK(skel->data->ima_hash_ret < 0, "ima_hash_ret",
|
|
"ima_hash_ret = %ld\n", skel->data->ima_hash_ret);
|
|
|
|
CHECK(skel->bss->ima_hash == 0, "ima_hash",
|
|
"ima_hash = %lu\n", skel->bss->ima_hash);
|
|
|
|
close_clean:
|
|
snprintf(cmd, sizeof(cmd), "./ima_setup.sh cleanup %s", measured_dir);
|
|
CHECK_FAIL(system(cmd));
|
|
close_prog:
|
|
ima__destroy(skel);
|
|
}
|