| Message ID | 1551223620-11586-3-git-send-email-zohar@linux.ibm.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | selftests/ima: add kexec and kernel module tests | expand |
On 2/26/19 4:26 PM, Mimi Zohar wrote: > Define, update and move get_secureboot_mode() to a common file for use > by other tests. > > Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> > Reviewed-by: Petr Vorel <pvorel@suse.cz> > --- > tools/testing/selftests/ima/Makefile | 1 + > tools/testing/selftests/ima/common_lib.sh | 24 ++++++++++++++++++++++++ > tools/testing/selftests/ima/test_kexec_load.sh | 17 +++-------------- > 3 files changed, 28 insertions(+), 14 deletions(-) > create mode 100755 tools/testing/selftests/ima/common_lib.sh > > diff --git a/tools/testing/selftests/ima/Makefile b/tools/testing/selftests/ima/Makefile > index 0b3adf5444b6..46b9e04d2737 100644 > --- a/tools/testing/selftests/ima/Makefile > +++ b/tools/testing/selftests/ima/Makefile > @@ -5,6 +5,7 @@ ARCH ?= $(shell echo $(uname_M) | sed -e s/i.86/x86/ -e s/x86_64/x86/) > > ifeq ($(ARCH),x86) > TEST_PROGS := test_kexec_load.sh > +TEST_FILES := common_lib.sh > > include ../lib.mk > > diff --git a/tools/testing/selftests/ima/common_lib.sh b/tools/testing/selftests/ima/common_lib.sh > new file mode 100755 > index 000000000000..5583ea74c14e > --- /dev/null > +++ b/tools/testing/selftests/ima/common_lib.sh > @@ -0,0 +1,24 @@ > +#!/bin/sh > +# SPDX-License-Identifier: GPL-2.0-or-later # SPDX-License-Identifier: GPL-2.0 > + > +# The secure boot mode can be accessed either as the last integer > +# of "od -An -t u1 /sys/firmware/efi/efivars/SecureBoot-*" or from > +# "od -An -t u1 /sys/firmware/efi/vars/SecureBoot-*/data". > +# Return 1 for SecureBoot mode enabled. > +get_secureboot_mode() > +{ > + local efivarfs="/sys/firmware/efi/efivars" > + # Make sure that efivars is mounted in the normal location > + if ! grep -q "^\S\+ $efivarfs efivarfs" /proc/mounts; then > + echo "$TEST: efivars is not mounted on $efivarfs" >&2 > + exit $ksft_skip > + fi > + > + # Get secureboot mode > + local file="$efivarfs/../vars/SecureBoot-*/data" > + if [ ! -e $file ]; then > + echo "$TEST: unknown secureboot mode" >&2 > + exit $ksft_skip > + fi > + return `od -An -t u1 /sys/firmware/efi/vars/SecureBoot-*/data` > +} > diff --git a/tools/testing/selftests/ima/test_kexec_load.sh b/tools/testing/selftests/ima/test_kexec_load.sh > index 0345803e7bec..35934e0665f1 100755 > --- a/tools/testing/selftests/ima/test_kexec_load.sh > +++ b/tools/testing/selftests/ima/test_kexec_load.sh > @@ -5,7 +5,7 @@ > # is booted in secureboot mode. > > TEST="$0" > -EFIVARFS="/sys/firmware/efi/efivars" > +. ./common_lib.sh > rc=0 > > # Kselftest framework requirement - SKIP code is 4. > @@ -17,19 +17,8 @@ if [ $(id -ru) -ne 0 ]; then > exit $ksft_skip > fi > > -# Make sure that efivars is mounted in the normal location > -if ! grep -q "^\S\+ $EFIVARFS efivarfs" /proc/mounts; then > - echo "$TEST: efivars is not mounted on $EFIVARFS" >&2 > - exit $ksft_skip > -fi > - > -# Get secureboot mode > -file="$EFIVARFS/SecureBoot-*" > -if [ ! -e $file ]; then > - echo "$TEST: unknown secureboot mode" >&2 > - exit $ksft_skip > -fi > -secureboot=`hexdump $file | awk '{print substr($4,length($4),1)}'` > +get_secureboot_mode > +secureboot=$? > > # kexec_load should fail in secure boot mode > KERNEL_IMAGE="/boot/vmlinuz-`uname -r`" > The rest looks good to me. thanks, -- Shuah
Hi Mimi, > Define, update and move get_secureboot_mode() to a common file for use > by other tests. > Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Reviewed-by: Petr Vorel <pvorel@suse.cz> ... > ifeq ($(ARCH),x86) > TEST_PROGS := test_kexec_load.sh > +TEST_FILES := common_lib.sh In case there might be some common library for whole selftest, I'd name this ima_lib.sh. (even it won't be in the same directory it might be better for readability). > include ../lib.mk > diff --git a/tools/testing/selftests/ima/common_lib.sh b/tools/testing/selftests/ima/common_lib.sh > new file mode 100755 > index 000000000000..5583ea74c14e > --- /dev/null > +++ b/tools/testing/selftests/ima/common_lib.sh > @@ -0,0 +1,24 @@ > +#!/bin/sh > +# SPDX-License-Identifier: GPL-2.0-or-later I'm sorry, that was me who advised GPL v2+ instead of GPL v2 only :). ... Kind regards, Petr
diff --git a/tools/testing/selftests/ima/Makefile b/tools/testing/selftests/ima/Makefile index 0b3adf5444b6..46b9e04d2737 100644 --- a/tools/testing/selftests/ima/Makefile +++ b/tools/testing/selftests/ima/Makefile @@ -5,6 +5,7 @@ ARCH ?= $(shell echo $(uname_M) | sed -e s/i.86/x86/ -e s/x86_64/x86/) ifeq ($(ARCH),x86) TEST_PROGS := test_kexec_load.sh +TEST_FILES := common_lib.sh include ../lib.mk diff --git a/tools/testing/selftests/ima/common_lib.sh b/tools/testing/selftests/ima/common_lib.sh new file mode 100755 index 000000000000..5583ea74c14e --- /dev/null +++ b/tools/testing/selftests/ima/common_lib.sh @@ -0,0 +1,24 @@ +#!/bin/sh +# SPDX-License-Identifier: GPL-2.0-or-later + +# The secure boot mode can be accessed either as the last integer +# of "od -An -t u1 /sys/firmware/efi/efivars/SecureBoot-*" or from +# "od -An -t u1 /sys/firmware/efi/vars/SecureBoot-*/data". +# Return 1 for SecureBoot mode enabled. +get_secureboot_mode() +{ + local efivarfs="/sys/firmware/efi/efivars" + # Make sure that efivars is mounted in the normal location + if ! grep -q "^\S\+ $efivarfs efivarfs" /proc/mounts; then + echo "$TEST: efivars is not mounted on $efivarfs" >&2 + exit $ksft_skip + fi + + # Get secureboot mode + local file="$efivarfs/../vars/SecureBoot-*/data" + if [ ! -e $file ]; then + echo "$TEST: unknown secureboot mode" >&2 + exit $ksft_skip + fi + return `od -An -t u1 /sys/firmware/efi/vars/SecureBoot-*/data` +} diff --git a/tools/testing/selftests/ima/test_kexec_load.sh b/tools/testing/selftests/ima/test_kexec_load.sh index 0345803e7bec..35934e0665f1 100755 --- a/tools/testing/selftests/ima/test_kexec_load.sh +++ b/tools/testing/selftests/ima/test_kexec_load.sh @@ -5,7 +5,7 @@ # is booted in secureboot mode. TEST="$0" -EFIVARFS="/sys/firmware/efi/efivars" +. ./common_lib.sh rc=0 # Kselftest framework requirement - SKIP code is 4. @@ -17,19 +17,8 @@ if [ $(id -ru) -ne 0 ]; then exit $ksft_skip fi -# Make sure that efivars is mounted in the normal location -if ! grep -q "^\S\+ $EFIVARFS efivarfs" /proc/mounts; then - echo "$TEST: efivars is not mounted on $EFIVARFS" >&2 - exit $ksft_skip -fi - -# Get secureboot mode -file="$EFIVARFS/SecureBoot-*" -if [ ! -e $file ]; then - echo "$TEST: unknown secureboot mode" >&2 - exit $ksft_skip -fi -secureboot=`hexdump $file | awk '{print substr($4,length($4),1)}'` +get_secureboot_mode +secureboot=$? # kexec_load should fail in secure boot mode KERNEL_IMAGE="/boot/vmlinuz-`uname -r`"