mbox series

[v8,0/3] IMA: Add tests for uid, gid, fowner, and fgroup options

Message ID 20211006103059.9617-1-pvorel@suse.cz (mailing list archive)
Headers show
Series IMA: Add tests for uid, gid, fowner, and fgroup options | expand

Message

Petr Vorel Oct. 6, 2021, 10:30 a.m. UTC 
Hi,

changes v7->v8:
* Add missing ;; case separator

Alex Henrie (3):
  IMA: Move check_policy_writable() to ima_setup.sh and rename it
  IMA: Move ima_check to ima_setup.sh
  IMA: Add tests for uid, gid, fowner, and fgroup options

 runtest/ima                                   |  1 +
 .../integrity/ima/tests/ima_conditionals.sh   | 63 +++++++++++++++++++
 .../integrity/ima/tests/ima_measurements.sh   | 31 +--------
 .../integrity/ima/tests/ima_policy.sh         | 16 +----
 .../security/integrity/ima/tests/ima_setup.sh | 38 +++++++++++
 5 files changed, 107 insertions(+), 42 deletions(-)
 create mode 100755 testcases/kernel/security/integrity/ima/tests/ima_conditionals.sh

Comments

Petr Vorel Jan. 12, 2022, 1:06 p.m. UTC | #1 
Hi all,

FYI patchset merged with diff below. Fixed
* "cat: '>': No such file or directory" error reported by Mimi
* use /proc/uptime to not require date

Thanks for your work and patience.

FYI we had some discussion about merging patches earlier - after they met rc1 or
next-tree (I guess getting into maintainer tree could be accepted). Feel free to
contribute to this discussion:

https://lore.kernel.org/ltp/20211221113042.21357-1-rpalethorpe@suse.com/
https://lore.kernel.org/ltp/87lf0ffw1y.fsf@suse.de/
https://lore.kernel.org/ltp/YdW5WEXgrotentzM@yuki/

Kind regards,
Petr

diff --git testcases/kernel/security/integrity/ima/tests/ima_conditionals.sh testcases/kernel/security/integrity/ima/tests/ima_conditionals.sh
index c83006f6d1..095028e163 100755
--- testcases/kernel/security/integrity/ima/tests/ima_conditionals.sh
+++ testcases/kernel/security/integrity/ima/tests/ima_conditionals.sh
@@ -5,8 +5,11 @@
 # Author: Alex Henrie <alexh@vpitech.com>
 #
 # Verify that conditional rules work.
+#
+# gid and fgroup options test kernel commit 40224c41661b ("ima: add gid
+# support") from v5.16.
 
-TST_NEEDS_CMDS="chgrp chown id sg sudo"
+TST_NEEDS_CMDS="cat chgrp chown id sg sudo"
 TST_CNT=1
 TST_NEEDS_DEVICE=1
 
@@ -28,16 +31,16 @@ verify_measurement()
 
 	tst_res TINFO "verify measuring user files when requested via $request"
 	ROD echo "measure $request=$value" \> $IMA_POLICY
-	ROD echo "$(date) $request test" \> $test_file
+	ROD echo "$(cat /proc/uptime) $request test" \> $test_file
 
 	case "$request" in
 	fgroup)
 		chgrp $user $test_file
-		$cmd
+		sh -c "$cmd"
 		;;
 	fowner)
 		chown $user $test_file
-		$cmd
+		sh -c "$cmd"
 		;;
 	gid) sudo sg $user "sh -c '$cmd'";;
 	uid) sudo -n -u $user sh -c "$cmd";;