| Message ID | 20250114112915.610297-3-pvorel@suse.cz (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | LTP tests: load predefined policy, enhancements | expand |
Hi Petr, On Tue, 2025-01-14 at 12:29 +0100, Petr Vorel wrote: > Taken from IMA docs [1], removed dont_measure fsmagic=0x1021994 (tmpfs) > as suggested by Mimi. I backtracked on my original suggestion. Instead of removing the tmpfs rule, qualify it as you did below. -> qualified the "dont_measure fsmagic=0x1021994" (tmpfs) rule to the file open hook [2]. > > [1] https://ima-doc.readthedocs.io/en/latest/ima-policy.html#ima-tcb > > Signed-off-by: Petr Vorel <pvorel@suse.cz> [2] Kernel commit 7eef7c8bac9a ("ima: limit the builtin 'tcb' dont_measure tmpfs policy rule") Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> > --- > .../security/integrity/ima/datafiles/Makefile | 4 ++-- > .../ima/datafiles/ima_measurements/Makefile | 11 ++++++++++ > .../ima/datafiles/ima_measurements/tcb.policy | 20 +++++++++++++++++++ > 3 files changed, 33 insertions(+), 2 deletions(-) > create mode 100644 > testcases/kernel/security/integrity/ima/datafiles/ima_measurements/Makefile > create mode 100644 > testcases/kernel/security/integrity/ima/datafiles/ima_measurements/tcb.policy > > diff --git a/testcases/kernel/security/integrity/ima/datafiles/Makefile > b/testcases/kernel/security/integrity/ima/datafiles/Makefile > index 200fd3f4d3..0f2b4fdb11 100644 > --- a/testcases/kernel/security/integrity/ima/datafiles/Makefile > +++ b/testcases/kernel/security/integrity/ima/datafiles/Makefile > @@ -1,5 +1,5 @@ > # SPDX-License-Identifier: GPL-2.0-or-later > -# Copyright (c) Linux Test Project, 2019-2020 > +# Copyright (c) Linux Test Project, 2019-2025 > # Copyright (c) 2020 Microsoft Corporation > # Copyright (C) 2009, Cisco Systems Inc. > # Ngie Cooper, July 2009 > @@ -8,6 +8,6 @@ top_srcdir ?= ../../../../../.. > > include $(top_srcdir)/include/mk/env_pre.mk > > -SUBDIRS := ima_kexec ima_keys ima_policy ima_selinux > +SUBDIRS := ima_kexec ima_keys ima_measurements ima_policy ima_selinux > > include $(top_srcdir)/include/mk/generic_trunk_target.mk > diff --git > a/testcases/kernel/security/integrity/ima/datafiles/ima_measurements/Makefile > b/testcases/kernel/security/integrity/ima/datafiles/ima_measurements/Makefile > new file mode 100644 > index 0000000000..6317f2bf85 > --- /dev/null > +++ b/testcases/kernel/security/integrity/ima/datafiles/ima_measurements/Makefile > @@ -0,0 +1,11 @@ > +# SPDX-License-Identifier: GPL-2.0-or-later > +# Copyright (c) Linux Test Project, 2025 > + > +top_srcdir ?= ../../../../../../.. > + > +include $(top_srcdir)/include/mk/env_pre.mk > + > +INSTALL_DIR := testcases/data/ima_measurements > +INSTALL_TARGETS := *.policy > + > +include $(top_srcdir)/include/mk/generic_leaf_target.mk > diff --git > a/testcases/kernel/security/integrity/ima/datafiles/ima_measurements/tcb.policy > b/testcases/kernel/security/integrity/ima/datafiles/ima_measurements/tcb.policy > new file mode 100644 > index 0000000000..1e4a932bf0 > --- /dev/null > +++ b/testcases/kernel/security/integrity/ima/datafiles/ima_measurements/tcb.policy > @@ -0,0 +1,20 @@ > +dont_measure fsmagic=0x9fa0 > +dont_measure fsmagic=0x62656572 > +dont_measure fsmagic=0x64626720 > +dont_measure fsmagic=0x1021994 func=FILE_CHECK > +dont_measure fsmagic=0x1cd1 > +dont_measure fsmagic=0x42494e4d > +dont_measure fsmagic=0x73636673 > +dont_measure fsmagic=0xf97cff8c > +dont_measure fsmagic=0x43415d53 > +dont_measure fsmagic=0x27e0eb > +dont_measure fsmagic=0x63677270 > +dont_measure fsmagic=0x6e736673 > +dont_measure fsmagic=0xde5e81e4 > +measure func=MMAP_CHECK mask=MAY_EXEC > +measure func=BPRM_CHECK mask=MAY_EXEC > +measure func=FILE_CHECK mask=^MAY_READ euid=0 > +measure func=FILE_CHECK mask=^MAY_READ uid=0 > +measure func=MODULE_CHECK > +measure func=FIRMWARE_CHECK > +measure func=POLICY_CHECK
diff --git a/testcases/kernel/security/integrity/ima/datafiles/Makefile b/testcases/kernel/security/integrity/ima/datafiles/Makefile index 200fd3f4d3..0f2b4fdb11 100644 --- a/testcases/kernel/security/integrity/ima/datafiles/Makefile +++ b/testcases/kernel/security/integrity/ima/datafiles/Makefile @@ -1,5 +1,5 @@ # SPDX-License-Identifier: GPL-2.0-or-later -# Copyright (c) Linux Test Project, 2019-2020 +# Copyright (c) Linux Test Project, 2019-2025 # Copyright (c) 2020 Microsoft Corporation # Copyright (C) 2009, Cisco Systems Inc. # Ngie Cooper, July 2009 @@ -8,6 +8,6 @@ top_srcdir ?= ../../../../../.. include $(top_srcdir)/include/mk/env_pre.mk -SUBDIRS := ima_kexec ima_keys ima_policy ima_selinux +SUBDIRS := ima_kexec ima_keys ima_measurements ima_policy ima_selinux include $(top_srcdir)/include/mk/generic_trunk_target.mk diff --git a/testcases/kernel/security/integrity/ima/datafiles/ima_measurements/Makefile b/testcases/kernel/security/integrity/ima/datafiles/ima_measurements/Makefile new file mode 100644 index 0000000000..6317f2bf85 --- /dev/null +++ b/testcases/kernel/security/integrity/ima/datafiles/ima_measurements/Makefile @@ -0,0 +1,11 @@ +# SPDX-License-Identifier: GPL-2.0-or-later +# Copyright (c) Linux Test Project, 2025 + +top_srcdir ?= ../../../../../../.. + +include $(top_srcdir)/include/mk/env_pre.mk + +INSTALL_DIR := testcases/data/ima_measurements +INSTALL_TARGETS := *.policy + +include $(top_srcdir)/include/mk/generic_leaf_target.mk diff --git a/testcases/kernel/security/integrity/ima/datafiles/ima_measurements/tcb.policy b/testcases/kernel/security/integrity/ima/datafiles/ima_measurements/tcb.policy new file mode 100644 index 0000000000..1e4a932bf0 --- /dev/null +++ b/testcases/kernel/security/integrity/ima/datafiles/ima_measurements/tcb.policy @@ -0,0 +1,20 @@ +dont_measure fsmagic=0x9fa0 +dont_measure fsmagic=0x62656572 +dont_measure fsmagic=0x64626720 +dont_measure fsmagic=0x1021994 func=FILE_CHECK +dont_measure fsmagic=0x1cd1 +dont_measure fsmagic=0x42494e4d +dont_measure fsmagic=0x73636673 +dont_measure fsmagic=0xf97cff8c +dont_measure fsmagic=0x43415d53 +dont_measure fsmagic=0x27e0eb +dont_measure fsmagic=0x63677270 +dont_measure fsmagic=0x6e736673 +dont_measure fsmagic=0xde5e81e4 +measure func=MMAP_CHECK mask=MAY_EXEC +measure func=BPRM_CHECK mask=MAY_EXEC +measure func=FILE_CHECK mask=^MAY_READ euid=0 +measure func=FILE_CHECK mask=^MAY_READ uid=0 +measure func=MODULE_CHECK +measure func=FIRMWARE_CHECK +measure func=POLICY_CHECK
Taken from IMA docs [1], removed dont_measure fsmagic=0x1021994 (tmpfs) as suggested by Mimi. [1] https://ima-doc.readthedocs.io/en/latest/ima-policy.html#ima-tcb Signed-off-by: Petr Vorel <pvorel@suse.cz> --- .../security/integrity/ima/datafiles/Makefile | 4 ++-- .../ima/datafiles/ima_measurements/Makefile | 11 ++++++++++ .../ima/datafiles/ima_measurements/tcb.policy | 20 +++++++++++++++++++ 3 files changed, 33 insertions(+), 2 deletions(-) create mode 100644 testcases/kernel/security/integrity/ima/datafiles/ima_measurements/Makefile create mode 100644 testcases/kernel/security/integrity/ima/datafiles/ima_measurements/tcb.policy