ima_kexec.sh 2.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120
  1. #!/bin/sh
  2. # SPDX-License-Identifier: GPL-2.0-or-later
  3. # Copyright (c) 2020 Microsoft Corporation
  4. # Copyright (c) 2020 Petr Vorel <pvorel@suse.cz>
  5. # Author: Lachlan Sneff <t-josne@linux.microsoft.com>
  6. #
  7. # Verify that kexec cmdline is measured correctly.
  8. # Test attempts to kexec the existing running kernel image.
  9. # To kexec a different kernel image export IMA_KEXEC_IMAGE=<pathname>.
  10. TST_NEEDS_CMDS="grep kexec sed"
  11. TST_CNT=3
  12. TST_NEEDS_DEVICE=1
  13. TST_SETUP="setup"
  14. . ima_setup.sh
  15. IMA_KEXEC_IMAGE="${IMA_KEXEC_IMAGE:-/boot/vmlinuz-$(uname -r)}"
  16. REQUIRED_POLICY='^measure.*func=KEXEC_CMDLINE'
  17. measure()
  18. {
  19. local cmdline="$1"
  20. local algorithm digest expected_digest found
  21. printf "$cmdline" > file1
  22. grep "kexec-cmdline" $ASCII_MEASUREMENTS > file2
  23. while read found
  24. do
  25. algorithm=$(echo "$found" | cut -d' ' -f4 | cut -d':' -f1)
  26. digest=$(echo "$found" | cut -d' ' -f4 | cut -d':' -f2)
  27. expected_digest=$(compute_digest $algorithm file1)
  28. if [ "$digest" = "$expected_digest" ]; then
  29. return 0
  30. fi
  31. done < file2
  32. return 1
  33. }
  34. setup()
  35. {
  36. tst_res TINFO "using kernel $IMA_KEXEC_IMAGE"
  37. if [ ! -f "$IMA_KEXEC_IMAGE" ]; then
  38. tst_brk TCONF "kernel image not found, specify path in \$IMA_KEXEC_IMAGE"
  39. fi
  40. if check_policy_readable; then
  41. require_ima_policy_content "$REQUIRED_POLICY"
  42. policy_readable=1
  43. fi
  44. }
  45. kexec_failure_hint()
  46. {
  47. local sb_enabled
  48. if tst_cmd_available bootctl; then
  49. if bootctl status 2>/dev/null | grep -qi 'Secure Boot: enabled'; then
  50. sb_enabled=1
  51. fi
  52. elif tst_cmd_available dmesg; then
  53. if dmesg | grep -qi 'Secure boot enabled'; then
  54. sb_enabled=1
  55. fi
  56. fi
  57. if [ "$sb_enabled" ]; then
  58. tst_res TWARN "secure boot is enabled, kernel image may not be signed"
  59. fi
  60. if check_ima_policy_content '^appraise.*func=KEXEC_KERNEL_CHECK'; then
  61. tst_res TWARN "'func=KEXEC_KERNEL_CHECK' appraise policy loaded, kernel image may not be signed"
  62. fi
  63. }
  64. kexec_test()
  65. {
  66. local param="$1"
  67. local cmdline="$2"
  68. local res=TFAIL
  69. local kexec_cmd
  70. kexec_cmd="$param=$cmdline"
  71. if [ "$param" = '--reuse-cmdline' ]; then
  72. cmdline="$(sed 's/BOOT_IMAGE=[^ ]* //' /proc/cmdline)"
  73. kexec_cmd="$param"
  74. fi
  75. kexec_cmd="kexec -s -l $IMA_KEXEC_IMAGE $kexec_cmd"
  76. tst_res TINFO "testing $kexec_cmd"
  77. if ! $kexec_cmd 2>err; then
  78. kexec_failure_hint
  79. tst_brk TBROK "kexec failed: $(cat err)"
  80. fi
  81. ROD kexec -su
  82. if ! measure "$cmdline"; then
  83. if [ "$policy_readable" != 1 ]; then
  84. tst_res TWARN "policy not readable, it might not contain required policy '$REQUIRED_POLICY'"
  85. res=TBROK
  86. fi
  87. tst_brk $res "unable to find a correct measurement"
  88. fi
  89. tst_res TPASS "kexec cmdline was measured correctly"
  90. }
  91. test()
  92. {
  93. case $1 in
  94. 1) kexec_test '--reuse-cmdline';;
  95. 2) kexec_test '--append' 'foo';;
  96. 3) kexec_test '--command-line' 'bar';;
  97. esac
  98. }
  99. tst_run