ima_policy.sh 2.0 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788
  1. #!/bin/sh
  2. # SPDX-License-Identifier: GPL-2.0-or-later
  3. # Copyright (c) 2009 IBM Corporation
  4. # Copyright (c) 2018-2020 Petr Vorel <pvorel@suse.cz>
  5. # Author: Mimi Zohar <zohar@linux.ibm.com>
  6. #
  7. # Test replacing the default integrity measurement policy.
  8. TST_SETUP="setup"
  9. TST_CNT=2
  10. . ima_setup.sh
  11. check_policy_writable()
  12. {
  13. local err="IMA policy already loaded and kernel not configured to enable multiple writes to it (need CONFIG_IMA_WRITE_POLICY=y)"
  14. [ -f $IMA_POLICY ] || tst_brk TCONF "$err"
  15. # CONFIG_IMA_READ_POLICY
  16. echo "" 2> log > $IMA_POLICY
  17. grep -q "Device or resource busy" log && tst_brk TCONF "$err"
  18. }
  19. setup()
  20. {
  21. check_policy_writable
  22. VALID_POLICY="$TST_DATAROOT/measure.policy"
  23. [ -f $VALID_POLICY ] || tst_brk TCONF "missing $VALID_POLICY"
  24. INVALID_POLICY="$TST_DATAROOT/measure.policy-invalid"
  25. [ -f $INVALID_POLICY ] || tst_brk TCONF "missing $INVALID_POLICY"
  26. }
  27. load_policy()
  28. {
  29. local ret
  30. exec 2>/dev/null 4>$IMA_POLICY
  31. [ $? -eq 0 ] || exit 1
  32. cat $1 >&4 2> /dev/null
  33. ret=$?
  34. exec 4>&-
  35. [ $ret -eq 0 ] && \
  36. tst_res TINFO "IMA policy updated, please reboot after testing to restore settings"
  37. return $ret
  38. }
  39. test1()
  40. {
  41. tst_res TINFO "verify that invalid policy isn't loaded"
  42. local p1
  43. check_policy_writable
  44. load_policy $INVALID_POLICY & p1=$!
  45. wait "$p1"
  46. if [ $? -ne 0 ]; then
  47. tst_res TPASS "didn't load invalid policy"
  48. else
  49. tst_res TFAIL "loaded invalid policy"
  50. fi
  51. }
  52. test2()
  53. {
  54. tst_res TINFO "verify that policy file is not opened concurrently and able to loaded multiple times"
  55. local p1 p2 rc1 rc2
  56. check_policy_writable
  57. load_policy $VALID_POLICY & p1=$!
  58. load_policy $VALID_POLICY & p2=$!
  59. wait "$p1"; rc1=$?
  60. wait "$p2"; rc2=$?
  61. if [ $rc1 -eq 0 ] && [ $rc2 -eq 0 ]; then
  62. tst_res TFAIL "policy opened concurrently"
  63. elif [ $rc1 -eq 0 ] || [ $rc2 -eq 0 ]; then
  64. tst_res TPASS "policy was loaded just by one process and able to loaded multiple times"
  65. else
  66. tst_res TFAIL "problem loading or extending policy (may require policy to be signed)"
  67. fi
  68. }
  69. tst_run