ima_setup.sh 4.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198
  1. #!/bin/sh
  2. # SPDX-License-Identifier: GPL-2.0-or-later
  3. # Copyright (c) 2009 IBM Corporation
  4. # Copyright (c) 2018-2020 Petr Vorel <pvorel@suse.cz>
  5. # Author: Mimi Zohar <zohar@linux.ibm.com>
  6. TST_TESTFUNC="test"
  7. TST_SETUP_CALLER="$TST_SETUP"
  8. TST_SETUP="ima_setup"
  9. TST_CLEANUP_CALLER="$TST_CLEANUP"
  10. TST_CLEANUP="ima_cleanup"
  11. TST_NEEDS_ROOT=1
  12. # TST_NEEDS_DEVICE can be unset, therefore specify explicitly
  13. TST_NEEDS_TMPDIR=1
  14. . tst_test.sh
  15. SYSFS="/sys"
  16. UMOUNT=
  17. TST_FS_TYPE="ext3"
  18. # TODO: find support for rmd128 rmd256 rmd320 wp256 wp384 tgr128 tgr160
  19. compute_digest()
  20. {
  21. local algorithm="$1"
  22. local file="$2"
  23. local digest
  24. digest="$(${algorithm}sum $file 2>/dev/null | cut -f1 -d ' ')"
  25. if [ -n "$digest" ]; then
  26. echo "$digest"
  27. return 0
  28. fi
  29. digest="$(openssl $algorithm $file 2>/dev/null | cut -f2 -d ' ')"
  30. if [ -n "$digest" ]; then
  31. echo "$digest"
  32. return 0
  33. fi
  34. # uncommon ciphers
  35. local arg="$algorithm"
  36. case "$algorithm" in
  37. tgr192) arg="tiger" ;;
  38. wp512) arg="whirlpool" ;;
  39. esac
  40. digest="$(rdigest --$arg $file 2>/dev/null | cut -f1 -d ' ')"
  41. if [ -n "$digest" ]; then
  42. echo "$digest"
  43. return 0
  44. fi
  45. return 1
  46. }
  47. check_policy_readable()
  48. {
  49. if [ ! -f $IMA_POLICY ]; then
  50. tst_res TINFO "missing $IMA_POLICY (reboot or CONFIG_IMA_WRITE_POLICY=y required)"
  51. return 1
  52. fi
  53. cat $IMA_POLICY > /dev/null 2>/dev/null
  54. }
  55. require_policy_readable()
  56. {
  57. if [ ! -f $IMA_POLICY ]; then
  58. tst_brk TCONF "missing $IMA_POLICY (reboot or CONFIG_IMA_WRITE_POLICY=y required)"
  59. fi
  60. if ! check_policy_readable; then
  61. tst_brk TCONF "cannot read IMA policy (CONFIG_IMA_READ_POLICY=y required)"
  62. fi
  63. }
  64. check_ima_policy_content()
  65. {
  66. local pattern="$1"
  67. local grep_params="${2--q}"
  68. check_policy_readable || return 1
  69. grep $grep_params "$pattern" $IMA_POLICY
  70. }
  71. require_ima_policy_content()
  72. {
  73. local pattern="$1"
  74. local grep_params="${2--q}"
  75. require_policy_readable
  76. if ! grep $grep_params "$pattern" $IMA_POLICY; then
  77. tst_brk TCONF "IMA policy does not specify '$pattern'"
  78. fi
  79. }
  80. require_ima_policy_cmdline()
  81. {
  82. local policy="$1"
  83. local i
  84. grep -q "ima_$policy" /proc/cmdline && return
  85. for i in $(cat /proc/cmdline); do
  86. if echo "$i" | grep -q '^ima_policy='; then
  87. echo "$i" | grep -q -e "|[ ]*$policy" -e "$policy[ ]*|" -e "=$policy" && return
  88. fi
  89. done
  90. tst_brk TCONF "IMA measurement tests require builtin IMA $policy policy (e.g. ima_policy=$policy kernel parameter)"
  91. }
  92. mount_helper()
  93. {
  94. local type="$1"
  95. local default_dir="$2"
  96. local dir
  97. dir="$(grep ^$type /proc/mounts | cut -d ' ' -f2 | head -1)"
  98. [ -n "$dir" ] && { echo "$dir"; return; }
  99. if ! mkdir -p $default_dir; then
  100. tst_brk TBROK "failed to create $default_dir"
  101. fi
  102. if ! mount -t $type $type $default_dir; then
  103. tst_brk TBROK "failed to mount $type"
  104. fi
  105. UMOUNT="$default_dir $UMOUNT"
  106. echo $default_dir
  107. }
  108. mount_loop_device()
  109. {
  110. local ret
  111. tst_mkfs
  112. tst_mount
  113. cd $TST_MNTPOINT
  114. }
  115. print_ima_config()
  116. {
  117. local config="/boot/config-$(uname -r)"
  118. local i
  119. if [ -r "$config" ]; then
  120. tst_res TINFO "IMA kernel config:"
  121. for i in $(grep ^CONFIG_IMA $config); do
  122. tst_res TINFO "$i"
  123. done
  124. fi
  125. tst_res TINFO "/proc/cmdline: $(cat /proc/cmdline)"
  126. }
  127. ima_setup()
  128. {
  129. SECURITYFS="$(mount_helper securityfs $SYSFS/kernel/security)"
  130. IMA_DIR="$SECURITYFS/ima"
  131. [ -d "$IMA_DIR" ] || tst_brk TCONF "IMA not enabled in kernel"
  132. ASCII_MEASUREMENTS="$IMA_DIR/ascii_runtime_measurements"
  133. BINARY_MEASUREMENTS="$IMA_DIR/binary_runtime_measurements"
  134. IMA_POLICY="$IMA_DIR/policy"
  135. # hack to support running tests locally from ima/tests directory
  136. if [ ! -d "$TST_DATAROOT" ]; then
  137. TST_DATAROOT="$LTPROOT/../datafiles/$TST_ID/"
  138. fi
  139. print_ima_config
  140. if [ "$TST_NEEDS_DEVICE" = 1 ]; then
  141. tst_res TINFO "\$TMPDIR is on tmpfs => run on loop device"
  142. mount_loop_device
  143. fi
  144. [ -n "$TST_SETUP_CALLER" ] && $TST_SETUP_CALLER
  145. }
  146. ima_cleanup()
  147. {
  148. local dir
  149. [ -n "$TST_CLEANUP_CALLER" ] && $TST_CLEANUP_CALLER
  150. for dir in $UMOUNT; do
  151. umount $dir
  152. done
  153. if [ "$TST_NEEDS_DEVICE" = 1 ]; then
  154. cd $TST_TMPDIR
  155. tst_umount
  156. fi
  157. }
  158. # loop device is needed to use only for tmpfs
  159. TMPDIR="${TMPDIR:-/tmp}"
  160. if [ "$(df -T $TMPDIR | tail -1 | awk '{print $2}')" != "tmpfs" -a -n "$TST_NEEDS_DEVICE" ]; then
  161. unset TST_NEEDS_DEVICE
  162. fi