1#!/bin/sh 2# SPDX-License-Identifier: GPL-2.0-or-later 3# Copyright (c) 2009 IBM Corporation 4# Copyright (c) 2018-2021 Petr Vorel <[email protected]> 5# Author: Mimi Zohar <[email protected]> 6# 7# Verify that measurements are added to the measurement list based on policy. 8 9TST_NEEDS_CMDS="awk cut sed" 10TST_SETUP="setup" 11TST_CNT=3 12 13setup() 14{ 15 require_ima_policy_cmdline "tcb" 16 17 TEST_FILE="$PWD/test.txt" 18 [ -f "$IMA_POLICY" ] || tst_res TINFO "not using default policy" 19} 20 21check_iversion_support() 22{ 23 local device mount fs 24 25 tst_kvcmp -ge "4.16" && return 0 26 27 device="$(df . | sed -e 1d | cut -f1 -d ' ')" 28 mount="$(grep $device /proc/mounts | head -1)" 29 fs="$(echo $mount | awk '{print $3'})" 30 31 case "$fs" in 32 ext[2-4]) 33 if ! echo "$mount" | grep -q -w "i_version"; then 34 tst_res TCONF "device '$device' is not mounted with iversion, please mount it with 'mount $device -o remount,iversion'" 35 return 1 36 fi 37 ;; 38 xfs) 39 if dmesg | grep -q "XFS.*Mounting V[1-4] Filesystem"; then 40 tst_res TCONF "XFS Filesystem >= V5 required for iversion support" 41 return 1 42 fi 43 ;; 44 '') 45 tst_res TWARN "could not find mount info for device '$device'" 46 ;; 47 esac 48 49 return 0 50} 51 52test1() 53{ 54 tst_res TINFO "verify adding record to the IMA measurement list" 55 ROD echo "$(cat /proc/uptime) this is a test file" \> $TEST_FILE 56 ima_check $TEST_FILE 57} 58 59test2() 60{ 61 62 tst_res TINFO "verify updating record in the IMA measurement list" 63 check_iversion_support || return 64 ROD echo "$(cat /proc/uptime) modified file" \> $TEST_FILE 65 ima_check $TEST_FILE 66} 67 68test3() 69{ 70 local user="nobody" 71 local dir="$PWD/user" 72 local file="$dir/test.txt" 73 74 # Default policy does not measure user files 75 tst_res TINFO "verify not measuring user files" 76 tst_check_cmds sudo || return 77 78 if ! id $user >/dev/null 2>/dev/null; then 79 tst_res TCONF "missing system user $user (wrong installation)" 80 return 81 fi 82 83 [ -d "$dir" ] || mkdir -m 0700 $dir 84 chown $user $dir 85 cd $dir 86 # need to read file to get updated $ASCII_MEASUREMENTS 87 sudo -n -u $user sh -c "echo $(cat /proc/uptime) user file > $file; cat $file > /dev/null" 88 cd .. 89 90 EXPECT_FAIL "grep $file $ASCII_MEASUREMENTS" 91} 92 93. ima_setup.sh 94tst_run 95