On Wed, 2023-03-08 at 11:03 +0000, Matt Bobrowski wrote:
Ha! I was literally in the midst of sending through a patch for this. Thanks for also taking a look and beating me to it!
This LGTM, feel free to add:
Reviewed-by: Matt Bobrowski mattbobrowski@google.com
Thanks.
I have only one remain question. Should we accept the old behavior, or simply reject it?
Roberto
On Wed, Mar 08, 2023 at 11:37:13AM +0100, Roberto Sassu wrote:
From: Roberto Sassu roberto.sassu@huawei.com
Commit 62622dab0a28 ("ima: return IMA digest value only when IMA_COLLECTED flag is set") caused bpf_ima_inode_hash() to refuse to give non-fresh digests. IMA test #3 assumed the old behavior, that bpf_ima_inode_hash() still returned also non-fresh digests.
Correct the test by accepting both cases. If the samples returned are 1, assume that the commit above is applied and that the returned digest is fresh. If the samples returned are 2, assume that the commit above is not applied, and check both the non-fresh and fresh digest.
Fixes: 62622dab0a28 ("ima: return IMA digest value only when IMA_COLLECTED flag is set") Reported by: David Vernet void@manifault.com Signed-off-by: Roberto Sassu roberto.sassu@huawei.com
.../selftests/bpf/prog_tests/test_ima.c | 29 ++++++++++++++----- 1 file changed, 21 insertions(+), 8 deletions(-)
diff --git a/tools/testing/selftests/bpf/prog_tests/test_ima.c b/tools/testing/selftests/bpf/prog_tests/test_ima.c index b13feceb38f..810b14981c2 100644 --- a/tools/testing/selftests/bpf/prog_tests/test_ima.c +++ b/tools/testing/selftests/bpf/prog_tests/test_ima.c @@ -70,7 +70,7 @@ void test_test_ima(void) u64 bin_true_sample; char cmd[256];
- int err, duration = 0;
- int err, duration = 0, fresh_digest_idx = 0; struct ima *skel = NULL;
skel = ima__open_and_load(); @@ -129,7 +129,15 @@ void test_test_ima(void) /* * Test #3 * - Goal: confirm that bpf_ima_inode_hash() returns a non-fresh digest
* - Expected result: 2 samples (/bin/true: non-fresh, fresh)
* - Expected result:* 1 sample (/bin/true: fresh) if commit 62622dab0a28 applied* 2 samples (/bin/true: non-fresh, fresh) if commit 62622dab0a28 is* not applied** If commit 62622dab0a28 ("ima: return IMA digest value only when* IMA_COLLECTED flag is set") is applied, bpf_ima_inode_hash() refuses* to give a non-fresh digest, hence the correct result is 1 instead of* 2.@@ -144,13 +152,18 @@ void test_test_ima(void) goto close_clean; err = ring_buffer__consume(ringbuf);
- ASSERT_EQ(err, 2, "num_samples_or_err");
- ASSERT_NEQ(ima_hash_from_bpf[0], 0, "ima_hash");
- ASSERT_NEQ(ima_hash_from_bpf[1], 0, "ima_hash");
- ASSERT_EQ(ima_hash_from_bpf[0], bin_true_sample, "sample_equal_or_err");
- ASSERT_GE(err, 1, "num_samples_or_err");
- if (err == 2) {
ASSERT_NEQ(ima_hash_from_bpf[0], 0, "ima_hash");ASSERT_EQ(ima_hash_from_bpf[0], bin_true_sample,"sample_equal_or_err");fresh_digest_idx = 1;- }
- ASSERT_NEQ(ima_hash_from_bpf[fresh_digest_idx], 0, "ima_hash"); /* IMA refreshed the digest. */
- ASSERT_NEQ(ima_hash_from_bpf[1], bin_true_sample,
"sample_different_or_err");
- ASSERT_NEQ(ima_hash_from_bpf[fresh_digest_idx], bin_true_sample,
"sample_equal_or_err");/* * Test #4 -- 2.25.1
/M