[PATCH ltp v5 3/3] IMA: Add tests for uid, gid, fowner, and fgroup options
From: Alex Henrie <hidden>
Date: 2021-09-22 02:09:44
Also in:
ltp
Subsystem:
the rest · Maintainer:
Linus Torvalds
Requires "ima: add gid support". Signed-off-by: Alex Henrie <redacted> --- v5: Omit awk and cut from TST_NEEDS_CMDS --- runtest/ima | 1 + .../integrity/ima/tests/ima_conditionals.sh | 57 +++++++++++++++++++ 2 files changed, 58 insertions(+) create mode 100755 testcases/kernel/security/integrity/ima/tests/ima_conditionals.sh
diff --git a/runtest/ima b/runtest/ima
index 29caa034a..01942eefa 100644
--- a/runtest/ima
+++ b/runtest/ima@@ -6,4 +6,5 @@ ima_violations ima_violations.sh ima_keys ima_keys.sh ima_kexec ima_kexec.sh ima_selinux ima_selinux.sh +ima_conditionals ima_conditionals.sh evm_overlay evm_overlay.sh
diff --git a/testcases/kernel/security/integrity/ima/tests/ima_conditionals.sh b/testcases/kernel/security/integrity/ima/tests/ima_conditionals.sh
new file mode 100755
index 000000000..657f4d244
--- /dev/null
+++ b/testcases/kernel/security/integrity/ima/tests/ima_conditionals.sh@@ -0,0 +1,57 @@ +#!/bin/sh +# SPDX-License-Identifier: GPL-2.0-or-later +# Copyright (c) 2021 VPI Technology +# Author: Alex Henrie <alexh@vpitech.com> +# +# Verify that conditional rules work. + +TST_NEEDS_CMDS="chgrp chown sg sudo" +TST_CNT=1 +TST_NEEDS_DEVICE=1 + +. ima_setup.sh + +test1() +{ + local user="nobody" + + require_policy_writable + ROD rm -f $TEST_FILE + tst_res TINFO "verify measuring user files when requested via uid" + ROD echo "measure uid=$(id -u $user)" \> $IMA_POLICY + ROD echo "$(date) uid test" \> $TEST_FILE + sudo -n -u $user sh -c "cat $TEST_FILE > /dev/null" + ima_check + + require_policy_writable + ROD rm -f $TEST_FILE + tst_res TINFO "verify measuring user files when requested via fowner" + ROD echo "measure fowner=$(id -u $user)" \> $IMA_POLICY + ROD echo "$(date) fowner test" \> $TEST_FILE + chown $user $TEST_FILE + cat $TEST_FILE > /dev/null + ima_check + + if tst_kvcmp -lt 5.16; then + tst_brk TCONF "gid and fgroup options require kernel 5.16 or newer" + fi + + require_policy_writable + ROD rm -f $TEST_FILE + tst_res TINFO "verify measuring user files when requested via gid" + ROD echo "measure gid=$(id -g $user)" \> $IMA_POLICY + ROD echo "$(date) gid test" \> $TEST_FILE + sudo sg $user "sh -c 'cat $TEST_FILE > /dev/null'" + ima_check + + require_policy_writable + ROD rm -f $TEST_FILE + tst_res TINFO "verify measuring user files when requested via fgroup" + ROD echo "measure fgroup=$(id -g $user)" \> $IMA_POLICY + ROD echo "$(date) fgroup test" \> $TEST_FILE + chgrp $user $TEST_FILE + cat $TEST_FILE > /dev/null + ima_check +} + +tst_run
--
2.33.0