Thread (23 messages) 23 messages, 5 authors, 2022-02-28

Re: [PATCH v2 4/6] selftests/bpf: Add test for bpf_ima_file_hash()

From: Shuah Khan <skhan@linuxfoundation.org>
Date: 2022-02-15 16:00:53
Also in: bpf, linux-integrity, linux-kselftest, linux-security-module, lkml

On 2/15/22 5:40 AM, Roberto Sassu wrote:
quoted hunk ↗ jump to hunk
Modify the existing IMA test to call bpf_ima_file_hash() and update the
expected result accordingly.

Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
---
  .../selftests/bpf/prog_tests/test_ima.c       | 29 ++++++++++++++++---
  tools/testing/selftests/bpf/progs/ima.c       | 10 +++++--
  2 files changed, 33 insertions(+), 6 deletions(-)
diff --git a/tools/testing/selftests/bpf/prog_tests/test_ima.c b/tools/testing/selftests/bpf/prog_tests/test_ima.c
index 97d8a6f84f4a..62bf0e830453 100644
--- a/tools/testing/selftests/bpf/prog_tests/test_ima.c
+++ b/tools/testing/selftests/bpf/prog_tests/test_ima.c
@@ -13,9 +13,10 @@
  
  #include "ima.skel.h"
  
-static int run_measured_process(const char *measured_dir, u32 *monitored_pid)
+static int run_measured_process(const char *measured_dir, u32 *monitored_pid,
+				bool *use_ima_file_hash)
  {
-	int child_pid, child_status;
+	int err, child_pid, child_status;
  
  	child_pid = fork();
  	if (child_pid == 0) {
@@ -24,6 +25,21 @@ static int run_measured_process(const char *measured_dir, u32 *monitored_pid)
  		       NULL);
  		exit(errno);
  
+	} else if (child_pid > 0) {
+		waitpid(child_pid, &child_status, 0);
+		err = WEXITSTATUS(child_status);
+		if (err)
+			return err;
+	}
+
+	child_pid = fork();
+	if (child_pid == 0) {
+		*monitored_pid = getpid();
+		*use_ima_file_hash = true;
+		execlp("./ima_setup.sh", "./ima_setup.sh", "run", measured_dir,
+		       NULL);
+		exit(errno);
+
  	} else if (child_pid > 0) {
  		waitpid(child_pid, &child_status, 0);
  		return WEXITSTATUS(child_status);
@@ -72,12 +88,17 @@ void test_test_ima(void)
  	if (CHECK(err, "failed to run command", "%s, errno = %d\n", cmd, errno))
  		goto close_clean;
  
-	err = run_measured_process(measured_dir, &skel->bss->monitored_pid);
+	err = run_measured_process(measured_dir, &skel->bss->monitored_pid,
+				   &skel->bss->use_ima_file_hash);
  	if (CHECK(err, "run_measured_process", "err = %d\n", err))
  		goto close_clean;
  
  	err = ring_buffer__consume(ringbuf);
-	ASSERT_EQ(err, 1, "num_samples_or_err");
+	/*
+	 * 1 sample with use_ima_file_hash = false
+	 * 2 samples with use_ima_file_hash = true (./ima_setup.sh, /bin/true)
+	 */
+	ASSERT_EQ(err, 3, "num_samples_or_err");
  	ASSERT_NEQ(ima_hash_from_bpf, 0, "ima_hash");
  
  close_clean:
diff --git a/tools/testing/selftests/bpf/progs/ima.c b/tools/testing/selftests/bpf/progs/ima.c
index 96060ff4ffc6..9bb63f96cfc0 100644
--- a/tools/testing/selftests/bpf/progs/ima.c
+++ b/tools/testing/selftests/bpf/progs/ima.c
@@ -18,6 +18,8 @@ struct {
  
  char _license[] SEC("license") = "GPL";
  
+bool use_ima_file_hash;
+
This can be statis.
quoted hunk ↗ jump to hunk
  SEC("lsm.s/bprm_committed_creds")
  void BPF_PROG(ima, struct linux_binprm *bprm)
  {
@@ -28,8 +30,12 @@ void BPF_PROG(ima, struct linux_binprm *bprm)
  
  	pid = bpf_get_current_pid_tgid() >> 32;
  	if (pid == monitored_pid) {
I also noticed monitored_pid is defined in several bpf. Potentially
could be made static. This isn't introduced in this patch though.
-		ret = bpf_ima_inode_hash(bprm->file->f_inode, &ima_hash,
-					 sizeof(ima_hash));
+		if (!use_ima_file_hash)
+			ret = bpf_ima_inode_hash(bprm->file->f_inode, &ima_hash,
+						 sizeof(ima_hash));
+		else
+			ret = bpf_ima_file_hash(bprm->file, &ima_hash,
+						sizeof(ima_hash));
  		if (ret < 0 || ima_hash == 0)
  			return;
  
thanks,
-- Shuah
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help