Re: [PATCH] ima_tpm.sh: update test2 to detect integrity violations

Hi Mimi,

> <securityfs>/integrity/ima/violations reflects the number of
> integrity violations.  Include the "--ignore-violations" option,
> if there are any violations, on the initial IMA measurement list
> verification.

Thanks for your patch!

LGTM and it should be fixed. But there are some potential problems
(see bellow).

> Signed-off-by: Mimi Zohar <[email protected]>
> ---
>  .../security/integrity/ima/tests/ima_tpm.sh   | 20 ++++++++++++-------
>  1 file changed, 13 insertions(+), 7 deletions(-)

> diff --git a/testcases/kernel/security/integrity/ima/tests/ima_tpm.sh b/testcases/kernel/security/integrity/ima/tests/ima_tpm.sh
> index 5d34d8679..acd8b6d30 100755
> --- a/testcases/kernel/security/integrity/ima/tests/ima_tpm.sh
> +++ b/testcases/kernel/security/integrity/ima/tests/ima_tpm.sh
> @@ -142,6 +142,8 @@ read_pcr_tpm2()
>  get_pcr10_aggregate()
>  {
>  	local cmd="evmctl -vv ima_measurement $BINARY_MEASUREMENTS"
> +	local violations="$IMA_DIR/violations"
> +	local num_violations=0
>  	local msg="$ERRMSG_EVMCTL"
>  	local res=TCONF
>  	local pcr ret
> @@ -151,16 +153,20 @@ get_pcr10_aggregate()
>  		res=TFAIL
>  	fi

> -	$cmd > hash.txt 2>&1
> -	ret=$?
> -	if [ $ret -ne 0 -a -z "$MISSING_EVMCTL" ]; then
> -		tst_res TFAIL "evmctl failed, trying with --ignore-violations"
You removed TFAIL (potential problem, see later).

> +	if [ ! -f "$violations" ]; then
> +		tst_res TINFO "missing $violations"
> +	else
> +		num_violations=$(cat "$violations")
> +	fi
> +
> +	if [ "$num_violations" -eq 0 ]; then
> +		$cmd > hash.txt 2>&1
> +		ret=$?
> +	else
> +		tst_res TINFO "ignoring $num_violations violations"
>  		cmd="$cmd --ignore-violations"
>  		$cmd > hash.txt 2>&1
>  		ret=$?
> -	elif [ $ret -ne 0 -a "$MISSING_EVMCTL" = 1 ]; then
> -		tst_res TFAIL "evmctl failed $msg"
And here again removed TFAIL (see later).

The main problem is that you removed the code when evmctl is not installed.

Therefore trying to rerun evmctl on failure on older release (e.g. 1.3) it will
fail due option have different name or not exist at all in evmctl < 1.2).
-a "$MISSING_EVMCTL" = 1 check had meaning "don't rerun with --ignore-violations
on old evmctl which does not have the option.

FYI the code is a bit complicated, because here on TPM2 we require evmctl 1.3.1
to have --ignore-violations (renamed from --validate), which was released in
2020 - too new for old enterprise distros to ignore; also TPM1 we require only
1.1 from 2018, probably still too new. Once SLE12-SP3 EOL (in 1 year we may just
expect 1.3.1 to simplify).

> -		return
>  	fi

>  	[ $ret -ne 0 ] && tst_res TWARN "evmctl failed, trying to continue $msg"
Back to removed TFAIL. While this is OK as TWARN (some problem, but not related
to testing) we might end up to TBROK "Test didn't report any results" error in
tst_test.sh which quits test with TBROK "Test didn't report any results" if
there is no TPASS/TFAIL/TCONF message.

_tst_resstr()
{
	echo "$TST_PASS$TST_FAIL$TST_CONF"
}

_tst_rescmp()
{
	local res=$(_tst_resstr)

	if [ "$1" = "$res" ]; then
		tst_brk TBROK "Test didn't report any results"
	fi
}

And this happen later in test2():
	get_pcr10_aggregate > tmp.txt
	pcr_aggregate="$(cat tmp.txt)"
	if [ -z "$pcr_aggregate" ]; then
		return
	fi

Other option would be to print TFAIL message in test2():

	get_pcr10_aggregate > tmp.txt
	pcr_aggregate="$(cat tmp.txt)"
	if [ -z "$pcr_aggregate" ]; then
		tst_res TBROK "failed to get aggregate PCR-10"
		return
	fi

Lol, I'm disappointed how complicated and error prone I wrote back then.
Part of the problem is that quit with tst_brk does not work, when code which
does it is run in a subshell (via $(...) or `...) ), which quits subshell but
not the parent shell.

Kind regards,
Petr

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp