Re: ima_setup.sh: Fix check_policy_writable() for kernel < 4.5

Hi Petr, 

On Mon, 2026-08-03 at 15:19 +0200, Petr Vorel wrote:

[...] 

> Do you agree that test2 in ima_policy.sh should be skipped on kernel < 4.5? If
> you consider useful running the test also on these old kernels I could just
> correct the commit message for older kernel or simply ignore that fact (just add
> a comment to the test that it's irrelevant for < 4.5. (I know 4.4 is not
> supported any more, in fact it's just for SLES and possibly other LTS distros
> still supporting this old kernel, but I still appreciate your opinion.

Test 2 says, ""verify that policy file is not opened concurrently and able to
loaded multiple times". Prior to 4.5, a policy cannot be loaded multiple times.
I agree ima_policy.sh: test2 should be skipped on kernels prior to 4.5.

> 
> 
> > > > Should test2 report TCONF (or split the two assertions) when
> > > > CONFIG_IMA_WRITE_POLICY is not available?
> 
> FYI we could sooner or later start using kernel config (e.g. look into
> CONFIG_IMA_WRITE_POLICY and CONFIG_IMA_READ_POLICY as many LTP tests and now
> even LTP library require kernel config (we resisted long time add kernel config
> as a hard dependency, but finally Cyril added support in 2018).

Nice!

> 
> But more important for me would be to migrate LTP IMA tests to shell loader [1]
> or even rewrite to C API. We have deprecated tst_test.sh API some time ago.

Oh!  Sure, sounds good.

thanks,

Mimi