Re: [PATCH v2 1/2] ima_setup.sh: Fix check_policy_writable() for kernel < 4.5

On Mon, 2026-08-10 at 16:33 +0200, Petr Vorel wrote:
> Writing into policy via echo on kernel < 4.5 effectively makes policy
> not writable (no point to check if the policy is writable). Therefore
> skip this extra check in check_policy_writable() on these old kernels.
> 
> This change improves IMA testing on kernel < 4.5:
> 
> 1) Allows to run ima_policy.sh which was previously skipped:
> 
>     ima_policy 1 TINFO: verify that invalid policy isn't loaded
>     ima_policy 1 TCONF: IMA policy already loaded and kernel not configured to enable multiple writes to it (need CONFIG_IMA_WRITE_POLICY=y)
> 
> 2) Fixes failing ima_violations.sh, which was failing due policy was not
>    writable:
> 
>     ima_violations 1 TINFO: Tested kernel: Linux susetest 4.4.140
>     ima_violations 1 TINFO: booted with IMA policy: tcb
>     ima_violations 1 TINFO: using log /var/log/audit/audit.log
>     ima_violations 1 TINFO: verify open writers violation
>     ima_violations 1 TFAIL: open_writers violation not added
>     ima_violations 2 TINFO: verify ToMToU violation
>     ima_violations 2 TFAIL: ToMToU violation not added
>     ima_violations 3 TINFO: verify open_writers using mmapped files
>     tst_kconfig.c:90: TINFO: Parsing kernel config '/proc/config.gz'
>     tst_kconfig.c:90: TINFO: Parsing kernel config '/proc/config.gz'
>     tst_kconfig.c:755: TINFO: CONFIG_FAULT_INJECTION kernel option detected which might slow the execution
>     tst_kconfig.c:755: TINFO: CONFIG_FAULT_INJECTION kernel option detected which might slow the execution
>     tst_kconfig.c:90: TINFO: Parsing kernel config '/proc/config.gz'
>     tst_kconfig.c:755: TINFO: CONFIG_FAULT_INJECTION kernel option detected which might slow the execution
>     ima_mmap.c:33: TPASS: test completed
>     ima_violations 3 TFAIL: open_writers violation not added
> 
> 3) Fixes failing ima_conditionals.sh -r uid and ima_conditionals.sh -r fowner
> 
>     ima_conditionals 1 TINFO: request 'uid'
>     tst_security.c:115: TINFO: SecureBoot sysfs file not available
>     ima_conditionals 1 TINFO: verify measuring user files when requested via uid
>     tst_rod: Failed to open '/sys/kernel/security/ima/policy' for writing: Permission denied
>     ima_conditionals 1 TBROK: echo measure uid=65534 > /sys/kernel/security/ima/policy failed
> 
>     ima_conditionals 1 TINFO: request 'fowner'
>     tst_security.c:115: TINFO: SecureBoot sysfs file not available
>     ima_conditionals 1 TINFO: verify measuring user files when requested via fowner
>     tst_rod: Failed to open '/sys/kernel/security/ima/policy' for writing: Permission denied
>     ima_conditionals 1 TBROK: echo measure fowner=65534 > /sys/kernel/security/ima/policy failed
> 
> Fixes: cd96265e65 ("ima/ima_policy.sh: Improve check of policy writability")
> Signed-off-by: Petr Vorel <[email protected]>
> ---
> The same in v1.
> 
> @Mimi I appreciate your RBT or ABT.
> 
> Link to v1:
> https://lore.kernel.org/ltp/[email protected]/T/#t
> 
>  .../kernel/security/integrity/ima/tests/ima_setup.sh  | 11 ++++++++---
>  1 file changed, 8 insertions(+), 3 deletions(-)
> 
> diff --git a/testcases/kernel/security/integrity/ima/tests/ima_setup.sh b/testcases/kernel/security/integrity/ima/tests/ima_setup.sh
> index b69d7c31d9..19f00532b1 100644
> --- a/testcases/kernel/security/integrity/ima/tests/ima_setup.sh
> +++ b/testcases/kernel/security/integrity/ima/tests/ima_setup.sh
> @@ -95,10 +95,15 @@ require_policy_readable()
>  check_policy_writable()
>  {
>  	[ -f $IMA_POLICY ] || return 1
> -	# workaround for kernels < v4.18 without fix
> +
> +	# Workaround for kernels < v4.18 without fix
>  	# ffb122de9a60b ("ima: Reflect correct permissions for policy")
> -	echo "" 2> log > $IMA_POLICY
> -	grep -q "Device or resource busy" log && return 1
> +	# Require >= 4.5 to write multiple times via CONFIG_IMA_WRITE_POLICY
> +	# 38d859f991f3 ("IMA: policy can now be updated multiple times")
> +	if tst_kvcmp -ge 4.5; then
> +		echo "" 2> log > $IMA_POLICY
> +		grep -q "Device or resource busy" log && return 1
> +	fi
>  	return 0
>  }
>  

Thanks, Petr.

Reviewed-by: Mimi Zohar <[email protected]