1#!/bin/sh 2# SPDX-License-Identifier: GPL-2.0-or-later 3# Copyright (c) 2009 IBM Corporation 4# Copyright (c) 2018-2020 Petr Vorel <pvorel@suse.cz> 5# Author: Mimi Zohar <zohar@linux.ibm.com> 6# 7# Test replacing the default integrity measurement policy. 8 9TST_SETUP="setup" 10TST_CNT=2 11 12. ima_setup.sh 13 14check_policy_writable() 15{ 16 local err="IMA policy already loaded and kernel not configured to enable multiple writes to it (need CONFIG_IMA_WRITE_POLICY=y)" 17 18 [ -f $IMA_POLICY ] || tst_brk TCONF "$err" 19 # CONFIG_IMA_READ_POLICY 20 echo "" 2> log > $IMA_POLICY 21 grep -q "Device or resource busy" log && tst_brk TCONF "$err" 22} 23 24setup() 25{ 26 check_policy_writable 27 28 VALID_POLICY="$TST_DATAROOT/measure.policy" 29 [ -f $VALID_POLICY ] || tst_brk TCONF "missing $VALID_POLICY" 30 31 INVALID_POLICY="$TST_DATAROOT/measure.policy-invalid" 32 [ -f $INVALID_POLICY ] || tst_brk TCONF "missing $INVALID_POLICY" 33} 34 35load_policy() 36{ 37 local ret 38 39 exec 2>/dev/null 4>$IMA_POLICY 40 [ $? -eq 0 ] || exit 1 41 42 cat $1 >&4 2> /dev/null 43 ret=$? 44 exec 4>&- 45 46 [ $ret -eq 0 ] && \ 47 tst_res TINFO "IMA policy updated, please reboot after testing to restore settings" 48 49 return $ret 50} 51 52test1() 53{ 54 tst_res TINFO "verify that invalid policy isn't loaded" 55 56 local p1 57 58 check_policy_writable 59 load_policy $INVALID_POLICY & p1=$! 60 wait "$p1" 61 if [ $? -ne 0 ]; then 62 tst_res TPASS "didn't load invalid policy" 63 else 64 tst_res TFAIL "loaded invalid policy" 65 fi 66} 67 68test2() 69{ 70 tst_res TINFO "verify that policy file is not opened concurrently and able to loaded multiple times" 71 72 local p1 p2 rc1 rc2 73 74 check_policy_writable 75 load_policy $VALID_POLICY & p1=$! 76 load_policy $VALID_POLICY & p2=$! 77 wait "$p1"; rc1=$? 78 wait "$p2"; rc2=$? 79 if [ $rc1 -eq 0 ] && [ $rc2 -eq 0 ]; then 80 tst_res TFAIL "policy opened concurrently" 81 elif [ $rc1 -eq 0 ] || [ $rc2 -eq 0 ]; then 82 tst_res TPASS "policy was loaded just by one process and able to loaded multiple times" 83 else 84 tst_res TFAIL "problem loading or extending policy (may require policy to be signed)" 85 fi 86} 87 88tst_run 89