1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Copyright (c) 2022 FUJITSU LIMITED. All rights reserved.
4 * Author: Dai Shili <daisl.fnst@fujitsu.com>
5 */
6
7 /*\
8 * [Description]
9 *
10 * This code tests if STATX_ATTR_VERITY flag in the statx attributes is set correctly.
11 *
12 * The statx() system call sets STATX_ATTR_VERITY if the file has fs-verity
13 * enabled. This can perform better than FS_IOC_GETFLAGS and
14 * FS_IOC_MEASURE_VERITY because it doesn't require opening the file, and
15 * opening verity files can be expensive.
16 *
17 * Minimum Linux version required is v5.5.
18 */
19
20 #define _GNU_SOURCE
21 #include <sys/mount.h>
22 #include <stdlib.h>
23 #include "tst_test.h"
24 #include "lapi/fs.h"
25 #include "lapi/fsverity.h"
26 #include "lapi/stat.h"
27 #include <inttypes.h>
28
29 #define MNTPOINT "mnt_point"
30 #define TESTFILE_FLAGGED MNTPOINT"/test_file1"
31 #define TESTFILE_UNFLAGGED MNTPOINT"/test_file2"
32
33 static int mount_flag;
34
35 static const uint32_t hash_algorithms[] = {
36 FS_VERITY_HASH_ALG_SHA256,
37 };
38
test_flagged(void)39 static void test_flagged(void)
40 {
41 struct statx buf;
42
43 TST_EXP_PASS(statx(AT_FDCWD, TESTFILE_FLAGGED, 0, 0, &buf),
44 "statx(AT_FDCWD, %s, 0, 0, &buf)", TESTFILE_FLAGGED);
45
46 if (buf.stx_attributes & STATX_ATTR_VERITY)
47 tst_res(TPASS, "STATX_ATTR_VERITY flag is set: (%"PRIu64") ",
48 (uint64_t)buf.stx_attributes);
49 else
50 tst_res(TFAIL, "STATX_ATTR_VERITY flag is not set");
51 }
52
test_unflagged(void)53 static void test_unflagged(void)
54 {
55 struct statx buf;
56
57 TST_EXP_PASS(statx(AT_FDCWD, TESTFILE_UNFLAGGED, 0, 0, &buf),
58 "statx(AT_FDCWD, %s, 0, 0, &buf)", TESTFILE_UNFLAGGED);
59
60 if ((buf.stx_attributes & STATX_ATTR_VERITY) == 0)
61 tst_res(TPASS, "STATX_ATTR_VERITY flag is not set");
62 else
63 tst_res(TFAIL, "STATX_ATTR_VERITY flag is set");
64 }
65
66 static struct test_cases {
67 void (*tfunc)(void);
68 } tcases[] = {
69 {&test_flagged},
70 {&test_unflagged},
71 };
72
run(unsigned int i)73 static void run(unsigned int i)
74 {
75 tcases[i].tfunc();
76 }
77
flag_setup(void)78 static void flag_setup(void)
79 {
80 int fd, attr, ret;
81 struct fsverity_enable_arg enable;
82
83 fd = SAFE_OPEN(TESTFILE_FLAGGED, O_RDONLY, 0664);
84
85 ret = ioctl(fd, FS_IOC_GETFLAGS, &attr);
86 if (ret < 0) {
87 if (errno == ENOTTY)
88 tst_brk(TCONF | TERRNO, "FS_IOC_GETFLAGS not supported");
89
90 tst_brk(TBROK | TERRNO, "ioctl(%i, FS_IOC_GETFLAGS, ...)", fd);
91 }
92
93 memset(&enable, 0, sizeof(enable));
94 enable.version = 1;
95 enable.hash_algorithm = hash_algorithms[0];
96 enable.block_size = 4096;
97 enable.salt_size = 0;
98 enable.salt_ptr = (intptr_t)NULL;
99 enable.sig_size = 0;
100 enable.sig_ptr = (intptr_t)NULL;
101
102 ret = ioctl(fd, FS_IOC_ENABLE_VERITY, &enable);
103 if (ret < 0) {
104 if (errno == EOPNOTSUPP) {
105 tst_brk(TCONF,
106 "fs-verity is not supported on the file system or by the kernel");
107 }
108 tst_brk(TBROK | TERRNO, "ioctl(%i, FS_IOC_ENABLE_VERITY) failed", fd);
109 }
110
111 ret = ioctl(fd, FS_IOC_GETFLAGS, &attr);
112 if ((ret == 0) && !(attr & FS_VERITY_FL))
113 tst_res(TFAIL, "%i: fs-verity enabled but FS_VERITY_FL bit not set", fd);
114
115 SAFE_CLOSE(fd);
116 }
117
setup(void)118 static void setup(void)
119 {
120 TEST(mount(tst_device->dev, MNTPOINT, tst_device->fs_type, 0, NULL));
121 if (TST_RET) {
122 if (TST_ERR == EINVAL)
123 tst_brk(TCONF, "fs-verity not supported on loopdev");
124
125 tst_brk(TBROK | TERRNO, "mount() failed with %ld", TST_RET);
126 }
127 mount_flag = 1;
128
129 SAFE_FILE_PRINTF(TESTFILE_FLAGGED, "a");
130 SAFE_FILE_PRINTF(TESTFILE_UNFLAGGED, "a");
131
132 flag_setup();
133 }
134
cleanup(void)135 static void cleanup(void)
136 {
137 if (mount_flag)
138 tst_umount(MNTPOINT);
139 }
140
141 static struct tst_test test = {
142 .test = run,
143 .tcnt = ARRAY_SIZE(tcases),
144 .setup = setup,
145 .cleanup = cleanup,
146 .needs_root = 1,
147 .mntpoint = MNTPOINT,
148 .format_device = 1,
149 .dev_fs_type = "ext4",
150 .dev_fs_opts = (const char *const []){"-O verity", NULL},
151 .needs_kconfigs = (const char *[]) {
152 "CONFIG_FS_VERITY",
153 NULL
154 },
155 .needs_cmds = (const char *[]) {
156 "mkfs.ext4 >= 1.45.2",
157 NULL
158 }
159 };
160