1#!/bin/sh 2# SPDX-License-Identifier: GPL-2.0-or-later 3# Copyright (c) 2020 Microsoft Corporation 4# Copyright (c) 2020 Petr Vorel <pvorel@suse.cz> 5# Author: Lachlan Sneff <t-josne@linux.microsoft.com> 6# 7# Verify that kexec cmdline is measured correctly. 8# Test attempts to kexec the existing running kernel image. 9# To kexec a different kernel image export IMA_KEXEC_IMAGE=<pathname>. 10 11TST_NEEDS_CMDS="grep kexec sed" 12TST_CNT=3 13TST_SETUP="setup" 14TST_MIN_KVER="5.3" 15 16IMA_KEXEC_IMAGE="${IMA_KEXEC_IMAGE:-/boot/vmlinuz-$(uname -r)}" 17REQUIRED_POLICY='^measure.*func=KEXEC_CMDLINE' 18 19measure() 20{ 21 local cmdline="$1" 22 local algorithm digest expected_digest found 23 24 printf "$cmdline" > file1 25 grep "kexec-cmdline" $ASCII_MEASUREMENTS > file2 26 27 while read found 28 do 29 algorithm=$(echo "$found" | cut -d' ' -f4 | cut -d':' -f1) 30 digest=$(echo "$found" | cut -d' ' -f4 | cut -d':' -f2) 31 32 expected_digest=$(compute_digest $algorithm file1) 33 34 if [ "$digest" = "$expected_digest" ]; then 35 return 0 36 fi 37 done < file2 38 39 return 1 40} 41 42setup() 43{ 44 tst_res TINFO "using kernel $IMA_KEXEC_IMAGE" 45 46 if [ ! -f "$IMA_KEXEC_IMAGE" ]; then 47 tst_brk TCONF "kernel image not found, specify path in \$IMA_KEXEC_IMAGE" 48 fi 49 50 if check_policy_readable; then 51 require_ima_policy_content "$REQUIRED_POLICY" 52 policy_readable=1 53 fi 54} 55 56kexec_failure_hint() 57{ 58 local sb_enabled 59 60 if tst_cmd_available bootctl; then 61 if bootctl status 2>/dev/null | grep -qi 'Secure Boot: enabled'; then 62 sb_enabled=1 63 fi 64 elif tst_cmd_available dmesg; then 65 if dmesg | grep -qi 'Secure boot enabled'; then 66 sb_enabled=1 67 fi 68 fi 69 if [ "$sb_enabled" ]; then 70 tst_res TWARN "secure boot is enabled, kernel image may not be signed" 71 fi 72 73 if check_ima_policy_content '^appraise.*func=KEXEC_KERNEL_CHECK'; then 74 tst_res TWARN "'func=KEXEC_KERNEL_CHECK' appraise policy loaded, kernel image may not be signed" 75 fi 76} 77 78kexec_test() 79{ 80 local param="$1" 81 local cmdline="$2" 82 local res=TFAIL 83 local kexec_cmd 84 85 kexec_cmd="$param=$cmdline" 86 if [ "$param" = '--reuse-cmdline' ]; then 87 cmdline="$(sed 's/BOOT_IMAGE=[^ ]* //' /proc/cmdline)" 88 kexec_cmd="$param" 89 fi 90 91 kexec_cmd="kexec -s -l $IMA_KEXEC_IMAGE $kexec_cmd" 92 tst_res TINFO "testing $kexec_cmd" 93 if ! $kexec_cmd 2>err; then 94 kexec_failure_hint 95 tst_brk TBROK "kexec failed: $(cat err)" 96 fi 97 98 ROD kexec -su 99 if ! measure "$cmdline"; then 100 if [ "$policy_readable" != 1 ]; then 101 tst_res TWARN "policy not readable, it might not contain required policy '$REQUIRED_POLICY'" 102 res=TBROK 103 fi 104 tst_brk $res "unable to find a correct measurement" 105 fi 106 tst_res TPASS "kexec cmdline was measured correctly" 107} 108 109test() 110{ 111 case $1 in 112 1) kexec_test '--reuse-cmdline';; 113 2) kexec_test '--append' 'foo';; 114 3) kexec_test '--command-line' 'bar';; 115 esac 116} 117 118. ima_setup.sh 119tst_run 120