ed-off-by: Dmitry Kasatkin
> > Acked-by: Dmitry Kasatkin
> > Acked-by: Petr Vorel
> > Acked-by: Mimi Zohar
> > Acked-by: Stefan Berger
> > Acked-by: Vitaly Chikunov
> > Acked-by: Ken Goldman
> > Acked-by: James Bottomley
> > Acked-by: Bru
PDX License Identifier, the special exception for linking with the
> OpenSSL library (WITH cryptsetup-OpenSSL-exception) was removed. With
> the relicensing of OpenSSL 3 or later to the Apache 2 license, the
> special exception is no longer necessary.
Thanks for restoring these files!
PIs EVP_DigestInit_ex(3),
EVP_DigestUpdate(3) and EVP_DigestFinal_ex(3), or the quick one-shot
EVP_Q_digest(3).
Signed-off-by: Petr Vorel
---
.../integrity/ima/src/ima_boot_aggregate.c| 32 +++
1 file changed, 32 insertions(+)
diff --git a/testcases/kernel/security/integrity/
fread() should read 1 byte, quit when it fails it.
This fixes warning: ignoring return value of ‘fread’ declared with
attribute ‘warn_unused_result’ [-Wunused-result].
Signed-off-by: Petr Vorel
---
.../kernel/security/integrity/ima/src/ima_boot_aggregate.c | 3 ++-
1 file changed, 2
Hi all,
both patches merged.
Kind regards,
Petr
Hi Mimi, all,
...
> +load_ima_policy()
> +{
> + local policy="$(ls $TST_DATAROOT/*.policy 2>/dev/null)"
> +
> + if [ "$LTP_IMA_LOAD_POLICY" != 1 -a "$policy" -a -f "$policy" ]; then
> + tst_res TINFO "NOTE: set LTP_IMA_LOAD_POLICY=1 to load policy
> for this test"
> +
-off-by: Petr Vorel
---
.../kernel/security/integrity/ima/README.md | 6 +++
.../integrity/ima/tests/ima_measurements.sh | 17 +-
.../security/integrity/ima/tests/ima_setup.sh | 52 ---
3 files changed, 66 insertions(+), 9 deletions(-)
diff --git a/testcases/kernel
Signed-off-by: Petr Vorel
---
testcases/kernel/security/integrity/ima/tests/ima_kexec.sh | 1 +
testcases/kernel/security/integrity/ima/tests/ima_keys.sh| 1 +
testcases/kernel/security/integrity/ima/tests/ima_selinux.sh | 1 +
3 files changed, 3 insertions(+)
diff --git a/testcases/kerne
Signed-off-by: Petr Vorel
---
.../ima/datafiles/ima_measurements/tcb.policy | 20 +++
1 file changed, 20 insertions(+)
create mode 100644
testcases/kernel/security/integrity/ima/datafiles/ima_measurements/tcb.policy
diff --git
a/testcases/kernel/security/integrity/ima
From: Petr Vorel
Hi Mimi, all,
this effort allows to load policy LTP provides as example
via LTP_IMA_LOAD_POLICY=1 environment variable (off by default).
This should allow better coverage for these who just run runtest/ima.
But it requires tooling which runs LTP to do the restart after each
> On Tue, 2024-12-31 at 13:23 +0100, Petr Vorel wrote:
> > Hi Mimi,
> > > Hi Petr,
> > > On Fri, 2024-12-13 at 23:20 +0100, Petr Vorel wrote:
> > > > Suggested-by: Mimi Zohar
> > > > Signed-off-by: Petr Vorel
> > > > ---
> &
also be included in the IMA-measurement list that previously weren't
> included.
LGTM.
Reviewed-by: Petr Vorel
Kind regards,
Petr
> [1] https://ima-doc.readthedocs.io/en/latest/ima-policy.html#ima-tcb
> Signed-off-by: Mimi Zohar
> ---
> security/integrity/ima/ima_po
> Hi Petr,
> On Fri, 2024-12-13 at 23:20 +0100, Petr Vorel wrote:
> > Suggested-by: Mimi Zohar
> > Signed-off-by: Petr Vorel
> > ---
> > .../integrity/ima/datafiles/ima_violations/violations.policy | 1 +
> > 1 file changed, 1 insertion(+)
> >
> Hi Petr,
> On Fri, 2024-12-13 at 23:20 +0100, Petr Vorel wrote:
> [snip]
> > --- a/testcases/kernel/security/integrity/ima/tests/ima_setup.sh
> > +++ b/testcases/kernel/security/integrity/ima/tests/ima_setup.sh
> > @@ -1,7 +1,7 @@
> > #!/bin/sh
> > # SP
")
Also remove leading 0 from tmpfs magic (to match IMA docs and tcb.policy).
Suggested-by: Mimi Zohar
Signed-off-by: Petr Vorel
---
.../security/integrity/ima/datafiles/ima_policy/measure.policy | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git
a/testcases/kernel/se
> Hi!
> Maybe a bit more description wouldn't hurt here. E.g. that we are
> printing a hint on a failure that selinux or apparmor may have caused
> the failure and we want a knob to disable it and use it for IMA.`
+1, this patch merged with the above explanation.
Thanks!
Kind regards,
Petr
Hi Mimi,
> On Mon, 2025-02-03 at 22:02 +0100, Petr Vorel wrote:
> > add func=FILE_CHECK to dont_measure tmpfs
> > Similarly to tcb.policy limit dont_measure tmpfs policy to func=FILE_CHECK.
> > This allows to do extra measurements, e.g. kexec boot command line,
Hi MImi,
...
> > +++ b/testcases/kernel/security/integrity/ima/tests/ima_selinux.sh
> > @@ -1,6 +1,7 @@
> > #!/bin/sh
> > # SPDX-License-Identifier: GPL-2.0-or-later
> > # Copyright (c) 2021 Microsoft Corporation
> > +# Copyright (c) Linux Test Project, 2021-2025
> > # Author: Lakshmi Ramasubr
From: Petr Vorel
Hi Mimi, all,
I fixed 2 regressions I found in the previous implementation.
I'm planning to solve problem with ima_measurements.sh (second commit).
There is also other problem with loading kexec.policy and then running
ima_measurements.sh on SUT with ima_policy=tcb
Condition is "$? -ne 0", therefore negative if command passed to if.
This was hidden until fix in the next commit.
Fixes: 4c74c7dc69 ("IMA: Read required policy from file")
Signed-off-by: Petr Vorel
---
.../kernel/security/integrity/ima/tests/ima_measurements.sh | 2 +
rd test.
Fixes: aac97cca96 ("ima_setup.sh: Allow to load predefined policy")
Signed-off-by: Petr Vorel
---
.../integrity/ima/tests/ima_measurements.sh| 2 +-
.../security/integrity/ima/tests/ima_setup.sh | 14 ++
2 files changed, 7 insertions(+), 9 deletions(-
Hi Mimi, all,
> On Tue, 2024-11-26 at 18:38 +0100, Petr Vorel wrote:
> > environment variable LTP_IMA_LOAD_POLICY=1 tries to load example policy
> > if available. This should be used only if tooling running LTP tests
> > allows to reboot afterwards (because policy may
Hi Xiubo Li,
> './configure --with-open-posix-testsuite' is needed just before
> generating the Makefiles.
Thanks!
Reviewed-by: Petr Vorel
Kind regards,
Petr
Hi Mimi,
> On Tue, 2024-11-26 at 18:38 +0100, Petr Vorel wrote:
> > The functionality IMHO was not backported to the enterprise kernels.
> > This helps to avoid false positive in ima_kexec.sh:
> > ima_kexec 1 TWARN: policy not readable, it might not contain required
>
Hi Mimi,
> Hi Petr,
> On Tue, 2024-11-26 at 18:38 +0100, Petr Vorel wrote:
> > Signed-off-by: Petr Vorel
> Except for the "dont_measure " rule, the "dont_measure" rules are for
> pseudo filesystems. Including a "dont_measure " policy rule was
> On Wed, 2024-12-11 at 20:48 +0100, Petr Vorel wrote:
> > Hi Mimi, all,
> > > On Tue, 2024-11-26 at 18:38 +0100, Petr Vorel wrote:
> > > > environment variable LTP_IMA_LOAD_POLICY=1 tries to load example policy
> > > > if available. This should
t readable.
This is better because in previous case test always failed due TWARN but
result is actually unknown (e.g. don't expect missing policy, return 1
as failure only when policy is readable and checking with grep failed).
Fixes: 3843e2d6fb ("IMA: Add policy related helpe
for example policy as an variant to
ima_policy=tcb command line parameter.
* Use LTP shell loader for ima_boot_aggregate.c and ima_mmap.c
Petr Vorel (8):
IMA: Add TCB policy as an example for ima_measurements.sh
ima_setup.sh: Allow to load predefined policy
tst_test.sh: IMA: Allow to disable
Suggested-by: Mimi Zohar
Signed-off-by: Petr Vorel
---
@Cyril: or should we use the opposite approach - by default unused and
declare tests where should be used? I guess tests for typical userspace
tools should use it (e.g. runtest/commands or tests which use
tst_net.sh).
testcases/kernel
policy itself to be signed).
Signed-off-by: Petr Vorel
---
.../kernel/security/integrity/ima/README.md | 12 +
.../integrity/ima/tests/ima_measurements.sh | 17 +-
.../security/integrity/ima/tests/ima_setup.sh | 54 ---
3 files changed, 74 insertions(+), 9 deletions
It will be reused.
Signed-off-by: Petr Vorel
---
.../kernel/security/integrity/ima/tests/ima_kexec.sh | 8 ++--
.../kernel/security/integrity/ima/tests/ima_setup.sh | 10 ++
2 files changed, 12 insertions(+), 6 deletions(-)
diff --git a/testcases/kernel/security/integrity/ima
Taken from IMA docs [1], removed dont_measure fsmagic=0x1021994 (tmpfs)
as suggested by Mimi.
[1] https://ima-doc.readthedocs.io/en/latest/ima-policy.html#ima-tcb
Signed-off-by: Petr Vorel
---
I would like to check in ima_measurements.sh for this policy as an
variant to ima_policy=tcb command
Add check for ^func=FILE_CHECK'
Signed-off-by: Petr Vorel
Signed-off-by: Petr Vorel
---
.../kernel/security/integrity/ima/tests/ima_violations.sh| 5 -
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/testcases/kernel/security/integrity/ima/tests/ima_violations.
t")
Reported-by: Martin Doucha
Signed-off-by: Petr Vorel
---
testcases/kernel/security/integrity/ima/tests/ima_kexec.sh | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/testcases/kernel/security/integrity/ima/tests/ima_kexec.sh
b/testcases/kernel/security/integrity/ima/test
Suggested-by: Mimi Zohar
Signed-off-by: Petr Vorel
---
.../integrity/ima/datafiles/ima_violations/violations.policy | 1 +
1 file changed, 1 insertion(+)
create mode 100644
testcases/kernel/security/integrity/ima/datafiles/ima_violations/violations.policy
diff --git
a/testcases/kernel
, install auditd
Fixes: https://github.com/linux-test-project/ltp/issues/372
Signed-off-by: Petr Vorel
---
Hi Mimi, all,
or should we drop /var/log/messages support entirely? I remember some
old systems had problem (not sure if bug in old kernel or
/var/log/messages was not somehow reliable
Signed-off-by: Petr Vorel
---
.../kernel/security/integrity/ima/tests/evm_overlay.sh | 3 +--
.../kernel/security/integrity/ima/tests/ima_measurements.sh | 6 +++---
testcases/kernel/security/integrity/ima/tests/ima_setup.sh | 6 +-
3 files changed, 9 insertions(+), 6 deletions
ents.sh and ima_violations.sh use detection for
ima_policy=tcb builtin policy. But if example policy is loaded there is
no longer tcb policy. Not sure how to fix it - some tooling might not
support reboot, thus I wanted to use ima_policy=tcb, which previously
worked.
Petr Vorel (10):
ima_violations.sh:
, install auditd
Fixes: https://github.com/linux-test-project/ltp/issues/372
Signed-off-by: Petr Vorel
---
.../kernel/security/integrity/ima/tests/ima_violations.sh | 6 --
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/testcases/kernel/security/integrity/ima/tests
Taken from IMA docs [1], removed dont_measure fsmagic=0x1021994 (tmpfs)
as suggested by Mimi.
[1] https://ima-doc.readthedocs.io/en/latest/ima-policy.html#ima-tcb
Signed-off-by: Petr Vorel
---
.../security/integrity/ima/datafiles/Makefile | 4 ++--
.../ima/datafiles/ima_measurements/Makefile
Suggested-by: Mimi Zohar
Signed-off-by: Petr Vorel
---
.../kernel/security/integrity/ima/datafiles/Makefile | 2 +-
.../integrity/ima/datafiles/ima_violations/Makefile | 11 +++
.../ima/datafiles/ima_violations/violations.policy| 2 ++
3 files changed, 14 insertions(+), 1
policy itself to be signed).
Signed-off-by: Petr Vorel
---
doc/users/setup_tests.rst | 3 +
.../kernel/security/integrity/ima/README.md | 12
.../security/integrity/ima/tests/ima_kexec.sh | 1 +
.../security/integrity/ima/tests/ima_keys.sh | 1 +
.../integrity/ima
Suggested-by: Mimi Zohar
Signed-off-by: Petr Vorel
---
testcases/kernel/security/integrity/ima/tests/ima_setup.sh | 1 +
testcases/lib/tst_test.sh | 4 ++--
2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/testcases/kernel/security/integrity/ima
First two tests are working with ima_policy=tcb,
but 3rd test requires more specific policy.
Signed-off-by: Petr Vorel
---
.../kernel/security/integrity/ima/tests/ima_measurements.sh | 5 +
1 file changed, 5 insertions(+)
diff --git a/testcases/kernel/security/integrity/ima/tests
ima-buf format might be loaded via loading policy in the next commit.
Signed-off-by: Petr Vorel
---
testcases/kernel/security/integrity/ima/tests/ima_setup.sh | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/testcases/kernel/security/integrity/ima/tests/ima_setup.sh
b
(actual content of /sys/kernel/security/ima/policy)
When missing CONFIG_IMA_READ_POLICY=y on required policy convert: test, but
convert TFAIL => TCONF.
Signed-off-by: Petr Vorel
---
.../security/integrity/ima/tests/ima_kexec.sh | 19 ++
.../security/integrity/ima/tests/ima_keys.sh |
IMA builtin policy contains required rules, allow using it.
This helps more reliable results on kernels without
CONFIG_IMA_READ_POLICY=y.
Signed-off-by: Petr Vorel
---
testcases/kernel/security/integrity/ima/tests/ima_violations.sh | 1 +
1 file changed, 1 insertion(+)
diff --git a/testcases
Proof of concept, it was never fixed in the kernel.
Instead we should have some basic EVM tests.
Signed-off-by: Petr Vorel
---
runtest/ima | 1 -
.../kernel/security/integrity/ima/README.md | 64 -
.../integrity/ima/tests/evm_overlay.sh
Hi Mimi,
...
> > Do I understand correctly you talk about policy containing
> > func=POLICY_CHECK [1]?
> Yes. On a secure boot enabled system, the architecture specific policy might
> require the IMA policy itself to be signed.
> Snippet from ima_fs.c:
> #if IS_ENABLED(CONFIG_INTEGRITY_MACHIN
Hi Mimi,
> Hi Petr,
> On Fri, 2024-12-13 at 23:20 +0100, Petr Vorel wrote:
> > Taken from IMA docs [1], removed dont_measure fsmagic=0x1021994 (tmpfs)
> > as suggested by Mimi.
> > [1] https://ima-doc.readthedocs.io/en/latest/ima-policy.html#ima-tcb
> > Signe
Hi Mimi,
> On Tue, 2024-12-31 at 11:00 +0100, Petr Vorel wrote:
> > > Hi Petr,
> > > On Fri, 2024-12-13 at 23:20 +0100, Petr Vorel wrote:
> > > [snip]
> > > > --- a/testcases/kernel/security/integrity/ima/tests/ima_setup.sh
> > > &g
Hi Mimi,
> Lines beginning with '#' in the IMA policy are comments and are ignored.
> Instead of placing the rule and comment on separate lines, allow the
> comment to be suffixed to the IMA policy rule.
+1
Reviewed-by: Petr Vorel
Kind regards,
Petr
> Sig
Hi Mimi,
> Hi Petr,
> On Fri, 2024-12-13 at 23:20 +0100, Petr Vorel wrote:
> > Suggested-by: Mimi Zohar
> > Signed-off-by: Petr Vorel
> > ---
> > .../integrity/ima/datafiles/ima_violations/violations.policy | 1 +
> > 1 file changed, 1 insertion(+)
&g
Hi Li,
> On Fri, Mar 14, 2025 at 8:43 PM Petr Vorel wrote:
> > Evaluation "-gt 0" needs to be together with expectation of empty
> > $expected_violations. Therefore use [ ... -a ... ] comparator to avoid
> > -eq comparison against empty $expected_violations.
support multiple
violations")
Signed-off-by: Petr Vorel
---
.../kernel/security/integrity/ima/tests/ima_violations.sh | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/testcases/kernel/security/integrity/ima/tests/ima_violations.sh
b/testcases/kernel/security/inte
nce other
tests), which is always better.
Fixes: 36c695e497 ("tst_security.sh: Add helper tst_update_selinux_state()")
Signed-off-by: Petr Vorel
---
@SELinux developers: FYI tst_security.sh is used in LTP test in
ima_selinux.sh [1] test.
Kind regards,
Petr
[1]
https://github.com/linux-tes
Hi Andrea,
> Hi!
> On 2/17/25 14:08, Petr Vorel wrote:
> > Adding TST_SETUP_EARLY to run test specific setup before loading policy.
> > That allows to avoid loading IMA policy (which usually request reboot)
> > if the test would be skipped anyway.
> > Fixes: aac97
rd test.
Fixes: aac97cca96 ("ima_setup.sh: Allow to load predefined policy")
Signed-off-by: Petr Vorel
---
.../integrity/ima/tests/ima_measurements.sh| 2 +-
.../security/integrity/ima/tests/ima_setup.sh | 14 ++
2 files changed, 7 insertions(+), 9 deletions(-
Hi Andrea,
> Hi!
Thanks for your review, merged as a needed fix.
Kind regards,
Petr
> Reviewed-by: Andrea Cervesato
> On 2/17/25 14:08, Petr Vorel wrote:
> > Some SLES15 versions create /selinux directory which fails the detection
> > if SELinux is actually not enabled
in kernel 3.0 in commit
7a627e3b9a2b ("SELINUX: add /sys/fs/selinux mount point to put selinuxfs")
14 years is enough, kernel 3.0 is not even supported in current LTP and
we don't even support /selinux in C API (tst_security.c).
Fixes: e7b804df65 ("shell: Add tst_security.s
Adding TST_SETUP_EARLY to run test specific setup before loading policy.
That allows to avoid loading IMA policy (which usually request reboot)
if the test would be skipped anyway.
Fixes: aac97cca96 ("ima_setup.sh: Allow to load predefined policy")
Signed-off-by: Petr Vorel
---
testca
Hi,
> Adding TST_SETUP_EARLY to run test specific setup before loading policy.
> That allows to avoid loading IMA policy (which usually request reboot)
> if the test would be skipped anyway.
> Fixes: aac97cca96 ("ima_setup.sh: Allow to load predefined policy")
>
eboot).
Therefore first check $REQUIRED_BUILTIN_POLICY (value of ima_policy
kernel cmdline parameter, it can TCONF), then run the test specific
setup and finally run the policy if needed.
Fixes: aac97cca96 ("ima_setup.sh: Allow to load predefined policy")
Signed-off-by: Petr Vorel
---
Li
Hi Mimi, Ignaz,
> Proof of concept, it was never fixed in the kernel.
> Instead we should have some basic EVM tests.
gently ping. Is evm_overlay.sh test useful for you?
Otherwise I'll delete it.
Kind regards,
Petr
> Signed-off-by: Petr Vorel
> -
Hi Mimi,
> Depending on the IMA policy and the number of violations, the kernel
> patches for minimizing the number of open-writers and ToMToU (Time of
> Measure Time of Use) violations may be a major performance improvement.
I would prefer this to be squashed into "ima_violations.sh: additional
Hi Mimi,
...
> > > + exec 3< $LOG || tst_brk TBROK "failed to read log file"
> > > tst_res TINFO "using log $LOG"
> > If you don't mind, I would reverse the order to get info about which log is
> > used:
> > tst_res TINFO "using log $LOG"
> > exec 3< $LOG || tst_brk TBROK "failed to re
; $LOG || tst_brk TBROK "failed to read log file"
Or, if it's needed to for some reason to run it before (no idea why, but I might
miss something), I would merge it as:
exec 3< $LOG || tst_brk TBROK "failed to read $LOG"
tst_res TINFO "using log $LOG"
Reviewed-by: Petr Vorel
Kind regards,
Petr
Hi Mimi,
> Add support for the number of expected violations. Include the
> expected number of violations in the output.
Unfortunately this works only on fixed kernel (e.g. the one with v1 of your
"ima: limit both open-writers and ToMToU violations" kernel patchset [1]
(I haven't built v2 [2], b
> On Tue, 2025-03-04 at 09:44 -0500, Mimi Zohar wrote:
> > On Tue, 2025-03-04 at 14:31 +0100, Petr Vorel wrote:
> > > Hi Mimi,
> > > > Add support for the number of expected violations. Include the
> > > > expected number of violations in the output.
&g
Hi all,
> Default value was suitable only for x86_64. This helps to use other
> archs on distros which set $BOOT_IMAGE.
FYI merged.
Kind regards,
Petr
Hi all,
> Test requires not only func=CRITICAL_DATA IMA policy content but also
> ima_policy=critical_data kernel cmdline. Without cmdline no measures are
> done.
FYI merged.
Kind regards,
Petr
> https://ima-doc.readthedocs.io/en/latest/ima-policy.html#ima-policy-critical-data
> https://git.ker
Hi Mimi,
> Violation tests are dependent on searching the $LOG file, which may
> itself result in a ToMToU violation. Preempt getting an additional
> violation during the tests by forcing the $LOG ToMToU violation
> earlier.
FYI I already merged this from v2 (modified, just swap TINFO message wi
Hi Mimi, all,
> Parsing stderr should be enough, but check also 'cat' exit code
> in case of error message change or other problem.
FYI patchset merged.
Kind regards,
Petr
Hi Mimi, Ignaz,
> On Fri, 2025-03-07 at 11:24 +0100, Petr Vorel wrote:
> > Hi Mimi, Ignaz,
> > > Proof of concept, it was never fixed in the kernel.
> > > Instead we should have some basic EVM tests.
> > gently ping. Is evm_overlay.sh test useful for
Hi Mimi,
Tested-by: Petr Vorel
Kind regards,
Petr
> On Thu, 2025-02-20 at 22:43 +0100, Petr Vorel wrote:
> > > On Thu, 2025-02-20 at 15:22 -0500, Mimi Zohar wrote:
> > > > On Thu, 2025-02-20 at 20:13 +0100, Petr Vorel wrote:
> > > > > > On Thu, 2025-02-20 at 19:16 +0100, Petr Vorel wrote:
> > >
Hi Mimi,
Tested-by: Petr Vorel
Kind regards,
Petr
> On Fri, 2025-02-21 at 09:16 +0100, Petr Vorel wrote:
> > > On Thu, 2025-02-20 at 22:43 +0100, Petr Vorel wrote:
> > > > > On Thu, 2025-02-20 at 15:22 -0500, Mimi Zohar wrote:
> > > > > > On Thu, 2025-02-20 at 20:13 +0100, Petr Vorel wrote:
> >
/commit/?id=fdd1ffe8a812
Fixes: 4944a63ed9 ("IMA: Add test for SELinux measurement")
Signed-off-by: Petr Vorel
---
FYI this is supposed to be applied on the top of "ima_setup.sh: Postpone
loading policy after test setup" patchset
https://patchwork.ozlabs.org/project/ltp/list/
Default value was suitable only for x86_64. This helps to use other
archs on distros which set $BOOT_IMAGE.
Signed-off-by: Petr Vorel
---
NOTE: this will not help for non-x86_64 archs on distros which don't
specify BOOT_IMAGE on kernel command line (e.g. aarch64 or ppc64le).
But unless
Hi Mimi,
> Kernel patch "ima: limit the number of ToMToU integrity violations"
> prevents superfluous ToMToU violations. Add corresponding LTP tests.
> Link:
> https://lore.kernel.org/linux-integrity/20250219162131.416719-3-zo...@linux.ibm.com/
> Signed-off-by: Mimi Zohar
Unfortunately tests
> Limit the number of open-writers integrity violations for an existing
> file open for write to one. After the existing file open for write
> closes (__fput), subsequent open-writers integrity violations may occur.
LGTM.
Reviewed-by: Petr Vorel
I also did a regression testing on LT
Hi Mimi,
LGTM.
Reviewed-by: Petr Vorel
Kind regards,
Petr
Hi Mimi,
> Hi Mimi,
> > Kernel patch "ima: limit the number of ToMToU integrity violations"
> > prevents superfluous ToMToU violations. Add corresponding LTP tests.
> > Link:
> > https://lore.kernel.org/linux-integrity/20250219162131.416719-3-zo...@linux.ibm.com/
> > Signed-off-by: Mimi Zohar
Hi Mimi,
> Add support for the number of expected violations. Include the
> expected number of violations in the output.
> Signed-off-by: Mimi Zohar
> ---
> .../security/integrity/ima/tests/ima_violations.sh | 10 --
> 1 file changed, 8 insertions(+), 2 deletions(-)
> diff --git a
Hi Mimi,
> Kernel patch "ima: limit the number of open-writers integrity
> violations" prevents superfluous "open-writers" violations. Add
> corresponding LTP tests.
> Link:
> https://lore.kernel.org/linux-integrity/20250219162131.416719-2-zo...@linux.ibm.com/
> Signed-off-by: Mimi Zohar
> ---
> On Thu, 2025-02-20 at 19:16 +0100, Petr Vorel wrote:
> > Hi Mimi,
> > > Kernel patch "ima: limit the number of ToMToU integrity violations"
> > > prevents superfluous ToMToU violations. Add corresponding LTP tests.
> > > Link:
> On Thu, 2025-02-20 at 15:22 -0500, Mimi Zohar wrote:
> > On Thu, 2025-02-20 at 20:13 +0100, Petr Vorel wrote:
> > > > On Thu, 2025-02-20 at 19:16 +0100, Petr Vorel wrote:
> > > > > Hi Mimi,
> > > > > > Kernel patch "ima: limit the
Parsing stderr should be enough, but check also 'cat' exit code
in case of error message change or other problem.
Signed-off-by: Petr Vorel
---
New in v2.
testcases/kernel/security/integrity/ima/tests/ima_setup.sh | 6 ++
1 file changed, 6 insertions(+)
diff --git a/testca
h: require kernel v6.14 for minimizing
violations tests")
Signed-off-by: Petr Vorel
---
Hi Mimi, all,
I'm sorry not catching this:
https://lore.kernel.org/linux-integrity/174319448478.2953471.5705766506609559454.pr-tracker-...@kernel.org/T/#t
We got this because openSUSE Tumbleweed reach
90 matches
Mail list logo
