linux-kernel - Re: [PATCH v2 01/11] test_firmware: enable custom fallback testing on limited kernel configs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAGXu5jKrurrd66BC6zyC8J4K7BPoEzG8Gn1hC6zBRfOODACcJg@mail.gmail.com>
Date:   Tue, 27 Feb 2018 15:07:49 -0800
From:   Kees Cook <keescook@...omium.org>
To:     "Luis R. Rodriguez" <mcgrof@...nel.org>
Cc:     Greg KH <gregkh@...uxfoundation.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Shuah Khan <shuah@...nel.org>,
        Martin Fuzzey <mfuzzey@...keon.com>,
        Mimi Zohar <zohar@...ux.vnet.ibm.com>,
        David Howells <dhowells@...hat.com>, pali.rohar@...il.com,
        Takashi Iwai <tiwai@...e.de>, arend.vanspriel@...adcom.com,
        Rafał Miłecki <zajec5@...il.com>,
        nbroeking@...com, Vikram Mulukutla <markivx@...eaurora.org>,
        stephen.boyd@...aro.org, Mark Brown <broonie@...nel.org>,
        Dmitry Torokhov <dmitry.torokhov@...il.com>,
        David Woodhouse <dwmw2@...radead.org>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Abhay_Salunke@...l.com, bjorn.andersson@...aro.org,
        jewalt@...innovations.com, LKML <linux-kernel@...r.kernel.org>,
        "linux-fsdevel@...r.kernel.org" <linux-fsdevel@...r.kernel.org>
Subject: Re: [PATCH v2 01/11] test_firmware: enable custom fallback testing on
 limited kernel configs

On Fri, Feb 23, 2018 at 6:46 PM, Luis R. Rodriguez <mcgrof@...nel.org> wrote:
> When a kernel is not built with:
>
> CONFIG_HAS_FW_LOADER_USER_HELPER_FALLBACK=y
>
> We don't currently enable testing fw_fallback.sh. For kernels that
> still enable the fallback mechanism, its possible to use the async
> request firmware API call request_firmware_nowait() using the custom
> interface to use the fallback mechanism, so we should be able to test
> this but we currently cannot.
>
> We can enable testing without CONFIG_HAS_FW_LOADER_USER_HELPER_FALLBACK=y
> by relying on /proc/config.gz (CONFIG_IKCONFIG_PROC), if present. If you
> don't have this we'll have no option but to rely on old heuristics for now.
>
> Signed-off-by: Luis R. Rodriguez <mcgrof@...nel.org>
> ---
>  tools/testing/selftests/firmware/config         |  4 +++
>  tools/testing/selftests/firmware/fw_fallback.sh | 45 ++++++++++++++++++++++++-
>  2 files changed, 48 insertions(+), 1 deletion(-)
>
> diff --git a/tools/testing/selftests/firmware/config b/tools/testing/selftests/firmware/config
> index c8137f70e291..bf634dda0720 100644
> --- a/tools/testing/selftests/firmware/config
> +++ b/tools/testing/selftests/firmware/config
> @@ -1 +1,5 @@
>  CONFIG_TEST_FIRMWARE=y
> +CONFIG_FW_LOADER=y
> +CONFIG_FW_LOADER_USER_HELPER=y
> +CONFIG_IKCONFIG=y
> +CONFIG_IKCONFIG_PROC=y
> diff --git a/tools/testing/selftests/firmware/fw_fallback.sh b/tools/testing/selftests/firmware/fw_fallback.sh
> index 722cad91df74..a42e437363d9 100755
> --- a/tools/testing/selftests/firmware/fw_fallback.sh
> +++ b/tools/testing/selftests/firmware/fw_fallback.sh
> @@ -6,7 +6,46 @@
>  # won't find so that we can do the load ourself manually.
>  set -e
>
> +PROC_CONFIG="/proc/config.gz"
> +TEST_DIR=$(dirname $0)
> +
>  modprobe test_firmware
> +if [ ! -f $PROC_CONFIG ]; then
> +       if modprobe configs 2>/dev/null; then
> +               echo "Loaded configs module"
> +               if [ ! -f $PROC_CONFIG ]; then
> +                       echo "You must have the following enabled in your kernel:" >&2
> +                       cat $TEST_DIR/config >&2
> +                       echo "Resorting to old heuristics" >&2
> +               fi
> +       else
> +               echo "Failed to load configs module, using old heuristics" >&2
> +       fi
> +fi
> +
> +kconfig_has()
> +{
> +       if [ -f $PROC_CONFIG ]; then
> +               if zgrep -q $1 $PROC_CONFIG 2>/dev/null; then
> +                       echo "yes"
> +               else
> +                       echo "no"
> +               fi
> +       else
> +               # We currently don't have easy heuristics to infer this
> +               # so best we can do is just try to use the kernel assuming
> +               # you had enabled it. This matches the old behaviour.
> +               if [ "$1" = "CONFIG_FW_LOADER_USER_HELPER_FALLBACK=y" ]; then
> +                       echo "yes"
> +               elif [ "$1" = "CONFIG_FW_LOADER_USER_HELPER=y" ]; then
> +                       if [ -d /sys/class/firmware/ ]; then
> +                               echo yes
> +                       else
> +                               echo no
> +                       fi
> +               fi
> +       fi
> +}

Some day when we have more formalized CONFIG-scanning for selftests,
we can probably describe all of this better in a cleaner way. In the
meantime, yeah, this seems fine.

>
>  DIR=/sys/devices/virtual/misc/test_firmware
>
> @@ -14,6 +53,7 @@ DIR=/sys/devices/virtual/misc/test_firmware
>  # These days no one enables CONFIG_FW_LOADER_USER_HELPER so check for that
>  # as an indicator for CONFIG_FW_LOADER_USER_HELPER.
>  HAS_FW_LOADER_USER_HELPER=$(if [ -d /sys/class/firmware/ ]; then echo yes; else echo no; fi)
> +HAS_FW_LOADER_USER_HELPER_FALLBACK=$(kconfig_has CONFIG_FW_LOADER_USER_HELPER_FALLBACK=y)
>
>  if [ "$HAS_FW_LOADER_USER_HELPER" = "yes" ]; then
>         OLD_TIMEOUT=$(cat /sys/class/firmware/timeout)
> @@ -286,7 +326,10 @@ run_sysfs_custom_load_tests()
>         fi
>  }
>
> -run_sysfs_main_tests
> +if [ "$HAS_FW_LOADER_USER_HELPER_FALLBACK" = "yes" ]; then
> +       run_sysfs_main_tests
> +fi
> +
>  run_sysfs_custom_load_tests
>
>  exit 0
> --
> 2.16.2
>

Acked-by: Kees Cook <keescook@...omium.org>

-Kees

-- 
Kees Cook
Pixel Security