linux-kernel - Re: [PATCH] bpf: Fix IMA test

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <9f19f0ff41114f7c90cca681f438388a64807e92.camel@huaweicloud.com>
Date:   Wed, 08 Mar 2023 13:05:45 +0100
From:   Roberto Sassu <roberto.sassu@...weicloud.com>
To:     Matt Bobrowski <mattbobrowski@...gle.com>
Cc:     andrii@...nel.org, mykolal@...com, ast@...nel.org,
        daniel@...earbox.net, martin.lau@...ux.dev, song@...nel.org,
        yhs@...com, john.fastabend@...il.com, kpsingh@...nel.org,
        sdf@...gle.com, haoluo@...gle.com, jolsa@...nel.org,
        shuah@...nel.org, bpf@...r.kernel.org,
        linux-kselftest@...r.kernel.org, linux-integrity@...r.kernel.org,
        linux-kernel@...r.kernel.org, zohar@...ux.ibm.com,
        Roberto Sassu <roberto.sassu@...wei.com>
Subject: Re: [PATCH] bpf: Fix IMA test

On Wed, 2023-03-08 at 11:03 +0000, Matt Bobrowski wrote:
> Ha! I was literally in the midst of sending through a patch for
> this. Thanks for also taking a look and beating me to it!
> 
> This LGTM, feel free to add:
> 
> Reviewed-by: Matt Bobrowski <mattbobrowski@...gle.com>

Thanks.

I have only one remain question. Should we accept the old behavior, or
simply reject it?

Roberto

> On Wed, Mar 08, 2023 at 11:37:13AM +0100, Roberto Sassu wrote:
> > From: Roberto Sassu <roberto.sassu@...wei.com>
> > 
> > Commit 62622dab0a28 ("ima: return IMA digest value only when IMA_COLLECTED
> > flag is set") caused bpf_ima_inode_hash() to refuse to give non-fresh
> > digests. IMA test #3 assumed the old behavior, that bpf_ima_inode_hash()
> > still returned also non-fresh digests.
> > 
> > Correct the test by accepting both cases. If the samples returned are 1,
> > assume that the commit above is applied and that the returned digest is
> > fresh. If the samples returned are 2, assume that the commit above is not
> > applied, and check both the non-fresh and fresh digest.
> > 
> > Fixes: 62622dab0a28 ("ima: return IMA digest value only when IMA_COLLECTED flag is set")
> > Reported by: David Vernet <void@...ifault.com>
> > Signed-off-by: Roberto Sassu <roberto.sassu@...wei.com>
> > ---
> >  .../selftests/bpf/prog_tests/test_ima.c       | 29 ++++++++++++++-----
> >  1 file changed, 21 insertions(+), 8 deletions(-)
> > 
> > diff --git a/tools/testing/selftests/bpf/prog_tests/test_ima.c b/tools/testing/selftests/bpf/prog_tests/test_ima.c
> > index b13feceb38f..810b14981c2 100644
> > --- a/tools/testing/selftests/bpf/prog_tests/test_ima.c
> > +++ b/tools/testing/selftests/bpf/prog_tests/test_ima.c
> > @@ -70,7 +70,7 @@ void test_test_ima(void)
> >  	u64 bin_true_sample;
> >  	char cmd[256];
> >  
> > -	int err, duration = 0;
> > +	int err, duration = 0, fresh_digest_idx = 0;
> >  	struct ima *skel = NULL;
> >  
> >  	skel = ima__open_and_load();
> > @@ -129,7 +129,15 @@ void test_test_ima(void)
> >  	/*
> >  	 * Test #3
> >  	 * - Goal: confirm that bpf_ima_inode_hash() returns a non-fresh digest
> > -	 * - Expected result: 2 samples (/bin/true: non-fresh, fresh)
> > +	 * - Expected result:
> > +	 *   1 sample (/bin/true: fresh) if commit 62622dab0a28 applied
> > +	 *   2 samples (/bin/true: non-fresh, fresh) if commit 62622dab0a28 is
> > +	 *     not applied
> > +	 *
> > +	 * If commit 62622dab0a28 ("ima: return IMA digest value only when
> > +	 * IMA_COLLECTED flag is set") is applied, bpf_ima_inode_hash() refuses
> > +	 * to give a non-fresh digest, hence the correct result is 1 instead of
> > +	 * 2.
> >  	 */
> >  	test_init(skel->bss);
> >  
> > @@ -144,13 +152,18 @@ void test_test_ima(void)
> >  		goto close_clean;
> >  
> >  	err = ring_buffer__consume(ringbuf);
> > -	ASSERT_EQ(err, 2, "num_samples_or_err");
> > -	ASSERT_NEQ(ima_hash_from_bpf[0], 0, "ima_hash");
> > -	ASSERT_NEQ(ima_hash_from_bpf[1], 0, "ima_hash");
> > -	ASSERT_EQ(ima_hash_from_bpf[0], bin_true_sample, "sample_equal_or_err");
> > +	ASSERT_GE(err, 1, "num_samples_or_err");
> > +	if (err == 2) {
> > +		ASSERT_NEQ(ima_hash_from_bpf[0], 0, "ima_hash");
> > +		ASSERT_EQ(ima_hash_from_bpf[0], bin_true_sample,
> > +			  "sample_equal_or_err");
> > +		fresh_digest_idx = 1;
> > +	}
> > +
> > +	ASSERT_NEQ(ima_hash_from_bpf[fresh_digest_idx], 0, "ima_hash");
> >  	/* IMA refreshed the digest. */
> > -	ASSERT_NEQ(ima_hash_from_bpf[1], bin_true_sample,
> > -		   "sample_different_or_err");
> > +	ASSERT_NEQ(ima_hash_from_bpf[fresh_digest_idx], bin_true_sample,
> > +		   "sample_equal_or_err");
> >  
> >  	/*
> >  	 * Test #4
> > -- 
> > 2.25.1
> > 
> /M