Re: [RFC PATCH 1/3] Update validate() to support multiple violations

[Petr Vorel <pvorel@suse.cz>]

Hi Mimi,

> Add support for the number of expected violations.  Include the
> expected number of violations in the output.

> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
> ---
>  .../security/integrity/ima/tests/ima_violations.sh     | 10 ++++++++--
>  1 file changed, 8 insertions(+), 2 deletions(-)

> diff --git a/testcases/kernel/security/integrity/ima/tests/ima_violations.sh b/testcases/kernel/security/integrity/ima/tests/ima_violations.sh
> index 37d8d473c..7f0382fb8 100755
> --- a/testcases/kernel/security/integrity/ima/tests/ima_violations.sh
> +++ b/testcases/kernel/security/integrity/ima/tests/ima_violations.sh
> @@ -71,20 +71,26 @@ validate()
>  	local num_violations="$1"
>  	local count="$2"
>  	local search="$3"
> +	local expected_violations=$4
nit: safer to quote as much as possible (="$4") to avoid errors.

>  	local max_attempt=3
>  	local count2 i num_violations_new

> +	[ -z $expected_violations ] && expected_violations=1
Also here: -z "$expected_violations"

I can add quotes before merge if you don't want to bother (I would send you a
diff to ack it before merging).

> +
>  	for i in $(seq 1 $max_attempt); do
>  		read num_violations_new < $IMA_VIOLATIONS
>  		count2="$(get_count $search)"
> -		if [ $(($num_violations_new - $num_violations)) -gt 0 ]; then
> +		if [ $(($num_violations_new - $num_violations)) -eq $expected_violations ]; then
>  			if [ $count2 -gt $count ]; then
> -				tst_res TPASS "$search violation added"
> +				tst_res TPASS "$expected_violations $search violation(s) added"
>  				return
>  			else
>  				tst_res TINFO "$search not found in $LOG ($i/$max_attempt attempt)..."
>  				tst_sleep 1s
>  			fi
> +		elif [ $(($num_violations_new - $num_violations)) -gt 0 ]; then
> +			tst_res $IMA_FAIL "$search too many violations added"
nit: maybe print values for debugging?

			tst_res $IMA_FAIL "$search too many violations added: $num_violations_new - $num_violations"

FYI failing tests has 2 or 3 higher:

ima_violations 1 TINFO: SUT has required policy content
ima_violations 1 TINFO: using log /var/log/audit/audit.log
ima_violations 1 TINFO: verify open writers violation
ima_violations 1 TFAIL: open_writers too many violations added: 106 - 104
ima_violations 2 TINFO: verify ToMToU violation
ima_violations 2 TFAIL: ToMToU too many violations added: 109 - 107
ima_violations 3 TINFO: verify open_writers using mmapped files
tst_test.c:1900: TINFO: LTP version: 20250130-22-gcd2215702f
tst_test.c:1904: TINFO: Tested kernel: 6.13.0-2.g0127a37-default #1 SMP PREEMPT_DYNAMIC Thu Jan 23 11:21:55 UTC 2025 (0127a37) x86_64
tst_kconfig.c:88: TINFO: Parsing kernel config '/proc/config.gz'
tst_kconfig.c:676: TINFO: CONFIG_FAULT_INJECTION kernel option detected which might slow the execution
tst_test.c:1722: TINFO: Overall timeout per run is 0h 02m 00s
ima_mmap.c:38: TINFO: sleep 3s
ima_violations 3 TFAIL: open_writers too many violations added: 112 - 110
ima_mmap.c:41: TPASS: test completed

Summary:
passed   1
failed   0
broken   0
skipped  0
warnings 0
ima_violations 4 TINFO: verify limiting single open writer violation
ima_violations 4 TFAIL: open_writers too many violations added: 116 - 113
ima_violations 5 TINFO: verify limiting multiple open writers violations
ima_violations 5 TFAIL: open_writers too many violations added: 121 - 117
ima_violations 6 TINFO: verify new open writer causes additional violation
ima_violations 6 TFAIL: open_writers too many violations added: 126 - 122
ima_violations 7 TINFO: verify limiting single open reader ToMToU violations
ima_violations 7 TFAIL: ToMToU too many violations added: 130 - 127
ima_violations 8 TINFO: verify new open reader causes additional ToMToU violation
ima_violations 8 TFAIL: ToMToU too many violations added: 134 - 131

As I noted in previous mail, either has of a backport (can be added later, we
don't have to wait for merging) or skip on older kernels (tst_kvcmp -lt ...).

Kind regards,
Petr