[PATCH] ima_selinux.sh: test2 assumes CONFIG_IMA_DISABLE_HTABLE is configured

[PATCH] ima_selinux.sh: test2 assumes CONFIG_IMA_DISABLE_HTABLE is configured

[Mimi Zohar]

test2 uses the last "selinux-state" record stored in the IMA measurement
list to determine whether SELinux is in enforcing mode and then compares
it to the selinux enforce file status.

The tst_update_selinux_state flips the SELinux enforce status
(/sys/fs/selinux/enforce) to force a new "selinux-state" record to be
appended to the IMA measurement list.  However, this only happens when
CONFIG_IMA_DISABLE_HTABLE is configured.

Don't fail the test when CONFIG_IMA_DISABLE_HTABLE is not configured.

Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
---
 .../kernel/security/integrity/ima/tests/ima_selinux.sh      | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/testcases/kernel/security/integrity/ima/tests/ima_selinux.sh b/testcases/kernel/security/integrity/ima/tests/ima_selinux.sh
index e64a7739f..9b312f8b7 100755
--- a/testcases/kernel/security/integrity/ima/tests/ima_selinux.sh
+++ b/testcases/kernel/security/integrity/ima/tests/ima_selinux.sh
@@ -147,7 +147,11 @@ test2()
 	enforced_value=$(echo $measured_data | awk -F'[=;]' '{print $4}')
 	expected_enforced_value=$(cat $SELINUX_DIR/enforce)
 	if [ "$expected_enforced_value" != "$enforced_value" ]; then
-		tst_res $IMA_FAIL "enforce: expected: $expected_enforced_value, got: $enforced_value"
+		if ! tst_check_kconfigs "CONFIG_IMA_DISABLE_HTABLE=y"; then
+			tst_res TPASS "Duplicate \"selinux-state\" record missing (CONFIG_IMA_DISABLE_HTABLE not set)"
+		else
+			tst_res $IMA_FAIL "enforce: expected: $expected_enforced_value, got: $enforced_value"
+		fi
 		return
 	fi
 
-- 
2.55.0

[LTP] [PATCH] ima_selinux.sh: test2 assumes CONFIG_IMA_DISABLE_HTABLE is configured

[Mimi Zohar]

test2 uses the last "selinux-state" record stored in the IMA measurement
list to determine whether SELinux is in enforcing mode and then compares
it to the selinux enforce file status.

The tst_update_selinux_state flips the SELinux enforce status
(/sys/fs/selinux/enforce) to force a new "selinux-state" record to be
appended to the IMA measurement list.  However, this only happens when
CONFIG_IMA_DISABLE_HTABLE is configured.

Don't fail the test when CONFIG_IMA_DISABLE_HTABLE is not configured.

Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
---
 .../kernel/security/integrity/ima/tests/ima_selinux.sh      | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/testcases/kernel/security/integrity/ima/tests/ima_selinux.sh b/testcases/kernel/security/integrity/ima/tests/ima_selinux.sh
index e64a7739f..9b312f8b7 100755
--- a/testcases/kernel/security/integrity/ima/tests/ima_selinux.sh
+++ b/testcases/kernel/security/integrity/ima/tests/ima_selinux.sh
@@ -147,7 +147,11 @@ test2()
 	enforced_value=$(echo $measured_data | awk -F'[=;]' '{print $4}')
 	expected_enforced_value=$(cat $SELINUX_DIR/enforce)
 	if [ "$expected_enforced_value" != "$enforced_value" ]; then
-		tst_res $IMA_FAIL "enforce: expected: $expected_enforced_value, got: $enforced_value"
+		if ! tst_check_kconfigs "CONFIG_IMA_DISABLE_HTABLE=y"; then
+			tst_res TPASS "Duplicate \"selinux-state\" record missing (CONFIG_IMA_DISABLE_HTABLE not set)"
+		else
+			tst_res $IMA_FAIL "enforce: expected: $expected_enforced_value, got: $enforced_value"
+		fi
 		return
 	fi
 
-- 
2.55.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] ima_selinux.sh: test2 assumes CONFIG_IMA_DISABLE_HTABLE is configured

[linuxtestproject.agent]

Hi Mimi,

On August 21, 2026, Mimi Zohar wrote:
> ima_selinux.sh: test2 assumes CONFIG_IMA_DISABLE_HTABLE is configured

> +		if ! tst_check_kconfigs "CONFIG_IMA_DISABLE_HTABLE=y"; then
> +			tst_res TPASS "Duplicate \"selinux-state\" record missing (CONFIG_IMA_DISABLE_HTABLE not set)"

Could this path report TCONF instead? Without duplicate records, test2 cannot
compare the current enforcing state with a fresh measurement and returns
before checking the remaining state fields. TPASS turns this untested
configuration into a successful test result.

Verdict - Needs revision

---
Note:

The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.

Regards,
LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] ima_selinux.sh: test2 assumes CONFIG_IMA_DISABLE_HTABLE is configured

[Petr Vorel]

Hi Mimi,

> Hi Mimi,

> On August 21, 2026, Mimi Zohar wrote:
> > ima_selinux.sh: test2 assumes CONFIG_IMA_DISABLE_HTABLE is configured

> > +		if ! tst_check_kconfigs "CONFIG_IMA_DISABLE_HTABLE=y"; then
> > +			tst_res TPASS "Duplicate \"selinux-state\" record missing (CONFIG_IMA_DISABLE_HTABLE not set)"

I would suggest the same, it makes sense to use TCONF to make it visible that
it's not an error but OTOH it was not actually tested due
CONFIG_IMA_DISABLE_HTABLE not set. If you don't mind, I'd change TPASS to TCONF
before merge (or feel free to send v2 with this change yourself with my
Reviewed-by: Petr Vorel <pvorel@suse.cz>
).

Thanks for the fix!

Kind regards,
Petr

> Could this path report TCONF instead? Without duplicate records, test2 cannot
> compare the current enforcing state with a fresh measurement and returns
> before checking the remaining state fields. TPASS turns this untested
> configuration into a successful test result.

> Verdict - Needs revision

> ---
> Note:

> The agent can sometimes produce false positives although often its
> findings are genuine. If you find issues with the review, please
> comment this email or ignore the suggestions.

> Regards,
> LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] ima_selinux.sh: test2 assumes CONFIG_IMA_DISABLE_HTABLE is configured

[Mimi Zohar]

Hi Petr.

On Tue, 2026-08-25 at 06:44 +0200, Petr Vorel wrote:
[...]
> > On August 21, 2026, Mimi Zohar wrote:
> > > ima_selinux.sh: test2 assumes CONFIG_IMA_DISABLE_HTABLE is configured
> 
> > > +		if ! tst_check_kconfigs "CONFIG_IMA_DISABLE_HTABLE=y"; then
> > > +			tst_res TPASS "Duplicate \"selinux-state\" record missing (CONFIG_IMA_DISABLE_HTABLE not set)"
> 
> I would suggest the same, it makes sense to use TCONF to make it visible that
> it's not an error but OTOH it was not actually tested due
> CONFIG_IMA_DISABLE_HTABLE not set. If you don't mind, I'd change TPASS to TCONF
> before merge (or feel free to send v2 with this change yourself with my
> Reviewed-by: Petr Vorel <pvorel@suse.cz>
> ).
> 
> Thanks for the fix!

Agreed, it should be TCONF.  Please make the change.

thanks,

Mimi

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] ima_selinux.sh: test2 assumes CONFIG_IMA_DISABLE_HTABLE is configured

[Petr Vorel]

Hi Mimi,

> Hi Petr.

> On Tue, 2026-08-25 at 06:44 +0200, Petr Vorel wrote:
> [...]
> > > On August 21, 2026, Mimi Zohar wrote:
> > > > ima_selinux.sh: test2 assumes CONFIG_IMA_DISABLE_HTABLE is configured

> > > > +		if ! tst_check_kconfigs "CONFIG_IMA_DISABLE_HTABLE=y"; then
> > > > +			tst_res TPASS "Duplicate \"selinux-state\" record missing (CONFIG_IMA_DISABLE_HTABLE not set)"

> > I would suggest the same, it makes sense to use TCONF to make it visible that
> > it's not an error but OTOH it was not actually tested due
> > CONFIG_IMA_DISABLE_HTABLE not set. If you don't mind, I'd change TPASS to TCONF
> > before merge (or feel free to send v2 with this change yourself with my
> > Reviewed-by: Petr Vorel <pvorel@suse.cz>
> > ).

> > Thanks for the fix!

> Agreed, it should be TCONF.  Please make the change.

Thanks for your ack, merged with TCONF.

Kind regards,
Petr

> thanks,

> Mimi

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp