Re: [LTP] ima_tpm.sh: properly detect failure to verify the IMA measurement list

[Petr Vorel <pvorel@suse.cz>]

Hi Mimi, Andrea,

> Hi Mimi,

> > > +	pcr_aggregate="$(cat tmp.txt | awk '{print $1}')"

> > The cat here is redundant, awk can read the file directly:


> This is valid.

+1, agent did a good job here :). We could even avoid using tail (awk has this
feature), but let's ignore that.

As it is trivial, I can change it before merge (see diff below).

> > > +		lineno="$(cat tmp.txt | awk '{print $2}')"

> > Same here:

> > 	lineno="$(awk '{print $2}' tmp.txt)"

> [..]


> > > +		tst_res TPASS "aggregate PCR value matched real PCR value (line: $lineno/$total_measurements)"

> > This line is about 100 columns wide. LTP shell style asks for lines
> > under 80 characters; perhaps wrap it or shorten the message.

> we can ignore this one.

We should teach agent that splitting quotes string does more harm than slightly
longer line.

> @Petr can you please take a look?

Sure :). FYI I already did have a brief look yesterday, and I also triggered CI
jobs for v1 and wait them to finish. Of course I'll rerun them for v2.

@Mimi FYI v1 patch triggers failure - it just calculate a different
aggregate PCR-10. Although the commit subject is "properly detect failure" ..
I'm not sure if this is a false negative or the current code on master just did
not find error (false positive). As I said, I'll rerun v2 and let you know if
it's the same.

Testing on openSUSE Tumbleweed x86_64 VM with kernel: 7.1.8-1, virtualized TPM
2.0, evmctl 1.6.2. Working master [1], broken with your patch [2].

FYI TPM 2.0 used:

swtpm socket --tpmstate dir=/tmp/mytpm25 --ctrl \
type=unixio,path=/tmp/mytpm25/swtpm-sock --log level=20 -d --tpm2

Whole QEMU command:

/usr/bin/qemu-system-x86_64 -device VGA,edid=on,xres=1024,yres=768 \
-only-migratable -chardev ringbuf,id=serial0,logfile=serial0,logappend=on \
-serial chardev:serial0 -audiodev none,id=snd0 -device intel-hda -device \
hda-output,audiodev=snd0 -global isa-fdc.fdtypeA=none -m 1536 -cpu host -netdev \
user,id=qanet0 -device virtio-net,netdev=qanet0,mac=52:54:00:12:34:56 -object \
rng-random,filename=/dev/urandom,id=rng0 -device virtio-rng-pci,rng=rng0 \
-chardev socket,id=chrtpm,path=/tmp/mytpm25/swtpm-sock -tpmdev \
emulator,id=tpm0,chardev=chrtpm -device tpm-tis,tpmdev=tpm0 -boot order=c \
-device qemu-xhci -device usb-tablet -smp 1 -enable-kvm -no-shutdown -vnc \
:115,share=force-shared -device virtio-serial -chardev \
pipe,id=virtio_console,path=virtio_console,logfile=virtio_console.log,logappend=on \
-device \
virtconsole,chardev=virtio_console,name=org.openqa.console.virtio_console \
-chardev \
pipe,id=virtio_console_user,path=virtio_console_user,logfile=virtio_console_user.log,logappend=on \
-device \
virtconsole,chardev=virtio_console_user,name=org.openqa.console.virtio_console_user \
-chardev \
socket,path=qmp_socket,server=on,wait=off,id=qmp_socket,logfile=qmp_socket.log,logappend=on \
-qmp chardev:qmp_socket -S -device virtio-scsi-pci,id=scsi0 -blockdev \
driver=file,node-name=hd0-overlay0-file,filename=/var/lib/openqa/pool/25/raid/hd0-overlay0,cache.no-flush=on \
-blockdev \
driver=qcow2,node-name=hd0-overlay0,file=hd0-overlay0-file,cache.no-flush=on,discard=unmap \
-device virtio-blk,id=hd0-device,drive=hd0-overlay0,bootindex=0,serial=hd0 \
-blockdev \
driver=file,node-name=cd0-overlay0-file,filename=/var/lib/openqa/pool/25/raid/cd0-overlay0,cache.no-flush=on \
-blockdev \
driver=qcow2,node-name=cd0-overlay0,file=cd0-overlay0-file,cache.no-flush=on,discard=unmap \
-device scsi-cd,id=cd0-device,drive=cd0-overlay0,serial=cd0

Kind regards,
Petr

[1] https://openqa.opensuse.org/tests/6185158#step/ima_tpm/4
[2] https://openqa.opensuse.org/tests/6185106#step/ima_tpm/4
[3] https://openqa.opensuse.org/tests/6185106/file/autoinst-log.txt

diff --git testcases/kernel/security/integrity/ima/tests/ima_tpm.sh testcases/kernel/security/integrity/ima/tests/ima_tpm.sh
index 8bb86ea4ac..edf8699f83 100755
--- testcases/kernel/security/integrity/ima/tests/ima_tpm.sh
+++ testcases/kernel/security/integrity/ima/tests/ima_tpm.sh
@@ -295,7 +295,7 @@ test2()
 	get_pcr10_aggregate > tmp.txt
 	ret=$?
 
-	pcr_aggregate="$(cat tmp.txt | awk '{print $1}')"
+	pcr_aggregate="$(awk '{print $1}' tmp.txt)"
 	if [ -z "$pcr_aggregate" ]; then
 		return
 	fi
@@ -304,7 +304,7 @@ test2()
 	if [ "$hash" = "$pcr_aggregate" ]; then
 		tst_res TPASS "aggregate PCR value matches real PCR value"
 	elif [ $ret -eq 0 ]; then
-		lineno="$(cat tmp.txt | awk '{print $2}')"
+		lineno="$(awk '{print $2}' tmp.txt)"
 		if [ -z "$lineno" ]; then
 			return
 		fi

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp