Re: [LTP] ima_tpm.sh: properly detect failure to verify the IMA measurement list

[Mimi Zohar <zohar@linux.ibm.com>]

Hi Andrea, Petr,

Thank you for reviewing/testing/updating the v1/v2.

On Thu, 2026-08-27 at 12:22 +0200, Petr Vorel wrote:
> > @Petr can you please take a look?
> 
> Sure :). FYI I already did have a brief look yesterday, and I also triggered CI
> jobs for v1 and wait them to finish. Of course I'll rerun them for v2.
> 
> @Mimi FYI v1 patch triggers failure - it just calculate a different
> aggregate PCR-10. Although the commit subject is "properly detect failure" ..
> I'm not sure if this is a false negative or the current code on master just did
> not find error (false positive). As I said, I'll rerun v2 and let you know if
> it's the same.

I've been testing on real HW with a physical TPM, not in a virtual VM.  

Without a dont_measure policy rule to eliminate the "systemd_unit_file_t"
measurements, the number of measurements grows really fast.  The results of
test2 looks like:

ima_tpm 2 TINFO: verify PCR values
ima_tpm 2 TINFO: real PCR-10:
'ea84103155e8a91974c2706db94f91e396dad3f91430648224e19f17790716d8'
ima_tpm 2 TINFO: ignoring 5 violations
ima_tpm 2 TINFO: aggregate PCR-10:
'4608820a46bb8ad5e4d95b6f94273e76f1f12ca8c61b84d01aaed7b0fb226a74'
ima_tpm 2 TPASS: aggregate PCR value matched real PCR value (line: 7147/7634)

> 
> Testing on openSUSE Tumbleweed x86_64 VM with kernel: 7.1.8-1, virtualized TPM
> 2.0, evmctl 1.6.2. Working master [1], broken with your patch [2].

Interesting that with this simple patch, test2 now fails.

Mimi

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp