Re: [PATCH] ima_tpm.sh: update test2 to detect integrity violations

[Mimi Zohar <zohar@linux.ibm.com>]

Hi Petr,

On Mon, 2026-08-17 at 12:55 +0200, Petr Vorel wrote:
> Hi Mimi,
> 
> > <securityfs>/integrity/ima/violations reflects the number of
> > integrity violations.  Include the "--ignore-violations" option,
> > if there are any violations, on the initial IMA measurement list
> > verification.
> 
> Thanks for your patch!
> 
> LGTM and it should be fixed. But there are some potential problems
> (see bellow).

And here I thought this was a simple performance improvement to execute evmctl
with/without the --ignore-violations option once.

> 
> > Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
> > ---
> >  .../security/integrity/ima/tests/ima_tpm.sh   | 20 ++++++++++++-------
> >  1 file changed, 13 insertions(+), 7 deletions(-)
> 
> > diff --git a/testcases/kernel/security/integrity/ima/tests/ima_tpm.sh b/testcases/kernel/security/integrity/ima/tests/ima_tpm.sh
> > index 5d34d8679..acd8b6d30 100755
> > --- a/testcases/kernel/security/integrity/ima/tests/ima_tpm.sh
> > +++ b/testcases/kernel/security/integrity/ima/tests/ima_tpm.sh
> > @@ -142,6 +142,8 @@ read_pcr_tpm2()
> >  get_pcr10_aggregate()
> >  {
> >  	local cmd="evmctl -vv ima_measurement $BINARY_MEASUREMENTS"
> > +	local violations="$IMA_DIR/violations"
> > +	local num_violations=0
> >  	local msg="$ERRMSG_EVMCTL"
> >  	local res=TCONF
> >  	local pcr ret
> > @@ -151,16 +153,20 @@ get_pcr10_aggregate()
> >  		res=TFAIL
> >  	fi
> 
> > -	$cmd > hash.txt 2>&1
> > -	ret=$?
> > -	if [ $ret -ne 0 -a -z "$MISSING_EVMCTL" ]; then
> > -		tst_res TFAIL "evmctl failed, trying with --ignore-violations"
> You removed TFAIL (potential problem, see later).
> 
> > +	if [ ! -f "$violations" ]; then
> > +		tst_res TINFO "missing $violations"
> > +	else
> > +		num_violations=$(cat "$violations")
> > +	fi
> > +
> > +	if [ "$num_violations" -eq 0 ]; then
> > +		$cmd > hash.txt 2>&1
> > +		ret=$?
> > +	else
> > +		tst_res TINFO "ignoring $num_violations violations"
> >  		cmd="$cmd --ignore-violations"
> >  		$cmd > hash.txt 2>&1
> >  		ret=$?
> > -	elif [ $ret -ne 0 -a "$MISSING_EVMCTL" = 1 ]; then
> > -		tst_res TFAIL "evmctl failed $msg"
> And here again removed TFAIL (see later).
> 
> The main problem is that you removed the code when evmctl is not installed.

If I'm understanding the code correctly, the original code executed evmctl
whether it existed or not.  Let's fix that first.  My question is whether the
test should fail or be skipped?

> 
> Therefore trying to rerun evmctl on failure on older release (e.g. 1.3) it will
> fail due option have different name or not exist at all in evmctl < 1.2).
> -a "$MISSING_EVMCTL" = 1 check had meaning "don't rerun with --ignore-violations
> on old evmctl which does not have the option.

Thank you for the explanation.

Before appending the "--ignore-violations" we should make sure it is supported.
I guess for backwards compatibility we still want to verify the measurement
list, knowing it will fail.

Hopefully with these two changes this patch will work properly.

Mimi

> 
> FYI the code is a bit complicated, because here on TPM2 we require evmctl 1.3.1
> to have --ignore-violations (renamed from --validate), which was released in
> 2020 - too new for old enterprise distros to ignore; also TPM1 we require only
> 1.1 from 2018, probably still too new. Once SLE12-SP3 EOL (in 1 year we may just
> expect 1.3.1 to simplify).
> 
> > -		return
> >  	fi
> 
> >  	[ $ret -ne 0 ] && tst_res TWARN "evmctl failed, trying to continue $msg"
> Back to removed TFAIL. While this is OK as TWARN (some problem, but not related
> to testing) we might end up to TBROK "Test didn't report any results" error in
> tst_test.sh which quits test with TBROK "Test didn't report any results" if
> there is no TPASS/TFAIL/TCONF message.
> 
> _tst_resstr()
> {
> 	echo "$TST_PASS$TST_FAIL$TST_CONF"
> }
> 
> _tst_rescmp()
> {
> 	local res=$(_tst_resstr)
> 
> 	if [ "$1" = "$res" ]; then
> 		tst_brk TBROK "Test didn't report any results"
> 	fi
> }
> 
> And this happen later in test2():
> 	get_pcr10_aggregate > tmp.txt
> 	pcr_aggregate="$(cat tmp.txt)"
> 	if [ -z "$pcr_aggregate" ]; then
> 		return
> 	fi
> 
> Other option would be to print TFAIL message in test2():
> 
> 	get_pcr10_aggregate > tmp.txt
> 	pcr_aggregate="$(cat tmp.txt)"
> 	if [ -z "$pcr_aggregate" ]; then
> 		tst_res TBROK "failed to get aggregate PCR-10"
> 		return
> 	fi
> 
> Lol, I'm disappointed how complicated and error prone I wrote back then.
> Part of the problem is that quit with tst_brk does not work, when code which
> does it is run in a subshell (via $(...) or `...) ), which quits subshell but
> not the parent shell.