From: Mimi Zohar <zohar@linux.ibm.com>
To: Petr Vorel <pvorel@suse.cz>, ltp@lists.linux.it
Cc: linux-integrity@vger.kernel.org
Subject: Re: [PATCH v3 08/10] ima_setup.sh: Allow to load predefined policy
Date: Mon, 03 Feb 2025 11:31:35 -0500 [thread overview]
Message-ID: <44b924ca0fde4c916eba8a98551e44a65072d2e2.camel@linux.ibm.com> (raw)
In-Reply-To: <20250114112915.610297-9-pvorel@suse.cz>
On Tue, 2025-01-14 at 12:29 +0100, Petr Vorel wrote:
> environment variable LTP_IMA_LOAD_POLICY=1 tries to load example policy
> if available. This should be used only if tooling running LTP tests
> allows to reboot afterwards because policy may be writable only once,
> e.g. missing CONFIG_IMA_WRITE_POLICY=y, or policies can influence each
> other.
>
> Loading may fail due various reasons (e.g. previously mentioned missing
> CONFIG_IMA_WRITE_POLICY=y and policy already loaded or when secure boot is
> enabled and the kernel is configured with CONFIG_IMA_ARCH_POLICY enabled, an
> appraise func=POLICY_CHECK appraise_type=imasig rule is loaded, requiring the
> IMA policy itself to be signed).
>
> Signed-off-by: Petr Vorel <pvorel@suse.cz>
Looks good. Thanks, Petr.
Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
WARNING: multiple messages have this Message-ID (diff)
From: Mimi Zohar <zohar@linux.ibm.com>
To: Petr Vorel <pvorel@suse.cz>, ltp@lists.linux.it
Cc: linux-integrity@vger.kernel.org
Subject: Re: [LTP] [PATCH v3 08/10] ima_setup.sh: Allow to load predefined policy
Date: Mon, 03 Feb 2025 11:31:35 -0500 [thread overview]
Message-ID: <44b924ca0fde4c916eba8a98551e44a65072d2e2.camel@linux.ibm.com> (raw)
In-Reply-To: <20250114112915.610297-9-pvorel@suse.cz>
On Tue, 2025-01-14 at 12:29 +0100, Petr Vorel wrote:
> environment variable LTP_IMA_LOAD_POLICY=1 tries to load example policy
> if available. This should be used only if tooling running LTP tests
> allows to reboot afterwards because policy may be writable only once,
> e.g. missing CONFIG_IMA_WRITE_POLICY=y, or policies can influence each
> other.
>
> Loading may fail due various reasons (e.g. previously mentioned missing
> CONFIG_IMA_WRITE_POLICY=y and policy already loaded or when secure boot is
> enabled and the kernel is configured with CONFIG_IMA_ARCH_POLICY enabled, an
> appraise func=POLICY_CHECK appraise_type=imasig rule is loaded, requiring the
> IMA policy itself to be signed).
>
> Signed-off-by: Petr Vorel <pvorel@suse.cz>
Looks good. Thanks, Petr.
Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
--
Mailing list info: https://lists.linux.it/listinfo/ltp
next prev parent reply other threads:[~2025-02-03 16:31 UTC|newest]
Thread overview: 52+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-01-14 11:29 [PATCH v3 00/10] LTP tests: load predefined policy, enhancements Petr Vorel
2025-01-14 11:29 ` [LTP] " Petr Vorel
2025-01-14 11:29 ` [PATCH v3 01/10] ima_violations.sh: Fix log detection Petr Vorel
2025-01-14 11:29 ` [LTP] " Petr Vorel
2025-01-23 17:37 ` Mimi Zohar
2025-01-23 17:37 ` [LTP] " Mimi Zohar
2025-01-14 11:29 ` [PATCH v3 02/10] IMA: Add TCB policy as an example for ima_measurements.sh Petr Vorel
2025-01-14 11:29 ` [LTP] " Petr Vorel
2025-01-23 17:38 ` Mimi Zohar
2025-01-23 17:38 ` [LTP] " Mimi Zohar
2025-02-03 15:46 ` Mimi Zohar
2025-02-03 15:46 ` [LTP] " Mimi Zohar
2025-01-14 11:29 ` [PATCH v3 03/10] IMA: Move requirement check to ima_setup.sh Petr Vorel
2025-01-14 11:29 ` [LTP] " Petr Vorel
2025-01-23 17:38 ` Mimi Zohar
2025-01-23 17:38 ` [LTP] " Mimi Zohar
2025-01-14 11:29 ` [PATCH v3 04/10] IMA: Add example policy for ima_violations.sh Petr Vorel
2025-01-14 11:29 ` [LTP] " Petr Vorel
2025-02-03 15:51 ` Mimi Zohar
2025-02-03 15:51 ` [LTP] " Mimi Zohar
2025-01-14 11:29 ` [PATCH v3 05/10] IMA: Read required policy from file Petr Vorel
2025-01-14 11:29 ` [LTP] " Petr Vorel
2025-01-23 17:39 ` Mimi Zohar
2025-01-23 17:39 ` [LTP] " Mimi Zohar
2025-02-04 11:17 ` Petr Vorel
2025-02-04 11:17 ` [LTP] " Petr Vorel
2025-01-14 11:29 ` [PATCH v3 06/10] ima_violations.sh: Declare tcb builtin policy Petr Vorel
2025-01-14 11:29 ` [LTP] " Petr Vorel
2025-01-23 17:45 ` Mimi Zohar
2025-01-23 17:45 ` [LTP] " Mimi Zohar
2025-01-14 11:29 ` [PATCH v3 07/10] ima_setup.sh: Add digest index detection for ima-buf format Petr Vorel
2025-01-14 11:29 ` [LTP] " Petr Vorel
2025-02-03 16:00 ` Mimi Zohar
2025-02-03 16:00 ` [LTP] " Mimi Zohar
2025-01-14 11:29 ` [PATCH v3 08/10] ima_setup.sh: Allow to load predefined policy Petr Vorel
2025-01-14 11:29 ` [LTP] " Petr Vorel
2025-02-03 16:31 ` Mimi Zohar [this message]
2025-02-03 16:31 ` Mimi Zohar
2025-01-14 11:29 ` [PATCH v3 09/10] ima_measurements.sh: Check policy for test3 Petr Vorel
2025-01-14 11:29 ` [LTP] " Petr Vorel
2025-01-23 17:39 ` Mimi Zohar
2025-01-23 17:39 ` [LTP] " Mimi Zohar
2025-01-14 11:29 ` [PATCH v3 10/10] tst_test.sh: IMA: Allow to disable LSM warnings and use it for IMA Petr Vorel
2025-01-14 11:29 ` [LTP] " Petr Vorel
2025-01-23 17:39 ` Mimi Zohar
2025-01-23 17:39 ` [LTP] " Mimi Zohar
2025-01-31 9:26 ` Cyril Hrubis
2025-01-31 9:26 ` Cyril Hrubis
2025-01-31 12:09 ` Petr Vorel
2025-01-31 12:09 ` Petr Vorel
2025-01-23 17:37 ` [PATCH v3 00/10] LTP tests: load predefined policy, enhancements Mimi Zohar
2025-01-23 17:37 ` [LTP] " Mimi Zohar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=44b924ca0fde4c916eba8a98551e44a65072d2e2.camel@linux.ibm.com \
--to=zohar@linux.ibm.com \
--cc=linux-integrity@vger.kernel.org \
--cc=ltp@lists.linux.it \
--cc=pvorel@suse.cz \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.