Re: [PATCH v3 02/10] IMA: Add TCB policy as an example for ima_measurements.sh

[Mimi Zohar <zohar@linux.ibm.com>]

Hi Petr,

On Tue, 2025-01-14 at 12:29 +0100, Petr Vorel wrote:
> Taken from IMA docs [1], removed dont_measure fsmagic=0x1021994 (tmpfs)
> as suggested by Mimi.

I backtracked on my original suggestion.  Instead of removing the tmpfs rule, qualify
it as you did below.

-> qualified the "dont_measure fsmagic=0x1021994" (tmpfs) rule to the file open hook
[2].

> 
> [1] https://ima-doc.readthedocs.io/en/latest/ima-policy.html#ima-tcb
> 
> Signed-off-by: Petr Vorel <pvorel@suse.cz>

[2] Kernel commit 7eef7c8bac9a ("ima: limit the builtin 'tcb' dont_measure tmpfs
policy rule")

Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>

> ---
>  .../security/integrity/ima/datafiles/Makefile |  4 ++--
>  .../ima/datafiles/ima_measurements/Makefile   | 11 ++++++++++
>  .../ima/datafiles/ima_measurements/tcb.policy | 20 +++++++++++++++++++
>  3 files changed, 33 insertions(+), 2 deletions(-)
>  create mode 100644
> testcases/kernel/security/integrity/ima/datafiles/ima_measurements/Makefile
>  create mode 100644
> testcases/kernel/security/integrity/ima/datafiles/ima_measurements/tcb.policy
> 
> diff --git a/testcases/kernel/security/integrity/ima/datafiles/Makefile
> b/testcases/kernel/security/integrity/ima/datafiles/Makefile
> index 200fd3f4d3..0f2b4fdb11 100644
> --- a/testcases/kernel/security/integrity/ima/datafiles/Makefile
> +++ b/testcases/kernel/security/integrity/ima/datafiles/Makefile
> @@ -1,5 +1,5 @@
>  # SPDX-License-Identifier: GPL-2.0-or-later
> -# Copyright (c) Linux Test Project, 2019-2020
> +# Copyright (c) Linux Test Project, 2019-2025
>  # Copyright (c) 2020 Microsoft Corporation
>  # Copyright (C) 2009, Cisco Systems Inc.
>  # Ngie Cooper, July 2009
> @@ -8,6 +8,6 @@ top_srcdir	?= ../../../../../..
>  
>  include	$(top_srcdir)/include/mk/env_pre.mk
>  
> -SUBDIRS	:= ima_kexec ima_keys ima_policy ima_selinux
> +SUBDIRS	:= ima_kexec ima_keys ima_measurements ima_policy ima_selinux
>  
>  include $(top_srcdir)/include/mk/generic_trunk_target.mk
> diff --git
> a/testcases/kernel/security/integrity/ima/datafiles/ima_measurements/Makefile
> b/testcases/kernel/security/integrity/ima/datafiles/ima_measurements/Makefile
> new file mode 100644
> index 0000000000..6317f2bf85
> --- /dev/null
> +++ b/testcases/kernel/security/integrity/ima/datafiles/ima_measurements/Makefile
> @@ -0,0 +1,11 @@
> +# SPDX-License-Identifier: GPL-2.0-or-later
> +# Copyright (c) Linux Test Project, 2025
> +
> +top_srcdir	?= ../../../../../../..
> +
> +include	$(top_srcdir)/include/mk/env_pre.mk
> +
> +INSTALL_DIR		:= testcases/data/ima_measurements
> +INSTALL_TARGETS	:= *.policy
> +
> +include $(top_srcdir)/include/mk/generic_leaf_target.mk
> diff --git
> a/testcases/kernel/security/integrity/ima/datafiles/ima_measurements/tcb.policy
> b/testcases/kernel/security/integrity/ima/datafiles/ima_measurements/tcb.policy
> new file mode 100644
> index 0000000000..1e4a932bf0
> --- /dev/null
> +++ b/testcases/kernel/security/integrity/ima/datafiles/ima_measurements/tcb.policy
> @@ -0,0 +1,20 @@
> +dont_measure fsmagic=0x9fa0
> +dont_measure fsmagic=0x62656572
> +dont_measure fsmagic=0x64626720
> +dont_measure fsmagic=0x1021994 func=FILE_CHECK
> +dont_measure fsmagic=0x1cd1
> +dont_measure fsmagic=0x42494e4d
> +dont_measure fsmagic=0x73636673
> +dont_measure fsmagic=0xf97cff8c
> +dont_measure fsmagic=0x43415d53
> +dont_measure fsmagic=0x27e0eb
> +dont_measure fsmagic=0x63677270
> +dont_measure fsmagic=0x6e736673
> +dont_measure fsmagic=0xde5e81e4
> +measure func=MMAP_CHECK mask=MAY_EXEC
> +measure func=BPRM_CHECK mask=MAY_EXEC
> +measure func=FILE_CHECK mask=^MAY_READ euid=0
> +measure func=FILE_CHECK mask=^MAY_READ uid=0
> +measure func=MODULE_CHECK
> +measure func=FIRMWARE_CHECK
> +measure func=POLICY_CHECK