* [LTP] [PATCH v2] ima_tpm.sh: properly detect failure to verify the IMA measurement list @ 2026-08-26 22:29 ` Mimi Zohar 0 siblings, 0 replies; 10+ messages in thread From: Mimi Zohar @ 2026-08-26 22:29 UTC (permalink / raw) To: ltp; +Cc: linux-integrity test2 attempts to compare the aggregate PCR-10 value with the current TPM PCR value based on the current measurement list, but does not take into account that the measurement list might have grown. evmctl returns success/failure when verifying the IMA measurement list and displays the measurement list line number that matched. Update test2 to check the return code, before failing the test. Include the matched line number and total number of measurement list records. Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> --- Changelog: - addressed AI comments, minimizing changes .../security/integrity/ima/tests/ima_tpm.sh | 25 +++++++++++++++---- 1 file changed, 20 insertions(+), 5 deletions(-) diff --git a/testcases/kernel/security/integrity/ima/tests/ima_tpm.sh b/testcases/kernel/security/integrity/ima/tests/ima_tpm.sh index acd8b6d30..8bb86ea4a 100755 --- a/testcases/kernel/security/integrity/ima/tests/ima_tpm.sh +++ b/testcases/kernel/security/integrity/ima/tests/ima_tpm.sh @@ -146,7 +146,7 @@ get_pcr10_aggregate() local num_violations=0 local msg="$ERRMSG_EVMCTL" local res=TCONF - local pcr ret + local lineno pcr ret if [ -z "$MISSING_EVMCTL" ]; then msg= @@ -178,10 +178,13 @@ get_pcr10_aggregate() tst_res $res "failed to find aggregate PCR-10 $msg" tst_res TINFO "hash file:" cat hash.txt >&2 - return + return $ret fi - echo "$pcr" + lineno=$(grep -E "^($ALGORITHM )*PCR(.*10)*: succeed at entry" \ + hash.txt | tail -1 | awk '{print $NF}') + echo "$pcr $lineno" + return $ret } test1_tpm_bypass_mode() @@ -249,7 +252,9 @@ test1() test2() { - local hash pcr_aggregate out ret + local hash pcr_aggregate lineno out ret + local measurement_count="$IMA_DIR/runtime_measurements_count" + local total_measurements tst_res TINFO "verify PCR values" @@ -288,7 +293,9 @@ test2() tst_res TINFO "real PCR-10: '$hash'" get_pcr10_aggregate > tmp.txt - pcr_aggregate="$(cat tmp.txt)" + ret=$? + + pcr_aggregate="$(cat tmp.txt | awk '{print $1}')" if [ -z "$pcr_aggregate" ]; then return fi @@ -296,6 +303,14 @@ test2() if [ "$hash" = "$pcr_aggregate" ]; then tst_res TPASS "aggregate PCR value matches real PCR value" + elif [ $ret -eq 0 ]; then + lineno="$(cat tmp.txt | awk '{print $2}')" + if [ -z "$lineno" ]; then + return + fi + total_measurements=$(cat "$measurement_count") + + tst_res TPASS "aggregate PCR value matched real PCR value (line: $lineno/$total_measurements)" else tst_res TFAIL "aggregate PCR value does not match real PCR value" fi -- 2.55.0 -- Mailing list info: https://lists.linux.it/listinfo/ltp ^ permalink raw reply related [flat|nested] 10+ messages in thread
* [PATCH v2] ima_tpm.sh: properly detect failure to verify the IMA measurement list @ 2026-08-26 22:29 ` Mimi Zohar 0 siblings, 0 replies; 10+ messages in thread From: Mimi Zohar @ 2026-08-26 22:29 UTC (permalink / raw) To: ltp; +Cc: Petr Vorel, linux-integrity, Mimi Zohar test2 attempts to compare the aggregate PCR-10 value with the current TPM PCR value based on the current measurement list, but does not take into account that the measurement list might have grown. evmctl returns success/failure when verifying the IMA measurement list and displays the measurement list line number that matched. Update test2 to check the return code, before failing the test. Include the matched line number and total number of measurement list records. Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> --- Changelog: - addressed AI comments, minimizing changes .../security/integrity/ima/tests/ima_tpm.sh | 25 +++++++++++++++---- 1 file changed, 20 insertions(+), 5 deletions(-) diff --git a/testcases/kernel/security/integrity/ima/tests/ima_tpm.sh b/testcases/kernel/security/integrity/ima/tests/ima_tpm.sh index acd8b6d30..8bb86ea4a 100755 --- a/testcases/kernel/security/integrity/ima/tests/ima_tpm.sh +++ b/testcases/kernel/security/integrity/ima/tests/ima_tpm.sh @@ -146,7 +146,7 @@ get_pcr10_aggregate() local num_violations=0 local msg="$ERRMSG_EVMCTL" local res=TCONF - local pcr ret + local lineno pcr ret if [ -z "$MISSING_EVMCTL" ]; then msg= @@ -178,10 +178,13 @@ get_pcr10_aggregate() tst_res $res "failed to find aggregate PCR-10 $msg" tst_res TINFO "hash file:" cat hash.txt >&2 - return + return $ret fi - echo "$pcr" + lineno=$(grep -E "^($ALGORITHM )*PCR(.*10)*: succeed at entry" \ + hash.txt | tail -1 | awk '{print $NF}') + echo "$pcr $lineno" + return $ret } test1_tpm_bypass_mode() @@ -249,7 +252,9 @@ test1() test2() { - local hash pcr_aggregate out ret + local hash pcr_aggregate lineno out ret + local measurement_count="$IMA_DIR/runtime_measurements_count" + local total_measurements tst_res TINFO "verify PCR values" @@ -288,7 +293,9 @@ test2() tst_res TINFO "real PCR-10: '$hash'" get_pcr10_aggregate > tmp.txt - pcr_aggregate="$(cat tmp.txt)" + ret=$? + + pcr_aggregate="$(cat tmp.txt | awk '{print $1}')" if [ -z "$pcr_aggregate" ]; then return fi @@ -296,6 +303,14 @@ test2() if [ "$hash" = "$pcr_aggregate" ]; then tst_res TPASS "aggregate PCR value matches real PCR value" + elif [ $ret -eq 0 ]; then + lineno="$(cat tmp.txt | awk '{print $2}')" + if [ -z "$lineno" ]; then + return + fi + total_measurements=$(cat "$measurement_count") + + tst_res TPASS "aggregate PCR value matched real PCR value (line: $lineno/$total_measurements)" else tst_res TFAIL "aggregate PCR value does not match real PCR value" fi -- 2.55.0 ^ permalink raw reply related [flat|nested] 10+ messages in thread
* Re: [LTP] ima_tpm.sh: properly detect failure to verify the IMA measurement list 2026-08-26 22:29 ` Mimi Zohar (?) @ 2026-08-27 3:05 ` linuxtestproject.agent 2026-08-27 6:56 ` Andrea Cervesato via ltp -1 siblings, 1 reply; 10+ messages in thread From: linuxtestproject.agent @ 2026-08-27 3:05 UTC (permalink / raw) To: Mimi Zohar; +Cc: ltp Hi Mimi, On Wed, 26 Aug 2026, Mimi Zohar wrote: > ima_tpm.sh: properly detect failure to verify the IMA measurement list > - pcr_aggregate="$(cat tmp.txt)" > + ret=$? > + > + pcr_aggregate="$(cat tmp.txt | awk '{print $1}')" The cat here is redundant, awk can read the file directly: pcr_aggregate="$(awk '{print $1}' tmp.txt)" > + elif [ $ret -eq 0 ]; then > + lineno="$(cat tmp.txt | awk '{print $2}')" Same here: lineno="$(awk '{print $2}' tmp.txt)" > + tst_res TPASS "aggregate PCR value matched real PCR value (line: $lineno/$total_measurements)" This line is about 100 columns wide. LTP shell style asks for lines under 80 characters; perhaps wrap it or shorten the message. Verdict - Needs revision --- Note: The agent can sometimes produce false positives although often its findings are genuine. If you find issues with the review, please comment this email or ignore the suggestions. Regards, LTP AI Reviewer -- Mailing list info: https://lists.linux.it/listinfo/ltp ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [LTP] ima_tpm.sh: properly detect failure to verify the IMA measurement list 2026-08-27 3:05 ` [LTP] " linuxtestproject.agent @ 2026-08-27 6:56 ` Andrea Cervesato via ltp 2026-08-27 10:22 ` Petr Vorel 0 siblings, 1 reply; 10+ messages in thread From: Andrea Cervesato via ltp @ 2026-08-27 6:56 UTC (permalink / raw) To: linuxtestproject.agent; +Cc: ltp Hi Mimi, > > + pcr_aggregate="$(cat tmp.txt | awk '{print $1}')" > > The cat here is redundant, awk can read the file directly: > This is valid. > > + lineno="$(cat tmp.txt | awk '{print $2}')" > > Same here: > > lineno="$(awk '{print $2}' tmp.txt)" [..] > > > + tst_res TPASS "aggregate PCR value matched real PCR value (line: $lineno/$total_measurements)" > > This line is about 100 columns wide. LTP shell style asks for lines > under 80 characters; perhaps wrap it or shorten the message. we can ignore this one. @Petr can you please take a look? -- Andrea Cervesato SUSE QE Automation Engineer Linux andrea.cervesato@suse.com -- Mailing list info: https://lists.linux.it/listinfo/ltp ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [LTP] ima_tpm.sh: properly detect failure to verify the IMA measurement list 2026-08-27 6:56 ` Andrea Cervesato via ltp @ 2026-08-27 10:22 ` Petr Vorel 2026-08-27 12:59 ` Petr Vorel 2026-08-27 13:38 ` Mimi Zohar 0 siblings, 2 replies; 10+ messages in thread From: Petr Vorel @ 2026-08-27 10:22 UTC (permalink / raw) To: Andrea Cervesato; +Cc: ltp, linuxtestproject.agent Hi Mimi, Andrea, > Hi Mimi, > > > + pcr_aggregate="$(cat tmp.txt | awk '{print $1}')" > > The cat here is redundant, awk can read the file directly: > This is valid. +1, agent did a good job here :). We could even avoid using tail (awk has this feature), but let's ignore that. As it is trivial, I can change it before merge (see diff below). > > > + lineno="$(cat tmp.txt | awk '{print $2}')" > > Same here: > > lineno="$(awk '{print $2}' tmp.txt)" > [..] > > > + tst_res TPASS "aggregate PCR value matched real PCR value (line: $lineno/$total_measurements)" > > This line is about 100 columns wide. LTP shell style asks for lines > > under 80 characters; perhaps wrap it or shorten the message. > we can ignore this one. We should teach agent that splitting quotes string does more harm than slightly longer line. > @Petr can you please take a look? Sure :). FYI I already did have a brief look yesterday, and I also triggered CI jobs for v1 and wait them to finish. Of course I'll rerun them for v2. @Mimi FYI v1 patch triggers failure - it just calculate a different aggregate PCR-10. Although the commit subject is "properly detect failure" .. I'm not sure if this is a false negative or the current code on master just did not find error (false positive). As I said, I'll rerun v2 and let you know if it's the same. Testing on openSUSE Tumbleweed x86_64 VM with kernel: 7.1.8-1, virtualized TPM 2.0, evmctl 1.6.2. Working master [1], broken with your patch [2]. FYI TPM 2.0 used: swtpm socket --tpmstate dir=/tmp/mytpm25 --ctrl \ type=unixio,path=/tmp/mytpm25/swtpm-sock --log level=20 -d --tpm2 Whole QEMU command: /usr/bin/qemu-system-x86_64 -device VGA,edid=on,xres=1024,yres=768 \ -only-migratable -chardev ringbuf,id=serial0,logfile=serial0,logappend=on \ -serial chardev:serial0 -audiodev none,id=snd0 -device intel-hda -device \ hda-output,audiodev=snd0 -global isa-fdc.fdtypeA=none -m 1536 -cpu host -netdev \ user,id=qanet0 -device virtio-net,netdev=qanet0,mac=52:54:00:12:34:56 -object \ rng-random,filename=/dev/urandom,id=rng0 -device virtio-rng-pci,rng=rng0 \ -chardev socket,id=chrtpm,path=/tmp/mytpm25/swtpm-sock -tpmdev \ emulator,id=tpm0,chardev=chrtpm -device tpm-tis,tpmdev=tpm0 -boot order=c \ -device qemu-xhci -device usb-tablet -smp 1 -enable-kvm -no-shutdown -vnc \ :115,share=force-shared -device virtio-serial -chardev \ pipe,id=virtio_console,path=virtio_console,logfile=virtio_console.log,logappend=on \ -device \ virtconsole,chardev=virtio_console,name=org.openqa.console.virtio_console \ -chardev \ pipe,id=virtio_console_user,path=virtio_console_user,logfile=virtio_console_user.log,logappend=on \ -device \ virtconsole,chardev=virtio_console_user,name=org.openqa.console.virtio_console_user \ -chardev \ socket,path=qmp_socket,server=on,wait=off,id=qmp_socket,logfile=qmp_socket.log,logappend=on \ -qmp chardev:qmp_socket -S -device virtio-scsi-pci,id=scsi0 -blockdev \ driver=file,node-name=hd0-overlay0-file,filename=/var/lib/openqa/pool/25/raid/hd0-overlay0,cache.no-flush=on \ -blockdev \ driver=qcow2,node-name=hd0-overlay0,file=hd0-overlay0-file,cache.no-flush=on,discard=unmap \ -device virtio-blk,id=hd0-device,drive=hd0-overlay0,bootindex=0,serial=hd0 \ -blockdev \ driver=file,node-name=cd0-overlay0-file,filename=/var/lib/openqa/pool/25/raid/cd0-overlay0,cache.no-flush=on \ -blockdev \ driver=qcow2,node-name=cd0-overlay0,file=cd0-overlay0-file,cache.no-flush=on,discard=unmap \ -device scsi-cd,id=cd0-device,drive=cd0-overlay0,serial=cd0 Kind regards, Petr [1] https://openqa.opensuse.org/tests/6185158#step/ima_tpm/4 [2] https://openqa.opensuse.org/tests/6185106#step/ima_tpm/4 [3] https://openqa.opensuse.org/tests/6185106/file/autoinst-log.txt diff --git testcases/kernel/security/integrity/ima/tests/ima_tpm.sh testcases/kernel/security/integrity/ima/tests/ima_tpm.sh index 8bb86ea4ac..edf8699f83 100755 --- testcases/kernel/security/integrity/ima/tests/ima_tpm.sh +++ testcases/kernel/security/integrity/ima/tests/ima_tpm.sh @@ -295,7 +295,7 @@ test2() get_pcr10_aggregate > tmp.txt ret=$? - pcr_aggregate="$(cat tmp.txt | awk '{print $1}')" + pcr_aggregate="$(awk '{print $1}' tmp.txt)" if [ -z "$pcr_aggregate" ]; then return fi @@ -304,7 +304,7 @@ test2() if [ "$hash" = "$pcr_aggregate" ]; then tst_res TPASS "aggregate PCR value matches real PCR value" elif [ $ret -eq 0 ]; then - lineno="$(cat tmp.txt | awk '{print $2}')" + lineno="$(awk '{print $2}' tmp.txt)" if [ -z "$lineno" ]; then return fi -- Mailing list info: https://lists.linux.it/listinfo/ltp ^ permalink raw reply related [flat|nested] 10+ messages in thread
* Re: [LTP] ima_tpm.sh: properly detect failure to verify the IMA measurement list 2026-08-27 10:22 ` Petr Vorel @ 2026-08-27 12:59 ` Petr Vorel 2026-08-27 13:38 ` Mimi Zohar 1 sibling, 0 replies; 10+ messages in thread From: Petr Vorel @ 2026-08-27 12:59 UTC (permalink / raw) To: Andrea Cervesato, linuxtestproject.agent, Mimi Zohar, ltp Hi Mimi, ... > @Mimi FYI v1 patch triggers failure - it just calculate a different > aggregate PCR-10. Although the commit subject is "properly detect failure" .. > I'm not sure if this is a false negative or the current code on master just did > not find error (false positive). As I said, I'll rerun v2 and let you know if > it's the same. > Testing on openSUSE Tumbleweed x86_64 VM with kernel: 7.1.8-1, virtualized TPM > 2.0, evmctl 1.6.2. Working master [1], broken with your patch [2]. FYI tested on BIOS (legacy). > FYI TPM 2.0 used: > swtpm socket --tpmstate dir=/tmp/mytpm25 --ctrl \ > type=unixio,path=/tmp/mytpm25/swtpm-sock --log level=20 -d --tpm2 > Whole QEMU command: > /usr/bin/qemu-system-x86_64 -device VGA,edid=on,xres=1024,yres=768 \ > -only-migratable -chardev ringbuf,id=serial0,logfile=serial0,logappend=on \ > -serial chardev:serial0 -audiodev none,id=snd0 -device intel-hda -device \ > hda-output,audiodev=snd0 -global isa-fdc.fdtypeA=none -m 1536 -cpu host -netdev \ > user,id=qanet0 -device virtio-net,netdev=qanet0,mac=52:54:00:12:34:56 -object \ > rng-random,filename=/dev/urandom,id=rng0 -device virtio-rng-pci,rng=rng0 \ > -chardev socket,id=chrtpm,path=/tmp/mytpm25/swtpm-sock -tpmdev \ > emulator,id=tpm0,chardev=chrtpm -device tpm-tis,tpmdev=tpm0 -boot order=c \ > -device qemu-xhci -device usb-tablet -smp 1 -enable-kvm -no-shutdown -vnc \ > :115,share=force-shared -device virtio-serial -chardev \ > pipe,id=virtio_console,path=virtio_console,logfile=virtio_console.log,logappend=on \ > -device \ > virtconsole,chardev=virtio_console,name=org.openqa.console.virtio_console \ > -chardev \ > pipe,id=virtio_console_user,path=virtio_console_user,logfile=virtio_console_user.log,logappend=on \ > -device \ > virtconsole,chardev=virtio_console_user,name=org.openqa.console.virtio_console_user \ > -chardev \ > socket,path=qmp_socket,server=on,wait=off,id=qmp_socket,logfile=qmp_socket.log,logappend=on \ > -qmp chardev:qmp_socket -S -device virtio-scsi-pci,id=scsi0 -blockdev \ > driver=file,node-name=hd0-overlay0-file,filename=/var/lib/openqa/pool/25/raid/hd0-overlay0,cache.no-flush=on \ > -blockdev \ > driver=qcow2,node-name=hd0-overlay0,file=hd0-overlay0-file,cache.no-flush=on,discard=unmap \ > -device virtio-blk,id=hd0-device,drive=hd0-overlay0,bootindex=0,serial=hd0 \ > -blockdev \ > driver=file,node-name=cd0-overlay0-file,filename=/var/lib/openqa/pool/25/raid/cd0-overlay0,cache.no-flush=on \ > -blockdev \ > driver=qcow2,node-name=cd0-overlay0,file=cd0-overlay0-file,cache.no-flush=on,discard=unmap \ > -device scsi-cd,id=cd0-device,drive=cd0-overlay0,serial=cd0 > Kind regards, > Petr > [1] https://openqa.opensuse.org/tests/6185158#step/ima_tpm/4 > [2] https://openqa.opensuse.org/tests/6185106#step/ima_tpm/4 Maybe the wrapped version is easier to read https://openqa.opensuse.org/tests/6187473#step/ima_tpm/6 > [3] https://openqa.opensuse.org/tests/6185106/file/autoinst-log.txt https://openqa.opensuse.org/tests/6187580#step/ima_tpm/6 BTW tested on other VM locally (outside of openQA testing framework) with emulated TPM 2.0 I have even 2 tests failing. $ cat /sys/class/tpm/tpm*/tpm_version_major 2 $ evmctl ima_boot_aggregate -v; echo $? Failed to read TPM 1.2 PCRs (errno: No such file or directory) Using tss2-rc-decode to read PCRs. ERROR:tcti:src/tss2-tcti/tctildr-dl.c:263:tctildr_get_default() No standard TCTI could be loaded ERROR:tcti:src/tss2-tcti/tctildr.c:477:tctildr_init_context_data() Failed to instantiate TCTI ERROR:esys:src/tss2-esys/esys_context.c:71:Esys_Initialize() Initialize default tcti. ErrorCode (0x000a000a) read_tpm_banks:2208 Failed to read sha1 PCRs: (esys initialize failed: tcti:IO failure) ERROR:tcti:src/tss2-tcti/tctildr-dl.c:263:tctildr_get_default() No standard TCTI could be loaded ERROR:tcti:src/tss2-tcti/tctildr.c:477:tctildr_init_context_data() Failed to instantiate TCTI ERROR:esys:src/tss2-esys/esys_context.c:71:Esys_Initialize() Initialize default tcti. ErrorCode (0x000a000a) read_tpm_banks:2208 Failed to read sha256 PCRs: (esys initialize failed: tcti:IO failure) Failed to read any TPM PCRs errno: No such file or directory (2) 125 I need to use also --hwtpm: $ evmctl ima_boot_aggregate -v --hwtpm; echo $? Failed to read TPM 1.2 PCRs (errno: No such file or directory) Trying to read TPM 2.0 PCRs via sysfs Failed to read TPM 2.0 PCRs via sysfs (errno: No such file or directory) sha256:e911229581efb7ceb82826940c7e939d05dbc33b38862730651767ab5bd7c446 0 This is on VM BIOS (legacy) running on UEFI QEMU host. The same behaves when running this on the machine itself (in UEFI QEMU host, outside of the VM). Other, unrelated problem is that evmctl blocks on UEFI VM on UEFI QEMU host (w/a --hwtpm) without any TPM on tss2-rc, but that might be caused just by old VM, I'll retest and report if it persists. OT: it'd be nice to describe exit values in evmctl man page. Kind regards, Petr -- Mailing list info: https://lists.linux.it/listinfo/ltp ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [LTP] ima_tpm.sh: properly detect failure to verify the IMA measurement list 2026-08-27 10:22 ` Petr Vorel 2026-08-27 12:59 ` Petr Vorel @ 2026-08-27 13:38 ` Mimi Zohar 1 sibling, 0 replies; 10+ messages in thread From: Mimi Zohar @ 2026-08-27 13:38 UTC (permalink / raw) To: Petr Vorel, Andrea Cervesato; +Cc: ltp, linuxtestproject.agent Hi Andrea, Petr, Thank you for reviewing/testing/updating the v1/v2. On Thu, 2026-08-27 at 12:22 +0200, Petr Vorel wrote: > > @Petr can you please take a look? > > Sure :). FYI I already did have a brief look yesterday, and I also triggered CI > jobs for v1 and wait them to finish. Of course I'll rerun them for v2. > > @Mimi FYI v1 patch triggers failure - it just calculate a different > aggregate PCR-10. Although the commit subject is "properly detect failure" .. > I'm not sure if this is a false negative or the current code on master just did > not find error (false positive). As I said, I'll rerun v2 and let you know if > it's the same. I've been testing on real HW with a physical TPM, not in a virtual VM. Without a dont_measure policy rule to eliminate the "systemd_unit_file_t" measurements, the number of measurements grows really fast. The results of test2 looks like: ima_tpm 2 TINFO: verify PCR values ima_tpm 2 TINFO: real PCR-10: 'ea84103155e8a91974c2706db94f91e396dad3f91430648224e19f17790716d8' ima_tpm 2 TINFO: ignoring 5 violations ima_tpm 2 TINFO: aggregate PCR-10: '4608820a46bb8ad5e4d95b6f94273e76f1f12ca8c61b84d01aaed7b0fb226a74' ima_tpm 2 TPASS: aggregate PCR value matched real PCR value (line: 7147/7634) > > Testing on openSUSE Tumbleweed x86_64 VM with kernel: 7.1.8-1, virtualized TPM > 2.0, evmctl 1.6.2. Working master [1], broken with your patch [2]. Interesting that with this simple patch, test2 now fails. Mimi -- Mailing list info: https://lists.linux.it/listinfo/ltp ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [LTP] [PATCH v2] ima_tpm.sh: properly detect failure to verify the IMA measurement list 2026-08-26 22:29 ` Mimi Zohar @ 2026-09-10 19:41 ` Petr Vorel -1 siblings, 0 replies; 10+ messages in thread From: Petr Vorel @ 2026-09-10 19:41 UTC (permalink / raw) To: Mimi Zohar; +Cc: linux-integrity, ltp Hi Mimi, > test2 attempts to compare the aggregate PCR-10 value with the current > TPM PCR value based on the current measurement list, but does not take > into account that the measurement list might have grown. > evmctl returns success/failure when verifying the IMA measurement list > and displays the measurement list line number that matched. > Update test2 to check the return code, before failing the test. > Include the matched line number and total number of measurement > list records. I was not able to reproduce the failure on VM BIOS (legacy) running on UEFI QEMU host which I reported previously, therefore I merged it. Thank you! Kind regards, Petr -- Mailing list info: https://lists.linux.it/listinfo/ltp ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH v2] ima_tpm.sh: properly detect failure to verify the IMA measurement list @ 2026-09-10 19:41 ` Petr Vorel 0 siblings, 0 replies; 10+ messages in thread From: Petr Vorel @ 2026-09-10 19:41 UTC (permalink / raw) To: Mimi Zohar; +Cc: ltp, linux-integrity, Andrea Cervesato Hi Mimi, > test2 attempts to compare the aggregate PCR-10 value with the current > TPM PCR value based on the current measurement list, but does not take > into account that the measurement list might have grown. > evmctl returns success/failure when verifying the IMA measurement list > and displays the measurement list line number that matched. > Update test2 to check the return code, before failing the test. > Include the matched line number and total number of measurement > list records. I was not able to reproduce the failure on VM BIOS (legacy) running on UEFI QEMU host which I reported previously, therefore I merged it. Thank you! Kind regards, Petr ^ permalink raw reply [flat|nested] 10+ messages in thread
* [LTP] [PATCH] ima_tpm.sh: properly detect failure to verify the IMA measurement list @ 2026-08-26 0:34 Mimi Zohar 2026-08-26 1:15 ` [LTP] " linuxtestproject.agent 0 siblings, 1 reply; 10+ messages in thread From: Mimi Zohar @ 2026-08-26 0:34 UTC (permalink / raw) To: ltp; +Cc: linux-integrity test2 attempts to compare the aggregate PCR-10 value with the current TPM PCR value based on the current measurement list, but does not take into account that the measurement list might have been extended. evmctl returns success/failure when verifying the IMA measurement list and displays the measurement list line number that matched. Update test2. Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> --- .../security/integrity/ima/tests/ima_tpm.sh | 34 +++++++++++++------ 1 file changed, 23 insertions(+), 11 deletions(-) diff --git a/testcases/kernel/security/integrity/ima/tests/ima_tpm.sh b/testcases/kernel/security/integrity/ima/tests/ima_tpm.sh index acd8b6d30..5f7a5e983 100755 --- a/testcases/kernel/security/integrity/ima/tests/ima_tpm.sh +++ b/testcases/kernel/security/integrity/ima/tests/ima_tpm.sh @@ -146,7 +146,7 @@ get_pcr10_aggregate() local num_violations=0 local msg="$ERRMSG_EVMCTL" local res=TCONF - local pcr ret + local lineno pcr ret if [ -z "$MISSING_EVMCTL" ]; then msg= @@ -178,10 +178,13 @@ get_pcr10_aggregate() tst_res $res "failed to find aggregate PCR-10 $msg" tst_res TINFO "hash file:" cat hash.txt >&2 - return + return 1 fi - echo "$pcr" + lineno=$(grep -E "^($ALGORITHM )*PCR(.*10)*: succeed at entry" hash.txt | tail -1 \ + | awk '{print $NF}') + echo "$pcr $lineno" + return $ret } test1_tpm_bypass_mode() @@ -249,7 +252,9 @@ test1() test2() { - local hash pcr_aggregate out ret + local hash pcr_aggregate lineno out ret + local measurement_count="$IMA_DIR/runtime_measurements_count" + local total_measurements tst_res TINFO "verify PCR values" @@ -288,14 +293,21 @@ test2() tst_res TINFO "real PCR-10: '$hash'" get_pcr10_aggregate > tmp.txt - pcr_aggregate="$(cat tmp.txt)" - if [ -z "$pcr_aggregate" ]; then - return - fi - tst_res TINFO "aggregate PCR-10: '$pcr_aggregate'" + if [ $? -eq 0 ]; then + pcr_aggregate="$(cat tmp.txt | cut -d " " -f1)" + if [ -z "$pcr_aggregate" ]; then + return + fi + tst_res TINFO "aggregate PCR-10: '$pcr_aggregate'" - if [ "$hash" = "$pcr_aggregate" ]; then - tst_res TPASS "aggregate PCR value matches real PCR value" + lineno="$(cat tmp.txt | cut -d " " -f2)" + + if [ "$hash" = "$pcr_aggregate" ]; then + tst_res TPASS "aggregate PCR value matches real PCR value (line: $lineno)" + else + total_measurements=$(cat "$measurement_count") + tst_res TPASS "aggregate PCR value matched real PCR value (line: $lineno/$total_measurements)" + fi else tst_res TFAIL "aggregate PCR value does not match real PCR value" fi -- 2.55.0 -- Mailing list info: https://lists.linux.it/listinfo/ltp ^ permalink raw reply related [flat|nested] 10+ messages in thread
* Re: [LTP] ima_tpm.sh: properly detect failure to verify the IMA measurement list 2026-08-26 0:34 [LTP] [PATCH] " Mimi Zohar @ 2026-08-26 1:15 ` linuxtestproject.agent 0 siblings, 0 replies; 10+ messages in thread From: linuxtestproject.agent @ 2026-08-26 1:15 UTC (permalink / raw) To: Mimi Zohar; +Cc: ltp Hi Mimi, On Tue, 25 Aug 2026, Mimi Zohar wrote: > ima_tpm.sh: properly detect failure to verify the IMA measurement list > if [ -z "$pcr" ]; then > tst_res $res "failed to find aggregate PCR-10 $msg" > tst_res TINFO "hash file:" > cat hash.txt >&2 > - return > + return 1 > fi > + else > + tst_res TFAIL "aggregate PCR value does not match real PCR value" > + fi Could the helper's result classification be preserved here instead of unconditionally adding TFAIL for every nonzero return? When evmctl is older than 1.3.1 with a SHA-1 measurement list, setup allows the test to continue with MISSING_EVMCTL=1. If that evmctl does not produce a parseable aggregate, the helper reports TCONF through $res, but the new return path then also records TFAIL. Since tst_res retains both result bits, this unsupported-tool path becomes a test failure. Verdict - Needs revision --- Note: The agent can sometimes produce false positives although often its findings are genuine. If you find issues with the review, please comment this email or ignore the suggestions. Regards, LTP AI Reviewer -- Mailing list info: https://lists.linux.it/listinfo/ltp ^ permalink raw reply [flat|nested] 10+ messages in thread
end of thread, other threads:[~2026-09-10 19:42 UTC | newest] Thread overview: 10+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2026-08-26 22:29 [LTP] [PATCH v2] ima_tpm.sh: properly detect failure to verify the IMA measurement list Mimi Zohar 2026-08-26 22:29 ` Mimi Zohar 2026-08-27 3:05 ` [LTP] " linuxtestproject.agent 2026-08-27 6:56 ` Andrea Cervesato via ltp 2026-08-27 10:22 ` Petr Vorel 2026-08-27 12:59 ` Petr Vorel 2026-08-27 13:38 ` Mimi Zohar 2026-09-10 19:41 ` [LTP] [PATCH v2] " Petr Vorel 2026-09-10 19:41 ` Petr Vorel -- strict thread matches above, loose matches on Subject: below -- 2026-08-26 0:34 [LTP] [PATCH] " Mimi Zohar 2026-08-26 1:15 ` [LTP] " linuxtestproject.agent
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.