All of lore.kernel.org
 help / color / mirror / Atom feed
From: Mimi Zohar <zohar@linux.ibm.com>
To: Petr Vorel <pvorel@suse.cz>, ltp@lists.linux.it
Cc: linux-integrity@vger.kernel.org,
	Roberto Sassu <roberto.sassu@huaweicloud.com>
Subject: Re: [PATCH 2/3] ima_setup.sh: Allow to load predefined policy
Date: Wed, 11 Dec 2024 07:18:38 -0500	[thread overview]
Message-ID: <710315f59b9378d76d226e209fee698f6bc11c06.camel@linux.ibm.com> (raw)
In-Reply-To: <20241126173830.98960-3-pvorel@suse.cz>

On Tue, 2024-11-26 at 18:38 +0100, Petr Vorel wrote:
> environment variable LTP_IMA_LOAD_POLICY=1 tries to load example policy
> if available. This should be used only if tooling running LTP tests
> allows to reboot afterwards (because policy may be writable only once,
> e.g. missing CONFIG_IMA_WRITE_POLICY=y, or policies can influence each
> other).

Thanks, Petr.  Allowing the policy to be updated only if permitted is a good
idea.  Even with the LTP_IMA_LOAD_POLICY=1 environment variable, the policy
might not be loaded.  For example, when secure boot is enabled and the kernel is
configured with CONFIG_IMA_ARCH_POLICY enabled, an "appraise func=POLICY_CHECK
appraise_type=imasig" rule is loaded, requiring the IMA policy itself to be
signed.

On failure to load a policy, the ima_conditionals.sh and ima_policy.sh tests say
"TINFO: SELinux enabled in enforcing mode, this may affect test results".  We
should stop blaming SELinux. :)

thanks,

Mimi


WARNING: multiple messages have this Message-ID (diff)
From: Mimi Zohar <zohar@linux.ibm.com>
To: Petr Vorel <pvorel@suse.cz>, ltp@lists.linux.it
Cc: linux-integrity@vger.kernel.org,
	Roberto Sassu <roberto.sassu@huaweicloud.com>
Subject: Re: [LTP] [PATCH 2/3] ima_setup.sh: Allow to load predefined policy
Date: Wed, 11 Dec 2024 07:18:38 -0500	[thread overview]
Message-ID: <710315f59b9378d76d226e209fee698f6bc11c06.camel@linux.ibm.com> (raw)
In-Reply-To: <20241126173830.98960-3-pvorel@suse.cz>

On Tue, 2024-11-26 at 18:38 +0100, Petr Vorel wrote:
> environment variable LTP_IMA_LOAD_POLICY=1 tries to load example policy
> if available. This should be used only if tooling running LTP tests
> allows to reboot afterwards (because policy may be writable only once,
> e.g. missing CONFIG_IMA_WRITE_POLICY=y, or policies can influence each
> other).

Thanks, Petr.  Allowing the policy to be updated only if permitted is a good
idea.  Even with the LTP_IMA_LOAD_POLICY=1 environment variable, the policy
might not be loaded.  For example, when secure boot is enabled and the kernel is
configured with CONFIG_IMA_ARCH_POLICY enabled, an "appraise func=POLICY_CHECK
appraise_type=imasig" rule is loaded, requiring the IMA policy itself to be
signed.

On failure to load a policy, the ima_conditionals.sh and ima_policy.sh tests say
"TINFO: SELinux enabled in enforcing mode, this may affect test results".  We
should stop blaming SELinux. :)

thanks,

Mimi


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

  parent reply	other threads:[~2024-12-11 12:18 UTC|newest]

Thread overview: 26+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-11-26 17:38 [PATCH 0/3] LTP tests: load predefined policy Petr Vorel
2024-11-26 17:38 ` [LTP] " Petr Vorel
2024-11-26 17:38 ` [PATCH 1/3] ima: Add TCB policy as an example Petr Vorel
2024-11-26 17:38   ` [LTP] " Petr Vorel
2024-12-11 12:26   ` Mimi Zohar
2024-12-11 12:26     ` [LTP] " Mimi Zohar
2024-12-12  8:55     ` Petr Vorel
2024-12-12  8:55       ` [LTP] " Petr Vorel
2024-11-26 17:38 ` [PATCH 2/3] ima_setup.sh: Allow to load predefined policy Petr Vorel
2024-11-26 17:38   ` [LTP] " Petr Vorel
2024-11-26 22:09   ` Petr Vorel
2024-11-26 22:09     ` [LTP] " Petr Vorel
2024-12-11 12:18   ` Mimi Zohar [this message]
2024-12-11 12:18     ` Mimi Zohar
2024-12-11 19:48     ` Petr Vorel
2024-12-11 19:48       ` [LTP] " Petr Vorel
2024-12-12 14:29       ` Mimi Zohar
2024-12-12 14:29         ` [LTP] " Mimi Zohar
2024-12-12 15:11         ` Petr Vorel
2024-12-12 15:11           ` [LTP] " Petr Vorel
2024-11-26 17:38 ` [PATCH 3/3] ima_{kexec,keys,selinux}: Set minimal kernel version Petr Vorel
2024-11-26 17:38   ` [LTP] [PATCH 3/3] ima_{kexec, keys, selinux}: " Petr Vorel
2024-12-11 12:36   ` [PATCH 3/3] ima_{kexec,keys,selinux}: " Mimi Zohar
2024-12-11 12:36     ` [LTP] [PATCH 3/3] ima_{kexec, keys, selinux}: " Mimi Zohar
2024-12-12  8:30     ` [PATCH 3/3] ima_{kexec,keys,selinux}: " Petr Vorel
2024-12-12  8:30       ` [LTP] [PATCH 3/3] ima_{kexec, keys, selinux}: " Petr Vorel

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=710315f59b9378d76d226e209fee698f6bc11c06.camel@linux.ibm.com \
    --to=zohar@linux.ibm.com \
    --cc=linux-integrity@vger.kernel.org \
    --cc=ltp@lists.linux.it \
    --cc=pvorel@suse.cz \
    --cc=roberto.sassu@huaweicloud.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.