[PATCH v4 0/4] tst_runas.c, ima_{conditionals, measurements}.sh enhancements

All of lore.kernel.org
 help / color / mirror / Atom feed

* [PATCH v4 0/4] tst_runas.c, ima_{conditionals, measurements}.sh enhancements
@ 2025-12-09 18:55 ` Petr Vorel
  0 siblings, 0 replies; 23+ messages in thread
From: Petr Vorel @ 2025-12-09 18:55 UTC (permalink / raw)
  To: ltp
  Cc: Petr Vorel, Mimi Zohar, linux-integrity, selinux, Cyril Hrubis,
	Jan Stancek, Li Wang

v3->v4:
Rename tst_sudo.c => tst_runas.c (Li, Cyril)

Link to v3:
https://lore.kernel.org/ltp/20251127082638.224110-1-pvorel@suse.cz/T/#t
https://patchwork.ozlabs.org/project/ltp/list/?series=483681&state=*

Kind regards,
Petr

Petr Vorel (4):
  shell: Add tst_runas.c helper
  tst_test.sh: Add TST_USR_{G,U}ID variables
  ima_{conditionals,measurements}.sh: Use tst_runas
  ima_conditionals.sh: Split test by request

 doc/users/setup_tests.rst                     |  4 +
 runtest/ima                                   |  5 +-
 .../integrity/ima/tests/ima_conditionals.sh   | 78 +++++++++++--------
 .../integrity/ima/tests/ima_measurements.sh   | 11 +--
 testcases/lib/.gitignore                      |  1 +
 testcases/lib/Makefile                        |  2 +-
 testcases/lib/tst_runas.c                     | 51 ++++++++++++
 testcases/lib/tst_test.sh                     |  6 +-
 8 files changed, 115 insertions(+), 43 deletions(-)
 create mode 100644 testcases/lib/tst_runas.c

-- 
2.51.0


^ permalink raw reply	[flat|nested] 23+ messages in thread

* [LTP] [PATCH v4 0/4] tst_runas.c, ima_{conditionals, measurements}.sh enhancements
@ 2025-12-09 18:55 ` Petr Vorel
  0 siblings, 0 replies; 23+ messages in thread
From: Petr Vorel @ 2025-12-09 18:55 UTC (permalink / raw)
  To: ltp; +Cc: selinux, linux-integrity

v3->v4:
Rename tst_sudo.c => tst_runas.c (Li, Cyril)

Link to v3:
https://lore.kernel.org/ltp/20251127082638.224110-1-pvorel@suse.cz/T/#t
https://patchwork.ozlabs.org/project/ltp/list/?series=483681&state=*

Kind regards,
Petr

Petr Vorel (4):
  shell: Add tst_runas.c helper
  tst_test.sh: Add TST_USR_{G,U}ID variables
  ima_{conditionals,measurements}.sh: Use tst_runas
  ima_conditionals.sh: Split test by request

 doc/users/setup_tests.rst                     |  4 +
 runtest/ima                                   |  5 +-
 .../integrity/ima/tests/ima_conditionals.sh   | 78 +++++++++++--------
 .../integrity/ima/tests/ima_measurements.sh   | 11 +--
 testcases/lib/.gitignore                      |  1 +
 testcases/lib/Makefile                        |  2 +-
 testcases/lib/tst_runas.c                     | 51 ++++++++++++
 testcases/lib/tst_test.sh                     |  6 +-
 8 files changed, 115 insertions(+), 43 deletions(-)
 create mode 100644 testcases/lib/tst_runas.c

-- 
2.51.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

^ permalink raw reply	[flat|nested] 23+ messages in thread

* [PATCH v4 1/4] shell: Add tst_runas.c helper
  2025-12-09 18:55 ` [LTP] " Petr Vorel
@ 2025-12-09 18:55   ` Petr Vorel
  -1 siblings, 0 replies; 23+ messages in thread
From: Petr Vorel @ 2025-12-09 18:55 UTC (permalink / raw)
  To: ltp
  Cc: Petr Vorel, Mimi Zohar, linux-integrity, selinux, Cyril Hrubis,
	Jan Stancek, Li Wang

It will be used in LTP IMA tests. Not only it removes external
dependency, but also fixes problem when 'nobody' user is not possible to
use due using /usr/sbin/nologin shell.

Suggested-by: Jan Stancek <jstancek@redhat.com>
Signed-off-by: Petr Vorel <pvorel@suse.cz>
---
 doc/users/setup_tests.rst |  4 ++++
 testcases/lib/.gitignore  |  1 +
 testcases/lib/Makefile    |  2 +-
 testcases/lib/tst_runas.c | 50 +++++++++++++++++++++++++++++++++++++++
 4 files changed, 56 insertions(+), 1 deletion(-)
 create mode 100644 testcases/lib/tst_runas.c

diff --git a/doc/users/setup_tests.rst b/doc/users/setup_tests.rst
index 38976f3b0a..e3608127e4 100644
--- a/doc/users/setup_tests.rst
+++ b/doc/users/setup_tests.rst
@@ -71,6 +71,10 @@ users.
    * - LTP_IMA_LOAD_POLICY
      - Load IMA example policy, see :master:`testcases/kernel/security/integrity/ima/README.md`.
 
+   * - LTP_USR_UID, LTP_USR_GID
+     - Set UID and GID of ``nobody`` user for :doc:`../developers/api_shell_tests`,
+       see :master:`testcases/lib/tst_runas.c`.
+
    * - LTP_VIRT_OVERRIDE
      - Overrides virtual machine detection in the test library. Setting it to
        empty string, tells the library that system is not a virtual machine.
diff --git a/testcases/lib/.gitignore b/testcases/lib/.gitignore
index 19d7c67bbe..c379cd5ac4 100644
--- a/testcases/lib/.gitignore
+++ b/testcases/lib/.gitignore
@@ -26,3 +26,4 @@
 /tst_res_
 /tst_run_shell
 /tst_remaining_runtime
+/tst_runas
diff --git a/testcases/lib/Makefile b/testcases/lib/Makefile
index 2309a42a3d..e2461924a7 100644
--- a/testcases/lib/Makefile
+++ b/testcases/lib/Makefile
@@ -17,6 +17,6 @@ MAKE_TARGETS		:= tst_sleep tst_random tst_checkpoint tst_rod tst_kvcmp\
 			   tst_get_median tst_hexdump tst_get_free_pids tst_timeout_kill\
 			   tst_check_kconfigs tst_cgctl tst_fsfreeze tst_ns_create tst_ns_exec\
 			   tst_ns_ifmove tst_lockdown_enabled tst_secureboot_enabled tst_res_\
-			   tst_run_shell tst_remaining_runtime
+			   tst_run_shell tst_remaining_runtime tst_runas
 
 include $(top_srcdir)/include/mk/generic_trunk_target.mk
diff --git a/testcases/lib/tst_runas.c b/testcases/lib/tst_runas.c
new file mode 100644
index 0000000000..e8d5d8dd9d
--- /dev/null
+++ b/testcases/lib/tst_runas.c
@@ -0,0 +1,50 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Copyright (c) 2025 Petr Vorel <pvorel@suse.cz>
+ */
+
+#define LTP_USR_UID 65534
+#define LTP_USR_GID 65534
+
+#define TST_NO_DEFAULT_MAIN
+#include "tst_test.h"
+
+static void print_help(void)
+{
+	fprintf(stderr, "Usage: %s cmd [args] ...\n", __FILE__);
+	fprintf(stderr, "Usage: %s cmd [-h] print help\n\n", __FILE__);
+
+	fprintf(stderr, "Environment Variables\n");
+	fprintf(stderr, "LTP_USR_UID: UID of 'nobody' user, defaults %d\n",
+			LTP_USR_UID);
+	fprintf(stderr, "LTP_USR_GID: GID of 'nobody' user, defaults %d\n",
+			LTP_USR_GID);
+}
+
+int main(int argc, char *argv[])
+{
+	if (argc < 2 || !strcmp(argv[1], "-h")) {
+		print_help();
+		return 1;
+	}
+
+	unsigned uid = LTP_USR_UID, gid = LTP_USR_GID;
+
+	char *uid_env = getenv(TST_TO_STR_(LTP_USR_UID));
+	char *gid_env = getenv(TST_TO_STR_(LTP_USR_GID));
+
+	if (uid_env)
+		uid = SAFE_STRTOL(uid_env, 1, INT_MAX);
+
+	if (gid_env)
+		gid = SAFE_STRTOL(gid_env, 1, INT_MAX);
+
+	tst_res(TINFO, "UID: %d, GID: %d", uid, gid);
+	SAFE_SETGROUPS(0, NULL);
+	SAFE_SETRESGID(gid, gid, gid);
+	SAFE_SETRESUID(uid, uid, uid);
+
+	SAFE_CMD((const char * const *)&argv[1], NULL, NULL);
+
+	return 0;
+}
-- 
2.51.0


^ permalink raw reply related	[flat|nested] 23+ messages in thread

* [LTP] [PATCH v4 1/4] shell: Add tst_runas.c helper
@ 2025-12-09 18:55   ` Petr Vorel
  0 siblings, 0 replies; 23+ messages in thread
From: Petr Vorel @ 2025-12-09 18:55 UTC (permalink / raw)
  To: ltp; +Cc: selinux, linux-integrity

It will be used in LTP IMA tests. Not only it removes external
dependency, but also fixes problem when 'nobody' user is not possible to
use due using /usr/sbin/nologin shell.

Suggested-by: Jan Stancek <jstancek@redhat.com>
Signed-off-by: Petr Vorel <pvorel@suse.cz>
---
 doc/users/setup_tests.rst |  4 ++++
 testcases/lib/.gitignore  |  1 +
 testcases/lib/Makefile    |  2 +-
 testcases/lib/tst_runas.c | 50 +++++++++++++++++++++++++++++++++++++++
 4 files changed, 56 insertions(+), 1 deletion(-)
 create mode 100644 testcases/lib/tst_runas.c

diff --git a/doc/users/setup_tests.rst b/doc/users/setup_tests.rst
index 38976f3b0a..e3608127e4 100644
--- a/doc/users/setup_tests.rst
+++ b/doc/users/setup_tests.rst
@@ -71,6 +71,10 @@ users.
    * - LTP_IMA_LOAD_POLICY
      - Load IMA example policy, see :master:`testcases/kernel/security/integrity/ima/README.md`.
 
+   * - LTP_USR_UID, LTP_USR_GID
+     - Set UID and GID of ``nobody`` user for :doc:`../developers/api_shell_tests`,
+       see :master:`testcases/lib/tst_runas.c`.
+
    * - LTP_VIRT_OVERRIDE
      - Overrides virtual machine detection in the test library. Setting it to
        empty string, tells the library that system is not a virtual machine.
diff --git a/testcases/lib/.gitignore b/testcases/lib/.gitignore
index 19d7c67bbe..c379cd5ac4 100644
--- a/testcases/lib/.gitignore
+++ b/testcases/lib/.gitignore
@@ -26,3 +26,4 @@
 /tst_res_
 /tst_run_shell
 /tst_remaining_runtime
+/tst_runas
diff --git a/testcases/lib/Makefile b/testcases/lib/Makefile
index 2309a42a3d..e2461924a7 100644
--- a/testcases/lib/Makefile
+++ b/testcases/lib/Makefile
@@ -17,6 +17,6 @@ MAKE_TARGETS		:= tst_sleep tst_random tst_checkpoint tst_rod tst_kvcmp\
 			   tst_get_median tst_hexdump tst_get_free_pids tst_timeout_kill\
 			   tst_check_kconfigs tst_cgctl tst_fsfreeze tst_ns_create tst_ns_exec\
 			   tst_ns_ifmove tst_lockdown_enabled tst_secureboot_enabled tst_res_\
-			   tst_run_shell tst_remaining_runtime
+			   tst_run_shell tst_remaining_runtime tst_runas
 
 include $(top_srcdir)/include/mk/generic_trunk_target.mk
diff --git a/testcases/lib/tst_runas.c b/testcases/lib/tst_runas.c
new file mode 100644
index 0000000000..e8d5d8dd9d
--- /dev/null
+++ b/testcases/lib/tst_runas.c
@@ -0,0 +1,50 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Copyright (c) 2025 Petr Vorel <pvorel@suse.cz>
+ */
+
+#define LTP_USR_UID 65534
+#define LTP_USR_GID 65534
+
+#define TST_NO_DEFAULT_MAIN
+#include "tst_test.h"
+
+static void print_help(void)
+{
+	fprintf(stderr, "Usage: %s cmd [args] ...\n", __FILE__);
+	fprintf(stderr, "Usage: %s cmd [-h] print help\n\n", __FILE__);
+
+	fprintf(stderr, "Environment Variables\n");
+	fprintf(stderr, "LTP_USR_UID: UID of 'nobody' user, defaults %d\n",
+			LTP_USR_UID);
+	fprintf(stderr, "LTP_USR_GID: GID of 'nobody' user, defaults %d\n",
+			LTP_USR_GID);
+}
+
+int main(int argc, char *argv[])
+{
+	if (argc < 2 || !strcmp(argv[1], "-h")) {
+		print_help();
+		return 1;
+	}
+
+	unsigned uid = LTP_USR_UID, gid = LTP_USR_GID;
+
+	char *uid_env = getenv(TST_TO_STR_(LTP_USR_UID));
+	char *gid_env = getenv(TST_TO_STR_(LTP_USR_GID));
+
+	if (uid_env)
+		uid = SAFE_STRTOL(uid_env, 1, INT_MAX);
+
+	if (gid_env)
+		gid = SAFE_STRTOL(gid_env, 1, INT_MAX);
+
+	tst_res(TINFO, "UID: %d, GID: %d", uid, gid);
+	SAFE_SETGROUPS(0, NULL);
+	SAFE_SETRESGID(gid, gid, gid);
+	SAFE_SETRESUID(uid, uid, uid);
+
+	SAFE_CMD((const char * const *)&argv[1], NULL, NULL);
+
+	return 0;
+}
-- 
2.51.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

^ permalink raw reply related	[flat|nested] 23+ messages in thread

* Re: [LTP] [PATCH v4 1/4] shell: Add tst_runas.c helper
  2025-12-09 18:55   ` [LTP] " Petr Vorel
  (?)
@ 2025-12-15  6:57   ` Li Wang via ltp
  2025-12-17 15:13       ` [LTP] " Cyril Hrubis
  -1 siblings, 1 reply; 23+ messages in thread
From: Li Wang via ltp @ 2025-12-15  6:57 UTC (permalink / raw)
  To: Petr Vorel; +Cc: selinux, linux-integrity, ltp

Hi Petr,

Petr Vorel <pvorel@suse.cz> wrote:


> +++ b/testcases/lib/tst_runas.c
> @@ -0,0 +1,50 @@
> +// SPDX-License-Identifier: GPL-2.0-or-later
> +/*
> + * Copyright (c) 2025 Petr Vorel <pvorel@suse.cz>
> + */
> +
> +#define LTP_USR_UID 65534
> +#define LTP_USR_GID 65534
> +
> +#define TST_NO_DEFAULT_MAIN
> +#include "tst_test.h"
> +
> +static void print_help(void)
> +{
> +       fprintf(stderr, "Usage: %s cmd [args] ...\n", __FILE__);
> +       fprintf(stderr, "Usage: %s cmd [-h] print help\n\n", __FILE__);
> +
> +       fprintf(stderr, "Environment Variables\n");
> +       fprintf(stderr, "LTP_USR_UID: UID of 'nobody' user, defaults %d\n",
> +                       LTP_USR_UID);
> +       fprintf(stderr, "LTP_USR_GID: GID of 'nobody' user, defaults %d\n",
> +                       LTP_USR_GID);
> +}
> +
> +int main(int argc, char *argv[])
> +{
> +       if (argc < 2 || !strcmp(argv[1], "-h")) {
> +               print_help();
> +               return 1;
> +       }
> +
> +       unsigned uid = LTP_USR_UID, gid = LTP_USR_GID;
> +
>



> +       char *uid_env = getenv(TST_TO_STR_(LTP_USR_UID));
> +       char *gid_env = getenv(TST_TO_STR_(LTP_USR_GID));
>


So far this format is correct.

But as I pointed in the last thread, here using TST_TO_STR_ might be a
potential
issue if someday we make changes on that to become two-level macro.
It likely to interpreted as  getenv("65534");

So on the safe side, I’d still recommend writing it explicitly:

    char *uid_env = getenv("LTP_USR_UID");
    char *gid_env = getenv("LTP_USR_GID");


The rest whole patch set looks good:

Reviewed-by: Li Wang <liwang@redhat.com>


-- 
Regards,
Li Wang

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

^ permalink raw reply	[flat|nested] 23+ messages in thread

* Re: [PATCH v4 1/4] shell: Add tst_runas.c helper
  2025-12-15  6:57   ` Li Wang via ltp
@ 2025-12-17 15:13       ` Cyril Hrubis
  0 siblings, 0 replies; 23+ messages in thread
From: Cyril Hrubis @ 2025-12-17 15:13 UTC (permalink / raw)
  To: Li Wang; +Cc: Petr Vorel, ltp, Mimi Zohar, linux-integrity, selinux,
	Jan Stancek

Jo!
> > +       char *uid_env = getenv(TST_TO_STR_(LTP_USR_UID));
> > +       char *gid_env = getenv(TST_TO_STR_(LTP_USR_GID));
> >
> 
> 
> So far this format is correct.
> 
> But as I pointed in the last thread, here using TST_TO_STR_ might be a
> potential
> issue if someday we make changes on that to become two-level macro.
> It likely to interpreted as  getenv("65534");
> 
> So on the safe side, I’d still recommend writing it explicitly:
> 
>     char *uid_env = getenv("LTP_USR_UID");
>     char *gid_env = getenv("LTP_USR_GID");

+1

> The rest whole patch set looks good:
> 
> Reviewed-by: Li Wang <liwang@redhat.com>

For the rest also from me:

Reviewed-by: Cyril Hrubis <chrubis@suse.cz>

-- 
Cyril Hrubis
chrubis@suse.cz

^ permalink raw reply	[flat|nested] 23+ messages in thread

* Re: [LTP] [PATCH v4 1/4] shell: Add tst_runas.c helper
@ 2025-12-17 15:13       ` Cyril Hrubis
  0 siblings, 0 replies; 23+ messages in thread
From: Cyril Hrubis @ 2025-12-17 15:13 UTC (permalink / raw)
  To: Li Wang; +Cc: selinux, linux-integrity, ltp

Jo!
> > +       char *uid_env = getenv(TST_TO_STR_(LTP_USR_UID));
> > +       char *gid_env = getenv(TST_TO_STR_(LTP_USR_GID));
> >
> 
> 
> So far this format is correct.
> 
> But as I pointed in the last thread, here using TST_TO_STR_ might be a
> potential
> issue if someday we make changes on that to become two-level macro.
> It likely to interpreted as  getenv("65534");
> 
> So on the safe side, I’d still recommend writing it explicitly:
> 
>     char *uid_env = getenv("LTP_USR_UID");
>     char *gid_env = getenv("LTP_USR_GID");

+1

> The rest whole patch set looks good:
> 
> Reviewed-by: Li Wang <liwang@redhat.com>

For the rest also from me:

Reviewed-by: Cyril Hrubis <chrubis@suse.cz>

-- 
Cyril Hrubis
chrubis@suse.cz

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

^ permalink raw reply	[flat|nested] 23+ messages in thread

* Re: [PATCH v4 1/4] shell: Add tst_runas.c helper
  2025-12-17 15:13       ` [LTP] " Cyril Hrubis
@ 2025-12-17 15:57         ` Petr Vorel
  -1 siblings, 0 replies; 23+ messages in thread
From: Petr Vorel @ 2025-12-17 15:57 UTC (permalink / raw)
  To: Cyril Hrubis
  Cc: Li Wang, ltp, Mimi Zohar, linux-integrity, selinux, Jan Stancek

> Jo!
:)
> > > +       char *uid_env = getenv(TST_TO_STR_(LTP_USR_UID));
> > > +       char *gid_env = getenv(TST_TO_STR_(LTP_USR_GID));

> > So far this format is correct.

> > But as I pointed in the last thread, here using TST_TO_STR_ might be a
> > potential
I'm sorry to overlook this.

> > issue if someday we make changes on that to become two-level macro.
> > It likely to interpreted as  getenv("65534");

> > So on the safe side, I’d still recommend writing it explicitly:

> >     char *uid_env = getenv("LTP_USR_UID");
> >     char *gid_env = getenv("LTP_USR_GID");

> +1

The reason I used the macro is that I prefer to use constants instead of a plain
text (also danger of typo). But changed to your proposal and merged whole
patchset.

Thanks all for your review.

Kind regards,
Petr

> > The rest whole patch set looks good:

> > Reviewed-by: Li Wang <liwang@redhat.com>

> For the rest also from me:

> Reviewed-by: Cyril Hrubis <chrubis@suse.cz>

^ permalink raw reply	[flat|nested] 23+ messages in thread

* Re: [LTP] [PATCH v4 1/4] shell: Add tst_runas.c helper
@ 2025-12-17 15:57         ` Petr Vorel
  0 siblings, 0 replies; 23+ messages in thread
From: Petr Vorel @ 2025-12-17 15:57 UTC (permalink / raw)
  To: Cyril Hrubis; +Cc: selinux, linux-integrity, ltp

> Jo!
:)
> > > +       char *uid_env = getenv(TST_TO_STR_(LTP_USR_UID));
> > > +       char *gid_env = getenv(TST_TO_STR_(LTP_USR_GID));

> > So far this format is correct.

> > But as I pointed in the last thread, here using TST_TO_STR_ might be a
> > potential
I'm sorry to overlook this.

> > issue if someday we make changes on that to become two-level macro.
> > It likely to interpreted as  getenv("65534");

> > So on the safe side, I’d still recommend writing it explicitly:

> >     char *uid_env = getenv("LTP_USR_UID");
> >     char *gid_env = getenv("LTP_USR_GID");

> +1

The reason I used the macro is that I prefer to use constants instead of a plain
text (also danger of typo). But changed to your proposal and merged whole
patchset.

Thanks all for your review.

Kind regards,
Petr

> > The rest whole patch set looks good:

> > Reviewed-by: Li Wang <liwang@redhat.com>

> For the rest also from me:

> Reviewed-by: Cyril Hrubis <chrubis@suse.cz>

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

^ permalink raw reply	[flat|nested] 23+ messages in thread

* [PATCH v4 2/4] tst_test.sh: Add TST_USR_{G,U}ID variables
  2025-12-09 18:55 ` [LTP] " Petr Vorel
@ 2025-12-09 18:55   ` Petr Vorel
  -1 siblings, 0 replies; 23+ messages in thread
From: Petr Vorel @ 2025-12-09 18:55 UTC (permalink / raw)
  To: ltp
  Cc: Petr Vorel, Mimi Zohar, linux-integrity, selinux, Cyril Hrubis,
	Jan Stancek, Li Wang

Add TST_USR_{G,U}ID variables with the default values from tst_runas.c.

These can be used as a default values for tests which use tst_runas and
need to know UID/GID for other commands.

It will be used in LTP IMA tests.

Signed-off-by: Petr Vorel <pvorel@suse.cz>
---
 testcases/lib/tst_runas.c | 1 +
 testcases/lib/tst_test.sh | 6 +++++-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/testcases/lib/tst_runas.c b/testcases/lib/tst_runas.c
index e8d5d8dd9d..e937828273 100644
--- a/testcases/lib/tst_runas.c
+++ b/testcases/lib/tst_runas.c
@@ -3,6 +3,7 @@
  * Copyright (c) 2025 Petr Vorel <pvorel@suse.cz>
  */
 
+/* update also tst_test.sh */
 #define LTP_USR_UID 65534
 #define LTP_USR_GID 65534
 
diff --git a/testcases/lib/tst_test.sh b/testcases/lib/tst_test.sh
index 4be10a4f94..26e6a86dcb 100644
--- a/testcases/lib/tst_test.sh
+++ b/testcases/lib/tst_test.sh
@@ -17,6 +17,10 @@ export TST_ITERATIONS=1
 export TST_TMPDIR_RHOST=0
 export TST_LIB_LOADED=1
 
+# see testcases/lib/tst_runas.c
+export TST_USR_UID="${LTP_USR_UID:-65534}"
+export TST_USR_GID="${LTP_USR_GID:-65534}"
+
 . tst_ansi_color.sh
 . tst_security.sh
 
@@ -689,7 +693,7 @@ tst_run()
 			CHECKPOINT_WAKE2|CHECKPOINT_WAKE_AND_WAIT);;
 			DEV_EXTRA_OPTS|DEV_FS_OPTS|FORMAT_DEVICE|MOUNT_DEVICE);;
 			SKIP_FILESYSTEMS|SKIP_IN_LOCKDOWN|SKIP_IN_SECUREBOOT);;
-			DEVICE_SIZE);;
+			DEVICE_SIZE|USR_UID|USR_GID);;
 			*) tst_res TWARN "Reserved variable TST_$_tst_i used!";;
 			esac
 		done
-- 
2.51.0


^ permalink raw reply related	[flat|nested] 23+ messages in thread

* [LTP] [PATCH v4 2/4] tst_test.sh: Add TST_USR_{G,U}ID variables
@ 2025-12-09 18:55   ` Petr Vorel
  0 siblings, 0 replies; 23+ messages in thread
From: Petr Vorel @ 2025-12-09 18:55 UTC (permalink / raw)
  To: ltp; +Cc: selinux, linux-integrity

Add TST_USR_{G,U}ID variables with the default values from tst_runas.c.

These can be used as a default values for tests which use tst_runas and
need to know UID/GID for other commands.

It will be used in LTP IMA tests.

Signed-off-by: Petr Vorel <pvorel@suse.cz>
---
 testcases/lib/tst_runas.c | 1 +
 testcases/lib/tst_test.sh | 6 +++++-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/testcases/lib/tst_runas.c b/testcases/lib/tst_runas.c
index e8d5d8dd9d..e937828273 100644
--- a/testcases/lib/tst_runas.c
+++ b/testcases/lib/tst_runas.c
@@ -3,6 +3,7 @@
  * Copyright (c) 2025 Petr Vorel <pvorel@suse.cz>
  */
 
+/* update also tst_test.sh */
 #define LTP_USR_UID 65534
 #define LTP_USR_GID 65534
 
diff --git a/testcases/lib/tst_test.sh b/testcases/lib/tst_test.sh
index 4be10a4f94..26e6a86dcb 100644
--- a/testcases/lib/tst_test.sh
+++ b/testcases/lib/tst_test.sh
@@ -17,6 +17,10 @@ export TST_ITERATIONS=1
 export TST_TMPDIR_RHOST=0
 export TST_LIB_LOADED=1
 
+# see testcases/lib/tst_runas.c
+export TST_USR_UID="${LTP_USR_UID:-65534}"
+export TST_USR_GID="${LTP_USR_GID:-65534}"
+
 . tst_ansi_color.sh
 . tst_security.sh
 
@@ -689,7 +693,7 @@ tst_run()
 			CHECKPOINT_WAKE2|CHECKPOINT_WAKE_AND_WAIT);;
 			DEV_EXTRA_OPTS|DEV_FS_OPTS|FORMAT_DEVICE|MOUNT_DEVICE);;
 			SKIP_FILESYSTEMS|SKIP_IN_LOCKDOWN|SKIP_IN_SECUREBOOT);;
-			DEVICE_SIZE);;
+			DEVICE_SIZE|USR_UID|USR_GID);;
 			*) tst_res TWARN "Reserved variable TST_$_tst_i used!";;
 			esac
 		done
-- 
2.51.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

^ permalink raw reply related	[flat|nested] 23+ messages in thread

* Re: [PATCH v4 2/4] tst_test.sh: Add TST_USR_{G,U}ID variables
  2025-12-09 18:55   ` [LTP] " Petr Vorel
@ 2025-12-17 15:47     ` Cyril Hrubis
  -1 siblings, 0 replies; 23+ messages in thread
From: Cyril Hrubis @ 2025-12-17 15:47 UTC (permalink / raw)
  To: Petr Vorel
  Cc: ltp, Mimi Zohar, linux-integrity, selinux, Jan Stancek, Li Wang

Hi!
> Add TST_USR_{G,U}ID variables with the default values from tst_runas.c.
> 
> These can be used as a default values for tests which use tst_runas and
> need to know UID/GID for other commands.
> 
> It will be used in LTP IMA tests.
> 
> Signed-off-by: Petr Vorel <pvorel@suse.cz>
> ---
>  testcases/lib/tst_runas.c | 1 +
>  testcases/lib/tst_test.sh | 6 +++++-
>  2 files changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/testcases/lib/tst_runas.c b/testcases/lib/tst_runas.c
> index e8d5d8dd9d..e937828273 100644
> --- a/testcases/lib/tst_runas.c
> +++ b/testcases/lib/tst_runas.c
> @@ -3,6 +3,7 @@
>   * Copyright (c) 2025 Petr Vorel <pvorel@suse.cz>
>   */
>  
> +/* update also tst_test.sh */
>  #define LTP_USR_UID 65534
>  #define LTP_USR_GID 65534
>  
> diff --git a/testcases/lib/tst_test.sh b/testcases/lib/tst_test.sh
> index 4be10a4f94..26e6a86dcb 100644
> --- a/testcases/lib/tst_test.sh
> +++ b/testcases/lib/tst_test.sh
> @@ -17,6 +17,10 @@ export TST_ITERATIONS=1
>  export TST_TMPDIR_RHOST=0
>  export TST_LIB_LOADED=1
>  
> +# see testcases/lib/tst_runas.c
> +export TST_USR_UID="${LTP_USR_UID:-65534}"
> +export TST_USR_GID="${LTP_USR_GID:-65534}"

Do we need this? We already have the default values in the C code...

>  . tst_ansi_color.sh
>  . tst_security.sh
>  
> @@ -689,7 +693,7 @@ tst_run()
>  			CHECKPOINT_WAKE2|CHECKPOINT_WAKE_AND_WAIT);;
>  			DEV_EXTRA_OPTS|DEV_FS_OPTS|FORMAT_DEVICE|MOUNT_DEVICE);;
>  			SKIP_FILESYSTEMS|SKIP_IN_LOCKDOWN|SKIP_IN_SECUREBOOT);;
> -			DEVICE_SIZE);;
> +			DEVICE_SIZE|USR_UID|USR_GID);;
>  			*) tst_res TWARN "Reserved variable TST_$_tst_i used!";;
>  			esac
>  		done
> -- 
> 2.51.0
> 

-- 
Cyril Hrubis
chrubis@suse.cz

^ permalink raw reply	[flat|nested] 23+ messages in thread

* Re: [LTP] [PATCH v4 2/4] tst_test.sh: Add TST_USR_{G, U}ID variables
@ 2025-12-17 15:47     ` Cyril Hrubis
  0 siblings, 0 replies; 23+ messages in thread
From: Cyril Hrubis @ 2025-12-17 15:47 UTC (permalink / raw)
  To: Petr Vorel; +Cc: selinux, linux-integrity, ltp

Hi!
> Add TST_USR_{G,U}ID variables with the default values from tst_runas.c.
> 
> These can be used as a default values for tests which use tst_runas and
> need to know UID/GID for other commands.
> 
> It will be used in LTP IMA tests.
> 
> Signed-off-by: Petr Vorel <pvorel@suse.cz>
> ---
>  testcases/lib/tst_runas.c | 1 +
>  testcases/lib/tst_test.sh | 6 +++++-
>  2 files changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/testcases/lib/tst_runas.c b/testcases/lib/tst_runas.c
> index e8d5d8dd9d..e937828273 100644
> --- a/testcases/lib/tst_runas.c
> +++ b/testcases/lib/tst_runas.c
> @@ -3,6 +3,7 @@
>   * Copyright (c) 2025 Petr Vorel <pvorel@suse.cz>
>   */
>  
> +/* update also tst_test.sh */
>  #define LTP_USR_UID 65534
>  #define LTP_USR_GID 65534
>  
> diff --git a/testcases/lib/tst_test.sh b/testcases/lib/tst_test.sh
> index 4be10a4f94..26e6a86dcb 100644
> --- a/testcases/lib/tst_test.sh
> +++ b/testcases/lib/tst_test.sh
> @@ -17,6 +17,10 @@ export TST_ITERATIONS=1
>  export TST_TMPDIR_RHOST=0
>  export TST_LIB_LOADED=1
>  
> +# see testcases/lib/tst_runas.c
> +export TST_USR_UID="${LTP_USR_UID:-65534}"
> +export TST_USR_GID="${LTP_USR_GID:-65534}"

Do we need this? We already have the default values in the C code...

>  . tst_ansi_color.sh
>  . tst_security.sh
>  
> @@ -689,7 +693,7 @@ tst_run()
>  			CHECKPOINT_WAKE2|CHECKPOINT_WAKE_AND_WAIT);;
>  			DEV_EXTRA_OPTS|DEV_FS_OPTS|FORMAT_DEVICE|MOUNT_DEVICE);;
>  			SKIP_FILESYSTEMS|SKIP_IN_LOCKDOWN|SKIP_IN_SECUREBOOT);;
> -			DEVICE_SIZE);;
> +			DEVICE_SIZE|USR_UID|USR_GID);;
>  			*) tst_res TWARN "Reserved variable TST_$_tst_i used!";;
>  			esac
>  		done
> -- 
> 2.51.0
> 

-- 
Cyril Hrubis
chrubis@suse.cz

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

^ permalink raw reply	[flat|nested] 23+ messages in thread

* Re: [PATCH v4 2/4] tst_test.sh: Add TST_USR_{G,U}ID variables
  2025-12-17 15:47     ` [LTP] [PATCH v4 2/4] tst_test.sh: Add TST_USR_{G, U}ID variables Cyril Hrubis
@ 2025-12-18 11:47       ` Petr Vorel
  -1 siblings, 0 replies; 23+ messages in thread
From: Petr Vorel @ 2025-12-18 11:47 UTC (permalink / raw)
  To: Cyril Hrubis
  Cc: ltp, Mimi Zohar, linux-integrity, selinux, Jan Stancek, Li Wang

> Hi!
> > Add TST_USR_{G,U}ID variables with the default values from tst_runas.c.

> > These can be used as a default values for tests which use tst_runas and
> > need to know UID/GID for other commands.

> > It will be used in LTP IMA tests.

...
> > +# see testcases/lib/tst_runas.c
> > +export TST_USR_UID="${LTP_USR_UID:-65534}"
> > +export TST_USR_GID="${LTP_USR_GID:-65534}"

> Do we need this? We already have the default values in the C code...

I've merged the patch without notice this, therefore just to clarify.
I hoped I was clear in the commit message, obviously not.
Yes, just for a record you find the answer in the next patch:
https://lore.kernel.org/ltp/aULUsVxLIXFM19IV@yuki.lan/

So I hope everything is OK.

Kind regards,
Petr


^ permalink raw reply	[flat|nested] 23+ messages in thread

* Re: [LTP] [PATCH v4 2/4] tst_test.sh: Add TST_USR_{G, U}ID variables
@ 2025-12-18 11:47       ` Petr Vorel
  0 siblings, 0 replies; 23+ messages in thread
From: Petr Vorel @ 2025-12-18 11:47 UTC (permalink / raw)
  To: Cyril Hrubis; +Cc: selinux, linux-integrity, ltp

> Hi!
> > Add TST_USR_{G,U}ID variables with the default values from tst_runas.c.

> > These can be used as a default values for tests which use tst_runas and
> > need to know UID/GID for other commands.

> > It will be used in LTP IMA tests.

...
> > +# see testcases/lib/tst_runas.c
> > +export TST_USR_UID="${LTP_USR_UID:-65534}"
> > +export TST_USR_GID="${LTP_USR_GID:-65534}"

> Do we need this? We already have the default values in the C code...

I've merged the patch without notice this, therefore just to clarify.
I hoped I was clear in the commit message, obviously not.
Yes, just for a record you find the answer in the next patch:
https://lore.kernel.org/ltp/aULUsVxLIXFM19IV@yuki.lan/

So I hope everything is OK.

Kind regards,
Petr


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

^ permalink raw reply	[flat|nested] 23+ messages in thread

* [PATCH v4 3/4] ima_{conditionals,measurements}.sh: Use tst_runas
  2025-12-09 18:55 ` [LTP] " Petr Vorel
@ 2025-12-09 18:55   ` Petr Vorel
  -1 siblings, 0 replies; 23+ messages in thread
From: Petr Vorel @ 2025-12-09 18:55 UTC (permalink / raw)
  To: ltp
  Cc: Petr Vorel, Mimi Zohar, linux-integrity, selinux, Cyril Hrubis,
	Jan Stancek, Li Wang

Replace 'sudo' and 'sg' with 'tst_runas'.

This not only removes 'sudo' external dependency, but it s required
because new releases of many distros (e.g. Debian, openSUSE Tumbleweed,
SLES, ...) switched shell for 'nobody' user from /bin/bash (or /bin/sh)
to /usr/sbin/nologin. That effectively disables using 'sudo', 'su', 'sg':

    ima_conditionals 1 TINFO: verify measuring user files when requested via uid
    sudo: Account expired or PAM config lacks an "account" section for sudo, contact your system administrator
    sudo: a password is required

Signed-off-by: Petr Vorel <pvorel@suse.cz>
---
 .../integrity/ima/tests/ima_conditionals.sh         | 13 ++++++-------
 .../integrity/ima/tests/ima_measurements.sh         | 11 ++---------
 2 files changed, 8 insertions(+), 16 deletions(-)

diff --git a/testcases/kernel/security/integrity/ima/tests/ima_conditionals.sh b/testcases/kernel/security/integrity/ima/tests/ima_conditionals.sh
index ba19176039..ae947db1e9 100755
--- a/testcases/kernel/security/integrity/ima/tests/ima_conditionals.sh
+++ b/testcases/kernel/security/integrity/ima/tests/ima_conditionals.sh
@@ -9,7 +9,7 @@
 # gid and fgroup options test kernel commit 40224c41661b ("ima: add gid
 # support") from v5.16.
 
-TST_NEEDS_CMDS="cat chgrp chown id sg sudo"
+TST_NEEDS_CMDS="cat chgrp chown"
 TST_SETUP="setup"
 TST_CNT=1
 
@@ -27,8 +27,8 @@ verify_measurement()
 	local test_file="$PWD/test.txt"
 	local cmd="cat $test_file > /dev/null"
 
-	local value="$(id -u $user)"
-	[ "$request" = 'gid' -o "$request" = 'fgroup' ] && value="$(id -g $user)"
+	local value="$TST_USR_UID"
+	[ "$request" = 'gid' -o "$request" = 'fgroup' ] && value="$TST_USR_GID"
 
 	# needs to be checked each run (not in setup)
 	require_policy_writable
@@ -41,15 +41,14 @@ verify_measurement()
 
 	case "$request" in
 	fgroup)
-		chgrp $user $test_file
+		chgrp $TST_USR_GID $test_file
 		sh -c "$cmd"
 		;;
 	fowner)
-		chown $user $test_file
+		chown $TST_USR_UID $test_file
 		sh -c "$cmd"
 		;;
-	gid) sg $user "sh -c '$cmd'";;
-	uid) sudo -n -u $user sh -c "$cmd";;
+	gid|uid) tst_runas sh -c "$cmd";;
 	*) tst_brk TBROK "Invalid res type '$1'";;
 	esac
 
diff --git a/testcases/kernel/security/integrity/ima/tests/ima_measurements.sh b/testcases/kernel/security/integrity/ima/tests/ima_measurements.sh
index 60350f3926..cf35e131ed 100755
--- a/testcases/kernel/security/integrity/ima/tests/ima_measurements.sh
+++ b/testcases/kernel/security/integrity/ima/tests/ima_measurements.sh
@@ -68,30 +68,23 @@ test2()
 
 test3()
 {
-	local user="nobody"
 	local dir="$PWD/user"
 	local file="$dir/test.txt"
 	local cmd="grep $file $ASCII_MEASUREMENTS"
 
 	# Default policy does not measure user files
 	tst_res TINFO "verify not measuring user files"
-	tst_check_cmds sudo || return
 
 	if [ "$IMA_MISSING_POLICY_CONTENT" = 1 ]; then
 		tst_res TCONF "test requires specific policy, try load it with LTP_IMA_LOAD_POLICY=1"
 		return
 	fi
 
-	if ! id $user >/dev/null 2>/dev/null; then
-		tst_res TCONF "missing system user $user (wrong installation)"
-		return
-	fi
-
 	[ -d "$dir" ] || mkdir -m 0700 $dir
-	chown $user $dir
+	chown $TST_USR_UID $dir
 	cd $dir
 	# need to read file to get updated $ASCII_MEASUREMENTS
-	sudo -n -u $user sh -c "echo $(cat /proc/uptime) user file > $file; cat $file > /dev/null"
+	tst_runas sh -c "echo $(cat /proc/uptime) user file > $file; cat $file > /dev/null"
 	cd ..
 
 	if ! tst_rod "$cmd" 2> /dev/null; then
-- 
2.51.0


^ permalink raw reply related	[flat|nested] 23+ messages in thread

* [LTP] [PATCH v4 3/4] ima_{conditionals, measurements}.sh: Use tst_runas
@ 2025-12-09 18:55   ` Petr Vorel
  0 siblings, 0 replies; 23+ messages in thread
From: Petr Vorel @ 2025-12-09 18:55 UTC (permalink / raw)
  To: ltp; +Cc: selinux, linux-integrity

Replace 'sudo' and 'sg' with 'tst_runas'.

This not only removes 'sudo' external dependency, but it s required
because new releases of many distros (e.g. Debian, openSUSE Tumbleweed,
SLES, ...) switched shell for 'nobody' user from /bin/bash (or /bin/sh)
to /usr/sbin/nologin. That effectively disables using 'sudo', 'su', 'sg':

    ima_conditionals 1 TINFO: verify measuring user files when requested via uid
    sudo: Account expired or PAM config lacks an "account" section for sudo, contact your system administrator
    sudo: a password is required

Signed-off-by: Petr Vorel <pvorel@suse.cz>
---
 .../integrity/ima/tests/ima_conditionals.sh         | 13 ++++++-------
 .../integrity/ima/tests/ima_measurements.sh         | 11 ++---------
 2 files changed, 8 insertions(+), 16 deletions(-)

diff --git a/testcases/kernel/security/integrity/ima/tests/ima_conditionals.sh b/testcases/kernel/security/integrity/ima/tests/ima_conditionals.sh
index ba19176039..ae947db1e9 100755
--- a/testcases/kernel/security/integrity/ima/tests/ima_conditionals.sh
+++ b/testcases/kernel/security/integrity/ima/tests/ima_conditionals.sh
@@ -9,7 +9,7 @@
 # gid and fgroup options test kernel commit 40224c41661b ("ima: add gid
 # support") from v5.16.
 
-TST_NEEDS_CMDS="cat chgrp chown id sg sudo"
+TST_NEEDS_CMDS="cat chgrp chown"
 TST_SETUP="setup"
 TST_CNT=1
 
@@ -27,8 +27,8 @@ verify_measurement()
 	local test_file="$PWD/test.txt"
 	local cmd="cat $test_file > /dev/null"
 
-	local value="$(id -u $user)"
-	[ "$request" = 'gid' -o "$request" = 'fgroup' ] && value="$(id -g $user)"
+	local value="$TST_USR_UID"
+	[ "$request" = 'gid' -o "$request" = 'fgroup' ] && value="$TST_USR_GID"
 
 	# needs to be checked each run (not in setup)
 	require_policy_writable
@@ -41,15 +41,14 @@ verify_measurement()
 
 	case "$request" in
 	fgroup)
-		chgrp $user $test_file
+		chgrp $TST_USR_GID $test_file
 		sh -c "$cmd"
 		;;
 	fowner)
-		chown $user $test_file
+		chown $TST_USR_UID $test_file
 		sh -c "$cmd"
 		;;
-	gid) sg $user "sh -c '$cmd'";;
-	uid) sudo -n -u $user sh -c "$cmd";;
+	gid|uid) tst_runas sh -c "$cmd";;
 	*) tst_brk TBROK "Invalid res type '$1'";;
 	esac
 
diff --git a/testcases/kernel/security/integrity/ima/tests/ima_measurements.sh b/testcases/kernel/security/integrity/ima/tests/ima_measurements.sh
index 60350f3926..cf35e131ed 100755
--- a/testcases/kernel/security/integrity/ima/tests/ima_measurements.sh
+++ b/testcases/kernel/security/integrity/ima/tests/ima_measurements.sh
@@ -68,30 +68,23 @@ test2()
 
 test3()
 {
-	local user="nobody"
 	local dir="$PWD/user"
 	local file="$dir/test.txt"
 	local cmd="grep $file $ASCII_MEASUREMENTS"
 
 	# Default policy does not measure user files
 	tst_res TINFO "verify not measuring user files"
-	tst_check_cmds sudo || return
 
 	if [ "$IMA_MISSING_POLICY_CONTENT" = 1 ]; then
 		tst_res TCONF "test requires specific policy, try load it with LTP_IMA_LOAD_POLICY=1"
 		return
 	fi
 
-	if ! id $user >/dev/null 2>/dev/null; then
-		tst_res TCONF "missing system user $user (wrong installation)"
-		return
-	fi
-
 	[ -d "$dir" ] || mkdir -m 0700 $dir
-	chown $user $dir
+	chown $TST_USR_UID $dir
 	cd $dir
 	# need to read file to get updated $ASCII_MEASUREMENTS
-	sudo -n -u $user sh -c "echo $(cat /proc/uptime) user file > $file; cat $file > /dev/null"
+	tst_runas sh -c "echo $(cat /proc/uptime) user file > $file; cat $file > /dev/null"
 	cd ..
 
 	if ! tst_rod "$cmd" 2> /dev/null; then
-- 
2.51.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

^ permalink raw reply related	[flat|nested] 23+ messages in thread

* Re: [PATCH v4 3/4] ima_{conditionals,measurements}.sh: Use tst_runas
  2025-12-09 18:55   ` [LTP] [PATCH v4 3/4] ima_{conditionals, measurements}.sh: " Petr Vorel
@ 2025-12-17 16:05     ` Cyril Hrubis
  -1 siblings, 0 replies; 23+ messages in thread
From: Cyril Hrubis @ 2025-12-17 16:05 UTC (permalink / raw)
  To: Petr Vorel
  Cc: ltp, Mimi Zohar, linux-integrity, selinux, Jan Stancek, Li Wang

Hi!
> +	chown $TST_USR_UID $dir

And we need it here.

-- 
Cyril Hrubis
chrubis@suse.cz

^ permalink raw reply	[flat|nested] 23+ messages in thread

* Re: [LTP] [PATCH v4 3/4] ima_{conditionals, measurements}.sh: Use tst_runas
@ 2025-12-17 16:05     ` Cyril Hrubis
  0 siblings, 0 replies; 23+ messages in thread
From: Cyril Hrubis @ 2025-12-17 16:05 UTC (permalink / raw)
  To: Petr Vorel; +Cc: selinux, linux-integrity, ltp

Hi!
> +	chown $TST_USR_UID $dir

And we need it here.

-- 
Cyril Hrubis
chrubis@suse.cz

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

^ permalink raw reply	[flat|nested] 23+ messages in thread

* [PATCH v4 4/4] ima_conditionals.sh: Split test by request
  2025-12-09 18:55 ` [LTP] " Petr Vorel
@ 2025-12-09 18:55   ` Petr Vorel
  -1 siblings, 0 replies; 23+ messages in thread
From: Petr Vorel @ 2025-12-09 18:55 UTC (permalink / raw)
  To: ltp
  Cc: Petr Vorel, Mimi Zohar, linux-integrity, selinux, Cyril Hrubis,
	Jan Stancek, Li Wang

This helps to run all testcases on systems without CONFIG_IMA_WRITE_POLICY=y
(disabled by default in mainline, therefore disabled for some distros,
e.g. openSUSE Tumbleweed), if SUT reboots.

Signed-off-by: Petr Vorel <pvorel@suse.cz>
---
 runtest/ima                                   |  5 +-
 .../integrity/ima/tests/ima_conditionals.sh   | 67 ++++++++++++-------
 2 files changed, 46 insertions(+), 26 deletions(-)

diff --git a/runtest/ima b/runtest/ima
index 01942eefa3..c8d0c6801e 100644
--- a/runtest/ima
+++ b/runtest/ima
@@ -6,5 +6,8 @@ ima_violations ima_violations.sh
 ima_keys ima_keys.sh
 ima_kexec ima_kexec.sh
 ima_selinux ima_selinux.sh
-ima_conditionals ima_conditionals.sh
+ima_conditionals_uid ima_conditionals.sh -r uid
+ima_conditionals_fowner ima_conditionals.sh -r fowner
+ima_conditionals_gid ima_conditionals.sh -r gid
+ima_conditionals_fgroup ima_conditionals.sh -r fgroup
 evm_overlay evm_overlay.sh
diff --git a/testcases/kernel/security/integrity/ima/tests/ima_conditionals.sh b/testcases/kernel/security/integrity/ima/tests/ima_conditionals.sh
index ae947db1e9..7dd37373cd 100755
--- a/testcases/kernel/security/integrity/ima/tests/ima_conditionals.sh
+++ b/testcases/kernel/security/integrity/ima/tests/ima_conditionals.sh
@@ -11,35 +11,66 @@
 
 TST_NEEDS_CMDS="cat chgrp chown"
 TST_SETUP="setup"
-TST_CNT=1
+TST_OPTS="r:"
+TST_USAGE="usage"
+TST_PARSE_ARGS="parse_args"
+REQUEST="uid"
+
+parse_args()
+{
+	REQUEST="$2"
+}
+
+usage()
+{
+	cat << EOF
+usage: $0 [-r <uid|fowner|gid|fgroup>]
+
+OPTIONS
+-r	Specify the request to be measured. One of:
+	uid, fowner, gid, fgroup
+	Default: uid
+EOF
+}
 
 setup()
 {
+	case "$REQUEST" in
+	fgroup|fowner|gid|uid)
+		tst_res TINFO "request '$REQUEST'"
+		;;
+	*) tst_brk TBROK "Invalid -r '$REQUEST', use: -r <uid|fowner|gid|fgroup>";;
+	esac
+
 	if check_need_signed_policy; then
 		tst_brk TCONF "policy have to be signed"
 	fi
 }
 
-verify_measurement()
+test()
 {
+	# needs to be checked each run (not in setup)
+	require_policy_writable
+
 	local request="$1"
-	local user="nobody"
 	local test_file="$PWD/test.txt"
 	local cmd="cat $test_file > /dev/null"
-
 	local value="$TST_USR_UID"
-	[ "$request" = 'gid' -o "$request" = 'fgroup' ] && value="$TST_USR_GID"
 
-	# needs to be checked each run (not in setup)
-	require_policy_writable
+	if [ "$REQUEST" = 'gid' -o "$REQUEST" = 'fgroup' ]; then
+		if tst_kvcmp -lt 5.16; then
+			tst_brk TCONF "gid and fgroup options require kernel 5.16 or newer"
+		fi
+		value="$TST_USR_GID"
+	fi
 
 	ROD rm -f $test_file
 
-	tst_res TINFO "verify measuring user files when requested via $request"
-	ROD echo "measure $request=$value" \> $IMA_POLICY
-	ROD echo "$(cat /proc/uptime) $request test" \> $test_file
+	tst_res TINFO "verify measuring user files when requested via $REQUEST"
+	ROD echo "measure $REQUEST=$value" \> $IMA_POLICY
+	ROD echo "$(cat /proc/uptime) $REQUEST test" \> $test_file
 
-	case "$request" in
+	case "$REQUEST" in
 	fgroup)
 		chgrp $TST_USR_GID $test_file
 		sh -c "$cmd"
@@ -49,24 +80,10 @@ verify_measurement()
 		sh -c "$cmd"
 		;;
 	gid|uid) tst_runas sh -c "$cmd";;
-	*) tst_brk TBROK "Invalid res type '$1'";;
 	esac
 
 	ima_check $test_file
 }
 
-test1()
-{
-	verify_measurement uid
-	verify_measurement fowner
-
-	if tst_kvcmp -lt 5.16; then
-		tst_brk TCONF "gid and fgroup options require kernel 5.16 or newer"
-	fi
-
-	verify_measurement gid
-	verify_measurement fgroup
-}
-
 . ima_setup.sh
 tst_run
-- 
2.51.0


^ permalink raw reply related	[flat|nested] 23+ messages in thread

* [LTP] [PATCH v4 4/4] ima_conditionals.sh: Split test by request
@ 2025-12-09 18:55   ` Petr Vorel
  0 siblings, 0 replies; 23+ messages in thread
From: Petr Vorel @ 2025-12-09 18:55 UTC (permalink / raw)
  To: ltp; +Cc: selinux, linux-integrity

This helps to run all testcases on systems without CONFIG_IMA_WRITE_POLICY=y
(disabled by default in mainline, therefore disabled for some distros,
e.g. openSUSE Tumbleweed), if SUT reboots.

Signed-off-by: Petr Vorel <pvorel@suse.cz>
---
 runtest/ima                                   |  5 +-
 .../integrity/ima/tests/ima_conditionals.sh   | 67 ++++++++++++-------
 2 files changed, 46 insertions(+), 26 deletions(-)

diff --git a/runtest/ima b/runtest/ima
index 01942eefa3..c8d0c6801e 100644
--- a/runtest/ima
+++ b/runtest/ima
@@ -6,5 +6,8 @@ ima_violations ima_violations.sh
 ima_keys ima_keys.sh
 ima_kexec ima_kexec.sh
 ima_selinux ima_selinux.sh
-ima_conditionals ima_conditionals.sh
+ima_conditionals_uid ima_conditionals.sh -r uid
+ima_conditionals_fowner ima_conditionals.sh -r fowner
+ima_conditionals_gid ima_conditionals.sh -r gid
+ima_conditionals_fgroup ima_conditionals.sh -r fgroup
 evm_overlay evm_overlay.sh
diff --git a/testcases/kernel/security/integrity/ima/tests/ima_conditionals.sh b/testcases/kernel/security/integrity/ima/tests/ima_conditionals.sh
index ae947db1e9..7dd37373cd 100755
--- a/testcases/kernel/security/integrity/ima/tests/ima_conditionals.sh
+++ b/testcases/kernel/security/integrity/ima/tests/ima_conditionals.sh
@@ -11,35 +11,66 @@
 
 TST_NEEDS_CMDS="cat chgrp chown"
 TST_SETUP="setup"
-TST_CNT=1
+TST_OPTS="r:"
+TST_USAGE="usage"
+TST_PARSE_ARGS="parse_args"
+REQUEST="uid"
+
+parse_args()
+{
+	REQUEST="$2"
+}
+
+usage()
+{
+	cat << EOF
+usage: $0 [-r <uid|fowner|gid|fgroup>]
+
+OPTIONS
+-r	Specify the request to be measured. One of:
+	uid, fowner, gid, fgroup
+	Default: uid
+EOF
+}
 
 setup()
 {
+	case "$REQUEST" in
+	fgroup|fowner|gid|uid)
+		tst_res TINFO "request '$REQUEST'"
+		;;
+	*) tst_brk TBROK "Invalid -r '$REQUEST', use: -r <uid|fowner|gid|fgroup>";;
+	esac
+
 	if check_need_signed_policy; then
 		tst_brk TCONF "policy have to be signed"
 	fi
 }
 
-verify_measurement()
+test()
 {
+	# needs to be checked each run (not in setup)
+	require_policy_writable
+
 	local request="$1"
-	local user="nobody"
 	local test_file="$PWD/test.txt"
 	local cmd="cat $test_file > /dev/null"
-
 	local value="$TST_USR_UID"
-	[ "$request" = 'gid' -o "$request" = 'fgroup' ] && value="$TST_USR_GID"
 
-	# needs to be checked each run (not in setup)
-	require_policy_writable
+	if [ "$REQUEST" = 'gid' -o "$REQUEST" = 'fgroup' ]; then
+		if tst_kvcmp -lt 5.16; then
+			tst_brk TCONF "gid and fgroup options require kernel 5.16 or newer"
+		fi
+		value="$TST_USR_GID"
+	fi
 
 	ROD rm -f $test_file
 
-	tst_res TINFO "verify measuring user files when requested via $request"
-	ROD echo "measure $request=$value" \> $IMA_POLICY
-	ROD echo "$(cat /proc/uptime) $request test" \> $test_file
+	tst_res TINFO "verify measuring user files when requested via $REQUEST"
+	ROD echo "measure $REQUEST=$value" \> $IMA_POLICY
+	ROD echo "$(cat /proc/uptime) $REQUEST test" \> $test_file
 
-	case "$request" in
+	case "$REQUEST" in
 	fgroup)
 		chgrp $TST_USR_GID $test_file
 		sh -c "$cmd"
@@ -49,24 +80,10 @@ verify_measurement()
 		sh -c "$cmd"
 		;;
 	gid|uid) tst_runas sh -c "$cmd";;
-	*) tst_brk TBROK "Invalid res type '$1'";;
 	esac
 
 	ima_check $test_file
 }
 
-test1()
-{
-	verify_measurement uid
-	verify_measurement fowner
-
-	if tst_kvcmp -lt 5.16; then
-		tst_brk TCONF "gid and fgroup options require kernel 5.16 or newer"
-	fi
-
-	verify_measurement gid
-	verify_measurement fgroup
-}
-
 . ima_setup.sh
 tst_run
-- 
2.51.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

^ permalink raw reply related	[flat|nested] 23+ messages in thread

* Re: [LTP] [PATCH v4 0/4] tst_runas.c, ima_{conditionals, measurements}.sh enhancements
  2025-12-09 18:55 ` [LTP] " Petr Vorel
@ 2025-12-11 10:37   ` Andrea Cervesato via ltp
  -1 siblings, 0 replies; 23+ messages in thread
From: Andrea Cervesato @ 2025-12-11 10:37 UTC (permalink / raw)
  To: Petr Vorel, ltp; +Cc: selinux, linux-integrity

Hi Petr,

thanks for adding this tool. We will probably need to update
documentation as well after this patch will be merged.

-- 
Andrea Cervesato
SUSE QE Automation Engineer Linux
andrea.cervesato@suse.com


^ permalink raw reply	[flat|nested] 23+ messages in thread

* Re: [LTP] [PATCH v4 0/4] tst_runas.c, ima_{conditionals, measurements}.sh enhancements
@ 2025-12-11 10:37   ` Andrea Cervesato via ltp
  0 siblings, 0 replies; 23+ messages in thread
From: Andrea Cervesato via ltp @ 2025-12-11 10:37 UTC (permalink / raw)
  To: Petr Vorel, ltp; +Cc: selinux, linux-integrity

Hi Petr,

thanks for adding this tool. We will probably need to update
documentation as well after this patch will be merged.

-- 
Andrea Cervesato
SUSE QE Automation Engineer Linux
andrea.cervesato@suse.com


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

^ permalink raw reply	[flat|nested] 23+ messages in thread

end of thread, other threads:[~2025-12-18 11:48 UTC | newest]

Thread overview: 23+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-12-09 18:55 [PATCH v4 0/4] tst_runas.c, ima_{conditionals, measurements}.sh enhancements Petr Vorel
2025-12-09 18:55 ` [LTP] " Petr Vorel
2025-12-09 18:55 ` [PATCH v4 1/4] shell: Add tst_runas.c helper Petr Vorel
2025-12-09 18:55   ` [LTP] " Petr Vorel
2025-12-15  6:57   ` Li Wang via ltp
2025-12-17 15:13     ` Cyril Hrubis
2025-12-17 15:13       ` [LTP] " Cyril Hrubis
2025-12-17 15:57       ` Petr Vorel
2025-12-17 15:57         ` [LTP] " Petr Vorel
2025-12-09 18:55 ` [PATCH v4 2/4] tst_test.sh: Add TST_USR_{G,U}ID variables Petr Vorel
2025-12-09 18:55   ` [LTP] " Petr Vorel
2025-12-17 15:47   ` Cyril Hrubis
2025-12-17 15:47     ` [LTP] [PATCH v4 2/4] tst_test.sh: Add TST_USR_{G, U}ID variables Cyril Hrubis
2025-12-18 11:47     ` [PATCH v4 2/4] tst_test.sh: Add TST_USR_{G,U}ID variables Petr Vorel
2025-12-18 11:47       ` [LTP] [PATCH v4 2/4] tst_test.sh: Add TST_USR_{G, U}ID variables Petr Vorel
2025-12-09 18:55 ` [PATCH v4 3/4] ima_{conditionals,measurements}.sh: Use tst_runas Petr Vorel
2025-12-09 18:55   ` [LTP] [PATCH v4 3/4] ima_{conditionals, measurements}.sh: " Petr Vorel
2025-12-17 16:05   ` [PATCH v4 3/4] ima_{conditionals,measurements}.sh: " Cyril Hrubis
2025-12-17 16:05     ` [LTP] [PATCH v4 3/4] ima_{conditionals, measurements}.sh: " Cyril Hrubis
2025-12-09 18:55 ` [PATCH v4 4/4] ima_conditionals.sh: Split test by request Petr Vorel
2025-12-09 18:55   ` [LTP] " Petr Vorel
2025-12-11 10:37 ` [LTP] [PATCH v4 0/4] tst_runas.c, ima_{conditionals, measurements}.sh enhancements Andrea Cervesato
2025-12-11 10:37   ` Andrea Cervesato via ltp

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.