Re: [PATCH 2/2] ima_selinux.sh: Detect SELinux before loading policy

[Petr Vorel <pvorel@suse.cz>]

Hi,

> Adding TST_SETUP_EARLY to run test specific setup before loading policy.
> That allows to avoid loading IMA policy (which usually request reboot)
> if the test would be skipped anyway.

> Fixes: aac97cca96 ("ima_setup.sh: Allow to load predefined policy")
> Signed-off-by: Petr Vorel <pvorel@suse.cz>
> ---
>  testcases/kernel/security/integrity/ima/tests/ima_selinux.sh | 3 ++-
>  testcases/kernel/security/integrity/ima/tests/ima_setup.sh   | 2 ++
>  2 files changed, 4 insertions(+), 1 deletion(-)

> diff --git a/testcases/kernel/security/integrity/ima/tests/ima_selinux.sh b/testcases/kernel/security/integrity/ima/tests/ima_selinux.sh
> index 97c5d64ec5..577f7c2aca 100755
> --- a/testcases/kernel/security/integrity/ima/tests/ima_selinux.sh
> +++ b/testcases/kernel/security/integrity/ima/tests/ima_selinux.sh
> @@ -13,9 +13,10 @@

>  TST_NEEDS_CMDS="awk cut grep tail"
>  TST_CNT=2
> -TST_SETUP="setup"
>  TST_MIN_KVER="5.12"

> +TST_SETUP_EARLY="setup"

Hm, unlike TST_SETUP_CALLER, which is defined in ima_setup.sh, using "TST_"
prefixed variables in the test itself is catched by variable checker in
tst_test.sh:

ima_selinux 1 TWARN: Reserved variable TST_SETUP_EARLY used!

I need to redefine the variable to not use "TST_" prefix (see the diff below).
I'm sorry for the noise.

Kind regards,
Petr

+++ testcases/kernel/security/integrity/ima/tests/ima_selinux.sh
@@ -15,7 +15,7 @@ TST_NEEDS_CMDS="awk cut grep tail"
 TST_CNT=2
 TST_MIN_KVER="5.12"
 
-TST_SETUP_EARLY="setup"
+IMA_SETUP_EARLY="setup"
 
 REQUIRED_POLICY_CONTENT='selinux.policy'
 
diff --git testcases/kernel/security/integrity/ima/tests/ima_setup.sh testcases/kernel/security/integrity/ima/tests/ima_setup.sh
index 2a9f64978e..befaf7f73c 100644
--- testcases/kernel/security/integrity/ima/tests/ima_setup.sh
+++ testcases/kernel/security/integrity/ima/tests/ima_setup.sh
@@ -265,7 +265,7 @@ ima_setup()
 		cd "$TST_MNTPOINT"
 	fi
 
-	[ -n "$TST_SETUP_EARLY" ] && $TST_SETUP_EARLY
+	[ -n "$IMA_SETUP_EARLY" ] && $IMA_SETUP_EARLY
 
 	if ! verify_ima_policy; then
 		load_ima_policy