Linux Integrity Measurement development
 help / color / mirror / Atom feed
* [PATCH] ima_violations.sh: Fix condition evaluation
@ 2025-03-14 12:42 Petr Vorel
       [not found] ` <CAEemH2ejo61V9v=BXRt+cVL-roNLFuyKpY2MC_dYW+iJJ3ZrAQ@mail.gmail.com>
  0 siblings, 1 reply; 2+ messages in thread
From: Petr Vorel @ 2025-03-14 12:42 UTC (permalink / raw)
  To: ltp; +Cc: Petr Vorel, Mimi Zohar, linux-integrity

Evaluation "-gt 0" needs to be together with expectation of empty
$expected_violations. Therefore use [ ... -a ... ] comparator to avoid
-eq comparison against empty $expected_violations.

    # LTPROOT=/opt/ltp PATH="/opt/ltp/testcases/bin:$PATH" LTP_IMA_LOAD_POLICY=1 ima_keys.sh
    ima_keys 1 TINFO: /proc/cmdline: BOOT_IMAGE=/boot/vmlinuz-6.14.0-rc3-1.gb6b4102-default security=apparmor ignore_loglevel ima_policy=tcb

    # LTPROOT=/opt/ltp PATH="/opt/ltp/testcases/bin:$PATH" ima_violations.sh
    ...
    /opt/ltp/testcases/bin/ima_violations.sh: line 95: [: 0: unary operator expected
    ima_violations 1 TFAIL: open_writers violation not added
    ima_violations 2 TINFO: verify ToMToU violation
    /opt/ltp/testcases/bin/ima_violations.sh: line 95: [: 0: unary operator expected
    ima_violations 2 TFAIL: ToMToU violation not added
    ima_violations 3 TINFO: verify open_writers using mmapped files
    tst_test.c:1900: TINFO: LTP version: 20250130-22-gcd2215702f
    tst_test.c:1904: TINFO: Tested kernel: 6.14.0-rc3-1.gb6b4102-default #1 SMP PREEMPT_DYNAMIC Thu Feb 20 12:26:55 UTC 2025 (b6b4102) x86_64
    tst_kconfig.c:88: TINFO: Parsing kernel config '/proc/config.gz'
    tst_kconfig.c:676: TINFO: CONFIG_FAULT_INJECTION kernel option detected which might slow the execution
    tst_test.c:1722: TINFO: Overall timeout per run is 0h 02m 00s
    ima_mmap.c:38: TINFO: sleep 3s
    /opt/ltp/testcases/bin/ima_violations.sh: line 95: [: 0: unary operator expected
    ima_violations 3 TFAIL: open_writers violation not added

NOTE: This does not fix ima_violations.sh fails after caused by user
defined policy loaded by ima_keys.sh (via LTP_IMA_LOAD_POLICY=1).

Fixes: 726ed71905 ("ima_violations.sh: Update validate() to support multiple violations")
Signed-off-by: Petr Vorel <pvorel@suse.cz>
---
 .../kernel/security/integrity/ima/tests/ima_violations.sh      | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/testcases/kernel/security/integrity/ima/tests/ima_violations.sh b/testcases/kernel/security/integrity/ima/tests/ima_violations.sh
index 63346e9489..c6b929a233 100755
--- a/testcases/kernel/security/integrity/ima/tests/ima_violations.sh
+++ b/testcases/kernel/security/integrity/ima/tests/ima_violations.sh
@@ -90,8 +90,7 @@ validate()
 	for i in $(seq 1 $max_attempt); do
 		read num_violations_new < $IMA_VIOLATIONS
 		count2="$(get_count $search)"
-		if [ -z "$expected_violations" ] && \
-		   [ $(($num_violations_new - $num_violations)) -gt 0 ] || \
+		if [ -z "$expected_violations" -a $(($num_violations_new - $num_violations)) -gt 0 ] || \
 		   [ $(($num_violations_new - $num_violations)) -eq $expected_violations ]; then
 			[ -z "$expected_violations" ] && expected_violations=1
 			if [ $count2 -gt $count ]; then
-- 
2.47.2


^ permalink raw reply related	[flat|nested] 2+ messages in thread
end of thread, other threads:[~2025-03-24 23:01 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-03-14 12:42 [PATCH] ima_violations.sh: Fix condition evaluation Petr Vorel
     [not found] ` <CAEemH2ejo61V9v=BXRt+cVL-roNLFuyKpY2MC_dYW+iJJ3ZrAQ@mail.gmail.com>
2025-03-24 23:01   ` [LTP] " Petr Vorel

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox