[PATCH] ima_selinux.sh: test2 assumes CONFIG_IMA_DISABLE_HTABLE is configured

[PATCH] ima_selinux.sh: test2 assumes CONFIG_IMA_DISABLE_HTABLE is configured

[Mimi Zohar]

test2 uses the last "selinux-state" record stored in the IMA measurement
list to determine whether SELinux is in enforcing mode and then compares
it to the selinux enforce file status.

The tst_update_selinux_state flips the SELinux enforce status
(/sys/fs/selinux/enforce) to force a new "selinux-state" record to be
appended to the IMA measurement list.  However, this only happens when
CONFIG_IMA_DISABLE_HTABLE is configured.

Don't fail the test when CONFIG_IMA_DISABLE_HTABLE is not configured.

Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
---
 .../kernel/security/integrity/ima/tests/ima_selinux.sh      | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/testcases/kernel/security/integrity/ima/tests/ima_selinux.sh b/testcases/kernel/security/integrity/ima/tests/ima_selinux.sh
index e64a7739f..9b312f8b7 100755
--- a/testcases/kernel/security/integrity/ima/tests/ima_selinux.sh
+++ b/testcases/kernel/security/integrity/ima/tests/ima_selinux.sh
@@ -147,7 +147,11 @@ test2()
 	enforced_value=$(echo $measured_data | awk -F'[=;]' '{print $4}')
 	expected_enforced_value=$(cat $SELINUX_DIR/enforce)
 	if [ "$expected_enforced_value" != "$enforced_value" ]; then
-		tst_res $IMA_FAIL "enforce: expected: $expected_enforced_value, got: $enforced_value"
+		if ! tst_check_kconfigs "CONFIG_IMA_DISABLE_HTABLE=y"; then
+			tst_res TPASS "Duplicate \"selinux-state\" record missing (CONFIG_IMA_DISABLE_HTABLE not set)"
+		else
+			tst_res $IMA_FAIL "enforce: expected: $expected_enforced_value, got: $enforced_value"
+		fi
 		return
 	fi
 
-- 
2.55.0