[PATCH v2] ima_tpm.sh: properly detect failure to verify the IMA measurement list

[PATCH v2] ima_tpm.sh: properly detect failure to verify the IMA measurement list

[Mimi Zohar]

test2 attempts to compare the aggregate PCR-10 value with the current
TPM PCR value based on the current measurement list, but does not take
into account that the measurement list might have grown.

evmctl returns success/failure when verifying the IMA measurement list
and displays the measurement list line number that matched.

Update test2 to check the return code, before failing the test.
Include the matched line number and total number of measurement
list records.

Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
---
Changelog:
- addressed AI comments, minimizing changes

 .../security/integrity/ima/tests/ima_tpm.sh   | 25 +++++++++++++++----
 1 file changed, 20 insertions(+), 5 deletions(-)

diff --git a/testcases/kernel/security/integrity/ima/tests/ima_tpm.sh b/testcases/kernel/security/integrity/ima/tests/ima_tpm.sh
index acd8b6d30..8bb86ea4a 100755
--- a/testcases/kernel/security/integrity/ima/tests/ima_tpm.sh
+++ b/testcases/kernel/security/integrity/ima/tests/ima_tpm.sh
@@ -146,7 +146,7 @@ get_pcr10_aggregate()
 	local num_violations=0
 	local msg="$ERRMSG_EVMCTL"
 	local res=TCONF
-	local pcr ret
+	local lineno pcr ret

 	if [ -z "$MISSING_EVMCTL" ]; then
 		msg=
@@ -178,10 +178,13 @@ get_pcr10_aggregate()
 		tst_res $res "failed to find aggregate PCR-10 $msg"
 		tst_res TINFO "hash file:"
 		cat hash.txt >&2
-		return
+		return $ret
 	fi

-	echo "$pcr"
+	lineno=$(grep -E "^($ALGORITHM )*PCR(.*10)*: succeed at entry" \
+		 hash.txt | tail -1 | awk '{print $NF}')
+	echo "$pcr $lineno"
+	return $ret
 }

 test1_tpm_bypass_mode()
@@ -249,7 +252,9 @@ test1()

 test2()
 {
-	local hash pcr_aggregate out ret
+	local hash pcr_aggregate lineno out ret
+	local measurement_count="$IMA_DIR/runtime_measurements_count"
+	local total_measurements

 	tst_res TINFO "verify PCR values"

@@ -288,7 +293,9 @@ test2()
 	tst_res TINFO "real PCR-10: '$hash'"

 	get_pcr10_aggregate > tmp.txt
-	pcr_aggregate="$(cat tmp.txt)"
+	ret=$?
+
+	pcr_aggregate="$(cat tmp.txt | awk '{print $1}')"
 	if [ -z "$pcr_aggregate" ]; then
 		return
 	fi
@@ -296,6 +303,14 @@ test2()

 	if [ "$hash" = "$pcr_aggregate" ]; then
 		tst_res TPASS "aggregate PCR value matches real PCR value"
+	elif [ $ret -eq 0 ]; then
+		lineno="$(cat tmp.txt | awk '{print $2}')"
+		if [ -z "$lineno" ]; then
+			return
+		fi
+		total_measurements=$(cat "$measurement_count")
+
+		tst_res TPASS "aggregate PCR value matched real PCR value (line: $lineno/$total_measurements)"
 	else
 		tst_res TFAIL "aggregate PCR value does not match real PCR value"
 	fi
--
2.55.0

Re: [PATCH v2] ima_tpm.sh: properly detect failure to verify the IMA measurement list

[Petr Vorel]

Hi Mimi,

> test2 attempts to compare the aggregate PCR-10 value with the current
> TPM PCR value based on the current measurement list, but does not take
> into account that the measurement list might have grown.

> evmctl returns success/failure when verifying the IMA measurement list
> and displays the measurement list line number that matched.

> Update test2 to check the return code, before failing the test.
> Include the matched line number and total number of measurement
> list records.

I was not able to reproduce the failure on VM BIOS (legacy) running on UEFI QEMU
host which I reported previously, therefore I merged it.

Thank you!

Kind regards,
Petr