* Re: [PATCH] bpf: Fix IMA test
2023-03-08 10:37 [PATCH] bpf: Fix IMA test Roberto Sassu
@ 2023-03-08 10:40 ` Roberto Sassu
2023-03-08 19:17 ` Andrii Nakryiko
2023-03-08 11:03 ` Matt Bobrowski
2023-03-08 19:20 ` patchwork-bot+netdevbpf
2 siblings, 1 reply; 7+ messages in thread
From: Roberto Sassu @ 2023-03-08 10:40 UTC (permalink / raw)
To: andrii, mykolal, ast, daniel, martin.lau, song, yhs,
john.fastabend, kpsingh, sdf, haoluo, jolsa, shuah
Cc: bpf, linux-kselftest, linux-integrity, linux-kernel,
mattbobrowski, zohar, Roberto Sassu
On Wed, 2023-03-08 at 11:37 +0100, Roberto Sassu wrote:
> From: Roberto Sassu <roberto.sassu@huawei.com>
The title should have been selftests/bpf: ...
Will send a new version once I get the test result.
Roberto
> Commit 62622dab0a28 ("ima: return IMA digest value only when IMA_COLLECTED
> flag is set") caused bpf_ima_inode_hash() to refuse to give non-fresh
> digests. IMA test #3 assumed the old behavior, that bpf_ima_inode_hash()
> still returned also non-fresh digests.
>
> Correct the test by accepting both cases. If the samples returned are 1,
> assume that the commit above is applied and that the returned digest is
> fresh. If the samples returned are 2, assume that the commit above is not
> applied, and check both the non-fresh and fresh digest.
>
> Fixes: 62622dab0a28 ("ima: return IMA digest value only when IMA_COLLECTED flag is set")
> Reported by: David Vernet <void@manifault.com>
> Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
> ---
> .../selftests/bpf/prog_tests/test_ima.c | 29 ++++++++++++++-----
> 1 file changed, 21 insertions(+), 8 deletions(-)
>
> diff --git a/tools/testing/selftests/bpf/prog_tests/test_ima.c b/tools/testing/selftests/bpf/prog_tests/test_ima.c
> index b13feceb38f..810b14981c2 100644
> --- a/tools/testing/selftests/bpf/prog_tests/test_ima.c
> +++ b/tools/testing/selftests/bpf/prog_tests/test_ima.c
> @@ -70,7 +70,7 @@ void test_test_ima(void)
> u64 bin_true_sample;
> char cmd[256];
>
> - int err, duration = 0;
> + int err, duration = 0, fresh_digest_idx = 0;
> struct ima *skel = NULL;
>
> skel = ima__open_and_load();
> @@ -129,7 +129,15 @@ void test_test_ima(void)
> /*
> * Test #3
> * - Goal: confirm that bpf_ima_inode_hash() returns a non-fresh digest
> - * - Expected result: 2 samples (/bin/true: non-fresh, fresh)
> + * - Expected result:
> + * 1 sample (/bin/true: fresh) if commit 62622dab0a28 applied
> + * 2 samples (/bin/true: non-fresh, fresh) if commit 62622dab0a28 is
> + * not applied
> + *
> + * If commit 62622dab0a28 ("ima: return IMA digest value only when
> + * IMA_COLLECTED flag is set") is applied, bpf_ima_inode_hash() refuses
> + * to give a non-fresh digest, hence the correct result is 1 instead of
> + * 2.
> */
> test_init(skel->bss);
>
> @@ -144,13 +152,18 @@ void test_test_ima(void)
> goto close_clean;
>
> err = ring_buffer__consume(ringbuf);
> - ASSERT_EQ(err, 2, "num_samples_or_err");
> - ASSERT_NEQ(ima_hash_from_bpf[0], 0, "ima_hash");
> - ASSERT_NEQ(ima_hash_from_bpf[1], 0, "ima_hash");
> - ASSERT_EQ(ima_hash_from_bpf[0], bin_true_sample, "sample_equal_or_err");
> + ASSERT_GE(err, 1, "num_samples_or_err");
> + if (err == 2) {
> + ASSERT_NEQ(ima_hash_from_bpf[0], 0, "ima_hash");
> + ASSERT_EQ(ima_hash_from_bpf[0], bin_true_sample,
> + "sample_equal_or_err");
> + fresh_digest_idx = 1;
> + }
> +
> + ASSERT_NEQ(ima_hash_from_bpf[fresh_digest_idx], 0, "ima_hash");
> /* IMA refreshed the digest. */
> - ASSERT_NEQ(ima_hash_from_bpf[1], bin_true_sample,
> - "sample_different_or_err");
> + ASSERT_NEQ(ima_hash_from_bpf[fresh_digest_idx], bin_true_sample,
> + "sample_equal_or_err");
>
> /*
> * Test #4
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH] bpf: Fix IMA test
2023-03-08 10:40 ` Roberto Sassu
@ 2023-03-08 19:17 ` Andrii Nakryiko
0 siblings, 0 replies; 7+ messages in thread
From: Andrii Nakryiko @ 2023-03-08 19:17 UTC (permalink / raw)
To: Roberto Sassu
Cc: andrii, mykolal, ast, daniel, martin.lau, song, yhs,
john.fastabend, kpsingh, sdf, haoluo, jolsa, shuah, bpf,
linux-kselftest, linux-integrity, linux-kernel, mattbobrowski,
zohar, Roberto Sassu
On Wed, Mar 8, 2023 at 2:41 AM Roberto Sassu
<roberto.sassu@huaweicloud.com> wrote:
>
> On Wed, 2023-03-08 at 11:37 +0100, Roberto Sassu wrote:
> > From: Roberto Sassu <roberto.sassu@huawei.com>
>
> The title should have been selftests/bpf: ...
>
> Will send a new version once I get the test result.
I fixed up prefix and Reported-by tag, pushed to bpf-next. Thanks for the fix!
>
> Roberto
>
> > Commit 62622dab0a28 ("ima: return IMA digest value only when IMA_COLLECTED
> > flag is set") caused bpf_ima_inode_hash() to refuse to give non-fresh
> > digests. IMA test #3 assumed the old behavior, that bpf_ima_inode_hash()
> > still returned also non-fresh digests.
> >
> > Correct the test by accepting both cases. If the samples returned are 1,
> > assume that the commit above is applied and that the returned digest is
> > fresh. If the samples returned are 2, assume that the commit above is not
> > applied, and check both the non-fresh and fresh digest.
> >
> > Fixes: 62622dab0a28 ("ima: return IMA digest value only when IMA_COLLECTED flag is set")
> > Reported by: David Vernet <void@manifault.com>
> > Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
> > ---
> > .../selftests/bpf/prog_tests/test_ima.c | 29 ++++++++++++++-----
> > 1 file changed, 21 insertions(+), 8 deletions(-)
> >
> > diff --git a/tools/testing/selftests/bpf/prog_tests/test_ima.c b/tools/testing/selftests/bpf/prog_tests/test_ima.c
> > index b13feceb38f..810b14981c2 100644
> > --- a/tools/testing/selftests/bpf/prog_tests/test_ima.c
> > +++ b/tools/testing/selftests/bpf/prog_tests/test_ima.c
> > @@ -70,7 +70,7 @@ void test_test_ima(void)
> > u64 bin_true_sample;
> > char cmd[256];
> >
> > - int err, duration = 0;
> > + int err, duration = 0, fresh_digest_idx = 0;
> > struct ima *skel = NULL;
> >
> > skel = ima__open_and_load();
> > @@ -129,7 +129,15 @@ void test_test_ima(void)
> > /*
> > * Test #3
> > * - Goal: confirm that bpf_ima_inode_hash() returns a non-fresh digest
> > - * - Expected result: 2 samples (/bin/true: non-fresh, fresh)
> > + * - Expected result:
> > + * 1 sample (/bin/true: fresh) if commit 62622dab0a28 applied
> > + * 2 samples (/bin/true: non-fresh, fresh) if commit 62622dab0a28 is
> > + * not applied
> > + *
> > + * If commit 62622dab0a28 ("ima: return IMA digest value only when
> > + * IMA_COLLECTED flag is set") is applied, bpf_ima_inode_hash() refuses
> > + * to give a non-fresh digest, hence the correct result is 1 instead of
> > + * 2.
> > */
> > test_init(skel->bss);
> >
> > @@ -144,13 +152,18 @@ void test_test_ima(void)
> > goto close_clean;
> >
> > err = ring_buffer__consume(ringbuf);
> > - ASSERT_EQ(err, 2, "num_samples_or_err");
> > - ASSERT_NEQ(ima_hash_from_bpf[0], 0, "ima_hash");
> > - ASSERT_NEQ(ima_hash_from_bpf[1], 0, "ima_hash");
> > - ASSERT_EQ(ima_hash_from_bpf[0], bin_true_sample, "sample_equal_or_err");
> > + ASSERT_GE(err, 1, "num_samples_or_err");
> > + if (err == 2) {
> > + ASSERT_NEQ(ima_hash_from_bpf[0], 0, "ima_hash");
> > + ASSERT_EQ(ima_hash_from_bpf[0], bin_true_sample,
> > + "sample_equal_or_err");
> > + fresh_digest_idx = 1;
> > + }
> > +
> > + ASSERT_NEQ(ima_hash_from_bpf[fresh_digest_idx], 0, "ima_hash");
> > /* IMA refreshed the digest. */
> > - ASSERT_NEQ(ima_hash_from_bpf[1], bin_true_sample,
> > - "sample_different_or_err");
> > + ASSERT_NEQ(ima_hash_from_bpf[fresh_digest_idx], bin_true_sample,
> > + "sample_equal_or_err");
> >
> > /*
> > * Test #4
>
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] bpf: Fix IMA test
2023-03-08 10:37 [PATCH] bpf: Fix IMA test Roberto Sassu
2023-03-08 10:40 ` Roberto Sassu
@ 2023-03-08 11:03 ` Matt Bobrowski
2023-03-08 12:05 ` Roberto Sassu
2023-03-08 19:20 ` patchwork-bot+netdevbpf
2 siblings, 1 reply; 7+ messages in thread
From: Matt Bobrowski @ 2023-03-08 11:03 UTC (permalink / raw)
To: Roberto Sassu
Cc: andrii, mykolal, ast, daniel, martin.lau, song, yhs,
john.fastabend, kpsingh, sdf, haoluo, jolsa, shuah, bpf,
linux-kselftest, linux-integrity, linux-kernel, zohar,
Roberto Sassu
Ha! I was literally in the midst of sending through a patch for
this. Thanks for also taking a look and beating me to it!
This LGTM, feel free to add:
Reviewed-by: Matt Bobrowski <mattbobrowski@google.com>
On Wed, Mar 08, 2023 at 11:37:13AM +0100, Roberto Sassu wrote:
> From: Roberto Sassu <roberto.sassu@huawei.com>
>
> Commit 62622dab0a28 ("ima: return IMA digest value only when IMA_COLLECTED
> flag is set") caused bpf_ima_inode_hash() to refuse to give non-fresh
> digests. IMA test #3 assumed the old behavior, that bpf_ima_inode_hash()
> still returned also non-fresh digests.
>
> Correct the test by accepting both cases. If the samples returned are 1,
> assume that the commit above is applied and that the returned digest is
> fresh. If the samples returned are 2, assume that the commit above is not
> applied, and check both the non-fresh and fresh digest.
>
> Fixes: 62622dab0a28 ("ima: return IMA digest value only when IMA_COLLECTED flag is set")
> Reported by: David Vernet <void@manifault.com>
> Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
> ---
> .../selftests/bpf/prog_tests/test_ima.c | 29 ++++++++++++++-----
> 1 file changed, 21 insertions(+), 8 deletions(-)
>
> diff --git a/tools/testing/selftests/bpf/prog_tests/test_ima.c b/tools/testing/selftests/bpf/prog_tests/test_ima.c
> index b13feceb38f..810b14981c2 100644
> --- a/tools/testing/selftests/bpf/prog_tests/test_ima.c
> +++ b/tools/testing/selftests/bpf/prog_tests/test_ima.c
> @@ -70,7 +70,7 @@ void test_test_ima(void)
> u64 bin_true_sample;
> char cmd[256];
>
> - int err, duration = 0;
> + int err, duration = 0, fresh_digest_idx = 0;
> struct ima *skel = NULL;
>
> skel = ima__open_and_load();
> @@ -129,7 +129,15 @@ void test_test_ima(void)
> /*
> * Test #3
> * - Goal: confirm that bpf_ima_inode_hash() returns a non-fresh digest
> - * - Expected result: 2 samples (/bin/true: non-fresh, fresh)
> + * - Expected result:
> + * 1 sample (/bin/true: fresh) if commit 62622dab0a28 applied
> + * 2 samples (/bin/true: non-fresh, fresh) if commit 62622dab0a28 is
> + * not applied
> + *
> + * If commit 62622dab0a28 ("ima: return IMA digest value only when
> + * IMA_COLLECTED flag is set") is applied, bpf_ima_inode_hash() refuses
> + * to give a non-fresh digest, hence the correct result is 1 instead of
> + * 2.
> */
> test_init(skel->bss);
>
> @@ -144,13 +152,18 @@ void test_test_ima(void)
> goto close_clean;
>
> err = ring_buffer__consume(ringbuf);
> - ASSERT_EQ(err, 2, "num_samples_or_err");
> - ASSERT_NEQ(ima_hash_from_bpf[0], 0, "ima_hash");
> - ASSERT_NEQ(ima_hash_from_bpf[1], 0, "ima_hash");
> - ASSERT_EQ(ima_hash_from_bpf[0], bin_true_sample, "sample_equal_or_err");
> + ASSERT_GE(err, 1, "num_samples_or_err");
> + if (err == 2) {
> + ASSERT_NEQ(ima_hash_from_bpf[0], 0, "ima_hash");
> + ASSERT_EQ(ima_hash_from_bpf[0], bin_true_sample,
> + "sample_equal_or_err");
> + fresh_digest_idx = 1;
> + }
> +
> + ASSERT_NEQ(ima_hash_from_bpf[fresh_digest_idx], 0, "ima_hash");
> /* IMA refreshed the digest. */
> - ASSERT_NEQ(ima_hash_from_bpf[1], bin_true_sample,
> - "sample_different_or_err");
> + ASSERT_NEQ(ima_hash_from_bpf[fresh_digest_idx], bin_true_sample,
> + "sample_equal_or_err");
>
> /*
> * Test #4
> --
> 2.25.1
>
/M
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH] bpf: Fix IMA test
2023-03-08 11:03 ` Matt Bobrowski
@ 2023-03-08 12:05 ` Roberto Sassu
2023-03-08 12:24 ` Matt Bobrowski
0 siblings, 1 reply; 7+ messages in thread
From: Roberto Sassu @ 2023-03-08 12:05 UTC (permalink / raw)
To: Matt Bobrowski
Cc: andrii, mykolal, ast, daniel, martin.lau, song, yhs,
john.fastabend, kpsingh, sdf, haoluo, jolsa, shuah, bpf,
linux-kselftest, linux-integrity, linux-kernel, zohar,
Roberto Sassu
On Wed, 2023-03-08 at 11:03 +0000, Matt Bobrowski wrote:
> Ha! I was literally in the midst of sending through a patch for
> this. Thanks for also taking a look and beating me to it!
>
> This LGTM, feel free to add:
>
> Reviewed-by: Matt Bobrowski <mattbobrowski@google.com>
Thanks.
I have only one remain question. Should we accept the old behavior, or
simply reject it?
Roberto
> On Wed, Mar 08, 2023 at 11:37:13AM +0100, Roberto Sassu wrote:
> > From: Roberto Sassu <roberto.sassu@huawei.com>
> >
> > Commit 62622dab0a28 ("ima: return IMA digest value only when IMA_COLLECTED
> > flag is set") caused bpf_ima_inode_hash() to refuse to give non-fresh
> > digests. IMA test #3 assumed the old behavior, that bpf_ima_inode_hash()
> > still returned also non-fresh digests.
> >
> > Correct the test by accepting both cases. If the samples returned are 1,
> > assume that the commit above is applied and that the returned digest is
> > fresh. If the samples returned are 2, assume that the commit above is not
> > applied, and check both the non-fresh and fresh digest.
> >
> > Fixes: 62622dab0a28 ("ima: return IMA digest value only when IMA_COLLECTED flag is set")
> > Reported by: David Vernet <void@manifault.com>
> > Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
> > ---
> > .../selftests/bpf/prog_tests/test_ima.c | 29 ++++++++++++++-----
> > 1 file changed, 21 insertions(+), 8 deletions(-)
> >
> > diff --git a/tools/testing/selftests/bpf/prog_tests/test_ima.c b/tools/testing/selftests/bpf/prog_tests/test_ima.c
> > index b13feceb38f..810b14981c2 100644
> > --- a/tools/testing/selftests/bpf/prog_tests/test_ima.c
> > +++ b/tools/testing/selftests/bpf/prog_tests/test_ima.c
> > @@ -70,7 +70,7 @@ void test_test_ima(void)
> > u64 bin_true_sample;
> > char cmd[256];
> >
> > - int err, duration = 0;
> > + int err, duration = 0, fresh_digest_idx = 0;
> > struct ima *skel = NULL;
> >
> > skel = ima__open_and_load();
> > @@ -129,7 +129,15 @@ void test_test_ima(void)
> > /*
> > * Test #3
> > * - Goal: confirm that bpf_ima_inode_hash() returns a non-fresh digest
> > - * - Expected result: 2 samples (/bin/true: non-fresh, fresh)
> > + * - Expected result:
> > + * 1 sample (/bin/true: fresh) if commit 62622dab0a28 applied
> > + * 2 samples (/bin/true: non-fresh, fresh) if commit 62622dab0a28 is
> > + * not applied
> > + *
> > + * If commit 62622dab0a28 ("ima: return IMA digest value only when
> > + * IMA_COLLECTED flag is set") is applied, bpf_ima_inode_hash() refuses
> > + * to give a non-fresh digest, hence the correct result is 1 instead of
> > + * 2.
> > */
> > test_init(skel->bss);
> >
> > @@ -144,13 +152,18 @@ void test_test_ima(void)
> > goto close_clean;
> >
> > err = ring_buffer__consume(ringbuf);
> > - ASSERT_EQ(err, 2, "num_samples_or_err");
> > - ASSERT_NEQ(ima_hash_from_bpf[0], 0, "ima_hash");
> > - ASSERT_NEQ(ima_hash_from_bpf[1], 0, "ima_hash");
> > - ASSERT_EQ(ima_hash_from_bpf[0], bin_true_sample, "sample_equal_or_err");
> > + ASSERT_GE(err, 1, "num_samples_or_err");
> > + if (err == 2) {
> > + ASSERT_NEQ(ima_hash_from_bpf[0], 0, "ima_hash");
> > + ASSERT_EQ(ima_hash_from_bpf[0], bin_true_sample,
> > + "sample_equal_or_err");
> > + fresh_digest_idx = 1;
> > + }
> > +
> > + ASSERT_NEQ(ima_hash_from_bpf[fresh_digest_idx], 0, "ima_hash");
> > /* IMA refreshed the digest. */
> > - ASSERT_NEQ(ima_hash_from_bpf[1], bin_true_sample,
> > - "sample_different_or_err");
> > + ASSERT_NEQ(ima_hash_from_bpf[fresh_digest_idx], bin_true_sample,
> > + "sample_equal_or_err");
> >
> > /*
> > * Test #4
> > --
> > 2.25.1
> >
> /M
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH] bpf: Fix IMA test
2023-03-08 12:05 ` Roberto Sassu
@ 2023-03-08 12:24 ` Matt Bobrowski
0 siblings, 0 replies; 7+ messages in thread
From: Matt Bobrowski @ 2023-03-08 12:24 UTC (permalink / raw)
To: Roberto Sassu
Cc: andrii, mykolal, ast, daniel, martin.lau, song, yhs,
john.fastabend, kpsingh, sdf, haoluo, jolsa, shuah, bpf,
linux-kselftest, linux-integrity, linux-kernel, zohar,
Roberto Sassu
On Wed, Mar 08, 2023 at 01:05:45PM +0100, Roberto Sassu wrote:
> On Wed, 2023-03-08 at 11:03 +0000, Matt Bobrowski wrote:
> > Ha! I was literally in the midst of sending through a patch for
> > this. Thanks for also taking a look and beating me to it!
> >
> > This LGTM, feel free to add:
> >
> > Reviewed-by: Matt Bobrowski <mattbobrowski@google.com>
>
> Thanks.
>
> I have only one remain question. Should we accept the old behavior, or
> simply reject it?
I assume you mean whether we should continue supporting the old,
arguably incorrect, behavior in this test? I'm of the opinion that it
is OK, given that this is how the API behaved prior to commit
62622dab0a28.
I'll let others also chime in and share their .02 though...
> > On Wed, Mar 08, 2023 at 11:37:13AM +0100, Roberto Sassu wrote:
> > > From: Roberto Sassu <roberto.sassu@huawei.com>
> > >
> > > Commit 62622dab0a28 ("ima: return IMA digest value only when IMA_COLLECTED
> > > flag is set") caused bpf_ima_inode_hash() to refuse to give non-fresh
> > > digests. IMA test #3 assumed the old behavior, that bpf_ima_inode_hash()
> > > still returned also non-fresh digests.
> > >
> > > Correct the test by accepting both cases. If the samples returned are 1,
> > > assume that the commit above is applied and that the returned digest is
> > > fresh. If the samples returned are 2, assume that the commit above is not
> > > applied, and check both the non-fresh and fresh digest.
> > >
> > > Fixes: 62622dab0a28 ("ima: return IMA digest value only when IMA_COLLECTED flag is set")
> > > Reported by: David Vernet <void@manifault.com>
> > > Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
> > > ---
> > > .../selftests/bpf/prog_tests/test_ima.c | 29 ++++++++++++++-----
> > > 1 file changed, 21 insertions(+), 8 deletions(-)
> > >
> > > diff --git a/tools/testing/selftests/bpf/prog_tests/test_ima.c b/tools/testing/selftests/bpf/prog_tests/test_ima.c
> > > index b13feceb38f..810b14981c2 100644
> > > --- a/tools/testing/selftests/bpf/prog_tests/test_ima.c
> > > +++ b/tools/testing/selftests/bpf/prog_tests/test_ima.c
> > > @@ -70,7 +70,7 @@ void test_test_ima(void)
> > > u64 bin_true_sample;
> > > char cmd[256];
> > >
> > > - int err, duration = 0;
> > > + int err, duration = 0, fresh_digest_idx = 0;
> > > struct ima *skel = NULL;
> > >
> > > skel = ima__open_and_load();
> > > @@ -129,7 +129,15 @@ void test_test_ima(void)
> > > /*
> > > * Test #3
> > > * - Goal: confirm that bpf_ima_inode_hash() returns a non-fresh digest
> > > - * - Expected result: 2 samples (/bin/true: non-fresh, fresh)
> > > + * - Expected result:
> > > + * 1 sample (/bin/true: fresh) if commit 62622dab0a28 applied
> > > + * 2 samples (/bin/true: non-fresh, fresh) if commit 62622dab0a28 is
> > > + * not applied
> > > + *
> > > + * If commit 62622dab0a28 ("ima: return IMA digest value only when
> > > + * IMA_COLLECTED flag is set") is applied, bpf_ima_inode_hash() refuses
> > > + * to give a non-fresh digest, hence the correct result is 1 instead of
> > > + * 2.
> > > */
> > > test_init(skel->bss);
> > >
> > > @@ -144,13 +152,18 @@ void test_test_ima(void)
> > > goto close_clean;
> > >
> > > err = ring_buffer__consume(ringbuf);
> > > - ASSERT_EQ(err, 2, "num_samples_or_err");
> > > - ASSERT_NEQ(ima_hash_from_bpf[0], 0, "ima_hash");
> > > - ASSERT_NEQ(ima_hash_from_bpf[1], 0, "ima_hash");
> > > - ASSERT_EQ(ima_hash_from_bpf[0], bin_true_sample, "sample_equal_or_err");
> > > + ASSERT_GE(err, 1, "num_samples_or_err");
> > > + if (err == 2) {
> > > + ASSERT_NEQ(ima_hash_from_bpf[0], 0, "ima_hash");
> > > + ASSERT_EQ(ima_hash_from_bpf[0], bin_true_sample,
> > > + "sample_equal_or_err");
> > > + fresh_digest_idx = 1;
> > > + }
> > > +
> > > + ASSERT_NEQ(ima_hash_from_bpf[fresh_digest_idx], 0, "ima_hash");
> > > /* IMA refreshed the digest. */
> > > - ASSERT_NEQ(ima_hash_from_bpf[1], bin_true_sample,
> > > - "sample_different_or_err");
> > > + ASSERT_NEQ(ima_hash_from_bpf[fresh_digest_idx], bin_true_sample,
> > > + "sample_equal_or_err");
> > >
> > > /*
> > > * Test #4
> > > --
> > > 2.25.1
/M
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] bpf: Fix IMA test
2023-03-08 10:37 [PATCH] bpf: Fix IMA test Roberto Sassu
2023-03-08 10:40 ` Roberto Sassu
2023-03-08 11:03 ` Matt Bobrowski
@ 2023-03-08 19:20 ` patchwork-bot+netdevbpf
2 siblings, 0 replies; 7+ messages in thread
From: patchwork-bot+netdevbpf @ 2023-03-08 19:20 UTC (permalink / raw)
To: Roberto Sassu
Cc: andrii, mykolal, ast, daniel, martin.lau, song, yhs,
john.fastabend, kpsingh, sdf, haoluo, jolsa, shuah, bpf,
linux-kselftest, linux-integrity, linux-kernel, mattbobrowski,
zohar, roberto.sassu
Hello:
This patch was applied to bpf/bpf-next.git (master)
by Andrii Nakryiko <andrii@kernel.org>:
On Wed, 8 Mar 2023 11:37:13 +0100 you wrote:
> From: Roberto Sassu <roberto.sassu@huawei.com>
>
> Commit 62622dab0a28 ("ima: return IMA digest value only when IMA_COLLECTED
> flag is set") caused bpf_ima_inode_hash() to refuse to give non-fresh
> digests. IMA test #3 assumed the old behavior, that bpf_ima_inode_hash()
> still returned also non-fresh digests.
>
> [...]
Here is the summary with links:
- bpf: Fix IMA test
https://git.kernel.org/bpf/bpf-next/c/12fabae03ca6
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 7+ messages in thread