[LTP] [PATCH] ima_tpm.sh: update test2 to detect integrity violations

[LTP] [PATCH] ima_tpm.sh: update test2 to detect integrity violations

[Mimi Zohar]

<securityfs>/integrity/ima/violations reflects the number of
integrity violations.  Include the "--ignore-violations" option,
if there are any violations, on the initial IMA measurement list
verification.

Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
---
 .../security/integrity/ima/tests/ima_tpm.sh   | 20 ++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/testcases/kernel/security/integrity/ima/tests/ima_tpm.sh b/testcases/kernel/security/integrity/ima/tests/ima_tpm.sh
index 5d34d8679..acd8b6d30 100755
--- a/testcases/kernel/security/integrity/ima/tests/ima_tpm.sh
+++ b/testcases/kernel/security/integrity/ima/tests/ima_tpm.sh
@@ -142,6 +142,8 @@ read_pcr_tpm2()
 get_pcr10_aggregate()
 {
 	local cmd="evmctl -vv ima_measurement $BINARY_MEASUREMENTS"
+	local violations="$IMA_DIR/violations"
+	local num_violations=0
 	local msg="$ERRMSG_EVMCTL"
 	local res=TCONF
 	local pcr ret
@@ -151,16 +153,20 @@ get_pcr10_aggregate()
 		res=TFAIL
 	fi
 
-	$cmd > hash.txt 2>&1
-	ret=$?
-	if [ $ret -ne 0 -a -z "$MISSING_EVMCTL" ]; then
-		tst_res TFAIL "evmctl failed, trying with --ignore-violations"
+	if [ ! -f "$violations" ]; then
+		tst_res TINFO "missing $violations"
+	else
+		num_violations=$(cat "$violations")
+	fi
+
+	if [ "$num_violations" -eq 0 ]; then
+		$cmd > hash.txt 2>&1
+		ret=$?
+	else
+		tst_res TINFO "ignoring $num_violations violations"
 		cmd="$cmd --ignore-violations"
 		$cmd > hash.txt 2>&1
 		ret=$?
-	elif [ $ret -ne 0 -a "$MISSING_EVMCTL" = 1 ]; then
-		tst_res TFAIL "evmctl failed $msg"
-		return
 	fi
 
 	[ $ret -ne 0 ] && tst_res TWARN "evmctl failed, trying to continue $msg"
-- 
2.55.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] ima_tpm.sh: update test2 to detect integrity violations

[linuxtestproject.agent]

Hi Mimi,

On Fri, Aug 14, 2026, Mimi Zohar wrote:
> ima_tpm.sh: update test2 to detect integrity violations

> +	if [ "$num_violations" -eq 0 ]; then
> +		$cmd > hash.txt 2>&1
> +		ret=$?
> +	else
> +		tst_res TINFO "ignoring $num_violations violations"
> 		cmd="$cmd --ignore-violations"

Could the failure path of the unflagged invocation retain a retry with
--ignore-violations?

The counter read races with new IMA violations. If another task triggers a
ToMToU or open_writers violation after the counter is read as zero but before
evmctl reads the PCRs, the kernel appends a zero-digest record and extends the
PCR with 0xff. This invocation processes that record without
--ignore-violations, extends zeroes instead, and reports a spurious PCR
mismatch. The removed fallback covered this window.

Verdict - Needs revision

---
Note:

The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.

Regards,
LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH] ima_tpm.sh: update test2 to detect integrity violations

[Petr Vorel]

Hi Mimi,

> <securityfs>/integrity/ima/violations reflects the number of
> integrity violations.  Include the "--ignore-violations" option,
> if there are any violations, on the initial IMA measurement list
> verification.

Thanks for your patch!

LGTM and it should be fixed. But there are some potential problems
(see bellow).

> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
> ---
>  .../security/integrity/ima/tests/ima_tpm.sh   | 20 ++++++++++++-------
>  1 file changed, 13 insertions(+), 7 deletions(-)

> diff --git a/testcases/kernel/security/integrity/ima/tests/ima_tpm.sh b/testcases/kernel/security/integrity/ima/tests/ima_tpm.sh
> index 5d34d8679..acd8b6d30 100755
> --- a/testcases/kernel/security/integrity/ima/tests/ima_tpm.sh
> +++ b/testcases/kernel/security/integrity/ima/tests/ima_tpm.sh
> @@ -142,6 +142,8 @@ read_pcr_tpm2()
>  get_pcr10_aggregate()
>  {
>  	local cmd="evmctl -vv ima_measurement $BINARY_MEASUREMENTS"
> +	local violations="$IMA_DIR/violations"
> +	local num_violations=0
>  	local msg="$ERRMSG_EVMCTL"
>  	local res=TCONF
>  	local pcr ret
> @@ -151,16 +153,20 @@ get_pcr10_aggregate()
>  		res=TFAIL
>  	fi

> -	$cmd > hash.txt 2>&1
> -	ret=$?
> -	if [ $ret -ne 0 -a -z "$MISSING_EVMCTL" ]; then
> -		tst_res TFAIL "evmctl failed, trying with --ignore-violations"
You removed TFAIL (potential problem, see later).

> +	if [ ! -f "$violations" ]; then
> +		tst_res TINFO "missing $violations"
> +	else
> +		num_violations=$(cat "$violations")
> +	fi
> +
> +	if [ "$num_violations" -eq 0 ]; then
> +		$cmd > hash.txt 2>&1
> +		ret=$?
> +	else
> +		tst_res TINFO "ignoring $num_violations violations"
>  		cmd="$cmd --ignore-violations"
>  		$cmd > hash.txt 2>&1
>  		ret=$?
> -	elif [ $ret -ne 0 -a "$MISSING_EVMCTL" = 1 ]; then
> -		tst_res TFAIL "evmctl failed $msg"
And here again removed TFAIL (see later).

The main problem is that you removed the code when evmctl is not installed.

Therefore trying to rerun evmctl on failure on older release (e.g. 1.3) it will
fail due option have different name or not exist at all in evmctl < 1.2).
-a "$MISSING_EVMCTL" = 1 check had meaning "don't rerun with --ignore-violations
on old evmctl which does not have the option.

FYI the code is a bit complicated, because here on TPM2 we require evmctl 1.3.1
to have --ignore-violations (renamed from --validate), which was released in
2020 - too new for old enterprise distros to ignore; also TPM1 we require only
1.1 from 2018, probably still too new. Once SLE12-SP3 EOL (in 1 year we may just
expect 1.3.1 to simplify).

> -		return
>  	fi

>  	[ $ret -ne 0 ] && tst_res TWARN "evmctl failed, trying to continue $msg"
Back to removed TFAIL. While this is OK as TWARN (some problem, but not related
to testing) we might end up to TBROK "Test didn't report any results" error in
tst_test.sh which quits test with TBROK "Test didn't report any results" if
there is no TPASS/TFAIL/TCONF message.

_tst_resstr()
{
	echo "$TST_PASS$TST_FAIL$TST_CONF"
}

_tst_rescmp()
{
	local res=$(_tst_resstr)

	if [ "$1" = "$res" ]; then
		tst_brk TBROK "Test didn't report any results"
	fi
}

And this happen later in test2():
	get_pcr10_aggregate > tmp.txt
	pcr_aggregate="$(cat tmp.txt)"
	if [ -z "$pcr_aggregate" ]; then
		return
	fi

Other option would be to print TFAIL message in test2():

	get_pcr10_aggregate > tmp.txt
	pcr_aggregate="$(cat tmp.txt)"
	if [ -z "$pcr_aggregate" ]; then
		tst_res TBROK "failed to get aggregate PCR-10"
		return
	fi

Lol, I'm disappointed how complicated and error prone I wrote back then.
Part of the problem is that quit with tst_brk does not work, when code which
does it is run in a subshell (via $(...) or `...) ), which quits subshell but
not the parent shell.

Kind regards,
Petr

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH] ima_tpm.sh: update test2 to detect integrity violations

[Mimi Zohar]

Hi Petr,

On Mon, 2026-08-17 at 12:55 +0200, Petr Vorel wrote:
> Hi Mimi,
> 
> > <securityfs>/integrity/ima/violations reflects the number of
> > integrity violations.  Include the "--ignore-violations" option,
> > if there are any violations, on the initial IMA measurement list
> > verification.
> 
> Thanks for your patch!
> 
> LGTM and it should be fixed. But there are some potential problems
> (see bellow).

And here I thought this was a simple performance improvement to execute evmctl
with/without the --ignore-violations option once.

> 
> > Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
> > ---
> >  .../security/integrity/ima/tests/ima_tpm.sh   | 20 ++++++++++++-------
> >  1 file changed, 13 insertions(+), 7 deletions(-)
> 
> > diff --git a/testcases/kernel/security/integrity/ima/tests/ima_tpm.sh b/testcases/kernel/security/integrity/ima/tests/ima_tpm.sh
> > index 5d34d8679..acd8b6d30 100755
> > --- a/testcases/kernel/security/integrity/ima/tests/ima_tpm.sh
> > +++ b/testcases/kernel/security/integrity/ima/tests/ima_tpm.sh
> > @@ -142,6 +142,8 @@ read_pcr_tpm2()
> >  get_pcr10_aggregate()
> >  {
> >  	local cmd="evmctl -vv ima_measurement $BINARY_MEASUREMENTS"
> > +	local violations="$IMA_DIR/violations"
> > +	local num_violations=0
> >  	local msg="$ERRMSG_EVMCTL"
> >  	local res=TCONF
> >  	local pcr ret
> > @@ -151,16 +153,20 @@ get_pcr10_aggregate()
> >  		res=TFAIL
> >  	fi
> 
> > -	$cmd > hash.txt 2>&1
> > -	ret=$?
> > -	if [ $ret -ne 0 -a -z "$MISSING_EVMCTL" ]; then
> > -		tst_res TFAIL "evmctl failed, trying with --ignore-violations"
> You removed TFAIL (potential problem, see later).
> 
> > +	if [ ! -f "$violations" ]; then
> > +		tst_res TINFO "missing $violations"
> > +	else
> > +		num_violations=$(cat "$violations")
> > +	fi
> > +
> > +	if [ "$num_violations" -eq 0 ]; then
> > +		$cmd > hash.txt 2>&1
> > +		ret=$?
> > +	else
> > +		tst_res TINFO "ignoring $num_violations violations"
> >  		cmd="$cmd --ignore-violations"
> >  		$cmd > hash.txt 2>&1
> >  		ret=$?
> > -	elif [ $ret -ne 0 -a "$MISSING_EVMCTL" = 1 ]; then
> > -		tst_res TFAIL "evmctl failed $msg"
> And here again removed TFAIL (see later).
> 
> The main problem is that you removed the code when evmctl is not installed.

If I'm understanding the code correctly, the original code executed evmctl
whether it existed or not.  Let's fix that first.  My question is whether the
test should fail or be skipped?

> 
> Therefore trying to rerun evmctl on failure on older release (e.g. 1.3) it will
> fail due option have different name or not exist at all in evmctl < 1.2).
> -a "$MISSING_EVMCTL" = 1 check had meaning "don't rerun with --ignore-violations
> on old evmctl which does not have the option.

Thank you for the explanation.

Before appending the "--ignore-violations" we should make sure it is supported.
I guess for backwards compatibility we still want to verify the measurement
list, knowing it will fail.

Hopefully with these two changes this patch will work properly.

Mimi

> 
> FYI the code is a bit complicated, because here on TPM2 we require evmctl 1.3.1
> to have --ignore-violations (renamed from --validate), which was released in
> 2020 - too new for old enterprise distros to ignore; also TPM1 we require only
> 1.1 from 2018, probably still too new. Once SLE12-SP3 EOL (in 1 year we may just
> expect 1.3.1 to simplify).
> 
> > -		return
> >  	fi
> 
> >  	[ $ret -ne 0 ] && tst_res TWARN "evmctl failed, trying to continue $msg"
> Back to removed TFAIL. While this is OK as TWARN (some problem, but not related
> to testing) we might end up to TBROK "Test didn't report any results" error in
> tst_test.sh which quits test with TBROK "Test didn't report any results" if
> there is no TPASS/TFAIL/TCONF message.
> 
> _tst_resstr()
> {
> 	echo "$TST_PASS$TST_FAIL$TST_CONF"
> }
> 
> _tst_rescmp()
> {
> 	local res=$(_tst_resstr)
> 
> 	if [ "$1" = "$res" ]; then
> 		tst_brk TBROK "Test didn't report any results"
> 	fi
> }
> 
> And this happen later in test2():
> 	get_pcr10_aggregate > tmp.txt
> 	pcr_aggregate="$(cat tmp.txt)"
> 	if [ -z "$pcr_aggregate" ]; then
> 		return
> 	fi
> 
> Other option would be to print TFAIL message in test2():
> 
> 	get_pcr10_aggregate > tmp.txt
> 	pcr_aggregate="$(cat tmp.txt)"
> 	if [ -z "$pcr_aggregate" ]; then
> 		tst_res TBROK "failed to get aggregate PCR-10"
> 		return
> 	fi
> 
> Lol, I'm disappointed how complicated and error prone I wrote back then.
> Part of the problem is that quit with tst_brk does not work, when code which
> does it is run in a subshell (via $(...) or `...) ), which quits subshell but
> not the parent shell.

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp