[LTP] [PATCH] ima_tpm.sh: properly detect failure to verify the IMA measurement list

[LTP] [PATCH] ima_tpm.sh: properly detect failure to verify the IMA measurement list

[Mimi Zohar]

test2 attempts to compare the aggregate PCR-10 value with the current
TPM PCR value based on the current measurement list, but does not take
into account that the measurement list might have been extended.

evmctl returns success/failure when verifying the IMA measurement list
and displays the measurement list line number that matched. Update
test2.

Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
---
 .../security/integrity/ima/tests/ima_tpm.sh   | 34 +++++++++++++------
 1 file changed, 23 insertions(+), 11 deletions(-)

diff --git a/testcases/kernel/security/integrity/ima/tests/ima_tpm.sh b/testcases/kernel/security/integrity/ima/tests/ima_tpm.sh
index acd8b6d30..5f7a5e983 100755
--- a/testcases/kernel/security/integrity/ima/tests/ima_tpm.sh
+++ b/testcases/kernel/security/integrity/ima/tests/ima_tpm.sh
@@ -146,7 +146,7 @@ get_pcr10_aggregate()
 	local num_violations=0
 	local msg="$ERRMSG_EVMCTL"
 	local res=TCONF
-	local pcr ret
+	local lineno pcr ret
 
 	if [ -z "$MISSING_EVMCTL" ]; then
 		msg=
@@ -178,10 +178,13 @@ get_pcr10_aggregate()
 		tst_res $res "failed to find aggregate PCR-10 $msg"
 		tst_res TINFO "hash file:"
 		cat hash.txt >&2
-		return
+		return 1
 	fi
 
-	echo "$pcr"
+	lineno=$(grep -E "^($ALGORITHM )*PCR(.*10)*: succeed at entry" hash.txt | tail -1 \
+		| awk '{print $NF}')
+	echo "$pcr $lineno"
+	return $ret
 }
 
 test1_tpm_bypass_mode()
@@ -249,7 +252,9 @@ test1()
 
 test2()
 {
-	local hash pcr_aggregate out ret
+	local hash pcr_aggregate lineno out ret
+	local measurement_count="$IMA_DIR/runtime_measurements_count"
+	local total_measurements
 
 	tst_res TINFO "verify PCR values"
 
@@ -288,14 +293,21 @@ test2()
 	tst_res TINFO "real PCR-10: '$hash'"
 
 	get_pcr10_aggregate > tmp.txt
-	pcr_aggregate="$(cat tmp.txt)"
-	if [ -z "$pcr_aggregate" ]; then
-		return
-	fi
-	tst_res TINFO "aggregate PCR-10: '$pcr_aggregate'"
+	if [ $? -eq 0 ]; then
+		pcr_aggregate="$(cat tmp.txt | cut -d " " -f1)"
+		if [ -z "$pcr_aggregate" ]; then
+			return
+		fi
+		tst_res TINFO "aggregate PCR-10: '$pcr_aggregate'"
 
-	if [ "$hash" = "$pcr_aggregate" ]; then
-		tst_res TPASS "aggregate PCR value matches real PCR value"
+		lineno="$(cat tmp.txt | cut -d " " -f2)"
+
+		if [ "$hash" = "$pcr_aggregate" ]; then
+			tst_res TPASS "aggregate PCR value matches real PCR value (line: $lineno)"
+		else
+			total_measurements=$(cat "$measurement_count")
+			tst_res TPASS "aggregate PCR value matched real PCR value (line: $lineno/$total_measurements)"
+		fi
 	else
 		tst_res TFAIL "aggregate PCR value does not match real PCR value"
 	fi
-- 
2.55.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] ima_tpm.sh: properly detect failure to verify the IMA measurement list

[linuxtestproject.agent]

Hi Mimi,

On Tue, 25 Aug 2026, Mimi Zohar wrote:
> ima_tpm.sh: properly detect failure to verify the IMA measurement list

> 	if [ -z "$pcr" ]; then
> 		tst_res $res "failed to find aggregate PCR-10 $msg"
> 		tst_res TINFO "hash file:"
> 		cat hash.txt >&2
> -		return
> +		return 1
> 	fi

> +	else
> +		tst_res TFAIL "aggregate PCR value does not match real PCR value"
> +	fi

Could the helper's result classification be preserved here instead of
unconditionally adding TFAIL for every nonzero return?

When evmctl is older than 1.3.1 with a SHA-1 measurement list, setup allows
the test to continue with MISSING_EVMCTL=1. If that evmctl does not produce
a parseable aggregate, the helper reports TCONF through $res, but the new
return path then also records TFAIL. Since tst_res retains both result bits,
this unsupported-tool path becomes a test failure.

Verdict - Needs revision

---
Note:

The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.

Regards,
LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] ima_tpm.sh: properly detect failure to verify the IMA measurement list

[linuxtestproject.agent]

Hi Mimi,

On Wed, 26 Aug 2026, Mimi Zohar wrote:
> ima_tpm.sh: properly detect failure to verify the IMA measurement list

> -	pcr_aggregate="$(cat tmp.txt)"
> +	ret=$?
> +
> +	pcr_aggregate="$(cat tmp.txt | awk '{print $1}')"

The cat here is redundant, awk can read the file directly:

	pcr_aggregate="$(awk '{print $1}' tmp.txt)"

> +	elif [ $ret -eq 0 ]; then
> +		lineno="$(cat tmp.txt | awk '{print $2}')"

Same here:

	lineno="$(awk '{print $2}' tmp.txt)"

> +		tst_res TPASS "aggregate PCR value matched real PCR value (line: $lineno/$total_measurements)"

This line is about 100 columns wide. LTP shell style asks for lines
under 80 characters; perhaps wrap it or shorten the message.

Verdict - Needs revision

---
Note:

The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.

Regards,
LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] ima_tpm.sh: properly detect failure to verify the IMA measurement list

[Andrea Cervesato via ltp]

Hi Mimi,

> > +	pcr_aggregate="$(cat tmp.txt | awk '{print $1}')"
> 
> The cat here is redundant, awk can read the file directly:
> 

This is valid.

> > +		lineno="$(cat tmp.txt | awk '{print $2}')"
> 
> Same here:
> 
> 	lineno="$(awk '{print $2}' tmp.txt)"

[..]

> 
> > +		tst_res TPASS "aggregate PCR value matched real PCR value (line: $lineno/$total_measurements)"
> 
> This line is about 100 columns wide. LTP shell style asks for lines
> under 80 characters; perhaps wrap it or shorten the message.

we can ignore this one.

@Petr can you please take a look?

--
Andrea Cervesato
SUSE QE Automation Engineer Linux
andrea.cervesato@suse.com

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] ima_tpm.sh: properly detect failure to verify the IMA measurement list

[Petr Vorel]

Hi Mimi, Andrea,

> Hi Mimi,

> > > +	pcr_aggregate="$(cat tmp.txt | awk '{print $1}')"

> > The cat here is redundant, awk can read the file directly:


> This is valid.

+1, agent did a good job here :). We could even avoid using tail (awk has this
feature), but let's ignore that.

As it is trivial, I can change it before merge (see diff below).

> > > +		lineno="$(cat tmp.txt | awk '{print $2}')"

> > Same here:

> > 	lineno="$(awk '{print $2}' tmp.txt)"

> [..]


> > > +		tst_res TPASS "aggregate PCR value matched real PCR value (line: $lineno/$total_measurements)"

> > This line is about 100 columns wide. LTP shell style asks for lines
> > under 80 characters; perhaps wrap it or shorten the message.

> we can ignore this one.

We should teach agent that splitting quotes string does more harm than slightly
longer line.

> @Petr can you please take a look?

Sure :). FYI I already did have a brief look yesterday, and I also triggered CI
jobs for v1 and wait them to finish. Of course I'll rerun them for v2.

@Mimi FYI v1 patch triggers failure - it just calculate a different
aggregate PCR-10. Although the commit subject is "properly detect failure" ..
I'm not sure if this is a false negative or the current code on master just did
not find error (false positive). As I said, I'll rerun v2 and let you know if
it's the same.

Testing on openSUSE Tumbleweed x86_64 VM with kernel: 7.1.8-1, virtualized TPM
2.0, evmctl 1.6.2. Working master [1], broken with your patch [2].

FYI TPM 2.0 used:

swtpm socket --tpmstate dir=/tmp/mytpm25 --ctrl \
type=unixio,path=/tmp/mytpm25/swtpm-sock --log level=20 -d --tpm2

Whole QEMU command:

/usr/bin/qemu-system-x86_64 -device VGA,edid=on,xres=1024,yres=768 \
-only-migratable -chardev ringbuf,id=serial0,logfile=serial0,logappend=on \
-serial chardev:serial0 -audiodev none,id=snd0 -device intel-hda -device \
hda-output,audiodev=snd0 -global isa-fdc.fdtypeA=none -m 1536 -cpu host -netdev \
user,id=qanet0 -device virtio-net,netdev=qanet0,mac=52:54:00:12:34:56 -object \
rng-random,filename=/dev/urandom,id=rng0 -device virtio-rng-pci,rng=rng0 \
-chardev socket,id=chrtpm,path=/tmp/mytpm25/swtpm-sock -tpmdev \
emulator,id=tpm0,chardev=chrtpm -device tpm-tis,tpmdev=tpm0 -boot order=c \
-device qemu-xhci -device usb-tablet -smp 1 -enable-kvm -no-shutdown -vnc \
:115,share=force-shared -device virtio-serial -chardev \
pipe,id=virtio_console,path=virtio_console,logfile=virtio_console.log,logappend=on \
-device \
virtconsole,chardev=virtio_console,name=org.openqa.console.virtio_console \
-chardev \
pipe,id=virtio_console_user,path=virtio_console_user,logfile=virtio_console_user.log,logappend=on \
-device \
virtconsole,chardev=virtio_console_user,name=org.openqa.console.virtio_console_user \
-chardev \
socket,path=qmp_socket,server=on,wait=off,id=qmp_socket,logfile=qmp_socket.log,logappend=on \
-qmp chardev:qmp_socket -S -device virtio-scsi-pci,id=scsi0 -blockdev \
driver=file,node-name=hd0-overlay0-file,filename=/var/lib/openqa/pool/25/raid/hd0-overlay0,cache.no-flush=on \
-blockdev \
driver=qcow2,node-name=hd0-overlay0,file=hd0-overlay0-file,cache.no-flush=on,discard=unmap \
-device virtio-blk,id=hd0-device,drive=hd0-overlay0,bootindex=0,serial=hd0 \
-blockdev \
driver=file,node-name=cd0-overlay0-file,filename=/var/lib/openqa/pool/25/raid/cd0-overlay0,cache.no-flush=on \
-blockdev \
driver=qcow2,node-name=cd0-overlay0,file=cd0-overlay0-file,cache.no-flush=on,discard=unmap \
-device scsi-cd,id=cd0-device,drive=cd0-overlay0,serial=cd0

Kind regards,
Petr

[1] https://openqa.opensuse.org/tests/6185158#step/ima_tpm/4
[2] https://openqa.opensuse.org/tests/6185106#step/ima_tpm/4
[3] https://openqa.opensuse.org/tests/6185106/file/autoinst-log.txt

diff --git testcases/kernel/security/integrity/ima/tests/ima_tpm.sh testcases/kernel/security/integrity/ima/tests/ima_tpm.sh
index 8bb86ea4ac..edf8699f83 100755
--- testcases/kernel/security/integrity/ima/tests/ima_tpm.sh
+++ testcases/kernel/security/integrity/ima/tests/ima_tpm.sh
@@ -295,7 +295,7 @@ test2()
 	get_pcr10_aggregate > tmp.txt
 	ret=$?
 
-	pcr_aggregate="$(cat tmp.txt | awk '{print $1}')"
+	pcr_aggregate="$(awk '{print $1}' tmp.txt)"
 	if [ -z "$pcr_aggregate" ]; then
 		return
 	fi
@@ -304,7 +304,7 @@ test2()
 	if [ "$hash" = "$pcr_aggregate" ]; then
 		tst_res TPASS "aggregate PCR value matches real PCR value"
 	elif [ $ret -eq 0 ]; then
-		lineno="$(cat tmp.txt | awk '{print $2}')"
+		lineno="$(awk '{print $2}' tmp.txt)"
 		if [ -z "$lineno" ]; then
 			return
 		fi

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] ima_tpm.sh: properly detect failure to verify the IMA measurement list

[Petr Vorel]

Hi Mimi,

...
> @Mimi FYI v1 patch triggers failure - it just calculate a different
> aggregate PCR-10. Although the commit subject is "properly detect failure" ..
> I'm not sure if this is a false negative or the current code on master just did
> not find error (false positive). As I said, I'll rerun v2 and let you know if
> it's the same.

> Testing on openSUSE Tumbleweed x86_64 VM with kernel: 7.1.8-1, virtualized TPM
> 2.0, evmctl 1.6.2. Working master [1], broken with your patch [2].

FYI tested on BIOS (legacy).

> FYI TPM 2.0 used:

> swtpm socket --tpmstate dir=/tmp/mytpm25 --ctrl \
> type=unixio,path=/tmp/mytpm25/swtpm-sock --log level=20 -d --tpm2

> Whole QEMU command:

> /usr/bin/qemu-system-x86_64 -device VGA,edid=on,xres=1024,yres=768 \
> -only-migratable -chardev ringbuf,id=serial0,logfile=serial0,logappend=on \
> -serial chardev:serial0 -audiodev none,id=snd0 -device intel-hda -device \
> hda-output,audiodev=snd0 -global isa-fdc.fdtypeA=none -m 1536 -cpu host -netdev \
> user,id=qanet0 -device virtio-net,netdev=qanet0,mac=52:54:00:12:34:56 -object \
> rng-random,filename=/dev/urandom,id=rng0 -device virtio-rng-pci,rng=rng0 \
> -chardev socket,id=chrtpm,path=/tmp/mytpm25/swtpm-sock -tpmdev \
> emulator,id=tpm0,chardev=chrtpm -device tpm-tis,tpmdev=tpm0 -boot order=c \
> -device qemu-xhci -device usb-tablet -smp 1 -enable-kvm -no-shutdown -vnc \
> :115,share=force-shared -device virtio-serial -chardev \
> pipe,id=virtio_console,path=virtio_console,logfile=virtio_console.log,logappend=on \
> -device \
> virtconsole,chardev=virtio_console,name=org.openqa.console.virtio_console \
> -chardev \
> pipe,id=virtio_console_user,path=virtio_console_user,logfile=virtio_console_user.log,logappend=on \
> -device \
> virtconsole,chardev=virtio_console_user,name=org.openqa.console.virtio_console_user \
> -chardev \
> socket,path=qmp_socket,server=on,wait=off,id=qmp_socket,logfile=qmp_socket.log,logappend=on \
> -qmp chardev:qmp_socket -S -device virtio-scsi-pci,id=scsi0 -blockdev \
> driver=file,node-name=hd0-overlay0-file,filename=/var/lib/openqa/pool/25/raid/hd0-overlay0,cache.no-flush=on \
> -blockdev \
> driver=qcow2,node-name=hd0-overlay0,file=hd0-overlay0-file,cache.no-flush=on,discard=unmap \
> -device virtio-blk,id=hd0-device,drive=hd0-overlay0,bootindex=0,serial=hd0 \
> -blockdev \
> driver=file,node-name=cd0-overlay0-file,filename=/var/lib/openqa/pool/25/raid/cd0-overlay0,cache.no-flush=on \
> -blockdev \
> driver=qcow2,node-name=cd0-overlay0,file=cd0-overlay0-file,cache.no-flush=on,discard=unmap \
> -device scsi-cd,id=cd0-device,drive=cd0-overlay0,serial=cd0

> Kind regards,
> Petr

> [1] https://openqa.opensuse.org/tests/6185158#step/ima_tpm/4
> [2] https://openqa.opensuse.org/tests/6185106#step/ima_tpm/4
Maybe the wrapped version is easier to read
https://openqa.opensuse.org/tests/6187473#step/ima_tpm/6

> [3] https://openqa.opensuse.org/tests/6185106/file/autoinst-log.txt
https://openqa.opensuse.org/tests/6187580#step/ima_tpm/6

BTW tested on other VM locally (outside of openQA testing framework)
with emulated TPM 2.0 I have even 2 tests failing.

$ cat /sys/class/tpm/tpm*/tpm_version_major
2

$ evmctl ima_boot_aggregate -v; echo $?
Failed to read TPM 1.2 PCRs (errno: No such file or directory)
Using tss2-rc-decode to read PCRs.
ERROR:tcti:src/tss2-tcti/tctildr-dl.c:263:tctildr_get_default() No standard TCTI could be loaded 
ERROR:tcti:src/tss2-tcti/tctildr.c:477:tctildr_init_context_data() Failed to instantiate TCTI 
ERROR:esys:src/tss2-esys/esys_context.c:71:Esys_Initialize() Initialize default tcti. ErrorCode (0x000a000a) 
read_tpm_banks:2208 Failed to read sha1 PCRs: (esys initialize failed: tcti:IO failure)
ERROR:tcti:src/tss2-tcti/tctildr-dl.c:263:tctildr_get_default() No standard TCTI could be loaded 
ERROR:tcti:src/tss2-tcti/tctildr.c:477:tctildr_init_context_data() Failed to instantiate TCTI 
ERROR:esys:src/tss2-esys/esys_context.c:71:Esys_Initialize() Initialize default tcti. ErrorCode (0x000a000a) 
read_tpm_banks:2208 Failed to read sha256 PCRs: (esys initialize failed: tcti:IO failure)
Failed to read any TPM PCRs
errno: No such file or directory (2)
125

I need to use also --hwtpm:
$ evmctl ima_boot_aggregate -v --hwtpm; echo $?
Failed to read TPM 1.2 PCRs (errno: No such file or directory)
Trying to read TPM 2.0 PCRs via sysfs
Failed to read TPM 2.0 PCRs via sysfs (errno: No such file or directory)
sha256:e911229581efb7ceb82826940c7e939d05dbc33b38862730651767ab5bd7c446
0

This is on VM BIOS (legacy) running on UEFI QEMU host.

The same behaves when running this on the machine itself (in UEFI QEMU host,
outside of the VM).

Other, unrelated problem is that evmctl blocks on UEFI VM on UEFI QEMU host
(w/a --hwtpm) without any TPM on tss2-rc, but that might be caused just by old
VM, I'll retest and report if it persists.

OT: it'd be nice to describe exit values in evmctl man page.

Kind regards,
Petr

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] ima_tpm.sh: properly detect failure to verify the IMA measurement list

[Mimi Zohar]

Hi Andrea, Petr,

Thank you for reviewing/testing/updating the v1/v2.

On Thu, 2026-08-27 at 12:22 +0200, Petr Vorel wrote:
> > @Petr can you please take a look?
> 
> Sure :). FYI I already did have a brief look yesterday, and I also triggered CI
> jobs for v1 and wait them to finish. Of course I'll rerun them for v2.
> 
> @Mimi FYI v1 patch triggers failure - it just calculate a different
> aggregate PCR-10. Although the commit subject is "properly detect failure" ..
> I'm not sure if this is a false negative or the current code on master just did
> not find error (false positive). As I said, I'll rerun v2 and let you know if
> it's the same.

I've been testing on real HW with a physical TPM, not in a virtual VM.  

Without a dont_measure policy rule to eliminate the "systemd_unit_file_t"
measurements, the number of measurements grows really fast.  The results of
test2 looks like:

ima_tpm 2 TINFO: verify PCR values
ima_tpm 2 TINFO: real PCR-10:
'ea84103155e8a91974c2706db94f91e396dad3f91430648224e19f17790716d8'
ima_tpm 2 TINFO: ignoring 5 violations
ima_tpm 2 TINFO: aggregate PCR-10:
'4608820a46bb8ad5e4d95b6f94273e76f1f12ca8c61b84d01aaed7b0fb226a74'
ima_tpm 2 TPASS: aggregate PCR value matched real PCR value (line: 7147/7634)

> 
> Testing on openSUSE Tumbleweed x86_64 VM with kernel: 7.1.8-1, virtualized TPM
> 2.0, evmctl 1.6.2. Working master [1], broken with your patch [2].

Interesting that with this simple patch, test2 now fails.

Mimi

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp