From: Petr Vorel <pvorel@suse.cz>
To: ltp@lists.linux.it
Subject: [LTP] [PATCH ltp v3 1/2] IMA: Move check_policy_writable to ima_setup.sh and rename it
Date: Fri, 17 Sep 2021 13:16:35 +0200 [thread overview]
Message-ID: <YUR5E6eFMxieUbWA@pevik> (raw)
In-Reply-To: <20210914161503.97495-1-alexh@vpitech.com>
Hi Alex,
...
> --- a/testcases/kernel/security/integrity/ima/tests/ima_setup.sh
As it's now a generally used function I'll add a comment:
# Because we don't grep kernel config for CONFIG_IMA_WRITE_POLICY, we just try
# to write empty string (invalid), thus policy must be repeatedly checked.
# Because after first write to policy policy will be removed on systems without
# CONFIG_IMA_WRITE_POLICY.
> +require_policy_writable()
> +{
> + local err="IMA policy already loaded and kernel not configured to enable multiple writes to it (need CONFIG_IMA_WRITE_POLICY=y)"
> +
> + [ -f $IMA_POLICY ] || tst_brk TCONF "$err"
> + # CONFIG_IMA_READ_POLICY
> + echo "" 2> log > $IMA_POLICY
> + grep -q "Device or resource busy" log && tst_brk TCONF "$err"
> +}
> +
Kind regards,
Petr
WARNING: multiple messages have this Message-ID (diff)
From: Petr Vorel <pvorel@suse.cz>
To: Alex Henrie <alexh@vpitech.com>
Cc: linux-integrity@vger.kernel.org, ltp@lists.linux.it
Subject: Re: [LTP] [PATCH ltp v3 1/2] IMA: Move check_policy_writable to ima_setup.sh and rename it
Date: Fri, 17 Sep 2021 13:16:35 +0200 [thread overview]
Message-ID: <YUR5E6eFMxieUbWA@pevik> (raw)
Message-ID: <20210917111635.bOw9IYzJa_b7erp5-WtZ7vrrocddDj7-7W1CYk-bggM@z> (raw)
In-Reply-To: <20210914161503.97495-1-alexh@vpitech.com>
Hi Alex,
...
> --- a/testcases/kernel/security/integrity/ima/tests/ima_setup.sh
As it's now a generally used function I'll add a comment:
# Because we don't grep kernel config for CONFIG_IMA_WRITE_POLICY, we just try
# to write empty string (invalid), thus policy must be repeatedly checked.
# Because after first write to policy policy will be removed on systems without
# CONFIG_IMA_WRITE_POLICY.
> +require_policy_writable()
> +{
> + local err="IMA policy already loaded and kernel not configured to enable multiple writes to it (need CONFIG_IMA_WRITE_POLICY=y)"
> +
> + [ -f $IMA_POLICY ] || tst_brk TCONF "$err"
> + # CONFIG_IMA_READ_POLICY
> + echo "" 2> log > $IMA_POLICY
> + grep -q "Device or resource busy" log && tst_brk TCONF "$err"
> +}
> +
Kind regards,
Petr
--
Mailing list info: https://lists.linux.it/listinfo/ltp
next prev parent reply other threads:[~2021-09-17 11:16 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-09-14 16:15 [LTP] [PATCH ltp v3 1/2] IMA: Move check_policy_writable to ima_setup.sh and rename it Alex Henrie
2021-09-14 16:15 ` Alex Henrie
2021-09-14 16:15 ` [LTP] [PATCH ltp v3 2/2] IMA: Add tests for uid, gid, fowner, and fgroup options Alex Henrie
2021-09-14 16:15 ` Alex Henrie
2021-09-17 11:05 ` Petr Vorel
2021-09-17 11:05 ` Petr Vorel
2021-09-17 12:01 ` Petr Vorel
2021-09-17 12:01 ` Petr Vorel
2021-09-17 11:16 ` Petr Vorel [this message]
2021-09-17 11:16 ` [LTP] [PATCH ltp v3 1/2] IMA: Move check_policy_writable to ima_setup.sh and rename it Petr Vorel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YUR5E6eFMxieUbWA@pevik \
--to=pvorel@suse.cz \
--cc=ltp@lists.linux.it \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox