Messages in this thread | | | Subject | Re: [PATCH bpf-next v2 3/3] bpf: Update LSM selftests for bpf_ima_inode_hash | From | Yonghong Song <> | Date | Mon, 23 Nov 2020 10:36:05 -0800 |
| |
On 11/23/20 10:27 AM, KP Singh wrote: > [...] > >>>> >>>> Even if a custom policy has been loaded, potentially additional >>>> measurements unrelated to this test would be included the measurement >>>> list. One way of limiting a rule to a specific test is by loopback >>>> mounting a file system and defining a policy rule based on the loopback >>>> mount unique uuid. >>> >>> Thanks Mimi! >>> >>> I wonder if we simply limit this to policy to /tmp and run an executable >>> from /tmp (like test_local_storage.c does). >>> >>> The only side effect would be of extra hashes being calculated on >>> binaries run from /tmp which is not too bad I guess? >> >> The builtin measurement policy (ima_policy=tcb") explicitly defines a >> rule to not measure /tmp files. Measuring /tmp results in a lot of >> measurements. >> >> {.action = DONT_MEASURE, .fsmagic = TMPFS_MAGIC, .flags = IMA_FSMAGIC}, >> >>> >>> We could do the loop mount too, but I am guessing the most clean way >>> would be to shell out to mount from the test? Are there some other examples >>> of IMA we could look at? >> >> LTP loopback mounts a filesystem, since /tmp is not being measured with >> the builtin "tcb" policy. Defining new policy rules should be limited >> to the loopback mount. This would pave the way for defining IMA- >> appraisal signature verification policy rules, without impacting the >> running system. > > +Andrii > > Do you think we can split the IMA test out, > have a little shell script that does the loopback mount, gets the > FS UUID, updates the IMA policy and then runs a C program? > > This would also allow "test_progs" to be independent of CONFIG_IMA. > > I am guessing the structure would be something similar > to test_xdp_redirect.sh
Look at sk_assign test.
sk_assign.c: if (CHECK_FAIL(system("ip link set dev lo up"))) sk_assign.c: if (CHECK_FAIL(system("ip route add local default dev lo"))) sk_assign.c: if (CHECK_FAIL(system("ip -6 route add local default dev lo"))) sk_assign.c: if (CHECK_FAIL(system("tc qdisc add dev lo clsact"))) sk_assign.c: if (CHECK(system(tc_cmd), "BPF load failed;"
You can use "system" to invoke some bash commands to simulate a script in the tests.
> > - KP > >> >> Mimi >>
| |