Date:   Wed, 8 Mar 2023 11:03:51 +0000
From:   Matt Bobrowski <mattbobrowski@google.com>
To:     Roberto Sassu <roberto.sassu@huaweicloud.com>
Cc:     andrii@kernel.org, mykolal@fb.com, ast@kernel.org,
        daniel@iogearbox.net, martin.lau@linux.dev, song@kernel.org,
        yhs@fb.com, john.fastabend@gmail.com, kpsingh@kernel.org,
        sdf@google.com, haoluo@google.com, jolsa@kernel.org,
        shuah@kernel.org, bpf@vger.kernel.org,
        linux-kselftest@vger.kernel.org, linux-integrity@vger.kernel.org,
        linux-kernel@vger.kernel.org, zohar@linux.ibm.com,
        Roberto Sassu <roberto.sassu@huawei.com>
Subject: Re: [PATCH] bpf: Fix IMA test
Message-ID: <ZAhrl0rK9Yume1Ed@google.com>
References: <20230308103713.1681200-1-roberto.sassu@huaweicloud.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20230308103713.1681200-1-roberto.sassu@huaweicloud.com>
Precedence: bulk

Ha! I was literally in the midst of sending through a patch for
this. Thanks for also taking a look and beating me to it!

This LGTM, feel free to add:

Reviewed-by: Matt Bobrowski <mattbobrowski@google.com>

On Wed, Mar 08, 2023 at 11:37:13AM +0100, Roberto Sassu wrote:
> From: Roberto Sassu <roberto.sassu@huawei.com>
> 
> Commit 62622dab0a28 ("ima: return IMA digest value only when IMA_COLLECTED
> flag is set") caused bpf_ima_inode_hash() to refuse to give non-fresh
> digests. IMA test #3 assumed the old behavior, that bpf_ima_inode_hash()
> still returned also non-fresh digests.
> 
> Correct the test by accepting both cases. If the samples returned are 1,
> assume that the commit above is applied and that the returned digest is
> fresh. If the samples returned are 2, assume that the commit above is not
> applied, and check both the non-fresh and fresh digest.
> 
> Fixes: 62622dab0a28 ("ima: return IMA digest value only when IMA_COLLECTED flag is set")
> Reported by: David Vernet <void@manifault.com>
> Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
> ---
>  .../selftests/bpf/prog_tests/test_ima.c       | 29 ++++++++++++++-----
>  1 file changed, 21 insertions(+), 8 deletions(-)
> 
> diff --git a/tools/testing/selftests/bpf/prog_tests/test_ima.c b/tools/testing/selftests/bpf/prog_tests/test_ima.c
> index b13feceb38f..810b14981c2 100644
> --- a/tools/testing/selftests/bpf/prog_tests/test_ima.c
> +++ b/tools/testing/selftests/bpf/prog_tests/test_ima.c
> @@ -70,7 +70,7 @@ void test_test_ima(void)
>  	u64 bin_true_sample;
>  	char cmd[256];
>  
> -	int err, duration = 0;
> +	int err, duration = 0, fresh_digest_idx = 0;
>  	struct ima *skel = NULL;
>  
>  	skel = ima__open_and_load();
> @@ -129,7 +129,15 @@ void test_test_ima(void)
>  	/*
>  	 * Test #3
>  	 * - Goal: confirm that bpf_ima_inode_hash() returns a non-fresh digest
> -	 * - Expected result: 2 samples (/bin/true: non-fresh, fresh)
> +	 * - Expected result:
> +	 *   1 sample (/bin/true: fresh) if commit 62622dab0a28 applied
> +	 *   2 samples (/bin/true: non-fresh, fresh) if commit 62622dab0a28 is
> +	 *     not applied
> +	 *
> +	 * If commit 62622dab0a28 ("ima: return IMA digest value only when
> +	 * IMA_COLLECTED flag is set") is applied, bpf_ima_inode_hash() refuses
> +	 * to give a non-fresh digest, hence the correct result is 1 instead of
> +	 * 2.
>  	 */
>  	test_init(skel->bss);
>  
> @@ -144,13 +152,18 @@ void test_test_ima(void)
>  		goto close_clean;
>  
>  	err = ring_buffer__consume(ringbuf);
> -	ASSERT_EQ(err, 2, "num_samples_or_err");
> -	ASSERT_NEQ(ima_hash_from_bpf[0], 0, "ima_hash");
> -	ASSERT_NEQ(ima_hash_from_bpf[1], 0, "ima_hash");
> -	ASSERT_EQ(ima_hash_from_bpf[0], bin_true_sample, "sample_equal_or_err");
> +	ASSERT_GE(err, 1, "num_samples_or_err");
> +	if (err == 2) {
> +		ASSERT_NEQ(ima_hash_from_bpf[0], 0, "ima_hash");
> +		ASSERT_EQ(ima_hash_from_bpf[0], bin_true_sample,
> +			  "sample_equal_or_err");
> +		fresh_digest_idx = 1;
> +	}
> +
> +	ASSERT_NEQ(ima_hash_from_bpf[fresh_digest_idx], 0, "ima_hash");
>  	/* IMA refreshed the digest. */
> -	ASSERT_NEQ(ima_hash_from_bpf[1], bin_true_sample,
> -		   "sample_different_or_err");
> +	ASSERT_NEQ(ima_hash_from_bpf[fresh_digest_idx], bin_true_sample,
> +		   "sample_equal_or_err");
>  
>  	/*
>  	 * Test #4
> -- 
> 2.25.1
> 
/M