134b82d3aSKP Singh // SPDX-License-Identifier: GPL-2.0
234b82d3aSKP Singh
334b82d3aSKP Singh /*
434b82d3aSKP Singh * Copyright (C) 2020 Google LLC.
534b82d3aSKP Singh */
634b82d3aSKP Singh
734b82d3aSKP Singh #include <stdio.h>
834b82d3aSKP Singh #include <stdlib.h>
934b82d3aSKP Singh #include <unistd.h>
1034b82d3aSKP Singh #include <sys/wait.h>
1134b82d3aSKP Singh #include <test_progs.h>
12f446b570SKP Singh #include <linux/ring_buffer.h>
1334b82d3aSKP Singh
1434b82d3aSKP Singh #include "ima.skel.h"
1534b82d3aSKP Singh
1691e8fa25SRoberto Sassu #define MAX_SAMPLES 4
1727a77d0dSRoberto Sassu
_run_measured_process(const char * measured_dir,u32 * monitored_pid,const char * cmd)1891e8fa25SRoberto Sassu static int _run_measured_process(const char *measured_dir, u32 *monitored_pid,
1991e8fa25SRoberto Sassu const char *cmd)
2034b82d3aSKP Singh {
2134b82d3aSKP Singh int child_pid, child_status;
2234b82d3aSKP Singh
2334b82d3aSKP Singh child_pid = fork();
2434b82d3aSKP Singh if (child_pid == 0) {
2534b82d3aSKP Singh *monitored_pid = getpid();
2691e8fa25SRoberto Sassu execlp("./ima_setup.sh", "./ima_setup.sh", cmd, measured_dir,
2734b82d3aSKP Singh NULL);
2834b82d3aSKP Singh exit(errno);
2934b82d3aSKP Singh
3034b82d3aSKP Singh } else if (child_pid > 0) {
3134b82d3aSKP Singh waitpid(child_pid, &child_status, 0);
3234b82d3aSKP Singh return WEXITSTATUS(child_status);
3334b82d3aSKP Singh }
3434b82d3aSKP Singh
3534b82d3aSKP Singh return -EINVAL;
3634b82d3aSKP Singh }
3734b82d3aSKP Singh
run_measured_process(const char * measured_dir,u32 * monitored_pid)3891e8fa25SRoberto Sassu static int run_measured_process(const char *measured_dir, u32 *monitored_pid)
3991e8fa25SRoberto Sassu {
4091e8fa25SRoberto Sassu return _run_measured_process(measured_dir, monitored_pid, "run");
4191e8fa25SRoberto Sassu }
4291e8fa25SRoberto Sassu
4327a77d0dSRoberto Sassu static u64 ima_hash_from_bpf[MAX_SAMPLES];
4427a77d0dSRoberto Sassu static int ima_hash_from_bpf_idx;
45f446b570SKP Singh
process_sample(void * ctx,void * data,size_t len)46f446b570SKP Singh static int process_sample(void *ctx, void *data, size_t len)
47f446b570SKP Singh {
4827a77d0dSRoberto Sassu if (ima_hash_from_bpf_idx >= MAX_SAMPLES)
4927a77d0dSRoberto Sassu return -ENOSPC;
5027a77d0dSRoberto Sassu
5127a77d0dSRoberto Sassu ima_hash_from_bpf[ima_hash_from_bpf_idx++] = *((u64 *)data);
52f446b570SKP Singh return 0;
53f446b570SKP Singh }
54f446b570SKP Singh
test_init(struct ima__bss * bss)5527a77d0dSRoberto Sassu static void test_init(struct ima__bss *bss)
5627a77d0dSRoberto Sassu {
5727a77d0dSRoberto Sassu ima_hash_from_bpf_idx = 0;
5827a77d0dSRoberto Sassu
5927a77d0dSRoberto Sassu bss->use_ima_file_hash = false;
6091e8fa25SRoberto Sassu bss->enable_bprm_creds_for_exec = false;
61e6dcf7bbSRoberto Sassu bss->enable_kernel_read_file = false;
627bae42b6SRoberto Sassu bss->test_deny = false;
6327a77d0dSRoberto Sassu }
6427a77d0dSRoberto Sassu
test_test_ima(void)6534b82d3aSKP Singh void test_test_ima(void)
6634b82d3aSKP Singh {
6734b82d3aSKP Singh char measured_dir_template[] = "/tmp/ima_measuredXXXXXX";
68efadf2adSKumar Kartikeya Dwivedi struct ring_buffer *ringbuf = NULL;
6934b82d3aSKP Singh const char *measured_dir;
7091e8fa25SRoberto Sassu u64 bin_true_sample;
7134b82d3aSKP Singh char cmd[256];
7234b82d3aSKP Singh
73*12fabae0SRoberto Sassu int err, duration = 0, fresh_digest_idx = 0;
7434b82d3aSKP Singh struct ima *skel = NULL;
7534b82d3aSKP Singh
7634b82d3aSKP Singh skel = ima__open_and_load();
7734b82d3aSKP Singh if (CHECK(!skel, "skel_load", "skeleton failed\n"))
7834b82d3aSKP Singh goto close_prog;
7934b82d3aSKP Singh
80f446b570SKP Singh ringbuf = ring_buffer__new(bpf_map__fd(skel->maps.ringbuf),
81f446b570SKP Singh process_sample, NULL, NULL);
82f446b570SKP Singh if (!ASSERT_OK_PTR(ringbuf, "ringbuf"))
83f446b570SKP Singh goto close_prog;
84f446b570SKP Singh
8534b82d3aSKP Singh err = ima__attach(skel);
8634b82d3aSKP Singh if (CHECK(err, "attach", "attach failed: %d\n", err))
8734b82d3aSKP Singh goto close_prog;
8834b82d3aSKP Singh
8934b82d3aSKP Singh measured_dir = mkdtemp(measured_dir_template);
9034b82d3aSKP Singh if (CHECK(measured_dir == NULL, "mkdtemp", "err %d\n", errno))
9134b82d3aSKP Singh goto close_prog;
9234b82d3aSKP Singh
9334b82d3aSKP Singh snprintf(cmd, sizeof(cmd), "./ima_setup.sh setup %s", measured_dir);
94cff90846SKP Singh err = system(cmd);
95cff90846SKP Singh if (CHECK(err, "failed to run command", "%s, errno = %d\n", cmd, errno))
9634b82d3aSKP Singh goto close_clean;
9734b82d3aSKP Singh
9827a77d0dSRoberto Sassu /*
9927a77d0dSRoberto Sassu * Test #1
10027a77d0dSRoberto Sassu * - Goal: obtain a sample with the bpf_ima_inode_hash() helper
10127a77d0dSRoberto Sassu * - Expected result: 1 sample (/bin/true)
10227a77d0dSRoberto Sassu */
10327a77d0dSRoberto Sassu test_init(skel->bss);
10434b82d3aSKP Singh err = run_measured_process(measured_dir, &skel->bss->monitored_pid);
10527a77d0dSRoberto Sassu if (CHECK(err, "run_measured_process #1", "err = %d\n", err))
10634b82d3aSKP Singh goto close_clean;
10734b82d3aSKP Singh
108f446b570SKP Singh err = ring_buffer__consume(ringbuf);
109f446b570SKP Singh ASSERT_EQ(err, 1, "num_samples_or_err");
11027a77d0dSRoberto Sassu ASSERT_NEQ(ima_hash_from_bpf[0], 0, "ima_hash");
11127a77d0dSRoberto Sassu
11227a77d0dSRoberto Sassu /*
11327a77d0dSRoberto Sassu * Test #2
11427a77d0dSRoberto Sassu * - Goal: obtain samples with the bpf_ima_file_hash() helper
11527a77d0dSRoberto Sassu * - Expected result: 2 samples (./ima_setup.sh, /bin/true)
11627a77d0dSRoberto Sassu */
11727a77d0dSRoberto Sassu test_init(skel->bss);
11827a77d0dSRoberto Sassu skel->bss->use_ima_file_hash = true;
11927a77d0dSRoberto Sassu err = run_measured_process(measured_dir, &skel->bss->monitored_pid);
12027a77d0dSRoberto Sassu if (CHECK(err, "run_measured_process #2", "err = %d\n", err))
12127a77d0dSRoberto Sassu goto close_clean;
12227a77d0dSRoberto Sassu
12327a77d0dSRoberto Sassu err = ring_buffer__consume(ringbuf);
12427a77d0dSRoberto Sassu ASSERT_EQ(err, 2, "num_samples_or_err");
12527a77d0dSRoberto Sassu ASSERT_NEQ(ima_hash_from_bpf[0], 0, "ima_hash");
12627a77d0dSRoberto Sassu ASSERT_NEQ(ima_hash_from_bpf[1], 0, "ima_hash");
12791e8fa25SRoberto Sassu bin_true_sample = ima_hash_from_bpf[1];
12891e8fa25SRoberto Sassu
12991e8fa25SRoberto Sassu /*
13091e8fa25SRoberto Sassu * Test #3
13191e8fa25SRoberto Sassu * - Goal: confirm that bpf_ima_inode_hash() returns a non-fresh digest
132*12fabae0SRoberto Sassu * - Expected result:
133*12fabae0SRoberto Sassu * 1 sample (/bin/true: fresh) if commit 62622dab0a28 applied
134*12fabae0SRoberto Sassu * 2 samples (/bin/true: non-fresh, fresh) if commit 62622dab0a28 is
135*12fabae0SRoberto Sassu * not applied
136*12fabae0SRoberto Sassu *
137*12fabae0SRoberto Sassu * If commit 62622dab0a28 ("ima: return IMA digest value only when
138*12fabae0SRoberto Sassu * IMA_COLLECTED flag is set") is applied, bpf_ima_inode_hash() refuses
139*12fabae0SRoberto Sassu * to give a non-fresh digest, hence the correct result is 1 instead of
140*12fabae0SRoberto Sassu * 2.
14191e8fa25SRoberto Sassu */
14291e8fa25SRoberto Sassu test_init(skel->bss);
14391e8fa25SRoberto Sassu
14491e8fa25SRoberto Sassu err = _run_measured_process(measured_dir, &skel->bss->monitored_pid,
14591e8fa25SRoberto Sassu "modify-bin");
14691e8fa25SRoberto Sassu if (CHECK(err, "modify-bin #3", "err = %d\n", err))
14791e8fa25SRoberto Sassu goto close_clean;
14891e8fa25SRoberto Sassu
14991e8fa25SRoberto Sassu skel->bss->enable_bprm_creds_for_exec = true;
15091e8fa25SRoberto Sassu err = run_measured_process(measured_dir, &skel->bss->monitored_pid);
15191e8fa25SRoberto Sassu if (CHECK(err, "run_measured_process #3", "err = %d\n", err))
15291e8fa25SRoberto Sassu goto close_clean;
15391e8fa25SRoberto Sassu
15491e8fa25SRoberto Sassu err = ring_buffer__consume(ringbuf);
155*12fabae0SRoberto Sassu ASSERT_GE(err, 1, "num_samples_or_err");
156*12fabae0SRoberto Sassu if (err == 2) {
15791e8fa25SRoberto Sassu ASSERT_NEQ(ima_hash_from_bpf[0], 0, "ima_hash");
158*12fabae0SRoberto Sassu ASSERT_EQ(ima_hash_from_bpf[0], bin_true_sample,
159*12fabae0SRoberto Sassu "sample_equal_or_err");
160*12fabae0SRoberto Sassu fresh_digest_idx = 1;
161*12fabae0SRoberto Sassu }
162*12fabae0SRoberto Sassu
163*12fabae0SRoberto Sassu ASSERT_NEQ(ima_hash_from_bpf[fresh_digest_idx], 0, "ima_hash");
16491e8fa25SRoberto Sassu /* IMA refreshed the digest. */
165*12fabae0SRoberto Sassu ASSERT_NEQ(ima_hash_from_bpf[fresh_digest_idx], bin_true_sample,
166*12fabae0SRoberto Sassu "sample_equal_or_err");
16791e8fa25SRoberto Sassu
16891e8fa25SRoberto Sassu /*
16991e8fa25SRoberto Sassu * Test #4
17091e8fa25SRoberto Sassu * - Goal: verify that bpf_ima_file_hash() returns a fresh digest
17191e8fa25SRoberto Sassu * - Expected result: 4 samples (./ima_setup.sh: fresh, fresh;
17291e8fa25SRoberto Sassu * /bin/true: fresh, fresh)
17391e8fa25SRoberto Sassu */
17491e8fa25SRoberto Sassu test_init(skel->bss);
17591e8fa25SRoberto Sassu skel->bss->use_ima_file_hash = true;
17691e8fa25SRoberto Sassu skel->bss->enable_bprm_creds_for_exec = true;
17791e8fa25SRoberto Sassu err = run_measured_process(measured_dir, &skel->bss->monitored_pid);
17891e8fa25SRoberto Sassu if (CHECK(err, "run_measured_process #4", "err = %d\n", err))
17991e8fa25SRoberto Sassu goto close_clean;
18091e8fa25SRoberto Sassu
18191e8fa25SRoberto Sassu err = ring_buffer__consume(ringbuf);
18291e8fa25SRoberto Sassu ASSERT_EQ(err, 4, "num_samples_or_err");
18391e8fa25SRoberto Sassu ASSERT_NEQ(ima_hash_from_bpf[0], 0, "ima_hash");
18491e8fa25SRoberto Sassu ASSERT_NEQ(ima_hash_from_bpf[1], 0, "ima_hash");
18591e8fa25SRoberto Sassu ASSERT_NEQ(ima_hash_from_bpf[2], 0, "ima_hash");
18691e8fa25SRoberto Sassu ASSERT_NEQ(ima_hash_from_bpf[3], 0, "ima_hash");
18791e8fa25SRoberto Sassu ASSERT_NEQ(ima_hash_from_bpf[2], bin_true_sample,
18891e8fa25SRoberto Sassu "sample_different_or_err");
18991e8fa25SRoberto Sassu ASSERT_EQ(ima_hash_from_bpf[3], ima_hash_from_bpf[2],
19091e8fa25SRoberto Sassu "sample_equal_or_err");
19191e8fa25SRoberto Sassu
19291e8fa25SRoberto Sassu skel->bss->use_ima_file_hash = false;
19391e8fa25SRoberto Sassu skel->bss->enable_bprm_creds_for_exec = false;
19491e8fa25SRoberto Sassu err = _run_measured_process(measured_dir, &skel->bss->monitored_pid,
19591e8fa25SRoberto Sassu "restore-bin");
19691e8fa25SRoberto Sassu if (CHECK(err, "restore-bin #3", "err = %d\n", err))
19791e8fa25SRoberto Sassu goto close_clean;
19834b82d3aSKP Singh
199e6dcf7bbSRoberto Sassu /*
200e6dcf7bbSRoberto Sassu * Test #5
201e6dcf7bbSRoberto Sassu * - Goal: obtain a sample from the kernel_read_file hook
202e6dcf7bbSRoberto Sassu * - Expected result: 2 samples (./ima_setup.sh, policy_test)
203e6dcf7bbSRoberto Sassu */
204e6dcf7bbSRoberto Sassu test_init(skel->bss);
205e6dcf7bbSRoberto Sassu skel->bss->use_ima_file_hash = true;
206e6dcf7bbSRoberto Sassu skel->bss->enable_kernel_read_file = true;
207e6dcf7bbSRoberto Sassu err = _run_measured_process(measured_dir, &skel->bss->monitored_pid,
208e6dcf7bbSRoberto Sassu "load-policy");
209e6dcf7bbSRoberto Sassu if (CHECK(err, "run_measured_process #5", "err = %d\n", err))
210e6dcf7bbSRoberto Sassu goto close_clean;
211e6dcf7bbSRoberto Sassu
212e6dcf7bbSRoberto Sassu err = ring_buffer__consume(ringbuf);
213e6dcf7bbSRoberto Sassu ASSERT_EQ(err, 2, "num_samples_or_err");
214e6dcf7bbSRoberto Sassu ASSERT_NEQ(ima_hash_from_bpf[0], 0, "ima_hash");
215e6dcf7bbSRoberto Sassu ASSERT_NEQ(ima_hash_from_bpf[1], 0, "ima_hash");
216e6dcf7bbSRoberto Sassu
2177bae42b6SRoberto Sassu /*
2187bae42b6SRoberto Sassu * Test #6
2197bae42b6SRoberto Sassu * - Goal: ensure that the kernel_read_file hook denies an operation
2207bae42b6SRoberto Sassu * - Expected result: 0 samples
2217bae42b6SRoberto Sassu */
2227bae42b6SRoberto Sassu test_init(skel->bss);
2237bae42b6SRoberto Sassu skel->bss->enable_kernel_read_file = true;
2247bae42b6SRoberto Sassu skel->bss->test_deny = true;
2257bae42b6SRoberto Sassu err = _run_measured_process(measured_dir, &skel->bss->monitored_pid,
2267bae42b6SRoberto Sassu "load-policy");
2277bae42b6SRoberto Sassu if (CHECK(!err, "run_measured_process #6", "err = %d\n", err))
2287bae42b6SRoberto Sassu goto close_clean;
2297bae42b6SRoberto Sassu
2307bae42b6SRoberto Sassu err = ring_buffer__consume(ringbuf);
2317bae42b6SRoberto Sassu ASSERT_EQ(err, 0, "num_samples_or_err");
2327bae42b6SRoberto Sassu
23334b82d3aSKP Singh close_clean:
23434b82d3aSKP Singh snprintf(cmd, sizeof(cmd), "./ima_setup.sh cleanup %s", measured_dir);
235cff90846SKP Singh err = system(cmd);
236cff90846SKP Singh CHECK(err, "failed to run command", "%s, errno = %d\n", cmd, errno);
23734b82d3aSKP Singh close_prog:
238efadf2adSKumar Kartikeya Dwivedi ring_buffer__free(ringbuf);
23934b82d3aSKP Singh ima__destroy(skel);
24034b82d3aSKP Singh }
241