1 // SPDX-License-Identifier: GPL-2.0 2 3 /* 4 * Copyright (C) 2020 Google LLC. 5 */ 6 7 #include <stdio.h> 8 #include <stdlib.h> 9 #include <unistd.h> 10 #include <sys/wait.h> 11 #include <test_progs.h> 12 #include <linux/ring_buffer.h> 13 14 #include "ima.skel.h" 15 16 #define MAX_SAMPLES 4 17 18 static int _run_measured_process(const char *measured_dir, u32 *monitored_pid, 19 const char *cmd) 20 { 21 int child_pid, child_status; 22 23 child_pid = fork(); 24 if (child_pid == 0) { 25 *monitored_pid = getpid(); 26 execlp("./ima_setup.sh", "./ima_setup.sh", cmd, measured_dir, 27 NULL); 28 exit(errno); 29 30 } else if (child_pid > 0) { 31 waitpid(child_pid, &child_status, 0); 32 return WEXITSTATUS(child_status); 33 } 34 35 return -EINVAL; 36 } 37 38 static int run_measured_process(const char *measured_dir, u32 *monitored_pid) 39 { 40 return _run_measured_process(measured_dir, monitored_pid, "run"); 41 } 42 43 static u64 ima_hash_from_bpf[MAX_SAMPLES]; 44 static int ima_hash_from_bpf_idx; 45 46 static int process_sample(void *ctx, void *data, size_t len) 47 { 48 if (ima_hash_from_bpf_idx >= MAX_SAMPLES) 49 return -ENOSPC; 50 51 ima_hash_from_bpf[ima_hash_from_bpf_idx++] = *((u64 *)data); 52 return 0; 53 } 54 55 static void test_init(struct ima__bss *bss) 56 { 57 ima_hash_from_bpf_idx = 0; 58 59 bss->use_ima_file_hash = false; 60 bss->enable_bprm_creds_for_exec = false; 61 bss->enable_kernel_read_file = false; 62 bss->test_deny = false; 63 } 64 65 void test_test_ima(void) 66 { 67 char measured_dir_template[] = "/tmp/ima_measuredXXXXXX"; 68 struct ring_buffer *ringbuf = NULL; 69 const char *measured_dir; 70 u64 bin_true_sample; 71 char cmd[256]; 72 73 int err, duration = 0; 74 struct ima *skel = NULL; 75 76 skel = ima__open_and_load(); 77 if (CHECK(!skel, "skel_load", "skeleton failed\n")) 78 goto close_prog; 79 80 ringbuf = ring_buffer__new(bpf_map__fd(skel->maps.ringbuf), 81 process_sample, NULL, NULL); 82 if (!ASSERT_OK_PTR(ringbuf, "ringbuf")) 83 goto close_prog; 84 85 err = ima__attach(skel); 86 if (CHECK(err, "attach", "attach failed: %d\n", err)) 87 goto close_prog; 88 89 measured_dir = mkdtemp(measured_dir_template); 90 if (CHECK(measured_dir == NULL, "mkdtemp", "err %d\n", errno)) 91 goto close_prog; 92 93 snprintf(cmd, sizeof(cmd), "./ima_setup.sh setup %s", measured_dir); 94 err = system(cmd); 95 if (CHECK(err, "failed to run command", "%s, errno = %d\n", cmd, errno)) 96 goto close_clean; 97 98 /* 99 * Test #1 100 * - Goal: obtain a sample with the bpf_ima_inode_hash() helper 101 * - Expected result: 1 sample (/bin/true) 102 */ 103 test_init(skel->bss); 104 err = run_measured_process(measured_dir, &skel->bss->monitored_pid); 105 if (CHECK(err, "run_measured_process #1", "err = %d\n", err)) 106 goto close_clean; 107 108 err = ring_buffer__consume(ringbuf); 109 ASSERT_EQ(err, 1, "num_samples_or_err"); 110 ASSERT_NEQ(ima_hash_from_bpf[0], 0, "ima_hash"); 111 112 /* 113 * Test #2 114 * - Goal: obtain samples with the bpf_ima_file_hash() helper 115 * - Expected result: 2 samples (./ima_setup.sh, /bin/true) 116 */ 117 test_init(skel->bss); 118 skel->bss->use_ima_file_hash = true; 119 err = run_measured_process(measured_dir, &skel->bss->monitored_pid); 120 if (CHECK(err, "run_measured_process #2", "err = %d\n", err)) 121 goto close_clean; 122 123 err = ring_buffer__consume(ringbuf); 124 ASSERT_EQ(err, 2, "num_samples_or_err"); 125 ASSERT_NEQ(ima_hash_from_bpf[0], 0, "ima_hash"); 126 ASSERT_NEQ(ima_hash_from_bpf[1], 0, "ima_hash"); 127 bin_true_sample = ima_hash_from_bpf[1]; 128 129 /* 130 * Test #3 131 * - Goal: confirm that bpf_ima_inode_hash() returns a non-fresh digest 132 * - Expected result: 2 samples (/bin/true: non-fresh, fresh) 133 */ 134 test_init(skel->bss); 135 136 err = _run_measured_process(measured_dir, &skel->bss->monitored_pid, 137 "modify-bin"); 138 if (CHECK(err, "modify-bin #3", "err = %d\n", err)) 139 goto close_clean; 140 141 skel->bss->enable_bprm_creds_for_exec = true; 142 err = run_measured_process(measured_dir, &skel->bss->monitored_pid); 143 if (CHECK(err, "run_measured_process #3", "err = %d\n", err)) 144 goto close_clean; 145 146 err = ring_buffer__consume(ringbuf); 147 ASSERT_EQ(err, 2, "num_samples_or_err"); 148 ASSERT_NEQ(ima_hash_from_bpf[0], 0, "ima_hash"); 149 ASSERT_NEQ(ima_hash_from_bpf[1], 0, "ima_hash"); 150 ASSERT_EQ(ima_hash_from_bpf[0], bin_true_sample, "sample_equal_or_err"); 151 /* IMA refreshed the digest. */ 152 ASSERT_NEQ(ima_hash_from_bpf[1], bin_true_sample, 153 "sample_different_or_err"); 154 155 /* 156 * Test #4 157 * - Goal: verify that bpf_ima_file_hash() returns a fresh digest 158 * - Expected result: 4 samples (./ima_setup.sh: fresh, fresh; 159 * /bin/true: fresh, fresh) 160 */ 161 test_init(skel->bss); 162 skel->bss->use_ima_file_hash = true; 163 skel->bss->enable_bprm_creds_for_exec = true; 164 err = run_measured_process(measured_dir, &skel->bss->monitored_pid); 165 if (CHECK(err, "run_measured_process #4", "err = %d\n", err)) 166 goto close_clean; 167 168 err = ring_buffer__consume(ringbuf); 169 ASSERT_EQ(err, 4, "num_samples_or_err"); 170 ASSERT_NEQ(ima_hash_from_bpf[0], 0, "ima_hash"); 171 ASSERT_NEQ(ima_hash_from_bpf[1], 0, "ima_hash"); 172 ASSERT_NEQ(ima_hash_from_bpf[2], 0, "ima_hash"); 173 ASSERT_NEQ(ima_hash_from_bpf[3], 0, "ima_hash"); 174 ASSERT_NEQ(ima_hash_from_bpf[2], bin_true_sample, 175 "sample_different_or_err"); 176 ASSERT_EQ(ima_hash_from_bpf[3], ima_hash_from_bpf[2], 177 "sample_equal_or_err"); 178 179 skel->bss->use_ima_file_hash = false; 180 skel->bss->enable_bprm_creds_for_exec = false; 181 err = _run_measured_process(measured_dir, &skel->bss->monitored_pid, 182 "restore-bin"); 183 if (CHECK(err, "restore-bin #3", "err = %d\n", err)) 184 goto close_clean; 185 186 /* 187 * Test #5 188 * - Goal: obtain a sample from the kernel_read_file hook 189 * - Expected result: 2 samples (./ima_setup.sh, policy_test) 190 */ 191 test_init(skel->bss); 192 skel->bss->use_ima_file_hash = true; 193 skel->bss->enable_kernel_read_file = true; 194 err = _run_measured_process(measured_dir, &skel->bss->monitored_pid, 195 "load-policy"); 196 if (CHECK(err, "run_measured_process #5", "err = %d\n", err)) 197 goto close_clean; 198 199 err = ring_buffer__consume(ringbuf); 200 ASSERT_EQ(err, 2, "num_samples_or_err"); 201 ASSERT_NEQ(ima_hash_from_bpf[0], 0, "ima_hash"); 202 ASSERT_NEQ(ima_hash_from_bpf[1], 0, "ima_hash"); 203 204 /* 205 * Test #6 206 * - Goal: ensure that the kernel_read_file hook denies an operation 207 * - Expected result: 0 samples 208 */ 209 test_init(skel->bss); 210 skel->bss->enable_kernel_read_file = true; 211 skel->bss->test_deny = true; 212 err = _run_measured_process(measured_dir, &skel->bss->monitored_pid, 213 "load-policy"); 214 if (CHECK(!err, "run_measured_process #6", "err = %d\n", err)) 215 goto close_clean; 216 217 err = ring_buffer__consume(ringbuf); 218 ASSERT_EQ(err, 0, "num_samples_or_err"); 219 220 close_clean: 221 snprintf(cmd, sizeof(cmd), "./ima_setup.sh cleanup %s", measured_dir); 222 err = system(cmd); 223 CHECK(err, "failed to run command", "%s, errno = %d\n", cmd, errno); 224 close_prog: 225 ring_buffer__free(ringbuf); 226 ima__destroy(skel); 227 } 228