selftests/bpf: Check if the digest is refreshed after a file write

Verify that bpf_ima_inode_hash() returns a non-fresh digest after a file
write, and that bpf_ima_file_hash() returns a fresh digest. Verification is
done by requesting the digest from the bprm_creds_for_exec hook, called
before ima_bprm_check().

Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20220302111404.193900-7-roberto.sassu@huawei.com

diff --git a/tools/testing/selftests/bpf/ima_setup.sh b/tools/testing/selftests/bpf/ima_setup.sh
index 8e62581113a3898f82562af4fffe2ffad9e51cca..a3de1cd43ba00f574f20deeb89729b23e7c35a00 100755 (executable)
--- a/tools/testing/selftests/bpf/ima_setup.sh
+++ b/tools/testing/selftests/bpf/ima_setup.sh
@@ -12,7 +12,7 @@ LOG_FILE="$(mktemp /tmp/ima_setup.XXXX.log)"
 
 usage()
 {
-       echo "Usage: $0 <setup|cleanup|run> <existing_tmp_dir>"
+       echo "Usage: $0 <setup|cleanup|run|modify-bin|restore-bin> <existing_tmp_dir>"
        exit 1
 }
 
@@ -77,6 +77,24 @@ run()
        exec "${copied_bin_path}"
 }
 
+modify_bin()
+{
+       local tmp_dir="$1"
+       local mount_dir="${tmp_dir}/mnt"
+       local copied_bin_path="${mount_dir}/$(basename ${TEST_BINARY})"
+
+       echo "mod" >> "${copied_bin_path}"
+}
+
+restore_bin()
+{
+       local tmp_dir="$1"
+       local mount_dir="${tmp_dir}/mnt"
+       local copied_bin_path="${mount_dir}/$(basename ${TEST_BINARY})"
+
+       truncate -s -4 "${copied_bin_path}"
+}
+
 catch()
 {
        local exit_code="$1"
@@ -105,6 +123,10 @@ main()
                cleanup "${tmp_dir}"
        elif [[ "${action}" == "run" ]]; then
                run "${tmp_dir}"
+       elif [[ "${action}" == "modify-bin" ]]; then
+               modify_bin "${tmp_dir}"
+       elif [[ "${action}" == "restore-bin" ]]; then
+               restore_bin "${tmp_dir}"
        else
                echo "Unknown action: ${action}"
                exit 1

diff --git a/tools/testing/selftests/bpf/prog_tests/test_ima.c b/tools/testing/selftests/bpf/prog_tests/test_ima.c
index acc911ba63fd688ccec563dc16554323facfd4af..a0cfba0b4273b88ff2dc7e280d281a9042f2cb5f 100644 (file)
--- a/tools/testing/selftests/bpf/prog_tests/test_ima.c
+++ b/tools/testing/selftests/bpf/prog_tests/test_ima.c
@@ -13,16 +13,17 @@
 
 #include "ima.skel.h"
 
-#define MAX_SAMPLES 2
+#define MAX_SAMPLES 4
 
-static int run_measured_process(const char *measured_dir, u32 *monitored_pid)
+static int _run_measured_process(const char *measured_dir, u32 *monitored_pid,
+                                const char *cmd)
 {
        int child_pid, child_status;
 
        child_pid = fork();
        if (child_pid == 0) {
                *monitored_pid = getpid();
-               execlp("./ima_setup.sh", "./ima_setup.sh", "run", measured_dir,
+               execlp("./ima_setup.sh", "./ima_setup.sh", cmd, measured_dir,
                       NULL);
                exit(errno);
 
@@ -34,6 +35,11 @@ static int run_measured_process(const char *measured_dir, u32 *monitored_pid)
        return -EINVAL;
 }
 
+static int run_measured_process(const char *measured_dir, u32 *monitored_pid)
+{
+       return _run_measured_process(measured_dir, monitored_pid, "run");
+}
+
 static u64 ima_hash_from_bpf[MAX_SAMPLES];
 static int ima_hash_from_bpf_idx;
 
@@ -51,6 +57,7 @@ static void test_init(struct ima__bss *bss)
        ima_hash_from_bpf_idx = 0;
 
        bss->use_ima_file_hash = false;
+       bss->enable_bprm_creds_for_exec = false;
 }
 
 void test_test_ima(void)
@@ -58,6 +65,7 @@ void test_test_ima(void)
        char measured_dir_template[] = "/tmp/ima_measuredXXXXXX";
        struct ring_buffer *ringbuf = NULL;
        const char *measured_dir;
+       u64 bin_true_sample;
        char cmd[256];
 
        int err, duration = 0;
@@ -114,6 +122,64 @@ void test_test_ima(void)
        ASSERT_EQ(err, 2, "num_samples_or_err");
        ASSERT_NEQ(ima_hash_from_bpf[0], 0, "ima_hash");
        ASSERT_NEQ(ima_hash_from_bpf[1], 0, "ima_hash");
+       bin_true_sample = ima_hash_from_bpf[1];
+
+       /*
+        * Test #3
+        * - Goal: confirm that bpf_ima_inode_hash() returns a non-fresh digest
+        * - Expected result: 2 samples (/bin/true: non-fresh, fresh)
+        */
+       test_init(skel->bss);
+
+       err = _run_measured_process(measured_dir, &skel->bss->monitored_pid,
+                                   "modify-bin");
+       if (CHECK(err, "modify-bin #3", "err = %d\n", err))
+               goto close_clean;
+
+       skel->bss->enable_bprm_creds_for_exec = true;
+       err = run_measured_process(measured_dir, &skel->bss->monitored_pid);
+       if (CHECK(err, "run_measured_process #3", "err = %d\n", err))
+               goto close_clean;
+
+       err = ring_buffer__consume(ringbuf);
+       ASSERT_EQ(err, 2, "num_samples_or_err");
+       ASSERT_NEQ(ima_hash_from_bpf[0], 0, "ima_hash");
+       ASSERT_NEQ(ima_hash_from_bpf[1], 0, "ima_hash");
+       ASSERT_EQ(ima_hash_from_bpf[0], bin_true_sample, "sample_equal_or_err");
+       /* IMA refreshed the digest. */
+       ASSERT_NEQ(ima_hash_from_bpf[1], bin_true_sample,
+                  "sample_different_or_err");
+
+       /*
+        * Test #4
+        * - Goal: verify that bpf_ima_file_hash() returns a fresh digest
+        * - Expected result: 4 samples (./ima_setup.sh: fresh, fresh;
+        *                               /bin/true: fresh, fresh)
+        */
+       test_init(skel->bss);
+       skel->bss->use_ima_file_hash = true;
+       skel->bss->enable_bprm_creds_for_exec = true;
+       err = run_measured_process(measured_dir, &skel->bss->monitored_pid);
+       if (CHECK(err, "run_measured_process #4", "err = %d\n", err))
+               goto close_clean;
+
+       err = ring_buffer__consume(ringbuf);
+       ASSERT_EQ(err, 4, "num_samples_or_err");
+       ASSERT_NEQ(ima_hash_from_bpf[0], 0, "ima_hash");
+       ASSERT_NEQ(ima_hash_from_bpf[1], 0, "ima_hash");
+       ASSERT_NEQ(ima_hash_from_bpf[2], 0, "ima_hash");
+       ASSERT_NEQ(ima_hash_from_bpf[3], 0, "ima_hash");
+       ASSERT_NEQ(ima_hash_from_bpf[2], bin_true_sample,
+                  "sample_different_or_err");
+       ASSERT_EQ(ima_hash_from_bpf[3], ima_hash_from_bpf[2],
+                 "sample_equal_or_err");
+
+       skel->bss->use_ima_file_hash = false;
+       skel->bss->enable_bprm_creds_for_exec = false;
+       err = _run_measured_process(measured_dir, &skel->bss->monitored_pid,
+                                   "restore-bin");
+       if (CHECK(err, "restore-bin #3", "err = %d\n", err))
+               goto close_clean;
 
 close_clean:
        snprintf(cmd, sizeof(cmd), "./ima_setup.sh cleanup %s", measured_dir);

diff --git a/tools/testing/selftests/bpf/progs/ima.c b/tools/testing/selftests/bpf/progs/ima.c
index e0b073dcfb5d7a3d4fb3ae7d3e8ad8d06f4516d0..9633e5f2453dec74fd3c78871b053456f09a7bba 100644 (file)
--- a/tools/testing/selftests/bpf/progs/ima.c
+++ b/tools/testing/selftests/bpf/progs/ima.c
@@ -19,6 +19,7 @@ struct {
 char _license[] SEC("license") = "GPL";
 
 bool use_ima_file_hash;
+bool enable_bprm_creds_for_exec;
 
 static void ima_test_common(struct file *file)
 {
@@ -54,3 +55,13 @@ void BPF_PROG(bprm_committed_creds, struct linux_binprm *bprm)
 {
        ima_test_common(bprm->file);
 }
+
+SEC("lsm.s/bprm_creds_for_exec")
+int BPF_PROG(bprm_creds_for_exec, struct linux_binprm *bprm)
+{
+       if (!enable_bprm_creds_for_exec)
+               return 0;
+
+       ima_test_common(bprm->file);
+       return 0;
+}