[v3,1/2] IMA: Add a test to verify measurment of keys

Add a testcase that verifies that the IMA subsystem has correctly
measured keys added to keyrings specified in the IMA policy file.

Additionally, add support for handling a new IMA template descriptor,
namely ima-buf[1], in the IMA measurement tests.

[1]: https://www.kernel.org/doc/html/latest/security/IMA-templates.html#use

Signed-off-by: Lachlan Sneff <t-josne@linux.microsoft.com>
---
 runtest/ima                                   |  1 +
 .../integrity/ima/datafiles/keycheck.policy   |  1 +
 .../security/integrity/ima/tests/ima_keys.sh  | 67 +++++++++++++++++++
 .../integrity/ima/tests/ima_measurements.sh   | 36 +---------
 .../integrity/ima/tests/ima_policy.sh         |  1 -
 .../security/integrity/ima/tests/ima_setup.sh | 35 ++++++++++
 6 files changed, 105 insertions(+), 36 deletions(-)
 create mode 100644 testcases/kernel/security/integrity/ima/datafiles/keycheck.policy
 create mode 100755 testcases/kernel/security/integrity/ima/tests/ima_keys.sh

Hi Lachlan,

Reviewed-by: Petr Vorel <pvorel@suse.cz>

> +++ b/testcases/kernel/security/integrity/ima/tests/ima_keys.sh
> @@ -0,0 +1,67 @@
> +#!/bin/sh
> +# SPDX-License-Identifier: GPL-2.0-or-later
> +# Copyright (c) 2020 Microsoft Corporation
> +# Author: Lachlan Sneff <t-josne@linux.microsoft.com>
> +#
> +# Verify that keys are measured correctly based on policy.
> +
> +TST_NEEDS_CMDS="grep mktemp cut sed tr"
This is already a dependency for tst_test.sh, but it does not harm to have it
here (in case we remove the dependency from tst_test.sh).
> +TST_CNT=1
> +TST_NEEDS_DEVICE=1
> +
> +. ima_setup.sh
> +
> +# Based on https://lkml.org/lkml/2019/12/13/564.
> +# (450d0fd51564 - "IMA: Call workqueue functions to measure queued keys")
> +test1()
> +{
> +	local keyrings keycheck_line templates test_file=$(mktemp)
Do we need mktemp? Can't it be just:
	local keyrings keycheck_line templates test_file="file.txt"

...
> +		echo "$line" | cut -d' ' -f6 | xxd -r -p > $test_file
Because you later just overwrite the file (simplicity).

I also try to keep shell dependencies low so it's possible to run it with in
dracut initramfs with rapido [1] without too many dependencies (although mktemp
is already tst_test.sh dependency).

> +
> +		expected_digest="$(compute_digest $algorithm $test_file)" || \
> +			tst_brk TCONF "cannot compute digest for $algorithm"
> +
> +		if [ "$digest" != "$expected_digest" ]; then
> +			tst_res TFAIL "incorrect digest was found for the ($keyring) keyring"
> +		fi
> +	done
> +
> +	rm $test_file
Again, IMHO no need to delete the file.

[1] https://github.com/rapido-linux/rapido

> +
> +	tst_res TPASS "specified keyrings were measured correctly"
This TPASS will be called even if there is previous TFAIL "incorrect digest was
found for the ($keyring) keyring". We should either exit testing with return,
or have variable to detect failure and not call this (not sure what makes more
sense).

Kind regards,
Petr

Hi Lachian,

> +
> +# Based on https://lkml.org/lkml/2019/12/13/564.
> +# (450d0fd51564 - "IMA: Call workqueue functions to measure queued keys")
> +test1()
> +{
> +	local keyrings keycheck_line templates test_file=$(mktemp)
> +
> +	tst_res TINFO "verifying key measurement for keyrings and templates specified in IMA policy file"
> +
> +	[ -f $IMA_POLICY ] || tst_brk TCONF "missing $IMA_POLICY"
> +
> +	[ -r $IMA_POLICY ] || tst_brk TCONF "cannot read IMA policy (CONFIG_IMA_READ_POLICY=y required)"
> +
> +	keycheck_line=$(grep "func=KEY_CHECK" $IMA_POLICY)
> +	if [ -z "$keycheck_line" ]; then
> +		tst_brk TCONF "ima policy does not specify \"func=KEY_CHECK\""
> +	fi
> +
> +	if echo "$keycheck_line" | grep -q "*keyrings*"; then
> +		tst_brk TCONF "ima policy does not specify a keyrings to check"
> +	fi
> +
> +	keyrings=$(echo "$keycheck_line" | tr " " "\n" | grep "keyrings" | \
> +		sed "s/\./\\\./g" | cut -d'=' -f2)
> +	if [ -z "$keyrings" ]; then
> +		tst_brk TCONF "ima policy has a keyring key-value specifier, but no specified keyrings"
> +	fi
> +
> +	templates=$(echo "$keycheck_line" | tr " " "\n" | grep "template" | \
> +		cut -d'=' -f2)
> +
> +	grep -E "($templates)*($keyrings)" $ASCII_MEASUREMENTS | while read line

Probably because I have multiple KEY_CHECK rules, this is failing:

grep: Unmatched ( or \(

And then it continues merrily alongs its way.

ima_keys 1 TPASS: specified keyrings were measured correctly
ima_keys 2 TCONF: missing /etc/keys/x509_ima.der

Mimi

> +	do
> +		local digest expected_digest algorithm
> +
> +		digest=$(echo "$line" | cut -d' ' -f4 | cut -d':' -f2)
> +		algorithm=$(echo "$line" | cut -d' ' -f4 | cut -d':' -f1)
> +		keyring=$(echo "$line" | cut -d' ' -f5)
> +
> +		echo "$line" | cut -d' ' -f6 | xxd -r -p > $test_file
> +
> +		expected_digest="$(compute_digest $algorithm $test_file)" || \
> +			tst_brk TCONF "cannot compute digest for $algorithm"
> +
> +		if [ "$digest" != "$expected_digest" ]; then
> +			tst_res TFAIL "incorrect digest was found for the ($keyring) keyring"
> +		fi
> +	done
> +
> +	rm $test_file
> +
> +	tst_res TPASS "specified keyrings were measured correctly"
> +}

[Resending due to mailer issues]

On Wed, 2020-06-24 at 09:21 -0400, Mimi Zohar wrote:
> Hi Lachian,
> 
> > +
> > +# Based on https://lkml.org/lkml/2019/12/13/564.
> > +# (450d0fd51564 - "IMA: Call workqueue functions to measure queued keys")
> > +test1()
> > +{
> > +	local keyrings keycheck_line templates test_file=$(mktemp)
> > +
> > +	tst_res TINFO "verifying key measurement for keyrings and templates specified in IMA policy file"
> > +
> > +	[ -f $IMA_POLICY ] || tst_brk TCONF "missing $IMA_POLICY"
> > +
> > +	[ -r $IMA_POLICY ] || tst_brk TCONF "cannot read IMA policy (CONFIG_IMA_READ_POLICY=y required)"
> > +
> > +	keycheck_line=$(grep "func=KEY_CHECK" $IMA_POLICY)
> > +	if [ -z "$keycheck_line" ]; then
> > +		tst_brk TCONF "ima policy does not specify \"func=KEY_CHECK\""
> > +	fi
> > +
> > +	if echo "$keycheck_line" | grep -q "*keyrings*"; then
> > +		tst_brk TCONF "ima policy does not specify a keyrings to check"
> > +	fi
> > +
> > +	keyrings=$(echo "$keycheck_line" | tr " " "\n" | grep "keyrings" | \
> > +		sed "s/\./\\\./g" | cut -d'=' -f2)
> > +	if [ -z "$keyrings" ]; then
> > +		tst_brk TCONF "ima policy has a keyring key-value specifier, but no specified keyrings"
> > +	fi
> > +
> > +	templates=$(echo "$keycheck_line" | tr " " "\n" | grep "template" | \
> > +		cut -d'=' -f2)
> > +
> > +	grep -E "($templates)*($keyrings)" $ASCII_MEASUREMENTS | while read line
> 
> Probably because I have multiple KEY_CHECK rules, this is failing:
> 
> grep: Unmatched ( or \(
> 
> And then it continues merrily alongs its way.
> 
> ima_keys 1 TPASS: specified keyrings were measured correctly
> ima_keys 2 TCONF: missing /etc/keys/x509_ima.der
> 
> Mimi
> 
> > +	do
> > +		local digest expected_digest algorithm
> > +
> > +		digest=$(echo "$line" | cut -d' ' -f4 | cut -d':' -f2)
> > +		algorithm=$(echo "$line" | cut -d' ' -f4 | cut -d':' -f1)
> > +		keyring=$(echo "$line" | cut -d' ' -f5)
> > +
> > +		echo "$line" | cut -d' ' -f6 | xxd -r -p > $test_file
> > +
> > +		expected_digest="$(compute_digest $algorithm $test_file)" || \
> > +			tst_brk TCONF "cannot compute digest for $algorithm"
> > +
> > +		if [ "$digest" != "$expected_digest" ]; then
> > +			tst_res TFAIL "incorrect digest was found for the ($keyring) keyring"
> > +		fi
> > +	done
> > +
> > +	rm $test_file
> > +
> > +	tst_res TPASS "specified keyrings were measured correctly"
> > +}