tools/testing/selftests/bpf/prog_tests/test_ima.c

   1 // SPDX-License-Identifier: GPL-2.0
   2
   3 /*
   4  * Copyright (C) 2020 Google LLC.
   5  */
   6
   7 #include <stdio.h>
   8 #include <stdlib.h>
   9 #include <unistd.h>
  10 #include <sys/wait.h>
  11 #include <test_progs.h>
  12 #include <linux/ring_buffer.h>
  13
  14 #include "ima.skel.h"
  15
  16 #define MAX_SAMPLES 4
  17
  18 static int _run_measured_process(const char *measured_dir, u32 *monitored_pid,
  19                                  const char *cmd)
  20 {
  21         int child_pid, child_status;
  22
  23         child_pid = fork();
  24         if (child_pid == 0) {
  25                 *monitored_pid = getpid();
  26                 execlp("./ima_setup.sh", "./ima_setup.sh", cmd, measured_dir,
  27                        NULL);
  28                 exit(errno);
  29
  30         } else if (child_pid > 0) {
  31                 waitpid(child_pid, &child_status, 0);
  32                 return WEXITSTATUS(child_status);
  33         }
  34
  35         return -EINVAL;
  36 }
  37
  38 static int run_measured_process(const char *measured_dir, u32 *monitored_pid)
  39 {
  40         return _run_measured_process(measured_dir, monitored_pid, "run");
  41 }
  42
  43 static u64 ima_hash_from_bpf[MAX_SAMPLES];
  44 static int ima_hash_from_bpf_idx;
  45
  46 static int process_sample(void *ctx, void *data, size_t len)
  47 {
  48         if (ima_hash_from_bpf_idx >= MAX_SAMPLES)
  49                 return -ENOSPC;
  50
  51         ima_hash_from_bpf[ima_hash_from_bpf_idx++] = *((u64 *)data);
  52         return 0;
  53 }
  54
  55 static void test_init(struct ima__bss *bss)
  56 {
  57         ima_hash_from_bpf_idx = 0;
  58
  59         bss->use_ima_file_hash = false;
  60         bss->enable_bprm_creds_for_exec = false;
  61         bss->enable_kernel_read_file = false;
  62         bss->test_deny = false;
  63 }
  64
  65 void test_test_ima(void)
  66 {
  67         char measured_dir_template[] = "/tmp/ima_measuredXXXXXX";
  68         struct ring_buffer *ringbuf = NULL;
  69         const char *measured_dir;
  70         u64 bin_true_sample;
  71         char cmd[256];
  72
  73         int err, duration = 0, fresh_digest_idx = 0;
  74         struct ima *skel = NULL;
  75
  76         skel = ima__open_and_load();
  77         if (CHECK(!skel, "skel_load", "skeleton failed\n"))
  78                 goto close_prog;
  79
  80         ringbuf = ring_buffer__new(bpf_map__fd(skel->maps.ringbuf),
  81                                    process_sample, NULL, NULL);
  82         if (!ASSERT_OK_PTR(ringbuf, "ringbuf"))
  83                 goto close_prog;
  84
  85         err = ima__attach(skel);
  86         if (CHECK(err, "attach", "attach failed: %d\n", err))
  87                 goto close_prog;
  88
  89         measured_dir = mkdtemp(measured_dir_template);
  90         if (CHECK(measured_dir == NULL, "mkdtemp", "err %d\n", errno))
  91                 goto close_prog;
  92
  93         snprintf(cmd, sizeof(cmd), "./ima_setup.sh setup %s", measured_dir);
  94         err = system(cmd);
  95         if (CHECK(err, "failed to run command", "%s, errno = %d\n", cmd, errno))
  96                 goto close_clean;
  97
  98         /*
  99          * Test #1
 100          * - Goal: obtain a sample with the bpf_ima_inode_hash() helper
 101          * - Expected result:  1 sample (/bin/true)
 102          */
 103         test_init(skel->bss);
 104         err = run_measured_process(measured_dir, &skel->bss->monitored_pid);
 105         if (CHECK(err, "run_measured_process #1", "err = %d\n", err))
 106                 goto close_clean;
 107
 108         err = ring_buffer__consume(ringbuf);
 109         ASSERT_EQ(err, 1, "num_samples_or_err");
 110         ASSERT_NEQ(ima_hash_from_bpf[0], 0, "ima_hash");
 111
 112         /*
 113          * Test #2
 114          * - Goal: obtain samples with the bpf_ima_file_hash() helper
 115          * - Expected result: 2 samples (./ima_setup.sh, /bin/true)
 116          */
 117         test_init(skel->bss);
 118         skel->bss->use_ima_file_hash = true;
 119         err = run_measured_process(measured_dir, &skel->bss->monitored_pid);
 120         if (CHECK(err, "run_measured_process #2", "err = %d\n", err))
 121                 goto close_clean;
 122
 123         err = ring_buffer__consume(ringbuf);
 124         ASSERT_EQ(err, 2, "num_samples_or_err");
 125         ASSERT_NEQ(ima_hash_from_bpf[0], 0, "ima_hash");
 126         ASSERT_NEQ(ima_hash_from_bpf[1], 0, "ima_hash");
 127         bin_true_sample = ima_hash_from_bpf[1];
 128
 129         /*
 130          * Test #3
 131          * - Goal: confirm that bpf_ima_inode_hash() returns a non-fresh digest
 132          * - Expected result:
 133          *   1 sample (/bin/true: fresh) if commit 62622dab0a28 applied
 134          *   2 samples (/bin/true: non-fresh, fresh) if commit 62622dab0a28 is
 135          *     not applied
 136          *
 137          * If commit 62622dab0a28 ("ima: return IMA digest value only when
 138          * IMA_COLLECTED flag is set") is applied, bpf_ima_inode_hash() refuses
 139          * to give a non-fresh digest, hence the correct result is 1 instead of
 140          * 2.
 141          */
 142         test_init(skel->bss);
 143
 144         err = _run_measured_process(measured_dir, &skel->bss->monitored_pid,
 145                                     "modify-bin");
 146         if (CHECK(err, "modify-bin #3", "err = %d\n", err))
 147                 goto close_clean;
 148
 149         skel->bss->enable_bprm_creds_for_exec = true;
 150         err = run_measured_process(measured_dir, &skel->bss->monitored_pid);
 151         if (CHECK(err, "run_measured_process #3", "err = %d\n", err))
 152                 goto close_clean;
 153
 154         err = ring_buffer__consume(ringbuf);
 155         ASSERT_GE(err, 1, "num_samples_or_err");
 156         if (err == 2) {
 157                 ASSERT_NEQ(ima_hash_from_bpf[0], 0, "ima_hash");
 158                 ASSERT_EQ(ima_hash_from_bpf[0], bin_true_sample,
 159                           "sample_equal_or_err");
 160                 fresh_digest_idx = 1;
 161         }
 162
 163         ASSERT_NEQ(ima_hash_from_bpf[fresh_digest_idx], 0, "ima_hash");
 164         /* IMA refreshed the digest. */
 165         ASSERT_NEQ(ima_hash_from_bpf[fresh_digest_idx], bin_true_sample,
 166                    "sample_equal_or_err");
 167
 168         /*
 169          * Test #4
 170          * - Goal: verify that bpf_ima_file_hash() returns a fresh digest
 171          * - Expected result: 4 samples (./ima_setup.sh: fresh, fresh;
 172          *                               /bin/true: fresh, fresh)
 173          */
 174         test_init(skel->bss);
 175         skel->bss->use_ima_file_hash = true;
 176         skel->bss->enable_bprm_creds_for_exec = true;
 177         err = run_measured_process(measured_dir, &skel->bss->monitored_pid);
 178         if (CHECK(err, "run_measured_process #4", "err = %d\n", err))
 179                 goto close_clean;
 180
 181         err = ring_buffer__consume(ringbuf);
 182         ASSERT_EQ(err, 4, "num_samples_or_err");
 183         ASSERT_NEQ(ima_hash_from_bpf[0], 0, "ima_hash");
 184         ASSERT_NEQ(ima_hash_from_bpf[1], 0, "ima_hash");
 185         ASSERT_NEQ(ima_hash_from_bpf[2], 0, "ima_hash");
 186         ASSERT_NEQ(ima_hash_from_bpf[3], 0, "ima_hash");
 187         ASSERT_NEQ(ima_hash_from_bpf[2], bin_true_sample,
 188                    "sample_different_or_err");
 189         ASSERT_EQ(ima_hash_from_bpf[3], ima_hash_from_bpf[2],
 190                   "sample_equal_or_err");
 191
 192         skel->bss->use_ima_file_hash = false;
 193         skel->bss->enable_bprm_creds_for_exec = false;
 194         err = _run_measured_process(measured_dir, &skel->bss->monitored_pid,
 195                                     "restore-bin");
 196         if (CHECK(err, "restore-bin #3", "err = %d\n", err))
 197                 goto close_clean;
 198
 199         /*
 200          * Test #5
 201          * - Goal: obtain a sample from the kernel_read_file hook
 202          * - Expected result: 2 samples (./ima_setup.sh, policy_test)
 203          */
 204         test_init(skel->bss);
 205         skel->bss->use_ima_file_hash = true;
 206         skel->bss->enable_kernel_read_file = true;
 207         err = _run_measured_process(measured_dir, &skel->bss->monitored_pid,
 208                                     "load-policy");
 209         if (CHECK(err, "run_measured_process #5", "err = %d\n", err))
 210                 goto close_clean;
 211
 212         err = ring_buffer__consume(ringbuf);
 213         ASSERT_EQ(err, 2, "num_samples_or_err");
 214         ASSERT_NEQ(ima_hash_from_bpf[0], 0, "ima_hash");
 215         ASSERT_NEQ(ima_hash_from_bpf[1], 0, "ima_hash");
 216
 217         /*
 218          * Test #6
 219          * - Goal: ensure that the kernel_read_file hook denies an operation
 220          * - Expected result: 0 samples
 221          */
 222         test_init(skel->bss);
 223         skel->bss->enable_kernel_read_file = true;
 224         skel->bss->test_deny = true;
 225         err = _run_measured_process(measured_dir, &skel->bss->monitored_pid,
 226                                     "load-policy");
 227         if (CHECK(!err, "run_measured_process #6", "err = %d\n", err))
 228                 goto close_clean;
 229
 230         err = ring_buffer__consume(ringbuf);
 231         ASSERT_EQ(err, 0, "num_samples_or_err");
 232
 233 close_clean:
 234         snprintf(cmd, sizeof(cmd), "./ima_setup.sh cleanup %s", measured_dir);
 235         err = system(cmd);
 236         CHECK(err, "failed to run command", "%s, errno = %d\n", cmd, errno);
 237 close_prog:
 238         ring_buffer__free(ringbuf);
 239         ima__destroy(skel);
 240 }