diff options
| author |   KP Singh <kpsingh@google.com> | 2020-11-24 15:12:10 +0000 |
|---|---|---|
| committer |   Daniel Borkmann <daniel@iogearbox.net> | 2020-11-26 00:25:47 +0100 |
| commit | 34b82d3ac1058653b3de7be4697b55f67533b1f1 (patch) | |
| tree | 446d0619ca0cf5c22e8698e90f92f908170e8879 /tools/testing/selftests/bpf/config | |
| parent | bpf: Add a BPF helper for getting the IMA hash of an inode (diff) | |
| download | linux-dev-34b82d3ac1058653b3de7be4697b55f67533b1f1.tar.xz linux-dev-34b82d3ac1058653b3de7be4697b55f67533b1f1.zip | |
bpf: Add a selftest for bpf_ima_inode_hash
The test does the following:
- Mounts a loopback filesystem and appends the IMA policy to measure
executions only on this file-system. Restricting the IMA policy to
a particular filesystem prevents a system-wide IMA policy change.
- Executes an executable copied to this loopback filesystem.
- Calls the bpf_ima_inode_hash in the bprm_committed_creds hook and
checks if the call succeeded and checks if a hash was calculated.
The test shells out to the added ima_setup.sh script as the setup is
better handled in a shell script and is more complicated to do in the
test program or even shelling out individual commands from C.
The list of required configs (i.e. IMA, SECURITYFS,
IMA_{WRITE,READ}_POLICY) for running this test are also updated.
Suggested-by: Mimi Zohar <zohar@linux.ibm.com> (limit policy rule to loopback mount)
Signed-off-by: KP Singh <kpsingh@google.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/bpf/20201124151210.1081188-4-kpsingh@chromium.org
Diffstat (limited to 'tools/testing/selftests/bpf/config')
| -rw-r--r-- | tools/testing/selftests/bpf/config | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/tools/testing/selftests/bpf/config b/tools/testing/selftests/bpf/config index 2118e23ac07a..365bf9771b07 100644 --- a/tools/testing/selftests/bpf/config +++ b/tools/testing/selftests/bpf/config @@ -39,3 +39,7 @@ CONFIG_BPF_JIT=y CONFIG_BPF_LSM=y CONFIG_SECURITY=y CONFIG_LIRC=y +CONFIG_IMA=y +CONFIG_SECURITYFS=y +CONFIG_IMA_WRITE_POLICY=y +CONFIG_IMA_READ_POLICY=y |