selftests/bpf: Add test for bpf_ima_file_hash()

Add new test to ensure that bpf_ima_file_hash() returns the digest of the
executed files.

Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20220302111404.193900-6-roberto.sassu@huawei.com

diff --git a/tools/testing/selftests/bpf/prog_tests/test_ima.c b/tools/testing/selftests/bpf/prog_tests/test_ima.c
index 97d8a6f..acc911b 100644 (file)
--- a/tools/testing/selftests/bpf/prog_tests/test_ima.c
+++ b/tools/testing/selftests/bpf/prog_tests/test_ima.c
@@ -13,6 +13,8 @@
 
 #include "ima.skel.h"
 
+#define MAX_SAMPLES 2
+
 static int run_measured_process(const char *measured_dir, u32 *monitored_pid)
 {
        int child_pid, child_status;
@@ -32,14 +34,25 @@ static int run_measured_process(const char *measured_dir, u32 *monitored_pid)
        return -EINVAL;
 }
 
-static u64 ima_hash_from_bpf;
+static u64 ima_hash_from_bpf[MAX_SAMPLES];
+static int ima_hash_from_bpf_idx;
 
 static int process_sample(void *ctx, void *data, size_t len)
 {
-       ima_hash_from_bpf = *((u64 *)data);
+       if (ima_hash_from_bpf_idx >= MAX_SAMPLES)
+               return -ENOSPC;
+
+       ima_hash_from_bpf[ima_hash_from_bpf_idx++] = *((u64 *)data);
        return 0;
 }
 
+static void test_init(struct ima__bss *bss)
+{
+       ima_hash_from_bpf_idx = 0;
+
+       bss->use_ima_file_hash = false;
+}
+
 void test_test_ima(void)
 {
        char measured_dir_template[] = "/tmp/ima_measuredXXXXXX";
@@ -72,13 +85,35 @@ void test_test_ima(void)
        if (CHECK(err, "failed to run command", "%s, errno = %d\n", cmd, errno))
                goto close_clean;
 
+       /*
+        * Test #1
+        * - Goal: obtain a sample with the bpf_ima_inode_hash() helper
+        * - Expected result:  1 sample (/bin/true)
+        */
+       test_init(skel->bss);
        err = run_measured_process(measured_dir, &skel->bss->monitored_pid);
-       if (CHECK(err, "run_measured_process", "err = %d\n", err))
+       if (CHECK(err, "run_measured_process #1", "err = %d\n", err))
                goto close_clean;
 
        err = ring_buffer__consume(ringbuf);
        ASSERT_EQ(err, 1, "num_samples_or_err");
-       ASSERT_NEQ(ima_hash_from_bpf, 0, "ima_hash");
+       ASSERT_NEQ(ima_hash_from_bpf[0], 0, "ima_hash");
+
+       /*
+        * Test #2
+        * - Goal: obtain samples with the bpf_ima_file_hash() helper
+        * - Expected result: 2 samples (./ima_setup.sh, /bin/true)
+        */
+       test_init(skel->bss);
+       skel->bss->use_ima_file_hash = true;
+       err = run_measured_process(measured_dir, &skel->bss->monitored_pid);
+       if (CHECK(err, "run_measured_process #2", "err = %d\n", err))
+               goto close_clean;
+
+       err = ring_buffer__consume(ringbuf);
+       ASSERT_EQ(err, 2, "num_samples_or_err");
+       ASSERT_NEQ(ima_hash_from_bpf[0], 0, "ima_hash");
+       ASSERT_NEQ(ima_hash_from_bpf[1], 0, "ima_hash");
 
 close_clean:
        snprintf(cmd, sizeof(cmd), "./ima_setup.sh cleanup %s", measured_dir);

diff --git a/tools/testing/selftests/bpf/progs/ima.c b/tools/testing/selftests/bpf/progs/ima.c
index b5a0de5..e0b073d 100644 (file)
--- a/tools/testing/selftests/bpf/progs/ima.c
+++ b/tools/testing/selftests/bpf/progs/ima.c
@@ -18,6 +18,8 @@ struct {
 
 char _license[] SEC("license") = "GPL";
 
+bool use_ima_file_hash;
+
 static void ima_test_common(struct file *file)
 {
        u64 ima_hash = 0;
@@ -27,8 +29,12 @@ static void ima_test_common(struct file *file)
 
        pid = bpf_get_current_pid_tgid() >> 32;
        if (pid == monitored_pid) {
-               ret = bpf_ima_inode_hash(file->f_inode, &ima_hash,
-                                        sizeof(ima_hash));
+               if (!use_ima_file_hash)
+                       ret = bpf_ima_inode_hash(file->f_inode, &ima_hash,
+                                                sizeof(ima_hash));
+               else
+                       ret = bpf_ima_file_hash(file, &ima_hash,
+                                               sizeof(ima_hash));
                if (ret < 0 || ima_hash == 0)
                        return;