[LTP] [RFC PATCH 3/3] ima: additional ToMToU violation tests

[Mimi Zohar]

On Thu, 2025-02-20 at 15:22 -0500, Mimi Zohar wrote:
> On Thu, 2025-02-20 at 20:13 +0100, Petr Vorel wrote:
> > > On Thu, 2025-02-20 at 19:16 +0100, Petr Vorel wrote:
> > > > Hi Mimi,
> > 
> > > > > Kernel patch "ima: limit the number of ToMToU integrity violations"
> > > > > prevents superfluous ToMToU violations.  Add corresponding LTP tests.
> > 
> > > > > Link:
> > > > > https://lore.kernel.org/linux-integrity/20250219162131.416719-3-zohar@linux.ibm.com/
> > > > > Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
> > 
> > > > Unfortunately tests fail on both mainline kernel and kernel with your patches.
> > 
> > > The new LTP IMA violations patches should fail without the associated kernel
> > > patches.
> > 
> > > > Any hint what could be wrong?
> > 
> > > Of course it's dependent on the IMA policy.  The tests assume being booted with the
> > > IMA
> > > TCB measurement policy or similar policy being loaded.  Can you share the IMA
> > > policy?
> > > e.g. cat /sys/kernel/security/ima/policy
> > 
> > > thanks,
> > 
> > > Mimi
> > 
> > Now testing on kernel *with* your patches. First run always fails, regardless
> > whether using ima_policy=tcb or
> > /opt/ltp/testcases/data/ima_violations/violations.policy).
> > 
> > Kind regards,
> > Petr
> 
> I'm not seeing that on my test machine.  Could there be other things running on your
> system causing violations.  In anycase, your original test was less exacting.  
> Similarly,
> instead of "-eq", try using "-qe" in the following test and removing the subsequent new
> "gt" test.

-> "-ge"

> 
> if [ $(($num_violations_new - $num_violations)) -eq $expected_violations ]; then
>