[LTP] [PATCH] ima_tpm.sh: properly detect failure to verify the IMA measurement list

[Mimi Zohar]

test2 attempts to compare the aggregate PCR-10 value with the current
TPM PCR value based on the current measurement list, but does not take
into account that the measurement list might have been extended.

evmctl returns success/failure when verifying the IMA measurement list
and displays the measurement list line number that matched. Update
test2.

Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
---
 .../security/integrity/ima/tests/ima_tpm.sh   | 34 +++++++++++++------
 1 file changed, 23 insertions(+), 11 deletions(-)

diff --git a/testcases/kernel/security/integrity/ima/tests/ima_tpm.sh b/testcases/kernel/security/integrity/ima/tests/ima_tpm.sh
index acd8b6d30..5f7a5e983 100755
--- a/testcases/kernel/security/integrity/ima/tests/ima_tpm.sh
+++ b/testcases/kernel/security/integrity/ima/tests/ima_tpm.sh
@@ -146,7 +146,7 @@ get_pcr10_aggregate()
 	local num_violations=0
 	local msg="$ERRMSG_EVMCTL"
 	local res=TCONF
-	local pcr ret
+	local lineno pcr ret
 
 	if [ -z "$MISSING_EVMCTL" ]; then
 		msg=
@@ -178,10 +178,13 @@ get_pcr10_aggregate()
 		tst_res $res "failed to find aggregate PCR-10 $msg"
 		tst_res TINFO "hash file:"
 		cat hash.txt >&2
-		return
+		return 1
 	fi
 
-	echo "$pcr"
+	lineno=$(grep -E "^($ALGORITHM )*PCR(.*10)*: succeed at entry" hash.txt | tail -1 \
+		| awk '{print $NF}')
+	echo "$pcr $lineno"
+	return $ret
 }
 
 test1_tpm_bypass_mode()
@@ -249,7 +252,9 @@ test1()
 
 test2()
 {
-	local hash pcr_aggregate out ret
+	local hash pcr_aggregate lineno out ret
+	local measurement_count="$IMA_DIR/runtime_measurements_count"
+	local total_measurements
 
 	tst_res TINFO "verify PCR values"
 
@@ -288,14 +293,21 @@ test2()
 	tst_res TINFO "real PCR-10: '$hash'"
 
 	get_pcr10_aggregate > tmp.txt
-	pcr_aggregate="$(cat tmp.txt)"
-	if [ -z "$pcr_aggregate" ]; then
-		return
-	fi
-	tst_res TINFO "aggregate PCR-10: '$pcr_aggregate'"
+	if [ $? -eq 0 ]; then
+		pcr_aggregate="$(cat tmp.txt | cut -d " " -f1)"
+		if [ -z "$pcr_aggregate" ]; then
+			return
+		fi
+		tst_res TINFO "aggregate PCR-10: '$pcr_aggregate'"
 
-	if [ "$hash" = "$pcr_aggregate" ]; then
-		tst_res TPASS "aggregate PCR value matches real PCR value"
+		lineno="$(cat tmp.txt | cut -d " " -f2)"
+
+		if [ "$hash" = "$pcr_aggregate" ]; then
+			tst_res TPASS "aggregate PCR value matches real PCR value (line: $lineno)"
+		else
+			total_measurements=$(cat "$measurement_count")
+			tst_res TPASS "aggregate PCR value matched real PCR value (line: $lineno/$total_measurements)"
+		fi
 	else
 		tst_res TFAIL "aggregate PCR value does not match real PCR value"
 	fi
-- 
2.55.0