[LTP] ima_tpm.sh: properly detect failure to verify the IMA measurement list

[Petr Vorel]

Hi Mimi,

...
> @Mimi FYI v1 patch triggers failure - it just calculate a different
> aggregate PCR-10. Although the commit subject is "properly detect failure" ..
> I'm not sure if this is a false negative or the current code on master just did
> not find error (false positive). As I said, I'll rerun v2 and let you know if
> it's the same.

> Testing on openSUSE Tumbleweed x86_64 VM with kernel: 7.1.8-1, virtualized TPM
> 2.0, evmctl 1.6.2. Working master [1], broken with your patch [2].

FYI tested on BIOS (legacy).

> FYI TPM 2.0 used:

> swtpm socket --tpmstate dir=/tmp/mytpm25 --ctrl \
> type=unixio,path=/tmp/mytpm25/swtpm-sock --log level=20 -d --tpm2

> Whole QEMU command:

> /usr/bin/qemu-system-x86_64 -device VGA,edid=on,xres=1024,yres=768 \
> -only-migratable -chardev ringbuf,id=serial0,logfile=serial0,logappend=on \
> -serial chardev:serial0 -audiodev none,id=snd0 -device intel-hda -device \
> hda-output,audiodev=snd0 -global isa-fdc.fdtypeA=none -m 1536 -cpu host -netdev \
> user,id=qanet0 -device virtio-net,netdev=qanet0,mac=52:54:00:12:34:56 -object \
> rng-random,filename=/dev/urandom,id=rng0 -device virtio-rng-pci,rng=rng0 \
> -chardev socket,id=chrtpm,path=/tmp/mytpm25/swtpm-sock -tpmdev \
> emulator,id=tpm0,chardev=chrtpm -device tpm-tis,tpmdev=tpm0 -boot order=c \
> -device qemu-xhci -device usb-tablet -smp 1 -enable-kvm -no-shutdown -vnc \
> :115,share=force-shared -device virtio-serial -chardev \
> pipe,id=virtio_console,path=virtio_console,logfile=virtio_console.log,logappend=on \
> -device \
> virtconsole,chardev=virtio_console,name=org.openqa.console.virtio_console \
> -chardev \
> pipe,id=virtio_console_user,path=virtio_console_user,logfile=virtio_console_user.log,logappend=on \
> -device \
> virtconsole,chardev=virtio_console_user,name=org.openqa.console.virtio_console_user \
> -chardev \
> socket,path=qmp_socket,server=on,wait=off,id=qmp_socket,logfile=qmp_socket.log,logappend=on \
> -qmp chardev:qmp_socket -S -device virtio-scsi-pci,id=scsi0 -blockdev \
> driver=file,node-name=hd0-overlay0-file,filename=/var/lib/openqa/pool/25/raid/hd0-overlay0,cache.no-flush=on \
> -blockdev \
> driver=qcow2,node-name=hd0-overlay0,file=hd0-overlay0-file,cache.no-flush=on,discard=unmap \
> -device virtio-blk,id=hd0-device,drive=hd0-overlay0,bootindex=0,serial=hd0 \
> -blockdev \
> driver=file,node-name=cd0-overlay0-file,filename=/var/lib/openqa/pool/25/raid/cd0-overlay0,cache.no-flush=on \
> -blockdev \
> driver=qcow2,node-name=cd0-overlay0,file=cd0-overlay0-file,cache.no-flush=on,discard=unmap \
> -device scsi-cd,id=cd0-device,drive=cd0-overlay0,serial=cd0

> Kind regards,
> Petr

> [1] https://openqa.opensuse.org/tests/6185158#step/ima_tpm/4
> [2] https://openqa.opensuse.org/tests/6185106#step/ima_tpm/4
Maybe the wrapped version is easier to read
https://openqa.opensuse.org/tests/6187473#step/ima_tpm/6

> [3] https://openqa.opensuse.org/tests/6185106/file/autoinst-log.txt
https://openqa.opensuse.org/tests/6187580#step/ima_tpm/6

BTW tested on other VM locally (outside of openQA testing framework)
with emulated TPM 2.0 I have even 2 tests failing.

$ cat /sys/class/tpm/tpm*/tpm_version_major
2

$ evmctl ima_boot_aggregate -v; echo $?
Failed to read TPM 1.2 PCRs (errno: No such file or directory)
Using tss2-rc-decode to read PCRs.
ERROR:tcti:src/tss2-tcti/tctildr-dl.c:263:tctildr_get_default() No standard TCTI could be loaded 
ERROR:tcti:src/tss2-tcti/tctildr.c:477:tctildr_init_context_data() Failed to instantiate TCTI 
ERROR:esys:src/tss2-esys/esys_context.c:71:Esys_Initialize() Initialize default tcti. ErrorCode (0x000a000a) 
read_tpm_banks:2208 Failed to read sha1 PCRs: (esys initialize failed: tcti:IO failure)
ERROR:tcti:src/tss2-tcti/tctildr-dl.c:263:tctildr_get_default() No standard TCTI could be loaded 
ERROR:tcti:src/tss2-tcti/tctildr.c:477:tctildr_init_context_data() Failed to instantiate TCTI 
ERROR:esys:src/tss2-esys/esys_context.c:71:Esys_Initialize() Initialize default tcti. ErrorCode (0x000a000a) 
read_tpm_banks:2208 Failed to read sha256 PCRs: (esys initialize failed: tcti:IO failure)
Failed to read any TPM PCRs
errno: No such file or directory (2)
125

I need to use also --hwtpm:
$ evmctl ima_boot_aggregate -v --hwtpm; echo $?
Failed to read TPM 1.2 PCRs (errno: No such file or directory)
Trying to read TPM 2.0 PCRs via sysfs
Failed to read TPM 2.0 PCRs via sysfs (errno: No such file or directory)
sha256:e911229581efb7ceb82826940c7e939d05dbc33b38862730651767ab5bd7c446
0

This is on VM BIOS (legacy) running on UEFI QEMU host.

The same behaves when running this on the machine itself (in UEFI QEMU host,
outside of the VM).

Other, unrelated problem is that evmctl blocks on UEFI VM on UEFI QEMU host
(w/a --hwtpm) without any TPM on tss2-rc, but that might be caused just by old
VM, I'll retest and report if it persists.

OT: it'd be nice to describe exit values in evmctl man page.

Kind regards,
Petr