Hi!
On Thu Dec 11, 2025 at 12:10 PM CET, Petr Vorel wrote:
> c0c35509f9 was not enough to fix evaluation against empty
> $expected_violations:
>
> ima_violations 1 TINFO: verify open writers violation
> /opt/ltp/testcases/bin/ima_violations.sh: line 96: [: 0: unary operator
> expected
>
> Therefore split checks into two if.
>
> Also improvements (readability)
> * shorten line length with saving subtraction into variable
> * evaluate empty variable with ${:-}
>
> Fixes: 726ed71905 ("ima_violations.sh: Update validate() to support multiple
> violations")
> Reported-by: Martin Doucha <[email protected]>
> Signed-off-by: Petr Vorel <[email protected]>
> ---
> NOTE: this was found on old SLES 4.4 based kernel which does not log
> validations. But missing validations might be just a Secure Boot related
> setup problem:
>
> $ mokutil --sb-state
> Secure Boot: EFI variables not supported on SUT
>
> Events are logged when Secure Boot is off:
> $ mokutil --sb-state
> SecureBoot disabled
>
> Or maybe violations worked differently on the old kernel (I remember
> only 6.15 change).
>
> Kind regards,
> Petr
>
> .../integrity/ima/tests/ima_violations.sh | 21 ++++++++++++-------
> 1 file changed, 14 insertions(+), 7 deletions(-)
>
> diff --git a/testcases/kernel/security/integrity/ima/tests/ima_violations.sh
> b/testcases/kernel/security/integrity/ima/tests/ima_violations.sh
> index 1d2f1d9447..a8476e6b59 100755
> --- a/testcases/kernel/security/integrity/ima/tests/ima_violations.sh
> +++ b/testcases/kernel/security/integrity/ima/tests/ima_violations.sh
> @@ -87,23 +87,30 @@ validate()
> local search="$3"
> local expected_violations="$4"
> local max_attempt=3
> - local count2 i num_violations_new
> + local count2 diff i num_violations_new pass
>
> for i in $(seq 1 $max_attempt); do
> read num_violations_new < $IMA_VIOLATIONS
> count2="$(get_count $search)"
> - if [ -z "$expected_violations" -a $(($num_violations_new -
> $num_violations)) -gt 0 ] || \
> - [ $(($num_violations_new - $num_violations)) -eq
> $expected_violations ]; then
> - [ -z "$expected_violations" ] && expected_violations=1
> + diff=$(($num_violations_new - $num_violations))
> +
> + if [ "$expected_violations" ] && [ $diff -eq
> $expected_violations ]; then
> + pass=1
> + fi
> + if [ -z "$expected_violations" ] && [ $diff -gt 0 ]; then
> + pass=1
> + fi
Maybe readability can be improved (well..shell scripts are pretty ugly
by nature anyway):
diff=$((num_violations_new - num_violations))
if [ "$expected_violations" ]; then
[ $diff -eq $expected_violations ] && pass=1
else
[ $diff -gt 0 ] && pass=1
fi
> +
> + if [ "$pass" = 1 ]; then
> if [ $count2 -gt $count ]; then
> - tst_res TPASS "$expected_violations $search
> violation(s) added"
> + tst_res TPASS "${expected_violations:-1}
> $search violation(s) added"
> return
> else
> tst_res TINFO "$search not found in $LOG
> ($i/$max_attempt attempt)..."
> tst_sleep 1s
> fi
> - elif [ $(($num_violations_new - $num_violations)) -gt 0 ]; then
> - tst_res $IMA_FAIL "$search too many violations added:
> $num_violations_new - $num_violations"
> + elif [ $diff -gt 0 ]; then
> + tst_res $IMA_FAIL "$search too many violations added:
> $diff ($num_violations_new - $num_violations)"
> return
> else
> tst_res $IMA_FAIL "$search violation not added"
--
Andrea Cervesato
SUSE QE Automation Engineer Linux
[email protected]
