test2 uses the last "selinux-state" record stored in the IMA measurement list to determine whether SELinux is in enforcing mode and then compares it to the selinux enforce file status.
The tst_update_selinux_state flips the SELinux enforce status (/sys/fs/selinux/enforce) to force a new "selinux-state" record to be appended to the IMA measurement list. However, this only happens when CONFIG_IMA_DISABLE_HTABLE is configured. Don't fail the test when CONFIG_IMA_DISABLE_HTABLE is not configured. Signed-off-by: Mimi Zohar <[email protected]> --- .../kernel/security/integrity/ima/tests/ima_selinux.sh | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/testcases/kernel/security/integrity/ima/tests/ima_selinux.sh b/testcases/kernel/security/integrity/ima/tests/ima_selinux.sh index e64a7739f..9b312f8b7 100755 --- a/testcases/kernel/security/integrity/ima/tests/ima_selinux.sh +++ b/testcases/kernel/security/integrity/ima/tests/ima_selinux.sh @@ -147,7 +147,11 @@ test2() enforced_value=$(echo $measured_data | awk -F'[=;]' '{print $4}') expected_enforced_value=$(cat $SELINUX_DIR/enforce) if [ "$expected_enforced_value" != "$enforced_value" ]; then - tst_res $IMA_FAIL "enforce: expected: $expected_enforced_value, got: $enforced_value" + if ! tst_check_kconfigs "CONFIG_IMA_DISABLE_HTABLE=y"; then + tst_res TPASS "Duplicate \"selinux-state\" record missing (CONFIG_IMA_DISABLE_HTABLE not set)" + else + tst_res $IMA_FAIL "enforce: expected: $expected_enforced_value, got: $enforced_value" + fi return fi -- 2.55.0
