selftests/kexec/kexec_common_lib.sh

0001 #!/bin/sh
0002 # SPDX-License-Identifier: GPL-2.0
0003 #
0004 # Kselftest framework defines: ksft_pass=0, ksft_fail=1, ksft_skip=4
0005
0006 VERBOSE="${VERBOSE:-1}"
0007 IKCONFIG="/tmp/config-`uname -r`"
0008 KERNEL_IMAGE="/boot/vmlinuz-`uname -r`"
0009 SECURITYFS=$(grep "securityfs" /proc/mounts | awk '{print $2}')
0010
0011 log_info()
0012 {
0013         [ $VERBOSE -ne 0 ] && echo "[INFO] $1"
0014 }
0015
0016 # The ksefltest framework requirement returns 0 for PASS.
0017 log_pass()
0018 {
0019         [ $VERBOSE -ne 0 ] && echo "$1 [PASS]"
0020         exit 0
0021 }
0022
0023 # The ksefltest framework requirement returns 1 for FAIL.
0024 log_fail()
0025 {
0026         [ $VERBOSE -ne 0 ] && echo "$1 [FAIL]"
0027         exit 1
0028 }
0029
0030 # The ksefltest framework requirement returns 4 for SKIP.
0031 log_skip()
0032 {
0033         [ $VERBOSE -ne 0 ] && echo "$1"
0034         exit 4
0035 }
0036
0037 # Check efivar SecureBoot-$(the UUID) and SetupMode-$(the UUID).
0038 # (Based on kdump-lib.sh)
0039 get_efivarfs_secureboot_mode()
0040 {
0041         local efivarfs="/sys/firmware/efi/efivars"
0042         local secure_boot_file=""
0043         local setup_mode_file=""
0044         local secureboot_mode=0
0045         local setup_mode=0
0046
0047         # Make sure that efivar_fs is mounted in the normal location
0048         if ! grep -q "^\S\+ $efivarfs efivarfs" /proc/mounts; then
0049                 log_info "efivars is not mounted on $efivarfs"
0050                 return 0;
0051         fi
0052         secure_boot_file=$(find "$efivarfs" -name SecureBoot-* 2>/dev/null)
0053         setup_mode_file=$(find "$efivarfs" -name SetupMode-* 2>/dev/null)
0054         if [ -f "$secure_boot_file" ] && [ -f "$setup_mode_file" ]; then
0055                 secureboot_mode=$(hexdump -v -e '/1 "%d\ "' \
0056                         "$secure_boot_file"|cut -d' ' -f 5)
0057                 setup_mode=$(hexdump -v -e '/1 "%d\ "' \
0058                         "$setup_mode_file"|cut -d' ' -f 5)
0059
0060                 if [ $secureboot_mode -eq 1 ] && [ $setup_mode -eq 0 ]; then
0061                         log_info "secure boot mode enabled (CONFIG_EFIVAR_FS)"
0062                         return 1;
0063                 fi
0064         fi
0065         return 0;
0066 }
0067
0068 # On powerpc platform, check device-tree property
0069 # /proc/device-tree/ibm,secureboot/os-secureboot-enforcing
0070 # to detect secureboot state.
0071 get_ppc64_secureboot_mode()
0072 {
0073         local secure_boot_file="/proc/device-tree/ibm,secureboot/os-secureboot-enforcing"
0074         # Check for secure boot file existence
0075         if [ -f $secure_boot_file ]; then
0076                 log_info "Secureboot is enabled (Device tree)"
0077                 return 1;
0078         fi
0079         log_info "Secureboot is not enabled (Device tree)"
0080         return 0;
0081 }
0082
0083 # Return the architecture of the system
0084 get_arch()
0085 {
0086         echo $(arch)
0087 }
0088
0089 # Check efivar SecureBoot-$(the UUID) and SetupMode-$(the UUID).
0090 # The secure boot mode can be accessed as the last integer of
0091 # "od -An -t u1 /sys/firmware/efi/efivars/SecureBoot-*".  The efi
0092 # SetupMode can be similarly accessed.
0093 # Return 1 for SecureBoot mode enabled and SetupMode mode disabled.
0094 get_secureboot_mode()
0095 {
0096         local secureboot_mode=0
0097         local system_arch=$(get_arch)
0098
0099         if [ "$system_arch" == "ppc64le" ]; then
0100                 get_ppc64_secureboot_mode
0101                 secureboot_mode=$?
0102         else
0103                 get_efivarfs_secureboot_mode
0104                 secureboot_mode=$?
0105         fi
0106
0107         if [ $secureboot_mode -eq 0 ]; then
0108                 log_info "secure boot mode not enabled"
0109         fi
0110         return $secureboot_mode;
0111 }
0112
0113 require_root_privileges()
0114 {
0115         if [ $(id -ru) -ne 0 ]; then
0116                 log_skip "requires root privileges"
0117         fi
0118 }
0119
0120 # Look for config option in Kconfig file.
0121 # Return 1 for found and 0 for not found.
0122 kconfig_enabled()
0123 {
0124         local config="$1"
0125         local msg="$2"
0126
0127         grep -E -q $config $IKCONFIG
0128         if [ $? -eq 0 ]; then
0129                 log_info "$msg"
0130                 return 1
0131         fi
0132         return 0
0133 }
0134
0135 # Attempt to get the kernel config first by checking the modules directory
0136 # then via proc, and finally by extracting it from the kernel image or the
0137 # configs.ko using scripts/extract-ikconfig.
0138 # Return 1 for found.
0139 get_kconfig()
0140 {
0141         local proc_config="/proc/config.gz"
0142         local module_dir="/lib/modules/`uname -r`"
0143         local configs_module="$module_dir/kernel/kernel/configs.ko*"
0144
0145         if [ -f $module_dir/config ]; then
0146                 IKCONFIG=$module_dir/config
0147                 return 1
0148         fi
0149
0150         if [ ! -f $proc_config ]; then
0151                 modprobe configs > /dev/null 2>&1
0152         fi
0153         if [ -f $proc_config ]; then
0154                 cat $proc_config | gunzip > $IKCONFIG 2>/dev/null
0155                 if [ $? -eq 0 ]; then
0156                         return 1
0157                 fi
0158         fi
0159
0160         local extract_ikconfig="$module_dir/source/scripts/extract-ikconfig"
0161         if [ ! -f $extract_ikconfig ]; then
0162                 log_skip "extract-ikconfig not found"
0163         fi
0164
0165         $extract_ikconfig $KERNEL_IMAGE > $IKCONFIG 2>/dev/null
0166         if [ $? -eq 1 ]; then
0167                 if [ ! -f $configs_module ]; then
0168                         log_skip "CONFIG_IKCONFIG not enabled"
0169                 fi
0170                 $extract_ikconfig $configs_module > $IKCONFIG
0171                 if [ $? -eq 1 ]; then
0172                         log_skip "CONFIG_IKCONFIG not enabled"
0173                 fi
0174         fi
0175         return 1
0176 }
0177
0178 # Make sure that securityfs is mounted
0179 mount_securityfs()
0180 {
0181         if [ -z $SECURITYFS ]; then
0182                 SECURITYFS=/sys/kernel/security
0183                 mount -t securityfs security $SECURITYFS
0184         fi
0185
0186         if [ ! -d "$SECURITYFS" ]; then
0187                 log_fail "$SECURITYFS :securityfs is not mounted"
0188         fi
0189 }
0190
0191 # The policy rule format is an "action" followed by key-value pairs.  This
0192 # function supports up to two key-value pairs, in any order.
0193 # For example: action func=<keyword> [appraise_type=<type>]
0194 # Return 1 for found and 0 for not found.
0195 check_ima_policy()
0196 {
0197         local action="$1"
0198         local keypair1="$2"
0199         local keypair2="$3"
0200         local ret=0
0201
0202         mount_securityfs
0203
0204         local ima_policy=$SECURITYFS/ima/policy
0205         if [ ! -e $ima_policy ]; then
0206                 log_fail "$ima_policy not found"
0207         fi
0208
0209         if [ -n $keypair2 ]; then
0210                 grep -e "^$action.*$keypair1" "$ima_policy" | \
0211                         grep -q -e "$keypair2"
0212         else
0213                 grep -q -e "^$action.*$keypair1" "$ima_policy"
0214         fi
0215
0216         # invert "grep -q" result, returning 1 for found.
0217         [ $? -eq 0 ] && ret=1
0218         return $ret
0219 }