From 5404aa839772c92cd53b614ac8c9bb0bc0b9df85 Mon Sep 17 00:00:00 2001 From: Mimi Zohar Date: Wed, 11 Mar 2020 14:42:59 -0400 Subject: [PATCH] ima-evm-utils: tests: verify the last "boot_aggregate" record For each kexec, an additional "boot_aggregate" will appear in the measurement list, assuming the previous measurement list is carried across kexec. Verify that the last "boot_aggregate" record in the IMA measurement list matches. The "boot_aggregate" is either the last field (e.g. "ima-ng") or the second to last field (e.g. "ima-sig") in the measurement list record. Signed-off-by: Mimi Zohar --- tests/boot_aggregate.test | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/tests/boot_aggregate.test b/tests/boot_aggregate.test index a143ff1..49a8475 100755 --- a/tests/boot_aggregate.test +++ b/tests/boot_aggregate.test @@ -100,6 +100,12 @@ display_pcrs() { } # The first entry in the IMA measuremnet list is the "boot_aggregate". +# For each kexec, an additional "boot_aggregate" will appear in the +# measurement list, assuming the previous measurement list is carried +# across the kexec. +# +# Verify that the last "boot_aggregate" record in the IMA measurement +# list matches. check() { echo "INFO: Calculating the boot_aggregate (PCRs 0 - 7) for multiple banks" bootaggr=$(evmctl ima_boot_aggregate) @@ -115,7 +121,7 @@ check() { if [ "$VERBOSE" != "0" ]; then echo "$hash" fi - if grep -q "${hash}" "${ASCII_RUNTIME_MEASUREMENTS}"; then + if grep -e "boot_aggregate$" -e "boot_aggregate.$" "${ASCII_RUNTIME_MEASUREMENTS}" | tail -n 1 | grep -q "${hash}"; then echo "SUCCESS: boot_aggregate ${hash} found" return "$OK" fi