← Back to branch summary

~apparmor-dev/apparmor/apparmor-ubuntu-citrain-trusty

« back to all changes in this revision

Viewing changes to tests/regression/apparmor/query_label.c

  • Committer: Seth Arnold
  • Date: 2014-03-12 02:05:16 UTC
  • mto: This revision was merged to the branch mainline in revision 1496.
  • Revision ID: seth.arnold@canonical.com-20140312020516-zjike3pmw6hi861h
[ Jamie Strandboge ]
 * debian/debhelper/dh_apparmor: exit with error if aa-easyprof does not
   exist
 * debian/control: drop Depends on apparmor-easyprof to Suggests for
   dh-apparmor
[ Seth Arnold, Jamie Strandboge, Steve Beattie, John Johansen, Tyler Hicks ]
* New upstream snapshot (LP: #1278702, #1061693, #1285653) dropping very
  large Ubuntu delta and fixing the following bugs:
  - Adjust fonts abstraction for libthai (LP: #1278702)
  - Support translated XDG user directories (LP: #1061693)
  - Adjust abstractions/web-data to include /var/www/html (LP: #1285653)
    Refresh 0002-add-debian-integration-to-lighttpd.patch to include
    /etc/lighttpd/conf-available/*.conf
  - Adjust debian/libapparmor1.symbols to reflect new upstream versioning
    for the aa_query_label() function
  - Raise exceptions in Python bindings when something fails
* ship new Python replacements for previous Perl-based tools
  - debian/apparmor-utils.install: remove usr/share/perl5/Immunix/*.pm and add
    usr/sbin/aa-autodep, usr/sbin/aa-cleanprof and usr/sbin/aa-mergeprof
  - debian/control:
    + remove various Perl dependencies
    + add python-apparmor and python3-apparmor
    + python3-apparmor Breaks: apparmor-easyprof to move the file since it
      ships dist-packages/apparmor/__init__.py now
  - debian/apparmor-utils.manpages: ship new manpages for aa-cleanprof and
    aa-mergeprof
  - debian/rules: build and install Python tools
* debian/apparmor.install:
  - install apparmorfs, dovecot, kernelvars, securityfs, sys,
    and xdg-user-dirs tunables and xdg-user-dirs.d directory
* debian/apparmor.dirs:
  - install /etc/apparmor.d/tunables/xdg-user-dirs.d
* debian/apparmor.postinst: create xdg-user-dirs.d
* debian/apparmor.postrm: remove xdg-user-dirs.d
* Remaining patches:
  - 0001-add-chromium-browser.patch
  - 0002-add-debian-integration-to-lighttpd.patch
  - 0003-ubuntu-manpage-updates.patch
  - 0004-libapparmor-layout-deb.patch (renamed from 0008)
  - 0005-libapparmor-mention-dbus-method-in-getcon-man.patch (renamed from
    0068)
  - 0006-etc-writable.patch (renamed from 0070)
  - 0007-aa-utils_are_bilingual.patch (renamed from 0077)
  - 0008-remove-ptrace.patch
  - 0009-convert-to-rules.patch
  - 0010-list-fns.patch
  - 0011-parse-mode.patch
  - 0012-add-decimal-interp.patch
  - 0013-policy_mediates.patch
  - 0014-fix-failpath.patch
  - 0015-feature_file.patch
  - 0016-fix-network.patch
  - 0017-aare-to-class.patch
  - 0018-add-mediation-unix.patch
  - 0019-parser_version.patch
  - 0020-caching.patch
  - 0021-label-class.patch
  - 0022-signal.patch
  - 0023-fix-lexer-debug.patch
  - 0024-ptrace.patch
  - 0025-use-diff-encode.patch
  - 0026-fix-serialize.patch
  - 0027-fix-af.patch
  - 0028-opt_arg.patch
  - 0029-tests-cond-dbus.patch
  - 0030-tests.diff
* Move manpages from libapparmor1 to libapparmor-dev
  - debian/libapparmor-dev.manpages: install aa_change_hat.2,
    aa_change_profile.2, aa_find_mountpoint.2, aa_getcon.2
  - debian/control: libapparmor-dev Replaces: and Breaks: libapparmor1
* Move /usr/lib/python3/dist-packages/apparmor/__init__.py from
  apparmor-easyprof to python3-apparmor
  - debian/control: python3-apparmor Breaks: apparmor-easyprof
  - debian/apparmor-easyprof.install: remove
    usr/lib/python*.*/site-packages/apparmor*
* New profiles and abstractions:
  - debian/apparmor.install: tunables/dovecot, tunables/kernelvars,
    tunables/xdg-user-dirs, tunables/xdg-user-dirs.d
* Test merge from upstream new pyutils branch (rev 2385)

Show diffs side-by-side

added added

removed removed

Lines of Context:
tests/regression/apparmor/query_label.c
 
1
#include <stdio.h>
 
2
#include <stdlib.h>
 
3
#include <string.h>
 
4
#include <sys/apparmor.h>
 
5
 
 
6
#define OPT_EXPECT              "--expect="
 
7
#define OPT_EXPECT_LEN          strlen(OPT_EXPECT)
 
8
 
 
9
#define OPT_LABEL               "--label="
 
10
#define OPT_LABEL_LEN           strlen(OPT_LABEL)
 
11
 
 
12
#define OPT_TYPE_DBUS           "--dbus="
 
13
#define OPT_TYPE_DBUS_LEN       strlen(OPT_TYPE_DBUS)
 
14
 
 
15
static char *progname = NULL;
 
16
 
 
17
void usage(void)
 
18
{
 
19
        fprintf(stderr, "Usage: %s --expect=EXPECTED --label=LABEL --CLASS=PERMS QUERY...\n\n",
 
20
                progname);
 
21
        fprintf(stderr, "  EXPECTED\tA comma separated list of allow, audit, and/or anything.\n");
 
22
        fprintf(stderr, "\t\t\"anything\" is a special keyword that matches any condition\n");
 
23
        fprintf(stderr, "\t\tand cannot be used with other keywords. Additionally,\n");
 
24
        fprintf(stderr, "\t\tEXPECTED can be empty to indicate neither, allow or audit,\n");
 
25
        fprintf(stderr, "\t\tin the results.\n");
 
26
        fprintf(stderr, "  LABEL\t\tThe AppArmor label to use in the query\n");
 
27
        fprintf(stderr, "  CLASS\t\tThe rule class and may consist of:\n");
 
28
        fprintf(stderr, "\t\t  dbus\n");
 
29
        fprintf(stderr, "  PERMS\t\tA comma separated list of permissions. Possibilities\n");
 
30
        fprintf(stderr, "\t\tfor the supported rule classes are:\n");
 
31
        fprintf(stderr, "\t\t  dbus: send,receive,bind\n");
 
32
        fprintf(stderr, "\t\tAdditionaly, PERMS can be empty to indicate an empty mask\n");
 
33
        exit(1);
 
34
}
 
35
 
 
36
static int parse_expected(int *should_allow, int *should_audit, char *expected)
 
37
{
 
38
        char *expect;
 
39
 
 
40
        *should_allow = *should_audit = 0;
 
41
 
 
42
        expect = strtok(expected, ",");
 
43
        while (expect) {
 
44
                if (!strcmp(expect, "allow")) {
 
45
                        *should_allow = 1;
 
46
                } else if (!strcmp(expect, "audit")) {
 
47
                        *should_audit = 1;
 
48
                } else if (!strcmp(expect, "anything")) {
 
49
                        *should_allow = *should_audit = -1;
 
50
                } else {
 
51
                        fprintf(stderr, "FAIL: unknown expect: %s\n", expect);
 
52
                        return 1;
 
53
                }
 
54
 
 
55
                expect = strtok(NULL, ",");
 
56
        }
 
57
 
 
58
        return 0;
 
59
}
 
60
 
 
61
static int parse_dbus_perms(uint32_t *mask, char *perms)
 
62
{
 
63
        char *perm;
 
64
 
 
65
        *mask = 0;
 
66
 
 
67
        perm = strtok(perms, ",");
 
68
        while (perm) {
 
69
                if (!strcmp(perm, "send"))
 
70
                        *mask |= AA_DBUS_SEND;
 
71
                else if (!strcmp(perm, "receive"))
 
72
                        *mask |= AA_DBUS_RECEIVE;
 
73
                else if (!strcmp(perm, "bind"))
 
74
                        *mask |= AA_DBUS_BIND;
 
75
                else {
 
76
                        fprintf(stderr, "FAIL: unknown perm: %s\n", perm);
 
77
                        return 1;
 
78
                }
 
79
 
 
80
                perm = strtok(NULL, ",");
 
81
        }
 
82
 
 
83
        return 0;
 
84
}
 
85
 
 
86
static ssize_t build_query(char **qstr, const char *label, int class,
 
87
                           int argc, char **argv)
 
88
{
 
89
        int size, label_size, i;
 
90
        char *buffer, *to;
 
91
 
 
92
        label_size = strlen(label);
 
93
        size = label_size + 1;
 
94
        for (i = 0; i < argc; i++) {
 
95
                if (argv[i])
 
96
                        size += strlen(argv[i]);
 
97
        }
 
98
 
 
99
        buffer = malloc(size + argc + 1 + AA_QUERY_CMD_LABEL_SIZE);
 
100
        if (!buffer)
 
101
                return -1;
 
102
 
 
103
        to = buffer + AA_QUERY_CMD_LABEL_SIZE;
 
104
        strcpy(to, label);
 
105
        to += label_size;
 
106
        *(to)++ = '\0';
 
107
        *(to)++ = class;
 
108
 
 
109
        for (i = 0; i < argc; to++, i++) {
 
110
                char *arg = argv[i];
 
111
 
 
112
                if (!arg)
 
113
                        arg = "";
 
114
                to = stpcpy(to, arg);
 
115
        }
 
116
        *qstr = buffer;
 
117
 
 
118
        /* don't include trailing \0 in size */
 
119
        return size + argc + AA_QUERY_CMD_LABEL_SIZE;
 
120
}
 
121
 
 
122
int main(int argc, char **argv)
 
123
{
 
124
        char *label, *class_str, *query;
 
125
        int class, should_allow, allowed, should_audit, audited, rc;
 
126
        uint32_t mask;
 
127
        ssize_t query_len;
 
128
 
 
129
        progname = argv[0];
 
130
 
 
131
        if (argc < 5)
 
132
                usage();
 
133
 
 
134
        if (!strncmp(argv[1], OPT_EXPECT, OPT_EXPECT_LEN)) {
 
135
                rc = parse_expected(&should_allow, &should_audit,
 
136
                                    argv[1] + OPT_EXPECT_LEN);
 
137
                if (rc)
 
138
                        usage();
 
139
        }
 
140
 
 
141
        if (!strncmp(argv[2], OPT_LABEL, OPT_LABEL_LEN))
 
142
                label = argv[2] + OPT_LABEL_LEN;
 
143
        else
 
144
                usage();
 
145
 
 
146
        class_str = argv[3];
 
147
        if (!strncmp(class_str, OPT_TYPE_DBUS, OPT_TYPE_DBUS_LEN)) {
 
148
                class = AA_CLASS_DBUS;
 
149
                rc = parse_dbus_perms(&mask, class_str + OPT_TYPE_DBUS_LEN);
 
150
                if (rc)
 
151
                        usage();
 
152
        } else {
 
153
                fprintf(stderr, "FAIL: unknown rule class: %s\n", class_str);
 
154
                usage();
 
155
        }
 
156
 
 
157
        query_len = build_query(&query, label, class, argc - 4, argv + 4);
 
158
        if (query_len < 0) {
 
159
                fprintf(stderr, "FAIL: failed to allocate memory for query string\n");
 
160
                exit(1);
 
161
        }
 
162
 
 
163
        rc = aa_query_label(mask, query, query_len, &allowed, &audited);
 
164
        free(query);
 
165
        if (rc < 0) {
 
166
                fprintf(stderr, "FAIL: failed to perform query: %m\n");
 
167
                exit(1);
 
168
        }
 
169
 
 
170
        if ((should_allow == -1 && should_audit == -1) ||
 
171
            (allowed == should_allow && audited == should_audit)) {
 
172
                printf("PASS\n");
 
173
        } else {
 
174
                fprintf(stderr, "FAIL: the access should %sbe allowed and should %sbe audited\n",
 
175
                        allowed ? "" : "not ", audited ? "" : "not ");
 
176
                exit(1);
 
177
        }
 
178
 
 
179
        exit(0);
 
180
}