On Wed, Oct 10, 2012 at 02:24:48AM +0200, Christian Boltz wrote:
> Changes compared to my first patch:
> - replace tr calls by perl's uc() (also for non-stdin mode)

Ah cool.

> - also handle encoded profile names (introduced by Steve)
> - don't fail if a file or profile name contains a '

My sed-a-rific you-now-have-two-problems version didn't seem to fail
with an encoded ', but definitely did with \^ (yes, I've added specific
testcases for those to my new testscript).

> BTW: I intentionally added the "name=" part in the replacement
>     line="${line/name=$ne/name=\"$nd\"}"
> It might look superfluous, but it ensures that the correct part is 
> replaced.

Yeah, I got that it was to ensure the correct replacement occurred.

In any event, Acked-By: Steve Beattie <[email protected]>

> I didn't test the testscript yet, but having one is a good idea ;-)

It's fairly simply to drive; from the utils/ directory, do:

  python test/test-aa-decode.py

(add -v to see the individual testcase descriptions listed.) You
will of course need a python installed; either/both python 2.x and
3.x should work (though 2.x may need to be 2.6 or newer). It also
gets triggered by a 'make check' in the utils/ directory.

Attached is an updated version of the test script; changes include

 - add testcases that include encoded "'" and "\^" strings
 - add a helper test run function that makes adding new testcases
   easier, basically define the log input content and a list of
   strings you expect to see in the output, pass them to the
   helper function and it does the rest.

Thanks!

-- 
Steve Beattie
<[email protected]>
http://NxNW.org/~steve/
---
 utils/test/test-aa-decode.py |  199 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 199 insertions(+)

Index: b/utils/test/test-aa-decode.py
===================================================================
--- /dev/null
+++ b/utils/test/test-aa-decode.py
@@ -0,0 +1,199 @@
+#! /usr/bin/env python
+# ------------------------------------------------------------------
+#
+#    Copyright (C) 2011-2012 Canonical Ltd.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+import os
+import signal
+import subprocess
+import tempfile
+import unittest
+
+aadecode_bin = "./aa-decode"
+
+
+# http://www.chiark.greenend.org.uk/ucgi/~cjwatson/blosxom/2009-07-02-python-sigpipe.html
+# This is needed so that the subprocesses that produce endless output
+# actually quit when the reader goes away.
+def subprocess_setup():
+    # Python installs a SIGPIPE handler by default. This is usually not what
+    # non-Python subprocesses expect.
+    signal.signal(signal.SIGPIPE, signal.SIG_DFL)
+
+def cmd(command, input = None, stderr = subprocess.STDOUT, stdout = subprocess.PIPE, stdin = None, timeout = None):
+    '''Try to execute given command (array) and return its stdout, or return
+    a textual error if it failed.'''
+
+    try:
+        sp = subprocess.Popen(command, stdin=stdin, stdout=stdout, stderr=stderr, close_fds=True, preexec_fn=subprocess_setup)
+    except OSError as e:
+        return [127, str(e)]
+
+    out, outerr = sp.communicate(input)
+    # Handle redirection of stdout
+    if out == None:
+        out = b''
+    # Handle redirection of stderr
+    if outerr == None:
+        outerr = b''
+    return [sp.returncode, out.decode('utf-8') + outerr.decode('utf-8')]
+
+
+def mkstemp_fill(contents, suffix='', prefix='tst-aadecode-', dir=None):
+    '''As tempfile.mkstemp does, return a (file, name) pair, but with prefilled contents.'''
+
+    handle, name = tempfile.mkstemp(suffix=suffix, prefix=prefix, dir=dir)
+    os.close(handle)
+    handle = open(name, "w+")
+    handle.write(contents)
+    handle.flush()
+    handle.seek(0)
+
+    return handle, name
+
+class AADecodeTest(unittest.TestCase):
+
+    def setUp(self):
+        self.tmpfile = None
+
+    def tearDown(self):
+        if self.tmpfile and os.path.exists(self.tmpfile):
+            os.remove(self.tmpfile)
+
+    def test_help(self):
+        '''Test --help argument'''
+
+        expected = 0
+        rc, report = cmd([aadecode_bin, "--help"])
+        result = 'Got exit code %d, expected %d\n' % (rc, expected)
+        self.assertEqual(expected, rc, result + report)
+
+    def _run_file_test(self, content, expected_list):
+        '''test case helper function; takes log content and a list of
+           expected strings as arguments'''
+
+        expected = 0
+
+        (f, self.tmpfile) = mkstemp_fill(content)
+
+        rc, report = cmd([aadecode_bin], stdin=f)
+        result = 'Got exit code %d, expected %d\n' % (rc, expected)
+        self.assertEqual(expected, rc, result + report)
+        for expected_string in expected_list:
+            result = 'could not find expected %s in output:\n' % (expected_string)
+            self.assertIn(expected_string, report, result + report)
+        f.close()
+
+    def test_simple_decode(self):
+        '''Test simple decode on command line'''
+
+        expected = 0
+        expected_output = 'Decoded: /tmp/foo bar'
+        test_code = '2F746D702F666F6F20626172'
+
+        rc, report = cmd([aadecode_bin, test_code])
+        result = 'Got exit code %d, expected %d\n' % (rc, expected)
+        self.assertEqual(expected, rc, result + report)
+        result = 'Got output "%s", expected "%s"\n' % (report, expected_output)
+        self.assertIn(expected_output, report, result + report)
+
+    def test_simple_filter(self):
+        '''test simple decoding of the name argument'''
+
+        expected_string = 'name="/tmp/foo bar"'
+        content = \
+'''type=AVC msg=audit(1348982151.183:2934): apparmor="DENIED" operation="open" parent=30751 profile="/usr/lib/firefox/firefox{,*[^s] [^h]}" name=2F746D702F666F6F20626172 pid=30833 comm="plugin-containe" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
+'''
+
+        self._run_file_test(content, [expected_string])
+
+    def test_simple_multiline(self):
+        '''test simple multiline decoding of the name argument'''
+
+        expected_strings = ['ses=4294967295 new ses=2762',
+                            'name="/tmp/foo bar"',
+                            'name="/home/steve/tmp/my test file"']
+        content = \
+''' type=LOGIN msg=audit(1348980001.155:2925): login pid=17875 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=2762
+type=AVC msg=audit(1348982151.183:2934): apparmor="DENIED" operation="open" parent=30751 profile="/usr/lib/firefox/firefox{,*[^s] [^h]}" name=2F746D702F666F6F20626172 pid=30833 comm="plugin-containe" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
+type=AVC msg=audit(1348982148.195:2933): apparmor="DENIED" operation="file_lock" parent=5490 profile="/usr/lib/firefox/firefox{,*[^s][^h]}" name=2F686F6D652F73746576652F746D702F6D7920746573742066696C65 pid=30737 comm="firefox" requested_mask="k" denied_mask="k" fsuid=1000 ouid=1000
+'''
+
+        self._run_file_test(content, expected_strings)
+
+    def test_simple_profile(self):
+        '''test simple decoding of the profile argument'''
+
+        '''Example take from LP: #897957'''
+        expected_strings = ['name="/lib/x86_64-linux-gnu/libdl-2.13.so"',
+                            'profile="/test space"']
+        content = \
+'''[289763.843292] type=1400 audit(1322614912.304:857): apparmor="ALLOWED" operation="getattr" parent=16001 profile=2F74657374207370616365 name="/lib/x86_64-linux-gnu/libdl-2.13.so" pid=17011 comm="bash" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
+'''
+
+        self._run_file_test(content, expected_strings)
+
+    def test_simple_profile2(self):
+        '''test simple decoding of name and profile argument'''
+
+        '''Example take from LP: #897957'''
+        expected_strings = ['name="/home/steve/tmp/my test file"',
+                            'profile="/home/steve/tmp/my prog.sh"']
+        content = \
+'''type=AVC msg=audit(1349805073.402:6857): apparmor="DENIED" operation="mknod" parent=5890 profile=2F686F6D652F73746576652F746D702F6D792070726F672E7368 name=2F686F6D652F73746576652F746D702F6D7920746573742066696C65 pid=5891 comm="touch" requested_mask="c" denied_mask="c" fsuid=1000 ouid=1000
+'''
+
+        self._run_file_test(content, expected_strings)
+
+    def test_simple_embedded_carat(self):
+        '''test simple decoding of embedded ^ in files'''
+
+        expected_strings = ['name="/home/steve/tmp/my test ^file"']
+        content = \
+'''type=AVC msg=audit(1349805073.402:6857): apparmor="DENIED" operation="mknod" parent=5890 profile="/usr/bin/test_profile" name=2F686F6D652F73746576652F746D702F6D792074657374205E66696C65 pid=5891 comm="touch" requested_mask="c" denied_mask="c" fsuid=1000 ouid=1000
+'''
+
+        self._run_file_test(content, expected_strings)
+
+    def test_simple_embedded_backslash_carat(self):
+        '''test simple decoding of embedded \^ in files'''
+
+        expected_strings = ['name="/home/steve/tmp/my test \^file"']
+        content = \
+'''type=AVC msg=audit(1349805073.402:6857): apparmor="DENIED" operation="mknod" parent=5890 profile="/usr/bin/test_profile" name=2F686F6D652F73746576652F746D702F6D792074657374205C5E66696C65 pid=5891 comm="touch" requested_mask="c" denied_mask="c" fsuid=1000 ouid=1000
+'''
+
+        self._run_file_test(content, expected_strings)
+
+    def test_simple_embedded_singlequote(self):
+        '''test simple decoding of embedded \' in files'''
+
+        expected_strings = ['name="/home/steve/tmp/my test \'file"']
+        content = \
+'''type=AVC msg=audit(1349805073.402:6857): apparmor="DENIED" operation="mknod" parent=5890 profile="/usr/bin/test_profile" name=2F686F6D652F73746576652F746D702F6D792074657374202766696C65 pid=5891 comm="touch" requested_mask="c" denied_mask="c" fsuid=1000 ouid=1000
+'''
+
+        self._run_file_test(content, expected_strings)
+
+    def test_simple_encoded_nonpath_profiles(self):
+        '''test simple decoding of nonpath profiles'''
+
+        expected_strings = ['name="/lib/x86_64-linux-gnu/libdl-2.13.so"',
+                            'profile="test space"']
+        content = \
+'''[289763.843292] type=1400 audit(1322614912.304:857): apparmor="ALLOWED" operation="getattr" parent=16001 profile=74657374207370616365 name="/lib/x86_64-linux-gnu/libdl-2.13.so" pid=17011 comm="bash" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
+'''
+
+        self._run_file_test(content, expected_strings)
+
+#
+# Main
+#
+if __name__ == '__main__':
+    unittest.main()

Attachment: signature.asc
Description: Digital signature

-- 
AppArmor mailing list
[email protected]
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/apparmor

Reply via email to