This patch replaces the hardcoded path to the in-tree apparmor parser
in several of the script based test scripts with the APPARMOR_PARSER
environment variable, keeping the hardcoded location as the default.
It also adds support for overriding the location of the parser via the
same environment variable. The make infrastructure is updated to use
this, though uses a different variable (PARSER) to drive it.
Thus 'make check PARSER=/some/path/to/an/alternate/apparmor_parser'
will run all the parser tests on that binary. This is useful for
running the testsuite in an automated post-install environment.
(It should be noted that doing so will still build and run the unit
test binaries based on the source tree.)
---
parser/tst/Makefile | 6 +++---
parser/tst/README | 4 ++++
parser/tst/caching.sh | 30 ++++++++++++++++--------------
parser/tst/minimize.sh | 19 +++++++++++--------
parser/tst/simple.pl | 8 +++++++-
5 files changed, 41 insertions(+), 26 deletions(-)
Index: b/parser/tst/Makefile
===================================================================
--- a/parser/tst/Makefile
+++ b/parser/tst/Makefile
@@ -36,13 +36,13 @@ error_output: $(PARSER)
@echo "Error Output: PASS"
parser_sanity: $(PARSER)
- $(Q)${PROVE} ${PROVE_ARG} ${TESTS}
+ $(Q)LANG=C APPARMOR_PARSER="$(PARSER)" ${PROVE} ${PROVE_ARG} ${TESTS}
caching: $(PARSER)
- LANG=C ./caching.sh
+ LANG=C APPARMOR_PARSER="$(PARSER)" ./caching.sh
minimize: $(PARSER)
- LANG=C ./minimize.sh
+ LANG=C APPARMOR_PARSER="$(PARSER)" ./minimize.sh
$(PARSER):
make -C $(PARSER_DIR) $(PARSER_BIN)
Index: b/parser/tst/caching.sh
===================================================================
--- a/parser/tst/caching.sh
+++ b/parser/tst/caching.sh
@@ -10,6 +10,8 @@ if [ ! -d /sys/kernel/security/apparmor
exit 0
fi
+APPARMOR_PARSER="${APPARMOR_PARSER:-../apparmor_parser}"
+
# fake base directory
basedir=$(mktemp -d -t aa-cache-XXXXXX)
trap "rm -rf $basedir" EXIT
@@ -33,19 +35,19 @@ fi
rm -f $basedir/test1 $basedir/test2
echo -n "Profiles are not cached by default: "
-../apparmor_parser $ARGS -q -r $basedir/$profile
+${APPARMOR_PARSER} $ARGS -q -r $basedir/$profile
[ -f $basedir/cache/$profile ] && echo "FAIL ($basedir/cache/$profile exists)"
&& exit 1
echo "ok"
echo -n "Profiles are not cached when using --skip-cache: "
-../apparmor_parser $ARGS -q --write-cache --skip-cache -r $basedir/$profile
+${APPARMOR_PARSER} $ARGS -q --write-cache --skip-cache -r $basedir/$profile
[ -f $basedir/cache/$profile ] && echo "FAIL ($basedir/cache/$profile exists)"
&& exit 1
echo "ok"
sleep $timeout
echo -n "Profiles are cached when requested: "
-../apparmor_parser $ARGS -q --write-cache -r $basedir/$profile
+${APPARMOR_PARSER} $ARGS -q --write-cache -r $basedir/$profile
[ ! -f $basedir/cache/$profile ] && echo "FAIL ($basedir/cache/$profile does
not exist)" && exit 1
echo "ok"
@@ -80,22 +82,22 @@ fi
echo "ok"
echo -n "Cache is loaded when it exists and features match: "
-../apparmor_parser $ARGS -v -r $basedir/$profile | grep -q 'Cached reload
succeeded' || { echo "FAIL"; exit 1; }
+${APPARMOR_PARSER} $ARGS -v -r $basedir/$profile | grep -q 'Cached reload
succeeded' || { echo "FAIL"; exit 1; }
echo "ok"
echo -n "Cache is not loaded when skipping is requested: "
-../apparmor_parser $ARGS -v --skip-read-cache -r $basedir/$profile | grep -q
'Replacement succeeded for' || { echo "FAIL"; exit 1; }
-../apparmor_parser $ARGS -v --skip-cache -r $basedir/$profile | grep -q
'Replacement succeeded for' || { echo "FAIL"; exit 1; }
+${APPARMOR_PARSER} $ARGS -v --skip-read-cache -r $basedir/$profile | grep -q
'Replacement succeeded for' || { echo "FAIL"; exit 1; }
+${APPARMOR_PARSER} $ARGS -v --skip-cache -r $basedir/$profile | grep -q
'Replacement succeeded for' || { echo "FAIL"; exit 1; }
echo "ok"
echo -n "Cache reading is skipped when features do not match cache: "
echo -n "monkey" > $basedir/cache/.features
-../apparmor_parser $ARGS -v -r $basedir/$profile | grep -q 'Replacement
succeeded for' || { echo "FAIL"; exit 1; }
+${APPARMOR_PARSER} $ARGS -v -r $basedir/$profile | grep -q 'Replacement
succeeded for' || { echo "FAIL"; exit 1; }
echo "ok"
echo -n "Cache writing is skipped when features do not match and not cleared: "
rm $basedir/cache/$profile
-../apparmor_parser $ARGS -v --write-cache --skip-bad-cache -r
$basedir/$profile | grep -q 'Replacement succeeded for' || { echo "FAIL"; exit
1; }
+${APPARMOR_PARSER} $ARGS -v --write-cache --skip-bad-cache -r
$basedir/$profile | grep -q 'Replacement succeeded for' || { echo "FAIL"; exit
1; }
[ -f $basedir/cache/$profile ] && echo "FAIL ($basedir/cache/$profile exists)"
&& exit 1
echo "ok"
@@ -104,7 +106,7 @@ rm -f $basedir/cache/$profile || true
echo -n "monkey" > $basedir/cache/.features
echo -n "monkey" > $basedir/cache/$profile
echo -n "monkey" > $basedir/cache/monkey
-../apparmor_parser $ARGS -v --write-cache -r $basedir/$profile | grep -q
'Replacement succeeded for' || { echo "Cache clear setup FAIL"; exit 1; }
+${APPARMOR_PARSER} $ARGS -v --write-cache -r $basedir/$profile | grep -q
'Replacement succeeded for' || { echo "Cache clear setup FAIL"; exit 1; }
echo -n "Cache clear updates features: "
echo -n "monkey" | diff -q $basedir/cache/.features - | grep -q 'differ' || {
echo "FAIL"; exit 1; }
echo "ok"
@@ -122,7 +124,7 @@ echo -n "monkey" > $basedir/cache/.featu
echo -n "monkey" > $basedir/cache/$profile
echo -n "monkey" > $basedir/cache/monkey
echo -n "Cache purge remove profiles unconditionally: "
-../apparmor_parser $ARGS -v --purge-cache -r $basedir/$profile || { echo
"Cache purge setup FAIL"; exit 1; }
+${APPARMOR_PARSER} $ARGS -v --purge-cache -r $basedir/$profile || { echo
"Cache purge setup FAIL"; exit 1; }
[ -f $basedir/cache/.features ] && { echo "FAIL"; exit 1; }
[ -f $basedir/cache/$profile ] && { echo "FAIL"; exit 1; }
[ -f $basedir/cache/monkey ] && { echo "FAIL"; exit 1; }
@@ -131,25 +133,25 @@ echo "ok"
echo -n "Profiles are cached when requested (again): "
rm -f $basedir/cache/.features || true
rm -f $basedir/cache/$profile || true
-../apparmor_parser $ARGS -q --write-cache -r $basedir/$profile
+${APPARMOR_PARSER} $ARGS -q --write-cache -r $basedir/$profile
[ ! -f $basedir/cache/$profile ] && echo "FAIL ($basedir/cache/$profile does
not exist)" && exit 1
echo "ok"
echo -n "Cache reading is skipped when profile is newer: "
sleep $timeout
touch $basedir/$profile
-../apparmor_parser $ARGS -v -r $basedir/$profile | grep -q 'Replacement
succeeded for' || { echo "FAIL"; exit 1; }
+${APPARMOR_PARSER} $ARGS -v -r $basedir/$profile | grep -q 'Replacement
succeeded for' || { echo "FAIL"; exit 1; }
echo "ok"
echo -n "Cache is used when cache is newer: "
sleep $timeout
touch $basedir/cache/$profile
-../apparmor_parser $ARGS -v -r $basedir/$profile | grep -q 'Cached reload
succeeded' || { echo "FAIL"; exit 1; }
+${APPARMOR_PARSER} $ARGS -v -r $basedir/$profile | grep -q 'Cached reload
succeeded' || { echo "FAIL"; exit 1; }
echo "ok"
echo -n "Cache reading is skipped when parser is newer: "
mkdir $basedir/parser
-cp ../apparmor_parser $basedir/parser/
+cp ${APPARMOR_PARSER} $basedir/parser/
$basedir/parser/apparmor_parser $ARGS -v -r $basedir/$profile | grep -q
'Replacement succeeded for' || { echo "FAIL"; exit 1; }
echo "ok"
Index: b/parser/tst/minimize.sh
===================================================================
--- a/parser/tst/minimize.sh
+++ b/parser/tst/minimize.sh
@@ -1,5 +1,8 @@
#!/bin/bash
+#
+APPARMOR_PARSER="${APPARMOR_PARSER:-../apparmor_parser}"
+
# Format of -D dfa-states
# dfa-states output is split into 2 parts:
# the accept state infomation
@@ -75,7 +78,7 @@
# {a} (0x 40030/0/0/0)
echo -n "Minimize profiles basic perms "
-if [ `echo "/t { /a r, /b w, /c a, /d l, /e k, /f m, /** w, }" |
../apparmor_parser -QT -O minimize -D dfa-states 2>&1 | grep -v '<==' | grep
'^{.*} (.*)$' | wc -l` -ne 6 ] ; then
+if [ `echo "/t { /a r, /b w, /c a, /d l, /e k, /f m, /** w, }" |
${APPARMOR_PARSER} -QT -O minimize -D dfa-states 2>&1 | grep -v '<==' | grep
'^{.*} (.*)$' | wc -l` -ne 6 ] ; then
echo "failed"
exit 1;
fi
@@ -90,7 +93,7 @@ echo "ok"
# {9} (0x 12804a/0/2800a/0)
# {c} (0x 40030/0/0/0)
echo -n "Minimize profiles audit perms "
-if [ `echo "/t { /a r, /b w, /c a, /d l, /e k, /f m, audit /** w, }" |
../apparmor_parser -QT -O minimize -D dfa-states 2>&1 | grep -v '<==' | grep
'^{.*} (.*)$' | wc -l` -ne 6 ] ; then
+if [ `echo "/t { /a r, /b w, /c a, /d l, /e k, /f m, audit /** w, }" |
${APPARMOR_PARSER} -QT -O minimize -D dfa-states 2>&1 | grep -v '<==' | grep
'^{.*} (.*)$' | wc -l` -ne 6 ] ; then
echo "failed"
exit 1;
fi
@@ -109,7 +112,7 @@ echo "ok"
# {c} (0x 40030/0/0/0)
echo -n "Minimize profiles deny perms "
-if [ `echo "/t { /a r, /b w, /c a, /d l, /e k, /f m, deny /** w, }" |
../apparmor_parser -QT -O minimize -D dfa-states 2>&1 | grep -v '<==' | grep
'^{.*} (.*)$' | wc -l` -ne 6 ] ; then
+if [ `echo "/t { /a r, /b w, /c a, /d l, /e k, /f m, deny /** w, }" |
${APPARMOR_PARSER} -QT -O minimize -D dfa-states 2>&1 | grep -v '<==' | grep
'^{.*} (.*)$' | wc -l` -ne 6 ] ; then
echo "failed"
exit 1;
fi
@@ -127,7 +130,7 @@ echo "ok"
# {c} (0x 40030/0/0/0)
echo -n "Minimize profiles audit deny perms "
-if [ `echo "/t { /a r, /b w, /c a, /d l, /e k, /f m, audit deny /** w, }" |
../apparmor_parser -QT -O minimize -D dfa-states 2>&1 | grep -v '<==' | grep
'^{.*} (.*)$' | wc -l` -ne 5 ] ; then
+if [ `echo "/t { /a r, /b w, /c a, /d l, /e k, /f m, audit deny /** w, }" |
${APPARMOR_PARSER} -QT -O minimize -D dfa-states 2>&1 | grep -v '<==' | grep
'^{.*} (.*)$' | wc -l` -ne 5 ] ; then
echo "failed"
exit 1;
fi
@@ -159,7 +162,7 @@ echo "ok"
#
echo -n "Minimize profiles xtrans "
-if [ `echo "/t { /b px, /* Pixr, /a Cx -> foo, }" | ../apparmor_parser -QT -O
minimize -D dfa-states 2>&1 | grep -v '<==' | grep '^{.*} (.*)$' | wc -l` -ne 3
] ; then
+if [ `echo "/t { /b px, /* Pixr, /a Cx -> foo, }" | ${APPARMOR_PARSER} -QT -O
minimize -D dfa-states 2>&1 | grep -v '<==' | grep '^{.*} (.*)$' | wc -l` -ne 3
] ; then
echo "failed"
exit 1;
fi
@@ -167,7 +170,7 @@ echo "ok"
# same test as above + audit
echo -n "Minimize profiles audit xtrans "
-if [ `echo "/t { /b px, audit /* Pixr, /a Cx -> foo, }" | ../apparmor_parser
-QT -O minimize -D dfa-states 2>&1 | grep -v '<==' | grep '^{.*} (.*)$' | wc
-l` -ne 3 ] ; then
+if [ `echo "/t { /b px, audit /* Pixr, /a Cx -> foo, }" | ${APPARMOR_PARSER}
-QT -O minimize -D dfa-states 2>&1 | grep -v '<==' | grep '^{.*} (.*)$' | wc
-l` -ne 3 ] ; then
echo "failed"
exit 1;
fi
@@ -180,7 +183,7 @@ echo "ok"
# {3} (0x 0/fe17f85/0/14005)
echo -n "Minimize profiles deny xtrans "
-if [ `echo "/t { /b px, deny /* xr, /a Cx -> foo, }" | ../apparmor_parser -QT
-O minimize -D dfa-states 2>&1 | grep -v '<==' | grep '^{.*} (.*)$' | wc -l`
-ne 1 ] ; then
+if [ `echo "/t { /b px, deny /* xr, /a Cx -> foo, }" | ${APPARMOR_PARSER} -QT
-O minimize -D dfa-states 2>&1 | grep -v '<==' | grep '^{.*} (.*)$' | wc -l`
-ne 1 ] ; then
echo "failed"
exit 1;
fi
@@ -192,7 +195,7 @@ echo "ok"
# {3} (0x 0/fe17f85/0/0)
echo -n "Minimize profiles audit deny xtrans "
-if [ `echo "/t { /b px, audit deny /* xr, /a Cx -> foo, }" |
../apparmor_parser -QT -O minimize -D dfa-states 2>&1 | grep -v '<==' | grep
'^{.*} (.*)$' | wc -l` -ne 0 ] ; then
+if [ `echo "/t { /b px, audit deny /* xr, /a Cx -> foo, }" |
${APPARMOR_PARSER} -QT -O minimize -D dfa-states 2>&1 | grep -v '<==' | grep
'^{.*} (.*)$' | wc -l` -ne 0 ] ; then
echo "failed"
exit 1;
fi
Index: b/parser/tst/simple.pl
===================================================================
--- a/parser/tst/simple.pl
+++ b/parser/tst/simple.pl
@@ -8,7 +8,7 @@ use Getopt::Long;
use Test::More;
my %config;
-$config{'parser'} = "/sbin/subdomain_parser";
+$config{'parser'} = "/sbin/apparmor_parser";
$config{'profiledir'} = "./simple_tests/";
$config{'timeout'} = 120; # in seconds
@@ -30,6 +30,12 @@ sub usage {
&usage if ($help);
read_config();
+# let environment variable override config file, for use in automated
+# test suites
+if ($ENV{APPARMOR_PARSER}) {
+ $config{'parser'} = $ENV{APPARMOR_PARSER};
+}
+
# Override config file profile location when passed on command line
if (@ARGV >= 1) {
$config{'profiledir'} = shift;
Index: b/parser/tst/README
===================================================================
--- a/parser/tst/README
+++ b/parser/tst/README
@@ -9,6 +9,10 @@ There is a user configuration file 'user
against a different parser, or use a different set of profiles for the
simple.pl test, you can change those settings in 'uservars.conf'.
+You can also override which parser is used through make by specifying
+the PARSER veriable. For example, to run the tests on the system parser,
+run 'make PARSER=/sbin/apparmor_parser'.
+
Adding to the testsuite
-----------------------
--
AppArmor mailing list
[email protected]
Modify settings or unsubscribe at:
https://lists.ubuntu.com/mailman/listinfo/apparmor
