On Thu, Mar 20, 2014 at 12:30:56PM -0500, Tyler Hicks wrote: > Bug: https://bugs.launchpad.net/bugs/1294819 > > This patch as minimal support for bare capability rules ("capability,"). > It prevents aa.py from emitting a traceback when encountering such a > rule. > > It only adds the ability to parse and write the bare rule. It doesn't > attempt to be clever when deleting duplicate rules, such as realizing > that "capability audit_control," can be deleted if "capability," is also > present. > > Signed-off-by: Tyler Hicks <[email protected]> > Acked-by: Steve Beattie <[email protected]> > --- > > * Changes since v1: > - Added a todo for deleting duplicates when a bare capability rule is > present > - Changed the RE_PROFILE_CAP to enforce whitespace between the > capability rule identifier and the capability name.
Ah yes, I'd noticed that when I first reviewed the patch, but forgot about it while fighting with other external issues while testing your patch. > - Use strip() on the capability name string > - Made adjustments to serialize_profile_from_old_profile() in order to > handle the new RE_PROFILE_CAP regex Right, this was the function I was confused about when adding dbus rules. Anyway, re-iterating my ack for this patch. Also, I added a token few testcases (if we come up with more, we can restructure this a bit): Signed-off-by: Steve Beattie <[email protected]> --- utils/test/test-regex_matches.py | 45 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) Index: b/utils/test/test-regex_matches.py =================================================================== --- a/utils/test/test-regex_matches.py +++ b/utils/test/test-regex_matches.py @@ -110,6 +110,50 @@ def setup_split_comment_testcases(): stub_test.__doc__ = "test '%s'" % (test_string) setattr(AARegexSplitComment, 'test_split_comment_%d' % (i), stub_test) +class AARegexCapability(unittest.TestCase): + '''Tests for RE_PROFILE_CAP''' + + def test_simple_capability_01(self): + '''test ' capability net_raw,' ''' + + line = ' capability net_raw,' + result = aa.RE_PROFILE_CAP.search(line) + self.assertTrue(result, 'Couldn\'t find capability rule in "%s"' % line) + cap = result.groups()[2].strip() + self.assertEqual(cap, 'net_raw', 'Expected capability "%s", got "%s"' + % ('net_raw', cap)) + + def test_simple_capability_02(self): + '''test ' capability net_raw , ' ''' + + line = 'capability net_raw , ' + result = aa.RE_PROFILE_CAP.search(line) + self.assertTrue(result, 'Couldn\'t find capability rule in "%s"' % line) + cap = result.groups()[2].strip() + self.assertEqual(cap, 'net_raw', 'Expected capability "%s", got "%s"' + % ('net_raw', cap)) + + def test_capability_all_01(self): + '''test ' capability,' ''' + + line = ' capability,' + result = aa.RE_PROFILE_CAP.search(line) + self.assertTrue(result, 'Couldn\'t find capability rule in "%s"' % line) + + def test_capability_all_02(self): + '''test ' capability , ' ''' + + line = ' capability , ' + result = aa.RE_PROFILE_CAP.search(line) + self.assertTrue(result, 'Couldn\'t find capability rule in "%s"' % line) + + def test_simple_bad_capability_01(self): + '''test ' capabilitynet_raw,' ''' + + line = ' capabilitynet_raw,' + result = aa.RE_PROFILE_CAP.search(line) + self.assertFalse(result, 'Found unexpected capability rule in "%s"' % line) + if __name__ == '__main__': verbosity = 2 @@ -119,6 +163,7 @@ if __name__ == '__main__': test_suite = unittest.TestSuite() test_suite.addTest(unittest.TestLoader().loadTestsFromTestCase(AARegexHasComma)) test_suite.addTest(unittest.TestLoader().loadTestsFromTestCase(AARegexSplitComment)) + test_suite.addTest(unittest.TestLoader().loadTestsFromTestCase(AARegexCapability)) result = unittest.TextTestRunner(verbosity=verbosity).run(test_suite) if not result.wasSuccessful(): exit(1) -- Steve Beattie <[email protected]> http://NxNW.org/~steve/
signature.asc
Description: Digital signature
-- AppArmor mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
