On Tue, Jun 10, 2014 at 12:08:21PM -0500, Tyler Hicks wrote: > Add two tests that verify AppArmor denials when one end of the pipe has > bad access permissions to the pipe. > > Signed-off-by: Tyler Hicks <[email protected]>
Looks good, Acked-by: Steve Beattie <[email protected]>. Thanks. > --- > tests/regression/apparmor/named_pipe.sh | 16 ++++++++++++++++ > 1 file changed, 16 insertions(+) > > diff --git a/tests/regression/apparmor/named_pipe.sh > b/tests/regression/apparmor/named_pipe.sh > index bc8c0e7..24c36a7 100755 > --- a/tests/regression/apparmor/named_pipe.sh > +++ b/tests/regression/apparmor/named_pipe.sh > @@ -29,9 +29,11 @@ okperm=rw > > subparent=parent > okparent=r > +badparent=w > > subchild=child > okchild=w > +badchild=r > > # Add genprofile params that are common to all hats here > common="" > @@ -93,3 +95,17 @@ genprofile hat:$subparent $common \ > hat:$subchild $common ${fifo}:${okchild} > > runchecktest "NAMED PIPE W (parent & child subprofiles)" fail ${subparent} > ${subchild} ${fifo} > + > +# PIPE - in separate subprofiles - bad access for child > + > +genprofile hat:$subparent $common ${fifo}:${okparent} \ > + hat:$subchild $common ${fifo}:${badchild} > + > +runchecktest "NAMED PIPE bad child (parent & child subprofiles)" fail > ${subparent} ${subchild} ${fifo} > + > +# PIPE - in separate subprofiles - bad access for parent > + > +genprofile hat:$subparent $common ${fifo}:${badparent} \ > + hat:$subchild $common ${fifo}:${okchild} > + > +runchecktest "NAMED PIPE bad parent (parent & child subprofiles)" fail > ${subparent} ${subchild} ${fifo} -- Steve Beattie <[email protected]> http://NxNW.org/~steve/
signature.asc
Description: Digital signature
-- AppArmor mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
