Create a list for each category (good server perms, bad server perms, good client perms, and bad client perms) of UNIX domain socket tests so that they can be looped through.
This makes it easier to append additional tests to the list based upon conditions such as kernel ABI, address type, etc. Signed-off-by: Tyler Hicks <[email protected]> --- tests/regression/apparmor/unix_socket.sh | 90 +++++++++++++------------------- 1 file changed, 35 insertions(+), 55 deletions(-) diff --git a/tests/regression/apparmor/unix_socket.sh b/tests/regression/apparmor/unix_socket.sh index 3d70886..b4fd59d 100755 --- a/tests/regression/apparmor/unix_socket.sh +++ b/tests/regression/apparmor/unix_socket.sh @@ -35,19 +35,6 @@ sockpath_abstract="@apparmor_unix_socket" message=4a0c83d87aaa7afa2baab5df3ee4df630f0046d5bfb7a3080c550b721f401b3b\ 8a738e1435a3b77aa6482a70fb51c44f20007221b85541b0184de66344d46a4c -# v6 requires 'w' and v7 requires 'rw' -okserver=w -badserver1=r -badserver2= -if [ "$(have_features policy/versions/v7)" == "true" ] ; then - okserver=rw - badserver2=w -fi - -okclient=rw -badclient1=r -badclient2=w - isabstract() { [ "${1:0:1}" == "@" ] @@ -66,6 +53,19 @@ testsocktype() local sockpath=$2 # fs path or "@NAME" for an abstract sock local socktype=$3 # stream, dgram, or seqpacket local args="$sockpath $socktype $message $client" + local i=0 + + # assume, by default, that the sock addr is of the pathname type + local okservers=("$sockpath:w") + local badservers=("" "$sockpath:r") + local okclients=("$sockpath:rw") + local badclients=("" "$sockpath:r" "$sockpath:w") + + # v6 requires 'w' and v7 requires 'rw' + if [ "$(have_features policy/versions/v7)" == "true" ] ; then + okservers=("$sockpath:rw") + badservers+=("$sockpath:w") + fi removesocket $sockpath @@ -84,57 +84,37 @@ testsocktype() return fi - # PASS - server w/ access to the file - - genprofile $sockpath:$okserver $client:Ux - runchecktest "$testdesc; confined server w/ access ($okserver)" pass $args - removesocket $sockpath - - # FAIL - server w/o access to the file - - genprofile $client:Ux - runchecktest "$testdesc; confined server w/o access" fail $args - removesocket $sockpath + for ((i=0; i<${#okservers[@]}; i++)); do + # PASS - server w/ access to the file - # FAIL - server w/ bad access to the file - - genprofile $sockpath:$badserver1 $client:Ux - runchecktest "$testdesc; confined server w/ bad access ($badserver1)" fail $args - removesocket $sockpath + genprofile ${okservers[i]} $client:Ux + runchecktest "$testdesc; confined server ok[$i]" pass $args + removesocket $sockpath + done - # $badserver2 is set to non-null at the top of the test script if the - # kernel advertises ABI v7 or newer - if [ -n "$badserver2" ] ; then + for ((i=0; i<${#badservers[@]}; i++)); do # FAIL - server w/ bad access to the file - genprofile $sockpath:$badserver2 $client:Ux - runchecktest "$testdesc; confined server w/ bad access ($badserver2)" fail $args + genprofile ${badservers[i]} $client:Ux + runchecktest "$testdesc; confined server bad[$i]" fail $args removesocket $sockpath - fi - - # PASS - client w/ access to the file - - genprofile $sockpath:$okserver $client:px -- image=$client $sockpath:$okclient - runchecktest "$testdesc; confined client w/ access ($okclient)" pass $args - removesocket $sockpath - - # FAIL - client w/o access to the file - - genprofile $sockpath:$okserver $client:px -- image=$client - runchecktest "$testdesc; confined client w/o access" fail $args - removesocket $sockpath + done - # FAIL - client w/ bad access to the file + for ((i=0; i<${#okclients[@]}; i++)); do + # PASS - client w/ access to the file - genprofile $sockpath:$okserver $client:px -- image=$client $sockpath:$badclient1 - runchecktest "$testdesc; confined client w/ bad access ($badclient1)" fail $args - removesocket $sockpath + genprofile ${okservers[0]} $client:px -- image=$client ${okclients[i]} + runchecktest "$testdesc; confined client ok[$i]" pass $args + removesocket $sockpath + done - # FAIL - client w/ bad access to the file + for ((i=0; i<${#badclients[@]}; i++)); do + # FAIL - client w/ bad access to the file - genprofile $sockpath:$okserver $client:px -- image=$client $sockpath:$badclient2 - runchecktest "$testdesc; confined client w/ bad access ($badclient2)" fail $args - removesocket $sockpath + genprofile ${okservers[0]} $client:px -- image=$client ${badclients[i]} + runchecktest "$testdesc; confined client bad[$i]" fail $args + removesocket $sockpath + done removeprofile } -- 2.1.0 -- AppArmor mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
