On Thu, Sep 04, 2014 at 06:55:41AM -0500, Tyler Hicks wrote: > Create a list for each category (good server perms, bad server perms, > good client perms, and bad client perms) of UNIX domain socket tests so > that they can be looped through. > > This makes it easier to append additional tests to the list based upon > conditions such as kernel ABI, address type, etc. > > Signed-off-by: Tyler Hicks <[email protected]>
Acked-by: Seth Arnold <[email protected]> Thanks > --- > tests/regression/apparmor/unix_socket.sh | 90 > +++++++++++++------------------- > 1 file changed, 35 insertions(+), 55 deletions(-) > > diff --git a/tests/regression/apparmor/unix_socket.sh > b/tests/regression/apparmor/unix_socket.sh > index 3d70886..b4fd59d 100755 > --- a/tests/regression/apparmor/unix_socket.sh > +++ b/tests/regression/apparmor/unix_socket.sh > @@ -35,19 +35,6 @@ sockpath_abstract="@apparmor_unix_socket" > message=4a0c83d87aaa7afa2baab5df3ee4df630f0046d5bfb7a3080c550b721f401b3b\ > 8a738e1435a3b77aa6482a70fb51c44f20007221b85541b0184de66344d46a4c > > -# v6 requires 'w' and v7 requires 'rw' > -okserver=w > -badserver1=r > -badserver2= > -if [ "$(have_features policy/versions/v7)" == "true" ] ; then > - okserver=rw > - badserver2=w > -fi > - > -okclient=rw > -badclient1=r > -badclient2=w > - > isabstract() > { > [ "${1:0:1}" == "@" ] > @@ -66,6 +53,19 @@ testsocktype() > local sockpath=$2 # fs path or "@NAME" for an abstract sock > local socktype=$3 # stream, dgram, or seqpacket > local args="$sockpath $socktype $message $client" > + local i=0 > + > + # assume, by default, that the sock addr is of the pathname type > + local okservers=("$sockpath:w") > + local badservers=("" "$sockpath:r") > + local okclients=("$sockpath:rw") > + local badclients=("" "$sockpath:r" "$sockpath:w") > + > + # v6 requires 'w' and v7 requires 'rw' > + if [ "$(have_features policy/versions/v7)" == "true" ] ; then > + okservers=("$sockpath:rw") > + badservers+=("$sockpath:w") > + fi > > removesocket $sockpath > > @@ -84,57 +84,37 @@ testsocktype() > return > fi > > - # PASS - server w/ access to the file > - > - genprofile $sockpath:$okserver $client:Ux > - runchecktest "$testdesc; confined server w/ access ($okserver)" pass > $args > - removesocket $sockpath > - > - # FAIL - server w/o access to the file > - > - genprofile $client:Ux > - runchecktest "$testdesc; confined server w/o access" fail $args > - removesocket $sockpath > + for ((i=0; i<${#okservers[@]}; i++)); do > + # PASS - server w/ access to the file > > - # FAIL - server w/ bad access to the file > - > - genprofile $sockpath:$badserver1 $client:Ux > - runchecktest "$testdesc; confined server w/ bad access ($badserver1)" > fail $args > - removesocket $sockpath > + genprofile ${okservers[i]} $client:Ux > + runchecktest "$testdesc; confined server ok[$i]" pass $args > + removesocket $sockpath > + done > > - # $badserver2 is set to non-null at the top of the test script if the > - # kernel advertises ABI v7 or newer > - if [ -n "$badserver2" ] ; then > + for ((i=0; i<${#badservers[@]}; i++)); do > # FAIL - server w/ bad access to the file > > - genprofile $sockpath:$badserver2 $client:Ux > - runchecktest "$testdesc; confined server w/ bad access > ($badserver2)" fail $args > + genprofile ${badservers[i]} $client:Ux > + runchecktest "$testdesc; confined server bad[$i]" fail $args > removesocket $sockpath > - fi > - > - # PASS - client w/ access to the file > - > - genprofile $sockpath:$okserver $client:px -- image=$client > $sockpath:$okclient > - runchecktest "$testdesc; confined client w/ access ($okclient)" pass > $args > - removesocket $sockpath > - > - # FAIL - client w/o access to the file > - > - genprofile $sockpath:$okserver $client:px -- image=$client > - runchecktest "$testdesc; confined client w/o access" fail $args > - removesocket $sockpath > + done > > - # FAIL - client w/ bad access to the file > + for ((i=0; i<${#okclients[@]}; i++)); do > + # PASS - client w/ access to the file > > - genprofile $sockpath:$okserver $client:px -- image=$client > $sockpath:$badclient1 > - runchecktest "$testdesc; confined client w/ bad access ($badclient1)" > fail $args > - removesocket $sockpath > + genprofile ${okservers[0]} $client:px -- image=$client > ${okclients[i]} > + runchecktest "$testdesc; confined client ok[$i]" pass $args > + removesocket $sockpath > + done > > - # FAIL - client w/ bad access to the file > + for ((i=0; i<${#badclients[@]}; i++)); do > + # FAIL - client w/ bad access to the file > > - genprofile $sockpath:$okserver $client:px -- image=$client > $sockpath:$badclient2 > - runchecktest "$testdesc; confined client w/ bad access ($badclient2)" > fail $args > - removesocket $sockpath > + genprofile ${okservers[0]} $client:px -- image=$client > ${badclients[i]} > + runchecktest "$testdesc; confined client bad[$i]" fail $args > + removesocket $sockpath > + done > > removeprofile > } > -- > 2.1.0 > > > -- > AppArmor mailing list > [email protected] > Modify settings or unsubscribe at: > https://lists.ubuntu.com/mailman/listinfo/apparmor >
signature.asc
Description: Digital signature
-- AppArmor mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
