On Wed, Apr 29, 2015 at 03:25:10PM -0700, John Johansen wrote: > The regression tests have issue on backport kernels when the userspace > has not been updated. The issue is that the regression tests detect the > kernel features set and generate policy that the parser may not be able > to compile. > > Augment the regressions tests with a couple simple functions to test what > is supported by the parser, and update the test conditionals to use them. > > Signed-off-by: John Johansen <[email protected]>
This looks good to me as-is; but I think the existing requires_features and have_features ought to be renamed to reflect that they are testing the kernel for those features. Acked-by: Seth Arnold <[email protected]> Thanks > > --- > > === modified file 'tests/regression/apparmor/dbus_eavesdrop.sh' > --- tests/regression/apparmor/dbus_eavesdrop.sh 2014-03-27 02:08:59 > +0000 > +++ tests/regression/apparmor/dbus_eavesdrop.sh 2015-04-29 21:49:04 > +0000 > @@ -19,6 +19,7 @@ > > . $bin/prologue.inc > requires_features dbus > +requires_parser_support "dbus," > . $bin/dbus.inc > > args="--session" > > === modified file 'tests/regression/apparmor/dbus_message.sh' > --- tests/regression/apparmor/dbus_message.sh 2014-03-27 02:08:59 +0000 > +++ tests/regression/apparmor/dbus_message.sh 2015-04-29 21:49:04 +0000 > @@ -19,6 +19,7 @@ > > . $bin/prologue.inc > requires_features dbus > +requires_parser_support "dbus," > . $bin/dbus.inc > > listnames="--type=method_call --session --name=org.freedesktop.DBus > /org/freedesktop/DBus org.freedesktop.DBus.ListNames" > > === modified file 'tests/regression/apparmor/dbus_service.sh' > --- tests/regression/apparmor/dbus_service.sh 2014-03-27 02:08:59 +0000 > +++ tests/regression/apparmor/dbus_service.sh 2015-04-29 21:49:04 +0000 > @@ -18,6 +18,7 @@ > > . $bin/prologue.inc > requires_features dbus > +requires_parser_support "dbus," > . $bin/dbus.inc > > service="--$bus --name=$dest $path $iface" > > === modified file 'tests/regression/apparmor/dbus_unrequested_reply.sh' > --- tests/regression/apparmor/dbus_unrequested_reply.sh 2014-09-05 > 14:43:05 +0000 > +++ tests/regression/apparmor/dbus_unrequested_reply.sh 2015-04-29 > 21:49:04 +0000 > @@ -18,6 +18,7 @@ > > . $bin/prologue.inc > requires_features dbus > +requires_parser_support "dbus," > . $bin/dbus.inc > > service="--$bus --name=$dest $path $iface" > > === modified file 'tests/regression/apparmor/deleted.sh' > --- tests/regression/apparmor/deleted.sh 2014-09-11 02:30:20 +0000 > +++ tests/regression/apparmor/deleted.sh 2015-04-29 21:49:04 +0000 > @@ -65,7 +65,7 @@ > badperm=wl > af_unix="" > > -if [ "$(have_features network/af_unix)" == "true" ]; then > +if [ "$(have_features network/af_unix)" == "true" -a "$(parser_supports > 'unix,')" == "true" ]; then > af_unix="unix:create" > fi > > > === modified file 'tests/regression/apparmor/mount.sh' > --- tests/regression/apparmor/mount.sh 2014-04-24 19:24:54 +0000 > +++ tests/regression/apparmor/mount.sh 2015-04-29 21:49:04 +0000 > @@ -102,7 +102,7 @@ > remove_mnt > > > -if [ "$(have_features mount)" != "true" ] ; then > +if [ "$(have_features mount)" != "true" -o "$(parser_supports 'mount,')" != > "true" ] ; then > genprofile capability:sys_admin > runchecktest "MOUNT (confined cap)" pass mount ${loop_device} > ${mount_point} > remove_mnt > > === modified file 'tests/regression/apparmor/named_pipe.sh' > --- tests/regression/apparmor/named_pipe.sh 2014-06-11 04:05:44 +0000 > +++ tests/regression/apparmor/named_pipe.sh 2015-04-29 21:49:04 +0000 > @@ -38,7 +38,7 @@ > # Add genprofile params that are common to all hats here > common="" > > -if [ "$(have_features signal)" == "true" ] ; then > +if [ "$(have_features signal)" == "true" -a "$(parser_supports 'signal,')" > == "true" ] ; then > # Allow send/receive of all signals > common="${common} signal:ALL" > fi > > === modified file 'tests/regression/apparmor/pivot_root.sh' > --- tests/regression/apparmor/pivot_root.sh 2015-03-31 09:46:45 +0000 > +++ tests/regression/apparmor/pivot_root.sh 2015-04-29 21:49:04 +0000 > @@ -106,8 +106,8 @@ > genprofile > do_test "no perms" fail "$put_old" "$new_root" "$test" > > -if [ "$(have_features mount)" != "true" ] ; then > - # pivot_root mediation isn't supported by this kernel, so verify that > +if [ "$(have_features mount)" != "true" -o "$(parser_supports 'mount,')" != > "true" ] ; then > + # pivot_root mediation isn't supported by this kernel/parser, so verify > that > # capability sys_admin is sufficient and skip the remaining tests > genprofile $cur $cap > do_test "cap" pass "$put_old" "$new_root" "$test" > > === modified file 'tests/regression/apparmor/prologue.inc' > --- tests/regression/apparmor/prologue.inc 2014-10-09 19:30:34 +0000 > +++ tests/regression/apparmor/prologue.inc 2015-04-29 21:49:04 +0000 > @@ -58,6 +58,30 @@ > fi > } > > +parser_supports() > +{ > + for R in $@ ; do > + echo "/test { $R }" | $subdomain ${parser_args} -qQT > 2>/dev/null 1>/dev/null > + if [ $? -ne 0 ] ; then > + echo "Compiler does not support rule '$R'" > + return 1; > + fi > + done > + > + echo "true" > + return 0; > +} > + > +requires_parser_support() > +{ > + local res=$(parser_supports $@) > + if [ "$res" != "true" ] ; then > + echo "$res. Skipping tests ..." > + exit 0 > + fi > +} > + > + > fatalerror() > { > # global _fatal > > === modified file 'tests/regression/apparmor/ptrace.sh' > --- tests/regression/apparmor/ptrace.sh 2014-04-23 18:44:41 +0000 > +++ tests/regression/apparmor/ptrace.sh 2015-04-29 21:49:04 +0000 > @@ -52,7 +52,7 @@ > runchecktest "test 2 -hc prog" pass -h -c -n 100 $helper /bin/true > > > -if [ "$(have_features ptrace)" == "true" ] ; then > +if [ "$(have_features ptrace)" == "true" -a "$(parser_supports 'ptrace,')" > == "true" ] ; then > . $bin/ptrace_v6.inc > else > . $bin/ptrace_v5.inc > > === modified file 'tests/regression/apparmor/socketpair.sh' > --- tests/regression/apparmor/socketpair.sh 2014-09-18 19:04:29 +0000 > +++ tests/regression/apparmor/socketpair.sh 2015-04-29 21:49:04 +0000 > @@ -34,7 +34,7 @@ > af_unix_create_label="" > af_unix_inherit="" > > -if [ "$(have_features network/af_unix)" == "true" ]; then > +if [ "$(have_features network/af_unix)" == "true" -a "$(parser_supports > 'unix,')" == "true" ]; then > # AppArmor requires that the process inheriting the sock file > # descriptors have send,receive perms in its profile > af_unix_create="unix:(create,getopt)" > > === modified file 'tests/regression/apparmor/unix_fd_server.sh' > --- tests/regression/apparmor/unix_fd_server.sh 2014-09-11 02:30:27 > +0000 > +++ tests/regression/apparmor/unix_fd_server.sh 2015-04-29 21:49:04 > +0000 > @@ -27,7 +27,7 @@ > badperm=w > af_unix="" > > -if [ "$(have_features network/af_unix)" == "true" ]; then > +if [ "$(have_features network/af_unix)" == "true" -a "$(parser_supports > 'unix,')" == "true" ]; then > af_unix="unix:create" > fi > > @@ -137,7 +137,7 @@ > sleep 1 > rm -f ${socket} > > -if [ "$(have_features policy/versions/v6)" == "true" ] ; then > +if [ "$(have_features policy/versions/v6)" == "true" -a "$(parser_supports > 'unix,')" == "true" ] ; then > # FAIL - confined client, no access to the socket file > > genprofile $file:$okperm $af_unix $socket:rw $fd_client:px -- > image=$fd_client $file:$okperm $af_unix > > === modified file 'tests/regression/apparmor/unix_socket_abstract.sh' > --- tests/regression/apparmor/unix_socket_abstract.sh 2014-09-29 23:49:13 > +0000 > +++ tests/regression/apparmor/unix_socket_abstract.sh 2015-04-29 21:49:04 > +0000 > @@ -30,6 +30,7 @@ > . $bin/unix_socket.inc > requires_features policy/versions/v7 > requires_features network/af_unix > +requires_parser_support "unix," > > settest unix_socket > > > === modified file 'tests/regression/apparmor/unix_socket_pathname.sh' > --- tests/regression/apparmor/unix_socket_pathname.sh 2014-10-09 05:32:01 > +0000 > +++ tests/regression/apparmor/unix_socket_pathname.sh 2015-04-29 21:49:04 > +0000 > @@ -52,7 +52,7 @@ > # af_unix support requires 'unix getattr' to call getsockname() > af_unix_okserver= > af_unix_okclient= > -if [ "$(have_features network/af_unix)" == "true" ] ; then > +if [ "$(have_features network/af_unix)" == "true" -a "$(parser_supports > 'unix,')" == "true" ] ; then > af_unix_okserver="create,setopt" > af_unix_okclient="create,getopt,setopt,getattr" > fi > > === modified file 'tests/regression/apparmor/unix_socket_unnamed.sh' > --- tests/regression/apparmor/unix_socket_unnamed.sh 2014-09-30 17:00:10 > +0000 > +++ tests/regression/apparmor/unix_socket_unnamed.sh 2015-04-29 21:49:04 > +0000 > @@ -30,6 +30,7 @@ > . $bin/unix_socket.inc > requires_features policy/versions/v7 > requires_features network/af_unix > +requires_parser_support "unix," > > settest unix_socket > > > > -- > AppArmor mailing list > [email protected] > Modify settings or unsubscribe at: > https://lists.ubuntu.com/mailman/listinfo/apparmor >
signature.asc
Description: Digital signature
-- AppArmor mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
