On 04/30/2014 01:23 PM, Pádraig Brady wrote: So the patch amends to:
> From d33e0889472eeb57d0b92ddfc224c122ee294ec9 Mon Sep 17 00:00:00 2001 > From: Jarkko Sakkinen <[email protected]> > Date: Wed, 30 Apr 2014 16:30:39 +0200 > Subject: [PATCH] tests: initial SMACK tests > > init.cfg: require_smack_ > local.mk: added new tests > tests/id/smack.sh: SMACK tests (new file) > tests/mkdir/smack-no-root.sh: SMACK tests (new file) > tests/mkdir/smack-root.sh: SMACK tests (new file) > --- > init.cfg | 9 +++++++++ > tests/id/smack.sh | 36 ++++++++++++++++++++++++++++++++++++ > tests/local.mk | 4 ++++ > tests/mkdir/smack-no-root.sh | 39 +++++++++++++++++++++++++++++++++++++++ > tests/mkdir/smack-root.sh | 35 +++++++++++++++++++++++++++++++++++ > 5 files changed, 123 insertions(+) > create mode 100755 tests/id/smack.sh > create mode 100755 tests/mkdir/smack-no-root.sh > create mode 100755 tests/mkdir/smack-root.sh > > diff --git a/init.cfg b/init.cfg > index 6a9b004..be7773a 100644 > --- a/init.cfg > +++ b/init.cfg > @@ -350,6 +350,15 @@ skip_if_() > esac > } > > +require_smack_() > +{ > + grep 'smackfs$' /proc/filesystems > /dev/null \ > + || skip_ "this system lacks SMACK support" Wouldn't it be better to let the grep output go into the test's log file? It wouldn't hurt ... and avoid /dev/null problems. > + > + test "$(ls -Zd .)" != '? .' \ > + || skip_ "this file system lacks SMACK support" > +} > + > very_expensive_() > { > if test "$RUN_VERY_EXPENSIVE_TESTS" != yes; then > diff --git a/tests/id/smack.sh b/tests/id/smack.sh > new file mode 100755 > index 0000000..5b60e7e > --- /dev/null > +++ b/tests/id/smack.sh > @@ -0,0 +1,36 @@ > +#!/bin/sh > +# SMACK test for the id-command. > +# Derived from tests/id/context.sh and tests/id/no-context.sh. > +# Copyright (C) 2014 Free Software Foundation, Inc. > + > +# This program is free software: you can redistribute it and/or modify > +# it under the terms of the GNU General Public License as published by > +# the Free Software Foundation, either version 3 of the License, or > +# (at your option) any later version. > + > +# This program is distributed in the hope that it will be useful, > +# but WITHOUT ANY WARRANTY; without even the implied warranty of > +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the > +# GNU General Public License for more details. > + > +# You should have received a copy of the GNU General Public License > +# along with this program. If not, see <http://www.gnu.org/licenses/>. > + > +. "${srcdir=.}/tests/init.sh"; path_prepend_ ./src > +print_ver_ id > + > +require_smack_ > + > +# Check the string "context=" presence without specified user. > +id | grep context= >/dev/null || fail=1 Likewise: there's no need to suppress the output. It may even better to redirect id's output to a file and 'cat' its content if fail=1. > + > +# Check context=" is absent without specified user in conforming mode. > +POSIXLY_CORRECT=1 id > out || fail=1 > +grep context= out && fail=1 Similar here: replace "fail=1" by "{ cat out; fail=1; }". > + > +# Check the string "context=" absence with specified user. > +# But if the current user is nameless, skip this part. > +id -nu > /dev/null \ > + && id $(id -nu) | grep context= >/dev/null && fail=1 ... and here. > + > +Exit $fail > diff --git a/tests/local.mk b/tests/local.mk > index d58b603..6d44144 100644 > --- a/tests/local.mk > +++ b/tests/local.mk > @@ -125,6 +125,7 @@ all_root_tests = \ > tests/misc/selinux.sh \ > tests/misc/truncate-owned-by-other.sh \ > tests/mkdir/writable-under-readonly.sh \ > + tests/mkdir/smack-root.sh \ > tests/mv/sticky-to-xpart.sh \ > tests/rm/fail-2eperm.sh \ > tests/rm/no-give-up.sh \ > @@ -517,6 +518,7 @@ all_tests = \ > tests/id/uid.sh \ > tests/id/setgid.sh \ > tests/id/zero.sh \ > + tests/id/smack.sh \ > tests/install/basic-1.sh \ > tests/install/create-leading.sh \ > tests/install/d-slashdot.sh \ > @@ -576,6 +578,8 @@ all_tests = \ > tests/mkdir/restorecon.sh \ > tests/mkdir/special-1.sh \ > tests/mkdir/t-slash.sh \ > + tests/mkdir/smack-no-root.sh \ > + tests/mkdir/smack-root.sh \ > tests/mv/acl.sh \ > tests/mv/atomic.sh \ > tests/mv/atomic2.sh \ > diff --git a/tests/mkdir/smack-no-root.sh b/tests/mkdir/smack-no-root.sh > new file mode 100755 > index 0000000..09157a8 > --- /dev/null > +++ b/tests/mkdir/smack-no-root.sh > @@ -0,0 +1,39 @@ > +#!/bin/sh > +# SMACK test for the mkdir,mknod, mkfifo commands. > +# Derived from tests/mkdir/selinux.sh. > +# Ensure that an invalid SMACK label doesn't cause a segfault. > + > +# Copyright (C) 2014 Free Software Foundation, Inc. > + > +# This program is free software: you can redistribute it and/or modify > +# it under the terms of the GNU General Public License as published by > +# the Free Software Foundation, either version 3 of the License, or > +# (at your option) any later version. > + > +# This program is distributed in the hope that it will be useful, > +# but WITHOUT ANY WARRANTY; without even the implied warranty of > +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the > +# GNU General Public License for more details. > + > +# You should have received a copy of the GNU General Public License > +# along with this program. If not, see <http://www.gnu.org/licenses/>. > + > +. "${srcdir=.}/tests/init.sh"; path_prepend_ ./src > +print_ver_ mkdir mkfifo mknod > + > +require_smack_ > + > +c=arbitrary-smack-label > +msg="failed to set default file creation context to '$c':" > + > +for cmd in 'mkdir dir' 'mknod b p' 'mkfifo f'; do > + $cmd --context="$c" 2> out && fail=1 > + set $cmd > + echo "$1: $msg" > exp || fail=1 > + > + sed -e 's/ Operation not permitted$//' out > k || fail=1 > + mv k out || fail=1 > + compare exp out || fail=1 > +done > + > +Exit $fail > diff --git a/tests/mkdir/smack-root.sh b/tests/mkdir/smack-root.sh > new file mode 100755 > index 0000000..96b75ea > --- /dev/null > +++ b/tests/mkdir/smack-root.sh > @@ -0,0 +1,35 @@ > +#!/bin/sh > +# SMACK test for the mkdir,mknod, mkfifo commands. > +# Derived from tests/mkdir/selinux.sh. > +# Ensure that SMACK label gets set. > + > +# Copyright (C) 2014 Free Software Foundation, Inc. > + > +# This program is free software: you can redistribute it and/or modify > +# it under the terms of the GNU General Public License as published by > +# the Free Software Foundation, either version 3 of the License, or > +# (at your option) any later version. > + > +# This program is distributed in the hope that it will be useful, > +# but WITHOUT ANY WARRANTY; without even the implied warranty of > +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the > +# GNU General Public License for more details. > + > +# You should have received a copy of the GNU General Public License > +# along with this program. If not, see <http://www.gnu.org/licenses/>. > + > +. "${srcdir=.}/tests/init.sh"; path_prepend_ ./src > +print_ver_ mkdir mkfifo mknod > + > +require_smack_ > +require_root_ > + > +c=arbitrary-smack-label > + > +for cmd in 'mkdir dir' 'mknod b p' 'mkfifo f'; do > + $cmd --context="$c" || fail=1 > + set $cmd > + test "$(ls -dZ $2 | cut -f1 -d' ')" = "$c" || fail=1 Likewise here, i.e. make debugging easier by redirecting to a file, and printing its content upon failure. > +done > + > +Exit $fail > -- > 1.8.4.2 I must add that I don't have a SMACK-enabled system, so my tests didn't run past "require_smack_" here. Thanks & have a nice day, Berny
