Skip to content

Commit 34c8cd6

Browse files
cgzonescgzones
committed
libsepol/tests: add test for segregate attributes
Signed-off-by: Christian Göttsche <[email protected]>
1 parent c0acacd commit 34c8cd6

8 files changed

+363
-0
lines changed

‎libsepol/tests/libsepol-tests.c

+2
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323
#include "test-expander.h"
2424
#include "test-deps.h"
2525
#include "test-downgrade.h"
26+
#include "test-segregateattributes.h"
2627

2728
#include <CUnit/Basic.h>
2829
#include <CUnit/Console.h>
@@ -69,6 +70,7 @@ static bool do_tests(int interactive, int verbose)
6970
DECLARE_SUITE(expander);
7071
DECLARE_SUITE(deps);
7172
DECLARE_SUITE(downgrade);
73+
DECLARE_SUITE(sattrs);
7274

7375
if (verbose)
7476
CU_basic_set_mode(CU_BRM_VERBOSE);

‎libsepol/tests/policies/test-sattrs/single.conf

+68
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
class process
2+
class blk_file
3+
class chr_file
4+
class dir
5+
class fifo_file
6+
class file
7+
class lnk_file
8+
class sock_file
9+
10+
sid kernel
11+
sid security
12+
sid unlabeled
13+
sid file
14+
sid port
15+
sid netif
16+
sid netmsg
17+
sid node
18+
sid devnull
19+
20+
class process { dyntransition transition }
21+
class file { write }
22+
23+
ifdef(`enable_mls',`
24+
sensitivity s0;
25+
dominance { s0 }
26+
category c0; category c1; category c2; category c3;
27+
category c4; category c5; category c6; category c7;
28+
category c8; category c9; category c10; category c11;
29+
category c12; category c13; category c14; category c15;
30+
category c16; category c17; category c18; category c19;
31+
category c20; category c21; category c22; category c23;
32+
33+
level s0:c0.c23;
34+
35+
mlsconstrain file { write } ( h1 dom h2 );
36+
')
37+
38+
#
39+
# Test start
40+
#
41+
42+
attribute test_attr1;
43+
attribute test_attr2;
44+
type test_type;
45+
typeattribute test_type test_attr1;
46+
typeattribute test_type test_attr2;
47+
segregate_attributes test_attr1, test_attr2;
48+
49+
#
50+
# Test End
51+
#
52+
53+
type sys_isid;
54+
allow sys_isid self : process { dyntransition transition };
55+
role sys_role;
56+
role sys_role types sys_isid;
57+
gen_user(sys_user,, sys_role, s0, s0 - s0:c0.c23)
58+
sid kernel gen_context(sys_user:sys_role:sys_isid, s0)
59+
sid security gen_context(sys_user:sys_role:sys_isid, s0)
60+
sid unlabeled gen_context(sys_user:sys_role:sys_isid, s0)
61+
sid file gen_context(sys_user:sys_role:sys_isid, s0)
62+
sid port gen_context(sys_user:sys_role:sys_isid, s0)
63+
sid netif gen_context(sys_user:sys_role:sys_isid, s0)
64+
sid netmsg gen_context(sys_user:sys_role:sys_isid, s0)
65+
sid node gen_context(sys_user:sys_role:sys_isid, s0)
66+
sid devnull gen_context(sys_user:sys_role:sys_isid, s0)
67+
fs_use_trans devpts gen_context(sys_user:sys_role:sys_isid, s0);
68+
fs_use_trans devtmpfs gen_context(sys_user:sys_role:sys_isid, s0);

‎libsepol/tests/policies/test-sattrs/split_base.conf

+53
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
class process
2+
class blk_file
3+
class chr_file
4+
class dir
5+
class fifo_file
6+
class file
7+
class lnk_file
8+
class sock_file
9+
10+
sid kernel
11+
sid security
12+
sid unlabeled
13+
sid file
14+
sid port
15+
sid netif
16+
sid netmsg
17+
sid node
18+
sid devnull
19+
20+
class process { dyntransition transition }
21+
class file { write }
22+
23+
ifdef(`enable_mls',`
24+
sensitivity s0;
25+
dominance { s0 }
26+
category c0; category c1; category c2; category c3;
27+
category c4; category c5; category c6; category c7;
28+
category c8; category c9; category c10; category c11;
29+
category c12; category c13; category c14; category c15;
30+
category c16; category c17; category c18; category c19;
31+
category c20; category c21; category c22; category c23;
32+
33+
level s0:c0.c23;
34+
35+
mlsconstrain file { write } ( h1 dom h2 );
36+
')
37+
38+
type sys_isid;
39+
allow sys_isid self : process { dyntransition transition };
40+
role sys_role;
41+
role sys_role types sys_isid;
42+
gen_user(sys_user,, sys_role, s0, s0 - s0:c0.c23)
43+
sid kernel gen_context(sys_user:sys_role:sys_isid, s0)
44+
sid security gen_context(sys_user:sys_role:sys_isid, s0)
45+
sid unlabeled gen_context(sys_user:sys_role:sys_isid, s0)
46+
sid file gen_context(sys_user:sys_role:sys_isid, s0)
47+
sid port gen_context(sys_user:sys_role:sys_isid, s0)
48+
sid netif gen_context(sys_user:sys_role:sys_isid, s0)
49+
sid netmsg gen_context(sys_user:sys_role:sys_isid, s0)
50+
sid node gen_context(sys_user:sys_role:sys_isid, s0)
51+
sid devnull gen_context(sys_user:sys_role:sys_isid, s0)
52+
fs_use_trans devpts gen_context(sys_user:sys_role:sys_isid, s0);
53+
fs_use_trans devtmpfs gen_context(sys_user:sys_role:sys_isid, s0);

‎libsepol/tests/policies/test-sattrs/split_module1.conf

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
module sattrs_test_1 1.0;
2+
3+
require {
4+
type test_type_t;
5+
}
6+
7+
attribute attr1;
8+
9+
typeattribute test_type_t attr1;

‎libsepol/tests/policies/test-sattrs/split_module2.conf

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
module sattrs_test_2 1.0;
2+
3+
require {
4+
type test_type_t;
5+
}
6+
7+
attribute attr2;
8+
9+
typeattribute test_type_t attr2;

‎libsepol/tests/policies/test-sattrs/split_module3.conf

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
module sattrs_test_3 1.0;
2+
3+
require {
4+
attribute attr1, attr2;
5+
}
6+
7+
type test_type_t;
8+
9+
segregate_attributes attr1, attr2;

‎libsepol/tests/test-segregateattributes.c

+203
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,203 @@
1+
#define _GNU_SOURCE
2+
3+
#include "test-segregateattributes.h"
4+
5+
#include "helpers.h"
6+
#include "test-common.h"
7+
8+
#include <sepol/debug.h>
9+
#include <sepol/policydb/link.h>
10+
#include <sepol/policydb/expand.h>
11+
12+
#include <stdio.h>
13+
#include <stdarg.h>
14+
15+
extern int mls;
16+
17+
int sattrs_test_init(void)
18+
{
19+
return 0;
20+
}
21+
22+
int sattrs_test_cleanup(void)
23+
{
24+
return 0;
25+
}
26+
27+
static struct msg_list {
28+
char *msg;
29+
struct msg_list *next;
30+
} *messages;
31+
32+
static void messages_clean(void)
33+
{
34+
while (messages) {
35+
struct msg_list *n = messages->next;
36+
free(messages->msg);
37+
free(messages);
38+
messages = n;
39+
}
40+
}
41+
42+
static void messages_check(unsigned count, const char *const expected[count])
43+
{
44+
unsigned i;
45+
const struct msg_list *m = messages;
46+
47+
for (i = 0; i < count; i++, m = m->next) {
48+
if (!m) {
49+
CU_FAIL("less messages than expected");
50+
return;
51+
}
52+
53+
if (strcmp(expected[i], m->msg) != 0) {
54+
CU_FAIL("messages differs from expected");
55+
fprintf(stderr, "<expected: '%s', got: '%s'>", expected[i], m->msg);
56+
}
57+
}
58+
59+
if (m) {
60+
CU_FAIL("more messages than expected");
61+
fprintf(stderr, "<next message: '%s'>", m->msg);
62+
}
63+
}
64+
65+
#ifdef __GNUC__
66+
__attribute__ ((format(printf, 3, 4)))
67+
#endif
68+
static void msg_handler(void *varg __attribute__ ((unused)),
69+
sepol_handle_t * handle,
70+
const char *fmt, ...)
71+
{
72+
char *msg;
73+
va_list ap;
74+
75+
va_start(ap, fmt);
76+
vasprintf(&msg, fmt, ap);
77+
va_end(ap);
78+
79+
struct msg_list *new = malloc(sizeof(struct msg_list));
80+
new->msg = msg;
81+
new->next = messages;
82+
messages = new;
83+
}
84+
85+
#define ARRAY_SIZE(a) (sizeof(a) / sizeof(*a))
86+
87+
static void test_sattrs_single(void)
88+
{
89+
policydb_t basemod, base_expanded;
90+
sepol_handle_t *handle;
91+
const char *const expected_messages_std[] = {
92+
"1 segregate attribute failures occurred",
93+
"segregate_attributes on line 50 of policies/test-sattrs/single.conf.std (or line 50 of policies/test-sattrs/single.conf.std) violated by type test_type associated with attributes test_attr2 and test_attr1",
94+
};
95+
const char *const expected_messages_mls[] = {
96+
"1 segregate attribute failures occurred",
97+
"segregate_attributes on line 63 of policies/test-sattrs/single.conf.mls (or line 63 of policies/test-sattrs/single.conf.mls) violated by type test_type associated with attributes test_attr2 and test_attr1",
98+
};
99+
const char *const *expected_messages = mls ? expected_messages_mls : expected_messages_std;
100+
const unsigned count = mls ? ARRAY_SIZE(expected_messages_mls) : ARRAY_SIZE(expected_messages_std);
101+
102+
if (policydb_init(&base_expanded))
103+
CU_FAIL_FATAL("Failed to initialize policy");
104+
105+
if (test_load_policy(&basemod, POLICY_BASE, mls, "test-sattrs", "single.conf"))
106+
CU_FAIL_FATAL("Failed to load policy");
107+
108+
if (link_modules(NULL, &basemod, NULL, 0, 0))
109+
CU_FAIL_FATAL("Failed to link base module");
110+
111+
if (expand_module(NULL, &basemod, &base_expanded, 0, 0))
112+
CU_FAIL_FATAL("Failed to expand policy");
113+
114+
if ((handle = sepol_handle_create()) == NULL)
115+
CU_FAIL_FATAL("Failed to initialize handle");
116+
117+
sepol_msg_set_callback(handle, msg_handler, NULL);
118+
119+
if (check_assertions(handle, &base_expanded, NULL) != -1)
120+
CU_FAIL("Assertions did not trigger");
121+
122+
messages_check(count, expected_messages);
123+
124+
sepol_handle_destroy(handle);
125+
messages_clean();
126+
policydb_destroy(&basemod);
127+
policydb_destroy(&base_expanded);
128+
}
129+
130+
#define NUM_MODS 3
131+
132+
static void test_sattrs_split(void)
133+
{
134+
policydb_t basemod, base_expanded;
135+
policydb_t *modules[NUM_MODS];
136+
const char *policies[NUM_MODS] = { "split_module1.conf", "split_module2.conf", "split_module3.conf" };
137+
sepol_handle_t *handle;
138+
const char *const expected_messages_std[] = {
139+
"1 segregate attribute failures occurred",
140+
"segregate_attributes on line 25 of policies/test-sattrs/split_module3.conf.std (or line 25 of policies/test-sattrs/split_base.conf.std) violated by type test_type_t associated with attributes attr1 and attr2",
141+
};
142+
const char *const expected_messages_mls[] = {
143+
"1 segregate attribute failures occurred",
144+
"segregate_attributes on line 25 of policies/test-sattrs/split_module3.conf.mls (or line 25 of policies/test-sattrs/split_base.conf.mls) violated by type test_type_t associated with attributes attr1 and attr2",
145+
};
146+
const char *const *expected_messages = mls ? expected_messages_mls : expected_messages_std;
147+
const unsigned count = mls ? ARRAY_SIZE(expected_messages_mls) : ARRAY_SIZE(expected_messages_std);
148+
unsigned i;
149+
150+
if (policydb_init(&base_expanded))
151+
CU_FAIL_FATAL("Failed to initialize policy");
152+
153+
if (test_load_policy(&basemod, POLICY_BASE, mls, "test-sattrs", "split_base.conf"))
154+
CU_FAIL_FATAL("Failed to load policy");
155+
156+
for (i = 0; i < NUM_MODS; i++) {
157+
modules[i] = calloc(1, sizeof(*modules[i]));
158+
if (!modules[i])
159+
CU_FAIL_FATAL("Failed to allocate module");
160+
161+
if (test_load_policy(modules[i], POLICY_MOD, mls, "test-sattrs", policies[i]))
162+
CU_FAIL_FATAL("Failed to load module");
163+
}
164+
165+
if (link_modules(NULL, &basemod, modules, 3, 0))
166+
CU_FAIL_FATAL("Failed to link base module");
167+
168+
if (expand_module(NULL, &basemod, &base_expanded, 0, 0))
169+
CU_FAIL_FATAL("Failed to expand policy");
170+
171+
if ((handle = sepol_handle_create()) == NULL)
172+
CU_FAIL_FATAL("Failed to initialize handle");
173+
174+
sepol_msg_set_callback(handle, msg_handler, NULL);
175+
176+
if (check_assertions(handle, &base_expanded, NULL) != -1)
177+
CU_FAIL("Assertions did not trigger");
178+
179+
messages_check(count, expected_messages);
180+
181+
sepol_handle_destroy(handle);
182+
messages_clean();
183+
for (i = 0; i < NUM_MODS; i++) {
184+
policydb_destroy(modules[i]);
185+
free(modules[i]);
186+
}
187+
policydb_destroy(&basemod);
188+
policydb_destroy(&base_expanded);
189+
}
190+
191+
int sattrs_add_tests(CU_pSuite suite)
192+
{
193+
if (NULL == CU_add_test(suite, "sattrs_single", test_sattrs_single)) {
194+
CU_cleanup_registry();
195+
return CU_get_error();
196+
}
197+
if (NULL == CU_add_test(suite, "sattrs_split", test_sattrs_split)) {
198+
CU_cleanup_registry();
199+
return CU_get_error();
200+
}
201+
202+
return 0;
203+
}

‎libsepol/tests/test-segregateattributes.h

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
#ifndef TEST_SEGREGATEATTRIBUTES_H__
2+
#define TEST_SEGREGATEATTRIBUTES_H__
3+
4+
#include <CUnit/Basic.h>
5+
6+
int sattrs_test_init(void);
7+
int sattrs_test_cleanup(void);
8+
int sattrs_add_tests(CU_pSuite suite);
9+
10+
#endif /* TEST_SEGREGATEATTRIBUTES_H__ */

0 commit comments

Comments
 (0)