mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2024-11-14 23:43:56 +01:00
59ac54e2fc
- ABI4 by default, fallback to abi 3. - aa-prebuild cli that can be used by other project shipping profiles. - --file option to cli to only build one dev profile. - add abi version filter to only & exclude directives.
66 lines
1.9 KiB
Go
66 lines
1.9 KiB
Go
// apparmor.d - Full set of apparmor profiles
|
|
// Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
|
// SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
package directive
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/roddhjav/apparmor.d/pkg/paths"
|
|
"github.com/roddhjav/apparmor.d/pkg/prebuild"
|
|
)
|
|
|
|
func TestExec_Apply(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
rootApparmord *paths.Path
|
|
opt *Option
|
|
profile string
|
|
want string
|
|
wantErr bool
|
|
}{
|
|
{
|
|
name: "exec",
|
|
rootApparmord: paths.New("../../../apparmor.d/groups/kde/"),
|
|
opt: &Option{
|
|
Name: "exec",
|
|
ArgMap: map[string]string{"DiscoverNotifier": ""},
|
|
ArgList: []string{"DiscoverNotifier"},
|
|
File: nil,
|
|
Raw: " #aa:exec DiscoverNotifier",
|
|
},
|
|
profile: ` #aa:exec DiscoverNotifier`,
|
|
want: ` /{,usr/}lib{,exec,32,64}/*-linux-gnu*/{,libexec/}DiscoverNotifier Px,
|
|
/{,usr/}lib{,exec,32,64}/DiscoverNotifier Px,`,
|
|
},
|
|
{
|
|
name: "exec-unconfined",
|
|
rootApparmord: paths.New("../../../apparmor.d/groups/freedesktop/"),
|
|
opt: &Option{
|
|
Name: "exec",
|
|
ArgMap: map[string]string{"U": "", "polkit-agent-helper": ""},
|
|
ArgList: []string{"U", "polkit-agent-helper"},
|
|
File: nil,
|
|
Raw: " #aa:exec U polkit-agent-helper",
|
|
},
|
|
profile: ` #aa:exec U polkit-agent-helper`,
|
|
want: ` /{,usr/}lib{,exec,32,64}/polkit-[0-9]/polkit-agent-helper-[0-9] Ux,
|
|
/{,usr/}lib{,exec,32,64}/polkit-agent-helper-[0-9] Ux,`,
|
|
},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
prebuild.RootApparmord = tt.rootApparmord
|
|
got, err := Directives["exec"].Apply(tt.opt, tt.profile)
|
|
if (err != nil) != tt.wantErr {
|
|
t.Errorf("Exec.Apply() error = %v, wantErr %v", err, tt.wantErr)
|
|
return
|
|
}
|
|
if got != tt.want {
|
|
t.Errorf("Exec.Apply() = |%v|, want |%v|", got, tt.want)
|
|
}
|
|
})
|
|
}
|
|
}
|