mirrors/apparmor
1
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor.git synced 2025-03-04 16:35:02 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions
apparmor/utils/test/test-ptrace.py

576 lines
30 KiB
Python
Raw Normal View History

Switch utils to python3 As discussed a while ago, switch the utils (including their tests) to use python3 by default. While on it, drop usage of "env" to always get the system python3 instead of a random one that happens to live somewhere in $PATH. In practise, this patch doesn't change much - AFAIK openSUSE, Debian and Ubuntu already patch aa-* to use python3. Also add a note to README to officially deprecate Python 2.x. (I won't break Python 2.x support intentionally - unless some future change gives me a very good reason to finally drop Python 2.x support.) Acked-by: Seth Arnold <seth.arnold@canonical.com> (since 2016-08-23, but the commit had to wait for the FileRule series because it touches test-file.py)
2016-10-01 20:57:09 +02:00
#!/usr/bin/python3
Add tests for PtraceRule and PtraceRuleset As usual, we have 100% test coverage :-) Those tests include all tests from test-ptrace_parse.py, therefore delete this file. Acked-by: John Johansen <john.johansen@canonical.com>
2015-12-27 01:18:50 +01:00
# ----------------------------------------------------------------------
# Copyright (C) 2015 Christian Boltz <apparmor@cboltz.de>
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of version 2 of the GNU General Public
# License as published by the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# ----------------------------------------------------------------------
import unittest
from collections import namedtuple
from common_test import AATest, setup_all_loops
from apparmor.rule.ptrace import PtraceRule, PtraceRuleset
from apparmor.rule import BaseRule
from apparmor.common import AppArmorException, AppArmorBug
from apparmor.logparser import ReadLog
from apparmor.translations import init_translation
_ = init_translation()
exp = namedtuple('exp', ['audit', 'allow_keyword', 'deny', 'comment',
'access', 'all_access', 'peer', 'all_peers'])
# # --- tests for single PtraceRule --- #
class PtraceTest(AATest):
def _compare_obj(self, obj, expected):
self.assertEqual(expected.allow_keyword, obj.allow_keyword)
self.assertEqual(expected.audit, obj.audit)
self.assertEqual(expected.access, obj.access)
if obj.peer:
self.assertEqual(expected.peer, obj.peer.regex)
else:
self.assertEqual(expected.peer, obj.peer)
self.assertEqual(expected.all_access, obj.all_access)
self.assertEqual(expected.all_peers, obj.all_peers)
self.assertEqual(expected.deny, obj.deny)
self.assertEqual(expected.comment, obj.comment)
class PtraceTestParse(PtraceTest):
tests = [
# PtraceRule object audit allow deny comment access all? peer all?
('ptrace,' , exp(False, False, False, '', None , True , None, True )),
# ('ptrace (),' , exp(False, False, False, '', None , True , None, True )), # XXX also broken in SignalRule?
('ptrace read,' , exp(False, False, False, '', {'read'}, False, None, True )),
('ptrace (read, tracedby),' , exp(False, False, False, '', {'read', 'tracedby'}, False, None, True )),
('ptrace read,' , exp(False, False, False, '', {'read'}, False, None, True )),
('deny ptrace read, # cmt' , exp(False, False, True , ' # cmt', {'read'}, False, None, True )),
('audit allow ptrace,' , exp(True , True , False, '', None , True , None, True )),
('ptrace peer=unconfined,' , exp(False, False, False, '', None , True , 'unconfined', False )),
Handle quoted peers when parsing ptrace rules This patch adds handling for quoted ptrace peer values and two testcases for it. Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2016-02-12 21:45:38 +01:00
('ptrace peer="unconfined",' , exp(False, False, False, '', None , True , 'unconfined', False )),
Add tests for PtraceRule and PtraceRuleset As usual, we have 100% test coverage :-) Those tests include all tests from test-ptrace_parse.py, therefore delete this file. Acked-by: John Johansen <john.johansen@canonical.com>
2015-12-27 01:18:50 +01:00
('ptrace read,' , exp(False, False, False, '', {'read'}, False, None, True )),
('ptrace peer=/foo,' , exp(False, False, False, '', None , True , '/foo', False )),
('ptrace r peer=/foo,' , exp(False, False, False, '', {'r'}, False, '/foo', False )),
Handle quoted peers when parsing ptrace rules This patch adds handling for quoted ptrace peer values and two testcases for it. Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2016-02-12 21:45:38 +01:00
('ptrace r peer="/foo bar",' , exp(False, False, False, '', {'r'}, False, '/foo bar', False )),
Add tests for PtraceRule and PtraceRuleset As usual, we have 100% test coverage :-) Those tests include all tests from test-ptrace_parse.py, therefore delete this file. Acked-by: John Johansen <john.johansen@canonical.com>
2015-12-27 01:18:50 +01:00
]
def _run_test(self, rawrule, expected):
self.assertTrue(PtraceRule.match(rawrule))
obj = PtraceRule.parse(rawrule)
self.assertEqual(rawrule.strip(), obj.raw_rule)
self._compare_obj(obj, expected)
class PtraceTestParseInvalid(PtraceTest):
tests = [
('ptrace foo,' , AppArmorException),
('ptrace foo bar,' , AppArmorException),
('ptrace foo int,' , AppArmorException),
('ptrace read bar,' , AppArmorException),
('ptrace read tracedby,' , AppArmorException),
('ptrace peer=,' , AppArmorException),
]
def _run_test(self, rawrule, expected):
self.assertTrue(PtraceRule.match(rawrule)) # the above invalid rules still match the main regex!
with self.assertRaises(expected):
PtraceRule.parse(rawrule)
class PtraceTestParseFromLog(PtraceTest):
def test_ptrace_from_log(self):
Drop 'log' parameter from ReadLog This parameter is always [], so we can simplify the ReadLog __init__() parameters. Note that some tests handed over '' instead of []. This was a bug, but didn't matter because those tests only use a small portion of ReadLog. Acked-by: Seth Arnold <seth.arnold@canonical.com>
2017-08-28 23:15:51 +02:00
parser = ReadLog('', '', '', '')
Add tests for PtraceRule and PtraceRuleset As usual, we have 100% test coverage :-) Those tests include all tests from test-ptrace_parse.py, therefore delete this file. Acked-by: John Johansen <john.johansen@canonical.com>
2015-12-27 01:18:50 +01:00
event = 'type=AVC msg=audit(1409700683.304:547661): apparmor="DENIED" operation="ptrace" profile="/home/ubuntu/bzr/apparmor/tests/regression/apparmor/ptrace" pid=22465 comm="ptrace" requested_mask="tracedby" denied_mask="tracedby" peer="/home/ubuntu/bzr/apparmor/tests/regression/apparmor/ptrace"'
parsed_event = parser.parse_event(event)
self.assertEqual(parsed_event, {
'request_mask': 'tracedby',
'denied_mask': 'tracedby',
'error_code': 0,
'magic_token': 0,
'parent': 0,
'profile': '/home/ubuntu/bzr/apparmor/tests/regression/apparmor/ptrace',
'peer': '/home/ubuntu/bzr/apparmor/tests/regression/apparmor/ptrace',
'operation': 'ptrace',
'resource': None,
'info': None,
'aamode': 'REJECTING',
'time': 1409700683,
'active_hat': None,
'pid': 22465,
'task': 0,
'attr': None,
'name2': None,
'name': None,
logparser.py parse_event(): always store family, protocol and sock_type Storing these event details depending on the operation type only makes things more difficult because it's hard to differenciate between file and network events. Note that this happens at the first log parsing stage (libapparmor log event -> temporary python array) and therefore doesn't add a serious memory footprint. The event tree will still only contain the elements relevant for the actual event type. This change means that lots of testcases now get 3 more fields (all None) when testing parse_event(), so update all affected testcases. (test-network doesn't need a change for probably obvious reasons.) Also rename a misnamed test in test-change_profile. Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk and 2.10.
2016-11-19 10:55:03 +01:00
'family': None,
'protocol': None,
'sock_type': None,
Add tests for PtraceRule and PtraceRuleset As usual, we have 100% test coverage :-) Those tests include all tests from test-ptrace_parse.py, therefore delete this file. Acked-by: John Johansen <john.johansen@canonical.com>
2015-12-27 01:18:50 +01:00
})
obj = PtraceRule(parsed_event['denied_mask'], parsed_event['peer'], log_event=parsed_event)
# audit allow deny comment access all? peer all?
expected = exp(False, False, False, '', {'tracedby'}, False, '/home/ubuntu/bzr/apparmor/tests/regression/apparmor/ptrace', False)
self._compare_obj(obj, expected)
self.assertEqual(obj.get_raw(1), ' ptrace tracedby peer=/home/ubuntu/bzr/apparmor/tests/regression/apparmor/ptrace,')
class PtraceFromInit(PtraceTest):
tests = [
# PtraceRule object audit allow deny comment access all? peer all?
(PtraceRule('r', 'unconfined', deny=True) , exp(False, False, True , '' , {'r'}, False, 'unconfined', False)),
(PtraceRule(('r', 'read'), '/bin/foo') , exp(False, False, False, '' , {'r', 'read'},False, '/bin/foo', False)),
(PtraceRule(PtraceRule.ALL, '/bin/foo') , exp(False, False, False, '' , None, True, '/bin/foo', False )),
(PtraceRule('rw', '/bin/foo') , exp(False, False, False, '' , {'rw'}, False, '/bin/foo', False )),
(PtraceRule('rw', PtraceRule.ALL) , exp(False, False, False, '' , {'rw'}, False, None, True )),
(PtraceRule(PtraceRule.ALL, PtraceRule.ALL) , exp(False, False, False, '' , None , True, None, True )),
]
def _run_test(self, obj, expected):
self._compare_obj(obj, expected)
class InvalidPtraceInit(AATest):
tests = [
# init params expected exception
(['' , '/foo' ] , AppArmorBug), # empty access
(['read', '' ] , AppArmorBug), # empty peer
([' ', '/foo' ] , AppArmorBug), # whitespace access
(['read', ' ' ] , AppArmorBug), # whitespace peer
(['xyxy', '/foo' ] , AppArmorException), # invalid access
# XXX is 'invalid peer' possible at all?
([dict(), '/foo' ] , AppArmorBug), # wrong type for access
([None , '/foo' ] , AppArmorBug), # wrong type for access
(['read', dict() ] , AppArmorBug), # wrong type for peer
(['read', None ] , AppArmorBug), # wrong type for peer
]
def _run_test(self, params, expected):
with self.assertRaises(expected):
PtraceRule(params[0], params[1])
def test_missing_params_1(self):
with self.assertRaises(TypeError):
PtraceRule()
def test_missing_params_2(self):
with self.assertRaises(TypeError):
PtraceRule('r')
class InvalidPtraceTest(AATest):
def _check_invalid_rawrule(self, rawrule):
obj = None
self.assertFalse(PtraceRule.match(rawrule))
with self.assertRaises(AppArmorException):
obj = PtraceRule(PtraceRule.parse(rawrule))
self.assertIsNone(obj, 'PtraceRule handed back an object unexpectedly')
def test_invalid_ptrace_missing_comma(self):
self._check_invalid_rawrule('ptrace') # missing comma
def test_invalid_non_PtraceRule(self):
self._check_invalid_rawrule('dbus,') # not a ptrace rule
def test_empty_data_1(self):
obj = PtraceRule('read', '/foo')
obj.access = ''
# no access set, and ALL not set
with self.assertRaises(AppArmorBug):
obj.get_clean(1)
def test_empty_data_2(self):
obj = PtraceRule('read', '/foo')
obj.peer = ''
# no ptrace set, and ALL not set
with self.assertRaises(AppArmorBug):
obj.get_clean(1)
class WritePtraceTestAATest(AATest):
def _run_test(self, rawrule, expected):
self.assertTrue(PtraceRule.match(rawrule))
obj = PtraceRule.parse(rawrule)
clean = obj.get_clean()
raw = obj.get_raw()
self.assertEqual(expected.strip(), clean, 'unexpected clean rule')
self.assertEqual(rawrule.strip(), raw, 'unexpected raw rule')
tests = [
# raw rule clean rule
('ptrace,' , 'ptrace,'),
(' ptrace , # foo ' , 'ptrace, # foo'),
(' audit ptrace read,' , 'audit ptrace read,'),
(' audit ptrace (read ),' , 'audit ptrace read,'),
(' audit ptrace (read , tracedby ),' , 'audit ptrace (read tracedby),'),
(' deny ptrace read ,# foo bar' , 'deny ptrace read, # foo bar'),
(' deny ptrace ( read ), ' , 'deny ptrace read,'),
(' allow ptrace ,# foo bar' , 'allow ptrace, # foo bar'),
('ptrace,' , 'ptrace,'),
('ptrace (trace),' , 'ptrace trace,'),
('ptrace (tracedby),' , 'ptrace tracedby,'),
('ptrace (read),' , 'ptrace read,'),
('ptrace (readby),' , 'ptrace readby,'),
('ptrace (trace read),' , 'ptrace (read trace),'),
('ptrace (read tracedby),' , 'ptrace (read tracedby),'),
('ptrace r,' , 'ptrace r,'),
('ptrace w,' , 'ptrace w,'),
('ptrace rw,' , 'ptrace rw,'),
('ptrace read,' , 'ptrace read,'),
('ptrace (tracedby),' , 'ptrace tracedby,'),
('ptrace w,' , 'ptrace w,'),
('ptrace read peer=foo,' , 'ptrace read peer=foo,'),
('ptrace tracedby peer=foo,' , 'ptrace tracedby peer=foo,'),
('ptrace (read tracedby) peer=/usr/bin/bar,' , 'ptrace (read tracedby) peer=/usr/bin/bar,'),
('ptrace (trace read) peer=/usr/bin/bar,' , 'ptrace (read trace) peer=/usr/bin/bar,'),
('ptrace wr peer=/sbin/baz,' , 'ptrace wr peer=/sbin/baz,'),
]
def test_write_manually(self):
obj = PtraceRule('read', '/foo', allow_keyword=True)
expected = ' allow ptrace read peer=/foo,'
self.assertEqual(expected, obj.get_clean(2), 'unexpected clean rule')
self.assertEqual(expected, obj.get_raw(2), 'unexpected raw rule')
class PtraceCoveredTest(AATest):
def _run_test(self, param, expected):
obj = PtraceRule.parse(self.rule)
check_obj = PtraceRule.parse(param)
self.assertTrue(PtraceRule.match(param))
self.assertEqual(obj.is_equal(check_obj), expected[0], 'Mismatch in is_equal, expected %s' % expected[0])
self.assertEqual(obj.is_equal(check_obj, True), expected[1], 'Mismatch in is_equal/strict, expected %s' % expected[1])
self.assertEqual(obj.is_covered(check_obj), expected[2], 'Mismatch in is_covered, expected %s' % expected[2])
self.assertEqual(obj.is_covered(check_obj, True, True), expected[3], 'Mismatch in is_covered/exact, expected %s' % expected[3])
class PtraceCoveredTest_01(PtraceCoveredTest):
rule = 'ptrace read,'
tests = [
# rule equal strict equal covered covered exact
('ptrace,' , [ False , False , False , False ]),
('ptrace read,' , [ True , True , True , True ]),
('ptrace read peer=unconfined,' , [ False , False , True , True ]),
('ptrace read, # comment' , [ True , False , True , True ]),
('allow ptrace read,' , [ True , False , True , True ]),
('ptrace read,' , [ True , False , True , True ]),
('audit ptrace read,' , [ False , False , False , False ]),
('audit ptrace,' , [ False , False , False , False ]),
('ptrace tracedby,' , [ False , False , False , False ]),
('audit deny ptrace read,' , [ False , False , False , False ]),
('deny ptrace read,' , [ False , False , False , False ]),
]
class PtraceCoveredTest_02(PtraceCoveredTest):
rule = 'audit ptrace read,'
tests = [
# rule equal strict equal covered covered exact
( 'ptrace read,' , [ False , False , True , False ]),
('audit ptrace read,' , [ True , True , True , True ]),
( 'ptrace,' , [ False , False , False , False ]),
('audit ptrace,' , [ False , False , False , False ]),
('ptrace tracedby,' , [ False , False , False , False ]),
]
class PtraceCoveredTest_03(PtraceCoveredTest):
rule = 'ptrace,'
tests = [
# rule equal strict equal covered covered exact
( 'ptrace,' , [ True , True , True , True ]),
('allow ptrace,' , [ True , False , True , True ]),
( 'ptrace read,' , [ False , False , True , True ]),
( 'ptrace w,' , [ False , False , True , True ]),
('audit ptrace,' , [ False , False , False , False ]),
('deny ptrace,' , [ False , False , False , False ]),
]
class PtraceCoveredTest_04(PtraceCoveredTest):
rule = 'deny ptrace read,'
tests = [
# rule equal strict equal covered covered exact
( 'deny ptrace read,' , [ True , True , True , True ]),
('audit deny ptrace read,' , [ False , False , False , False ]),
( 'ptrace read,' , [ False , False , False , False ]), # XXX should covered be true here?
( 'deny ptrace tracedby,' , [ False , False , False , False ]),
( 'deny ptrace,' , [ False , False , False , False ]),
]
class PtraceCoveredTest_05(PtraceCoveredTest):
rule = 'ptrace read peer=unconfined,'
tests = [
# rule equal strict equal covered covered exact
('ptrace,' , [ False , False , False , False ]),
('ptrace read,' , [ False , False , False , False ]),
('ptrace read peer=unconfined,' , [ True , True , True , True ]),
('ptrace peer=unconfined,' , [ False , False , False , False ]),
('ptrace read, # comment' , [ False , False , False , False ]),
('allow ptrace read,' , [ False , False , False , False ]),
('allow ptrace read peer=unconfined,' , [ True , False , True , True ]),
('allow ptrace read peer=/foo/bar,' , [ False , False , False , False ]),
('allow ptrace read peer=/**,' , [ False , False , False , False ]),
('allow ptrace read peer=**,' , [ False , False , False , False ]),
('ptrace read,' , [ False , False , False , False ]),
('ptrace read peer=unconfined,' , [ True , False , True , True ]),
('audit ptrace read peer=unconfined,' , [ False , False , False , False ]),
('audit ptrace,' , [ False , False , False , False ]),
('ptrace tracedby,' , [ False , False , False , False ]),
('audit deny ptrace read,' , [ False , False , False , False ]),
('deny ptrace read,' , [ False , False , False , False ]),
]
class PtraceCoveredTest_06(PtraceCoveredTest):
rule = 'ptrace read peer=/foo/bar,'
tests = [
# rule equal strict equal covered covered exact
('ptrace,' , [ False , False , False , False ]),
('ptrace read,' , [ False , False , False , False ]),
('ptrace read peer=/foo/bar,' , [ True , True , True , True ]),
('ptrace read peer=/foo/*,' , [ False , False , False , False ]),
('ptrace read peer=/**,' , [ False , False , False , False ]),
('ptrace read peer=/what/*,' , [ False , False , False , False ]),
('ptrace peer=/foo/bar,' , [ False , False , False , False ]),
('ptrace read, # comment' , [ False , False , False , False ]),
('allow ptrace read,' , [ False , False , False , False ]),
('allow ptrace read peer=/foo/bar,' , [ True , False , True , True ]),
('ptrace read,' , [ False , False , False , False ]),
('ptrace read peer=/foo/bar,' , [ True , False , True , True ]),
('ptrace read peer=/what/ever,' , [ False , False , False , False ]),
('audit ptrace read peer=/foo/bar,' , [ False , False , False , False ]),
('audit ptrace,' , [ False , False , False , False ]),
('ptrace tracedby,' , [ False , False , False , False ]),
('audit deny ptrace read,' , [ False , False , False , False ]),
('deny ptrace read,' , [ False , False , False , False ]),
]
class PtraceCoveredTest_07(PtraceCoveredTest):
rule = 'ptrace read peer=**,'
tests = [
# rule equal strict equal covered covered exact
('ptrace,' , [ False , False , False , False ]),
('ptrace read,' , [ False , False , False , False ]),
('ptrace read peer=/foo/bar,' , [ False , False , True , True ]),
('ptrace read peer=/foo/*,' , [ False , False , True , True ]),
('ptrace read peer=/**,' , [ False , False , True , True ]),
('ptrace read peer=/what/*,' , [ False , False , True , True ]),
('ptrace peer=/foo/bar,' , [ False , False , False , False ]),
('ptrace read, # comment' , [ False , False , False , False ]),
('allow ptrace read,' , [ False , False , False , False ]),
('allow ptrace read peer=/foo/bar,' , [ False , False , True , True ]),
('ptrace read,' , [ False , False , False , False ]),
('ptrace read peer=/foo/bar,' , [ False , False , True , True ]),
('ptrace read peer=/what/ever,' , [ False , False , True , True ]),
('audit ptrace read peer=/foo/bar,' , [ False , False , False , False ]),
('audit ptrace,' , [ False , False , False , False ]),
('ptrace tracedby,' , [ False , False , False , False ]),
('audit deny ptrace read,' , [ False , False , False , False ]),
('deny ptrace read,' , [ False , False , False , False ]),
]
Use list check in PtraceRule and SignalRule is_covered_localvars() PtraceRule 'access' and SignalRule 'access' and 'signal' can contain more than one value. Therefore adjust is_covered_localvars() in both to use the list (subset) instead of the plain (exactly equal) check. Also add a testcase for each to ensure the list/subset check works as expected. Acked-by: Steve Beattie <steve@nxnw.org>
2016-01-25 23:40:52 +01:00
class PtraceCoveredTest_08(PtraceCoveredTest):
rule = 'ptrace (trace, tracedby) peer=/foo/*,'
tests = [
# rule equal strict equal covered covered exact
('ptrace,' , [ False , False , False , False ]),
('ptrace trace,' , [ False , False , False , False ]),
('ptrace (tracedby, trace),' , [ False , False , False , False ]),
('ptrace trace peer=/foo/bar,' , [ False , False , True , True ]),
('ptrace (tracedby trace) peer=/foo/bar,',[ False , False , True , True ]),
('ptrace (tracedby, trace) peer=/foo/*,', [ True , False , True , True ]),
('ptrace tracedby peer=/foo/bar,' , [ False , False , True , True ]),
('ptrace trace peer=/foo/*,' , [ False , False , True , True ]),
('ptrace trace peer=/**,' , [ False , False , False , False ]),
('ptrace trace peer=/what/*,' , [ False , False , False , False ]),
('ptrace peer=/foo/bar,' , [ False , False , False , False ]),
('ptrace trace, # comment' , [ False , False , False , False ]),
('allow ptrace trace,' , [ False , False , False , False ]),
('allow ptrace trace peer=/foo/bar,' , [ False , False , True , True ]),
('ptrace trace,' , [ False , False , False , False ]),
('ptrace trace peer=/foo/bar,' , [ False , False , True , True ]),
('ptrace trace peer=/what/ever,' , [ False , False , False , False ]),
('audit ptrace trace peer=/foo/bar,' , [ False , False , False , False ]),
('audit ptrace,' , [ False , False , False , False ]),
('ptrace tracedby,' , [ False , False , False , False ]),
('audit deny ptrace trace,' , [ False , False , False , False ]),
('deny ptrace trace,' , [ False , False , False , False ]),
]
Add tests for PtraceRule and PtraceRuleset As usual, we have 100% test coverage :-) Those tests include all tests from test-ptrace_parse.py, therefore delete this file. Acked-by: John Johansen <john.johansen@canonical.com>
2015-12-27 01:18:50 +01:00
class PtraceCoveredTest_Invalid(AATest):
def test_borked_obj_is_covered_1(self):
obj = PtraceRule.parse('ptrace read peer=/foo,')
testobj = PtraceRule('read', '/foo')
testobj.access = ''
with self.assertRaises(AppArmorBug):
obj.is_covered(testobj)
def test_borked_obj_is_covered_2(self):
obj = PtraceRule.parse('ptrace read peer=/foo,')
testobj = PtraceRule('read', '/foo')
testobj.peer = ''
with self.assertRaises(AppArmorBug):
obj.is_covered(testobj)
def test_invalid_is_covered(self):
obj = PtraceRule.parse('ptrace read,')
testobj = BaseRule() # different type
with self.assertRaises(AppArmorBug):
obj.is_covered(testobj)
add some tests for BaseRule/BaseRuleset These tests verify that - _is_equal_aare() really raises an exception when it sees an invalid combination of other_value and other_all - BaseRuleset.__repr__() works as expected As a side effect, this commit pushes the test coverage of apparmor/rule/__init__.py to 100% ;-)
2018-06-09 20:53:53 +02:00
def test_invalid_is_equal_1(self):
Add tests for PtraceRule and PtraceRuleset As usual, we have 100% test coverage :-) Those tests include all tests from test-ptrace_parse.py, therefore delete this file. Acked-by: John Johansen <john.johansen@canonical.com>
2015-12-27 01:18:50 +01:00
obj = PtraceRule.parse('ptrace read,')
testobj = BaseRule() # different type
with self.assertRaises(AppArmorBug):
obj.is_equal(testobj)
add some tests for BaseRule/BaseRuleset These tests verify that - _is_equal_aare() really raises an exception when it sees an invalid combination of other_value and other_all - BaseRuleset.__repr__() works as expected As a side effect, this commit pushes the test coverage of apparmor/rule/__init__.py to 100% ;-)
2018-06-09 20:53:53 +02:00
def test_invalid_is_equal_2(self):
obj = PtraceRule.parse('ptrace read,')
testobj = PtraceRule.parse('ptrace read,')
testobj.all_peers = False # make testobj invalid (should trigger exception in _is_equal_aare())
with self.assertRaises(AppArmorBug):
obj.is_equal(testobj)
Add tests for PtraceRule and PtraceRuleset As usual, we have 100% test coverage :-) Those tests include all tests from test-ptrace_parse.py, therefore delete this file. Acked-by: John Johansen <john.johansen@canonical.com>
2015-12-27 01:18:50 +01:00
class PtraceLogprofHeaderTest(AATest):
tests = [
('ptrace,', [ _('Access mode'), _('ALL'), _('Peer'), _('ALL'), ]),
('ptrace read,', [ _('Access mode'), 'read', _('Peer'), _('ALL'), ]),
('deny ptrace,', [_('Qualifier'), 'deny', _('Access mode'), _('ALL'), _('Peer'), _('ALL'), ]),
('allow ptrace read,', [_('Qualifier'), 'allow', _('Access mode'), 'read', _('Peer'), _('ALL'), ]),
('audit ptrace read,', [_('Qualifier'), 'audit', _('Access mode'), 'read', _('Peer'), _('ALL'), ]),
('audit deny ptrace read,', [_('Qualifier'), 'audit deny', _('Access mode'), 'read', _('Peer'), _('ALL'), ]),
('ptrace (read, tracedby) peer=/foo,', [ _('Access mode'), 'read tracedby', _('Peer'), '/foo', ]),
]
def _run_test(self, params, expected):
obj = PtraceRule._parse(params)
self.assertEqual(obj.logprof_header(), expected)
## --- tests for PtraceRuleset --- #
class PtraceRulesTest(AATest):
def test_empty_ruleset(self):
ruleset = PtraceRuleset()
ruleset_2 = PtraceRuleset()
self.assertEqual([], ruleset.get_raw(2))
self.assertEqual([], ruleset.get_clean(2))
self.assertEqual([], ruleset_2.get_raw(2))
self.assertEqual([], ruleset_2.get_clean(2))
add some tests for BaseRule/BaseRuleset These tests verify that - _is_equal_aare() really raises an exception when it sees an invalid combination of other_value and other_all - BaseRuleset.__repr__() works as expected As a side effect, this commit pushes the test coverage of apparmor/rule/__init__.py to 100% ;-)
2018-06-09 20:53:53 +02:00
# test __repr__() for empty ruleset
as_string = '%s' % ruleset
self.assertEqual(as_string, '<PtraceRuleset (empty) />')
Add tests for PtraceRule and PtraceRuleset As usual, we have 100% test coverage :-) Those tests include all tests from test-ptrace_parse.py, therefore delete this file. Acked-by: John Johansen <john.johansen@canonical.com>
2015-12-27 01:18:50 +01:00
def test_ruleset_1(self):
ruleset = PtraceRuleset()
rules = [
'ptrace peer=/foo,',
'ptrace read,',
]
expected_raw = [
'ptrace peer=/foo,',
'ptrace read,',
'',
]
expected_clean = [
'ptrace peer=/foo,',
'ptrace read,',
'',
]
for rule in rules:
ruleset.add(PtraceRule.parse(rule))
self.assertEqual(expected_raw, ruleset.get_raw())
self.assertEqual(expected_clean, ruleset.get_clean())
add some tests for BaseRule/BaseRuleset These tests verify that - _is_equal_aare() really raises an exception when it sees an invalid combination of other_value and other_all - BaseRuleset.__repr__() works as expected As a side effect, this commit pushes the test coverage of apparmor/rule/__init__.py to 100% ;-)
2018-06-09 20:53:53 +02:00
# test __repr__() for non-empty ruleset
as_string = '%s' % ruleset
self.assertEqual(as_string, '<PtraceRuleset>\n ptrace peer=/foo,\n ptrace read,\n</PtraceRuleset>')
Add tests for PtraceRule and PtraceRuleset As usual, we have 100% test coverage :-) Those tests include all tests from test-ptrace_parse.py, therefore delete this file. Acked-by: John Johansen <john.johansen@canonical.com>
2015-12-27 01:18:50 +01:00
def test_ruleset_2(self):
ruleset = PtraceRuleset()
rules = [
'ptrace read peer=/foo,',
'allow ptrace read,',
'deny ptrace peer=/bar, # example comment',
]
expected_raw = [
' ptrace read peer=/foo,',
' allow ptrace read,',
' deny ptrace peer=/bar, # example comment',
'',
]
expected_clean = [
' deny ptrace peer=/bar, # example comment',
'',
' allow ptrace read,',
' ptrace read peer=/foo,',
'',
]
for rule in rules:
ruleset.add(PtraceRule.parse(rule))
self.assertEqual(expected_raw, ruleset.get_raw(1))
self.assertEqual(expected_clean, ruleset.get_clean(1))
class PtraceGlobTestAATest(AATest):
def setUp(self):
self.maxDiff = None
self.ruleset = PtraceRuleset()
def test_glob_1(self):
self.assertEqual(self.ruleset.get_glob('ptrace read,'), 'ptrace,')
# not supported or used yet
# def test_glob_2(self):
# self.assertEqual(self.ruleset.get_glob('ptrace read raw,'), 'ptrace read,')
def test_glob_ext(self):
with self.assertRaises(NotImplementedError):
# get_glob_ext is not available for ptrace rules
self.ruleset.get_glob_ext('ptrace read peer=/foo,')
#class PtraceDeleteTestAATest(AATest):
# pass
setup_all_loops(__name__)
if __name__ == '__main__':
make utils tests less verbose Given the big number of tests, printing a dot for each test (instead of multiple lines) is enough ;-)
2018-04-08 20:18:30 +02:00
unittest.main(verbosity=1)
Reference in a new issue Copy permalink