mirrors/apparmor
1
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor.git synced 2025-03-06 09:21:00 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions
apparmor/parser/tst/Makefile

65 lines
2 KiB
Makefile
Raw Normal View History

Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
#
Make the build process significantly quieter with respect to the unit and regression tests to avoid developer confusion.
2006-05-31 21:30:50 +00:00
PROVE=/usr/bin/prove
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
TESTS=simple.pl
add correct line number and filename tracking for error conditions (LP: #588014) Bug: https://launchpad.net/bugs/588014
2010-06-04 18:47:44 -07:00
PARSER_DIR=..
PARSER_BIN=apparmor_parser
PARSER=$(PARSER_DIR)/$(PARSER_BIN)
It's possible that git doesn't like to create empty directories, so create the generated_* directories themselves if they don't exist before running the script to generate them. Also modify the default invocation of prove to add -f, which reports the details of failing test cases.
2011-08-09 01:10:19 -07:00
PROVE_ARG=-f
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
Make the build process significantly quieter with respect to the unit and regression tests to avoid developer confusion.
2006-05-31 21:30:50 +00:00
ifeq ($(VERBOSE),1)
It's possible that git doesn't like to create empty directories, so create the generated_* directories themselves if they don't exist before running the script to generate them. Also modify the default invocation of prove to add -f, which reports the details of failing test cases.
2011-08-09 01:10:19 -07:00
PROVE_ARG+=-v
parser - use new caching test script This patch: - incorporates the new python caching test into the make check/make caching target, and removes the older shell based test script - adjusts the python scripts to give verbose output when the VERBOSE flag is set - reorders the tests so that the tests that take a shorter amount of time to run come first, leaving the language sanity test with its 69000+ testcases last Patch history: v1: initial revision v2: add gen_xtrans/gen_dbus dependency to valgrind test v3: drop gen_xtrans/gen_dbus as that was committed as a separate fix Acked-by: Steve Beattie <steve@nxnw.org> Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-11-27 21:25:06 -08:00
PYTEST_ARG = -v
parser: fix compilation failure of deny link rules, expand equality tests Merge from trunk commits 2909, 2910, 2911, and 2912 BugLink: http://bugs.launchpad.net/bugs/1433829 The apparmor_parser fails to compile deny rules with only link permissions. Eg. deny /f l, deny l /f, deny link /f -> /d, Will all fail to compile with the following assert apparmor_parser: aare_rules.cc:99: Node* convert_file_perms(int, uint32_t, uint32_t, bool): Assertion `perms != 0' failed. NOTE: this is a minimal patch a bigger patch that cleans-up and separates and reorganizes file, link, exec, and change_profile rules is needed parser: Expand Equality tests This adds several new equality tests and turned up a couple of more bugs https://launchpad.net/bugs/1433829 https://launchpad.net/bugs/1434018 - add link/link subset tests - add pix, Pix, cix, Cix, pux, Pux, cux, Cux and specified profile transitions (/f px -> b ...) - test equality of leading and trailing permission file rules ie. /foo rw, == rw /foo, - test that specific x match overrides generic x rule. ie. /** ix, /foo px, is different than /** ix, /foo ix, - test that deny removes permission /f[abc] r, deny /fb r, is differnt than /f[abc] r, In addition to adding the new tests, it changes the output of the equality tests, so that if the $verbose variable is not set successful tests only output a period, with failed tests outputing the full info. If verbose is set the full test info is output as before. It also does: - make the verbose output of equality.sh honor whether or not the environment variable VERBOSE is set - thereby making the output verbose when 'make check V=1' or 'make check VERBOSE=1' is given from within the parser/ directory. This will make distribution packagers happy when diagnosing build failures caused by test failures. - if verbose output is not emitted and the tests were successful, emit a newline before printing PASS. - verify audit and audit allow is equal - verify audit differs from deny and audit deny - verify deny differs from audit deny - make the verbose text a little more useful for some cases - correct overlap exec tests to substitute in looped perms Signed-off-by: John Johansen <john.johansen@canonical.com> Signed-off-by: Steve Beattie <steve@nxnw.org> Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-03-23 12:43:57 -07:00
else
fix two issues for older linux releases Merge from trunk revision 2975 The following patch addresses two issues on older releases: 1) In trunk commit 2911, the line 'undefine VERBOSE' was added to parser/tst/Makefile so that the equality tests would not generate verbose output when $VERBOSE != 1. Unfortunately, the 'undefine' keyword was not introduced in GNU Make until version 3.82. On distro releases like Ubuntu 12.04 LTS that include versions of Make older than that, make check and make clean abort when VERBOSE is not set to 1. The patch fixes that by setting VERBOSE to a zero length string if does not already equal 1. 2) In trunk commit 2923, a workaround for systemd as init was added to the pivot_root regression test. The workaround included a call to ps(1) to determine if systemd is pid 1. Unfortunately, in older versions of the procps package (such as the version in Ubuntu 12.04 LTS), 'ps -hp1' emits the warning Warning: bad ps syntax, perhaps a bogus '-'? See http://procps.sf.net/faq.html The patch below converts the ps call to 'ps hp1' which does not generate the warning. Signed-off-by: Steve Beattie <steve@nxnw.org> Acked-by: John Johansen <john.johansen@canonical.com>
2015-03-31 02:50:40 -07:00
VERBOSE=
Make the build process significantly quieter with respect to the unit and regression tests to avoid developer confusion.
2006-05-31 21:30:50 +00:00
endif
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
all: tests
parser: mark valgrind test target as phony Signed-off-by: Steve Beattie <steve@nxnw.org> Acked-By: Christian Boltz <apparmor@cboltz.de>
2013-12-03 15:37:57 -08:00
.PHONY: tests error_output gen_dbus gen_xtrans parser_sanity caching minimize equality valgrind
parser - use new caching test script This patch: - incorporates the new python caching test into the make check/make caching target, and removes the older shell based test script - adjusts the python scripts to give verbose output when the VERBOSE flag is set - reorders the tests so that the tests that take a shorter amount of time to run come first, leaving the language sanity test with its 69000+ testcases last Patch history: v1: initial revision v2: add gen_xtrans/gen_dbus dependency to valgrind test v3: drop gen_xtrans/gen_dbus as that was committed as a separate fix Acked-by: Steve Beattie <steve@nxnw.org> Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-11-27 21:25:06 -08:00
tests: error_output caching minimize equality parser_sanity
Add auto generation of xtransition conflict tests All the combiniation of xtransition conflics where not well represented in the regression test suite. Instead of relying on multiple static test files, automatically generate all possible conflicts. Signed-off-by: John Johansen <john.johansen@canonical.com>
2010-12-20 11:53:52 -08:00
parser: Regression tests for DBus rules This is a test in the style of gen-xtrans.pl that attempts to run through the most commonly constructed DBus rules. It also attempts to run through some common mistakes to ensure that the parser fails appropriately. Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-07-31 09:20:56 -07:00
GEN_TRANS_DIRS=simple_tests/generated_x/ simple_tests/generated_perms_leading/ simple_tests/generated_perms_safe/ simple_tests/generated_dbus
It's possible that git doesn't like to create empty directories, so create the generated_* directories themselves if they don't exist before running the script to generate them. Also modify the default invocation of prove to add -f, which reports the details of failing test cases.
2011-08-09 01:10:19 -07:00
gen_xtrans: $(GEN_TRANS_DIRS)
Add auto generation of xtransition conflict tests All the combiniation of xtransition conflics where not well represented in the regression test suite. Instead of relying on multiple static test files, automatically generate all possible conflicts. Signed-off-by: John Johansen <john.johansen@canonical.com>
2010-12-20 11:53:52 -08:00
./gen-xtrans.pl
add correct line number and filename tracking for error conditions (LP: #588014) Bug: https://launchpad.net/bugs/588014
2010-06-04 18:47:44 -07:00
It's possible that git doesn't like to create empty directories, so create the generated_* directories themselves if they don't exist before running the script to generate them. Also modify the default invocation of prove to add -f, which reports the details of failing test cases.
2011-08-09 01:10:19 -07:00
$(GEN_TRANS_DIRS):
mkdir $@
parser: Regression tests for DBus rules This is a test in the style of gen-xtrans.pl that attempts to run through the most commonly constructed DBus rules. It also attempts to run through some common mistakes to ensure that the parser fails appropriately. Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-07-31 09:20:56 -07:00
gen_dbus: $(GEN_TRANS_DIRS)
./gen-dbus.pl
add correct line number and filename tracking for error conditions (LP: #588014) Bug: https://launchpad.net/bugs/588014
2010-06-04 18:47:44 -07:00
error_output: $(PARSER)
parser - build against in-tree libapparmor With trunk commit 2205 "use libapparmor's find mountpoint fn", the parser now builds against and uses libapparmor at runtime. However, it currently builds against the system installed libapparmor library and header files, which fails if either aren't installed, and is thus painful for bootstrapping in a new environment. Instead, the parser, like pam_apparmor and mod_apparmor, should build against the in-tree libapparmor header and library. This patch does that and adjusts the tests to point LD_LIBRARY_PATH at the location of the built library as well. Signed-off-by: Steve Beattie <steve@nxnw.org> Acked-by: John Johansen <john.johansen@canonical.com>
2013-10-15 16:46:18 -07:00
LANG=C $(PARSER) -S -I errors >/dev/null errors/okay.sd
add correct line number and filename tracking for error conditions (LP: #588014) Bug: https://launchpad.net/bugs/588014
2010-06-04 18:47:44 -07:00
LANG=C $(PARSER) -S -I errors 2>&1 >/dev/null errors/single.sd | \
grep -q "AppArmor parser error for errors/single.sd in errors/single.sd at line 3: Could not open 'failure'"
LANG=C $(PARSER) -S -I errors 2>&1 >/dev/null errors/double.sd | \
adjust line offset now that $Id$ was removed
2010-12-20 13:06:54 -08:00
grep -q "AppArmor parser error for errors/double.sd in errors/includes/busted at line 66: Could not open 'does-not-exist'"
This patch adds a couple of additional lineno reporting testcases: * a non-include related syntax error (errors/modefail.sd) * multiple successful includes followed by a failed include (errors/multi_include.sd) It also fixes two issues with the parser's line counting: * the count began at 0 (demonstrated by the first testcase's error being reporting on one line less than it should be), and * an extra line increment when includes were detected (demonstrated by the second testcase's error being reported at a line beyond the correct linenumber. The existing testcases did not catch these because they were all based on the first include in the file failing and so the start of the count from 0 counteracted the extra counted line.
2010-06-25 12:43:48 -07:00
LANG=C $(PARSER) -S -I errors 2>&1 >/dev/null errors/modefail.sd | \
grep -q "AppArmor parser error for errors/modefail.sd in errors/modefail.sd at line 6: syntax error"
LANG=C $(PARSER) -S -I errors 2>&1 >/dev/null errors/multi_include.sd | \
grep -q "AppArmor parser error for errors/multi_include.sd in errors/multi_include.sd at line 12: Could not open 'failure'"
add correct line number and filename tracking for error conditions (LP: #588014) Bug: https://launchpad.net/bugs/588014
2010-06-04 18:47:44 -07:00
@echo "Error Output: PASS"
parser tests - fix dependency for parallel builds The parser sanity test make target does not directly depend on the make targets that generate the tests consumed by the sanity test, leading to runs that did not verify all the test cases when make check is invoked with parallelism (e.g. make check -j4). This patch against trunk fixes the issue. Signed-off-by: Steve Beattie <steve@nxnw.org> Acked-by: Seth Arnold <seth.arnold@canonical.com> Acked-by: Tyler Hicks <tyhicks@canonical.com>
2013-10-31 12:04:12 -07:00
parser_sanity: $(PARSER) gen_xtrans gen_dbus
Subject: parameterize parser tests to support different binaries This patch replaces the hardcoded path to the in-tree apparmor parser in several of the script based test scripts with the APPARMOR_PARSER environment variable, keeping the hardcoded location as the default. It also adds support for overriding the location of the parser via the same environment variable. The make infrastructure is updated to use this, though uses a different variable (PARSER) to drive it. Thus 'make check PARSER=/some/path/to/an/alternate/apparmor_parser' will run all the parser tests on that binary. This is useful for running the testsuite in an automated post-install environment. (It should be noted that doing so will still build and run the unit test binaries based on the source tree.) Signed-off-by: Steve Beattie <sbeattie@ubuntu.com> Acked-By: John Johansen <john.johansen@canonical.com>
2012-11-05 17:22:37 -08:00
$(Q)LANG=C APPARMOR_PARSER="$(PARSER)" ${PROVE} ${PROVE_ARG} ${TESTS}
Import the rest of the core functionality of the internal apparmor development tree (trunk branch). From svn repo version 6381.
2006-04-11 21:52:54 +00:00
Fix write_cache to not be a privileged operation so that the caching tests can be added to the build. Update caching tests to detect non-ns-resolution filesystems and back off on the timing test.
2010-09-14 12:45:34 -07:00
caching: $(PARSER)
parser - use new caching test script This patch: - incorporates the new python caching test into the make check/make caching target, and removes the older shell based test script - adjusts the python scripts to give verbose output when the VERBOSE flag is set - reorders the tests so that the tests that take a shorter amount of time to run come first, leaving the language sanity test with its 69000+ testcases last Patch history: v1: initial revision v2: add gen_xtrans/gen_dbus dependency to valgrind test v3: drop gen_xtrans/gen_dbus as that was committed as a separate fix Acked-by: Steve Beattie <steve@nxnw.org> Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-11-27 21:25:06 -08:00
LANG=C ./caching.py -p "$(PARSER)" $(PYTEST_ARG)
Fix write_cache to not be a privileged operation so that the caching tests can be added to the build. Update caching tests to detect non-ns-resolution filesystems and back off on the timing test.
2010-09-14 12:45:34 -07:00
Fix dfa minimization to deal with exec conflicts Minimization was failing because it was too agressive. It was minimizing as if there was only 1 accept condition. This allowed it to remove more states but at the cost of loosing unique permission sets, they where being combined into single commulative perms. This means that audit, deny, xtrans, ... info on one path would be applied to all other paths that it was combined with during minimization. This means that we need to retain the unique accept states, not allowing them to be combined into a single state. To do this we put each unique permission set into its own partition at the start of minimization. The states within a partition have the same permissions and can be combined within the other states in the partition as the loss of unique path information is will not result in a conflict. This is similar to what perm hashing used to do but deny information is still being correctly applied and carried. Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-03-09 04:20:19 -08:00
minimize: $(PARSER)
Subject: parameterize parser tests to support different binaries This patch replaces the hardcoded path to the in-tree apparmor parser in several of the script based test scripts with the APPARMOR_PARSER environment variable, keeping the hardcoded location as the default. It also adds support for overriding the location of the parser via the same environment variable. The make infrastructure is updated to use this, though uses a different variable (PARSER) to drive it. Thus 'make check PARSER=/some/path/to/an/alternate/apparmor_parser' will run all the parser tests on that binary. This is useful for running the testsuite in an automated post-install environment. (It should be noted that doing so will still build and run the unit test binaries based on the source tree.) Signed-off-by: Steve Beattie <sbeattie@ubuntu.com> Acked-By: John Johansen <john.johansen@canonical.com>
2012-11-05 17:22:37 -08:00
LANG=C APPARMOR_PARSER="$(PARSER)" ./minimize.sh
Fix dfa minimization to deal with exec conflicts Minimization was failing because it was too agressive. It was minimizing as if there was only 1 accept condition. This allowed it to remove more states but at the cost of loosing unique permission sets, they where being combined into single commulative perms. This means that audit, deny, xtrans, ... info on one path would be applied to all other paths that it was combined with during minimization. This means that we need to retain the unique accept states, not allowing them to be combined into a single state. To do this we put each unique permission set into its own partition at the start of minimization. The states within a partition have the same permissions and can be combined within the other states in the partition as the loss of unique path information is will not result in a conflict. This is similar to what perm hashing used to do but deny information is still being correctly applied and carried. Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-03-09 04:20:19 -08:00
parser: Binary profile equality tests for DBus rules This test is to verify that a list of profiles compile down into the same binary representation. This is useful, for example, when testing a rule syntax that includes permission aliases, as well as implied and explicit accesses. Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-07-31 09:22:11 -07:00
equality: $(PARSER)
LANG=C APPARMOR_PARSER="$(PARSER)" ./equality.sh
parser tests - fix dependency for parallel builds The parser sanity test make target does not directly depend on the make targets that generate the tests consumed by the sanity test, leading to runs that did not verify all the test cases when make check is invoked with parallelism (e.g. make check -j4). This patch against trunk fixes the issue. Signed-off-by: Steve Beattie <steve@nxnw.org> Acked-by: Seth Arnold <seth.arnold@canonical.com> Acked-by: Tyler Hicks <tyhicks@canonical.com>
2013-10-31 12:04:12 -07:00
valgrind: $(PARSER) gen_xtrans gen_dbus
parser - add simple valgrind wrapper tests This patch adds a test wrapper that runs valgrind on the parser over the simple_tests tree (or other directory tree if passed on the command line). An alternate parser location can also be passed on the command line. Like the libapparmor python bindings test, this test uses a bit of magic to generate tests that doesn't work with auto-detecting test utilities like nose. Running valgrind on the parser over all 69000+ testcases takes several hours, so while this patch includes a make target 'make valgrind', it does not add it to the set of tests run when 'make check' is called. Perhaps a 'make extra-tests' target is in order. Patch history: v1: - initial version. v2: - add some valgrind suppressions for overaggressive 4 byte reads past the end of allocated storage (not completed). v3: - add ability to dump valgrind suppressions to stdout, to use diagnosis runs of valgrind for determining whether a given failure is a false positive or not. - correctly return 0 on a successful run and an error code if one or more test cases fail. - point LD_LIBRARY_PATH at the in-tree libapparmor build. - split out some utility functions into testlib.py, for possible use by other to be written test scripts v4: - convert optparse to argparse Signed-off-by: Steve Beattie <steve@nxnw.org> Acked-by: Tyler Hicks <tyhicks@canonical.com> (for v2 version)
2013-10-15 17:06:26 -07:00
LANG=C ./valgrind_simple.py -p "$(PARSER)" -v simple_tests
add correct line number and filename tracking for error conditions (LP: #588014) Bug: https://launchpad.net/bugs/588014
2010-06-04 18:47:44 -07:00
$(PARSER):
make -C $(PARSER_DIR) $(PARSER_BIN)
Add auto generation of xtransition conflict tests All the combiniation of xtransition conflics where not well represented in the regression test suite. Instead of relying on multiple static test files, automatically generate all possible conflicts. Signed-off-by: John Johansen <john.johansen@canonical.com>
2010-12-20 11:53:52 -08:00
clean:
It's possible that git doesn't like to create empty directories, so create the generated_* directories themselves if they don't exist before running the script to generate them. Also modify the default invocation of prove to add -f, which reports the details of failing test cases.
2011-08-09 01:10:19 -07:00
find $(GEN_TRANS_DIRS) -type f | xargs rm -f
parser: add build option for coverage (v3) This patch adds a parser make variable and a make target for building the compiler with coverage compilation flags. With this, coverage information can be generated by running tests/test suites against the built parser and run through tools like gcovr. Patch History: v1: initial version v2: refreshed/no change v3: address feedback from sarnold: - mark coverage target as phony - correct missing '.' typo in clean target - make coverage extensions consistent in clean targets Signed-off-by: Steve Beattie <steve@nxnw.org> Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-12-06 05:31:11 -08:00
rm -f gmon.out
Reference in a new issue Copy permalink