mirrors/apparmor
1
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor.git synced 2025-03-04 08:24:42 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

tests: Add ptrace tests for LP: #1390592

Browse source 
These regression tests are for an Ubuntu-specific bug. However, they
should benefit the upstream project, as well. Ubuntu took an incomplete
version of a patch, which introduced the bug. The version of that patch
that landed upstream did not contain the bug.

The bug was in policy compilation of certain combinations of rule types,
conditionals, and conditional values. The easiest such combination to
test is a rule such as:

  ptrace peer=ABC,

Buggy parsers will generate binary policy that causes the kernel to deny
a ptrace of a process confined by ABC, despite the presence of the above
rule.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
This commit is contained in:
Tyler Hicks 2014-11-13 10:40:19 -06:00
parent e188f04ce4
commit 4c30cb0e64
1 changed files with 9 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
tests/regression/apparmor/ptrace_v6.inc
View file

@ -402,6 +402,15 @@ runchecktest "test 15p -h prog" fail -h -n 100 $helper /bin/true
runchecktest "test 15p -hc" fail -h -c -n 100 $helper
runchecktest "test 15p -hc prog" fail -h -c -n 100 $helper /bin/true
# Test LP: #1390592
# The bug was a policy compilation bug that triggers in a rule such as
# 'ptrace peer=ABC,'. The first character of the peer conditional value must be
# a-f|A-F|0-9 to trigger the bug. A parser affected by this bug will create a
# bad binary policy that causes the kernel to unexpectedly deny the ptrace
# 'trace' of a process confined by profile ABC.
genprofile "$helper rpx -> ABC" signal:ALL ptrace:trace:peer=ABC -- image=ABC addimage:$helper /bin/true:rix signal:ALL ptrace:tracedby:peer=$test
runchecktest "test LP: #1390592 -h prog" pass -h -n 100 $helper /bin/true
runchecktest "test LP: #1390592 -hc prog" pass -h -c -n 100 $helper /bin/true
## TODO: ptrace read tests
## TODO: ptrace + change_profile