mirror of
https://gitlab.com/apparmor/apparmor.git
synced 2025-03-07 01:41:00 +01:00
147 lines
3.7 KiB
Diff
147 lines
3.7 KiB
Diff
Index: subdomain/link.sh
|
|
===================================================================
|
|
--- subdomain.orig/link.sh
|
|
+++ subdomain/link.sh
|
|
@@ -9,9 +9,11 @@
|
|
# License.
|
|
|
|
#=NAME link
|
|
-#=DESCRIPTION
|
|
-# Link requires 'l' permission and that permissions on the src and target
|
|
-# must match. This test verifies matching, non-matching and missing link
|
|
+#=DESCRIPTION
|
|
+# Link requires 'l' permission on the link and that permissions on the
|
|
+#links rwmx perms are a subset of the targets perms, and if x is present
|
|
+#that the link and target have the same x qualifiers.
|
|
+# This test verifies matching, non-matching and missing link
|
|
# permissions in a profile.
|
|
#=END
|
|
|
|
@@ -22,50 +24,88 @@ bin=$pwd
|
|
|
|
. $bin/prologue.inc
|
|
|
|
-src=$tmpdir/src
|
|
target=$tmpdir/target
|
|
+linkfile=$tmpdir/linkfile
|
|
okperm=rwixl
|
|
badperm=rwl
|
|
nolinkperm=rwix
|
|
|
|
-touch $src
|
|
+touch $target
|
|
|
|
-# PASS TEST
|
|
+#test for $1 in $2
|
|
+function perm_is_subset () {
|
|
+ # zero length substring always matches
|
|
+ if [ -z $1 ] ; then
|
|
+ echo $2;
|
|
+ return 0;
|
|
+ fi
|
|
+
|
|
+ case "$2" in
|
|
+ *$1*) echo ${2##${2/$1*/}}; return 0;;
|
|
+ esac
|
|
+
|
|
+ #handle the special cases
|
|
+ #ix implies mix
|
|
+ local target=${2/ix/mix}
|
|
+
|
|
+ case "$target" in
|
|
+ *$1*) echo ${target##${target/$1*/}}; return 0;;
|
|
+ esac
|
|
+
|
|
+ # permute rw to do string match of rm rwm
|
|
+ target=${target/rw/wr}
|
|
+ case "$target" in
|
|
+ *$1*) echo ${target##${target/$1*/}}; return 0;;
|
|
+ esac
|
|
+}
|
|
+
|
|
+PERMS="r w m ix px ux Px Ux l rw rm rix rpx rux rPx rUx rl wm wix wpx wux \
|
|
+ wPx wUx wl mix mpx mux mPx mUx ml ixl pxl uxl Pxl Uxl rwm rwix rwpx \
|
|
+ rwux rwPx rwUx rwl rmix rmpx rmux rmPx rmUx rml wmix wmpx wmux wmPx \
|
|
+ wmUx wml mixl mpxl muxl mPxl mUxl rwmix rwmpx rwmux rwmPx rwmUx \
|
|
+ rwml wmixl wmpxl wmuxl wmPxl wmUxl rwmixl rwmpxl rwmuxl rwmPxl \
|
|
+ rwmUxl"
|
|
+
|
|
+
|
|
+# unconfined test
|
|
+runchecktest "unconfined" pass $target $linkfile
|
|
+
|
|
+# Link no perms on link or target
|
|
+genprofile
|
|
+runchecktest "link (no perms) -> target (no perms)" fail $target $linkfile
|
|
+rm -rf $linkfile
|
|
+
|
|
+# link no perms
|
|
+for TARGET_PERM in ${PERMS} ; do
|
|
+ genprofile $target:$TARGET_PERM
|
|
+ runchecktest "link (no perms) -> target ($TARGET_PERM)" fail $target $linkfile
|
|
+ rm -rf $linkfile
|
|
+done
|
|
+
|
|
+# target no perms
|
|
+for LINK_PERM in ${PERMS} ; do
|
|
+ genprofile $linkfile:$LINK_PERM
|
|
+ runchecktest "link ($LINK_PERM) -> target (no perms)" fail $target $linkfile
|
|
+ rm -rf $linkfile
|
|
+done
|
|
+
|
|
+# all other combination of perms
|
|
+for LINK_PERM in ${PERMS} ; do
|
|
+ for TARGET_PERM in ${PERMS} ; do
|
|
+ l_in_perms=${LINK_PERM/*l/l}
|
|
+ perms_no_link=${LINK_PERM/l/}
|
|
+ link_subset=`perm_is_subset ${perms_no_link} ${TARGET_PERM}`
|
|
+ if [ "$l_in_perms" == "l" -a -n "$perms_no_link" -a -n "$link_subset" ]
|
|
+ then
|
|
+ expected_result=pass
|
|
+ else
|
|
+ expected_result=fail
|
|
+ fi
|
|
+#echo "testing $LINK_PERM -> $TARGET_PERM = $l_in_perms, $perms_no_link, $link_subset $expected_result"
|
|
+ genprofile $linkfile:$LINK_PERM $target:$TARGET_PERM
|
|
+ runchecktest "link ($LINK_PERM) -> target ($TARGET_PERM)" ${expected_result} $target $linkfile
|
|
+ rm -rf $linkfile
|
|
|
|
-genprofile $src:$okperm $target:$okperm
|
|
-runchecktest "MATCHING PERM (rwixl)" pass $src $target
|
|
+ done
|
|
+done
|
|
|
|
-# PASS TEST
|
|
-
|
|
-rm -f $target
|
|
-
|
|
-genprofile $src:$nolinkperm $target:$okperm
|
|
-runchecktest "MATCHING PERM (rwix)" pass $src $target
|
|
-
|
|
-# PASS TEST
|
|
-
|
|
-rm -f $target
|
|
-
|
|
-genprofile $src:r $target:rl
|
|
-runchecktest "MATCHING PERM (r)" pass $src $target
|
|
-
|
|
-# PASS TEST
|
|
-
|
|
-rm -f $target
|
|
-
|
|
-genprofile $src:w $target:wl
|
|
-runchecktest "MATCHING PERM (w)" pass $src $target
|
|
-
|
|
-# FAILURE TEST
|
|
-
|
|
-rm -f $target
|
|
-
|
|
-genprofile $src:$okperm $target:$badperm
|
|
-runchecktest "NONMATCHING PERM" fail $src $target
|
|
-
|
|
-# NOLINK TEST
|
|
-
|
|
-rm -f $target
|
|
-
|
|
-genprofile $src:$okperm $target:$nolinkperm
|
|
-runchecktest "NOLINK PERM" fail $src $target
|