You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
283 lines
8.3 KiB
283 lines
8.3 KiB
# Authors: Karl MacMillan <kmacmillan@mentalrootkit.com> |
|
# |
|
# Copyright (C) 2006 Red Hat |
|
# see file 'COPYING' for use and warranty information |
|
# |
|
# This program is free software; you can redistribute it and/or |
|
# modify it under the terms of the GNU General Public License as |
|
# published by the Free Software Foundation; version 2 only |
|
# |
|
# This program is distributed in the hope that it will be useful, |
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of |
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
|
# GNU General Public License for more details. |
|
# |
|
# You should have received a copy of the GNU General Public License |
|
# along with this program; if not, write to the Free Software |
|
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
|
# |
|
|
|
import unittest |
|
import sepolgen.access as access |
|
import sepolgen.interfaces as interfaces |
|
import sepolgen.policygen as policygen |
|
import sepolgen.refparser as refparser |
|
import sepolgen.refpolicy as refpolicy |
|
|
|
class TestParam(unittest.TestCase): |
|
def test(self): |
|
p = interfaces.Param() |
|
p.name = "$1" |
|
self.assertEqual(p.name, "$1") |
|
self.assertRaises(ValueError, p.set_name, "$N") |
|
self.assertEqual(p.num, 1) |
|
self.assertEqual(p.type, refpolicy.SRC_TYPE) |
|
|
|
class TestAVExtractPerms(unittest.TestCase): |
|
def test(self): |
|
av = access.AccessVector(['foo', 'bar', 'file', 'read']) |
|
params = { } |
|
ret = interfaces.av_extract_params(av, params) |
|
self.assertEqual(ret, 0) |
|
self.assertEqual(params, { }) |
|
|
|
av.src_type = "$1" |
|
ret = interfaces.av_extract_params(av, params) |
|
self.assertEqual(ret, 0) |
|
p = params["$1"] |
|
self.assertEqual(p.name, "$1") |
|
self.assertEqual(p.type, refpolicy.SRC_TYPE) |
|
self.assertEqual(p.obj_classes, refpolicy.IdSet(["file"])) |
|
|
|
params = { } |
|
av.tgt_type = "$1" |
|
av.obj_class = "process" |
|
ret = interfaces.av_extract_params(av, params) |
|
self.assertEqual(ret, 0) |
|
p = params["$1"] |
|
self.assertEqual(p.name, "$1") |
|
self.assertEqual(p.type, refpolicy.SRC_TYPE) |
|
self.assertEqual(p.obj_classes, refpolicy.IdSet(["process"])) |
|
|
|
params = { } |
|
av.tgt_type = "$1" |
|
av.obj_class = "dir" |
|
ret = interfaces.av_extract_params(av, params) |
|
self.assertEqual(ret, 1) |
|
p = params["$1"] |
|
self.assertEqual(p.name, "$1") |
|
self.assertEqual(p.type, refpolicy.SRC_TYPE) |
|
self.assertEqual(p.obj_classes, refpolicy.IdSet(["dir"])) |
|
|
|
av.src_type = "bar" |
|
av.tgt_type = "$2" |
|
av.obj_class = "dir" |
|
ret = interfaces.av_extract_params(av, params) |
|
self.assertEqual(ret, 0) |
|
p = params["$2"] |
|
self.assertEqual(p.name, "$2") |
|
self.assertEqual(p.type, refpolicy.TGT_TYPE) |
|
self.assertEqual(p.obj_classes, refpolicy.IdSet(["dir"])) |
|
|
|
interface_example = """ |
|
interface(`files_search_usr',` |
|
gen_require(` |
|
type usr_t; |
|
') |
|
|
|
allow $1 usr_t:dir search; |
|
allow { domain $1 } { usr_t usr_home_t }:{ file dir } { read write getattr }; |
|
typeattribute $1 file_type; |
|
|
|
if (foo) { |
|
allow $1 foo:bar baz; |
|
} |
|
|
|
if (bar) { |
|
allow $1 foo:bar baz; |
|
} else { |
|
allow $1 foo:bar baz; |
|
} |
|
') |
|
|
|
interface(`files_list_usr',` |
|
gen_require(` |
|
type usr_t; |
|
') |
|
|
|
allow $1 usr_t:dir { read getattr }; |
|
|
|
optional_policy(` |
|
search_usr($1) |
|
') |
|
|
|
tunable_policy(`foo',` |
|
whatever($1) |
|
') |
|
|
|
') |
|
|
|
interface(`files_exec_usr_files',` |
|
gen_require(` |
|
type usr_t; |
|
') |
|
|
|
allow $1 usr_t:dir read; |
|
allow $1 usr_t:lnk_file { read getattr }; |
|
can_exec($1,usr_t) |
|
can_foo($1) |
|
|
|
') |
|
""" |
|
|
|
simple_interface = """ |
|
interface(`foo',` |
|
gen_require(` |
|
type usr_t; |
|
') |
|
allow $1 usr_t:dir { create add_name }; |
|
allow $1 usr_t:file { read write }; |
|
') |
|
""" |
|
|
|
test_expansion = """ |
|
interface(`foo',` |
|
gen_require(` |
|
type usr_t; |
|
') |
|
allow $1 usr_t:dir { create add_name }; |
|
allow $1 usr_t:file { read write }; |
|
') |
|
|
|
interface(`map', ` |
|
gen_require(` |
|
type bar_t; |
|
') |
|
allow $1 bar_t:file read; |
|
allow $2 bar_t:file write; |
|
|
|
foo($2) |
|
') |
|
|
|
interface(`hard_map', ` |
|
gen_require(` |
|
type baz_t; |
|
') |
|
allow $1 baz_t:file getattr; |
|
allow $2 baz_t:file read; |
|
allow $3 baz_t:file write; |
|
|
|
map($1, $2) |
|
map($2, $3) |
|
|
|
# This should have no effect |
|
foo($2) |
|
') |
|
""" |
|
|
|
def compare_avsets(l, avs_b): |
|
avs_a = access.AccessVectorSet() |
|
avs_a.from_list(l) |
|
|
|
a = list(avs_a) |
|
b = list(avs_b) |
|
|
|
a.sort() |
|
b.sort() |
|
|
|
if len(a) != len(b): |
|
return False |
|
|
|
|
|
for av_a, av_b in zip(a, b): |
|
if av_a != av_b: |
|
return False |
|
|
|
return True |
|
|
|
|
|
class TestInterfaceSet(unittest.TestCase): |
|
def test_simple(self): |
|
h = refparser.parse(simple_interface) |
|
i = interfaces.InterfaceSet() |
|
i.add_headers(h) |
|
|
|
self.assertEqual(len(i.interfaces), 1) |
|
for key, interface in i.interfaces.items(): |
|
self.assertEqual(key, interface.name) |
|
self.assertEqual(key, "foo") |
|
self.assertEqual(len(interface.access), 2) |
|
|
|
# Check the access vectors |
|
comp_avs = [["$1", "usr_t", "dir", "create", "add_name"], |
|
["$1", "usr_t", "file", "read", "write"]] |
|
ret = compare_avsets(comp_avs, interface.access) |
|
self.assertTrue(ret) |
|
|
|
# Check the params |
|
self.assertEqual(len(interface.params), 1) |
|
for param in interface.params.values(): |
|
self.assertEqual(param.type, refpolicy.SRC_TYPE) |
|
self.assertEqual(param.name, "$1") |
|
self.assertEqual(param.num, 1) |
|
self.assertEqual(param.required, True) |
|
|
|
def test_expansion(self): |
|
h = refparser.parse(test_expansion) |
|
i = interfaces.InterfaceSet() |
|
i.add_headers(h) |
|
|
|
self.assertEqual(len(i.interfaces), 3) |
|
for key, interface in i.interfaces.items(): |
|
self.assertEqual(key, interface.name) |
|
if key == "foo": |
|
comp_avs = [["$1", "usr_t", "dir", "create", "add_name"], |
|
["$1", "usr_t", "file", "read", "write"]] |
|
self.assertTrue(compare_avsets(comp_avs, interface.access)) |
|
elif key == "map": |
|
comp_avs = [["$2", "usr_t", "dir", "create", "add_name"], |
|
["$2", "usr_t", "file", "read", "write"], |
|
["$1", "bar_t", "file", "read"], |
|
["$2", "bar_t", "file", "write"]] |
|
self.assertTrue(compare_avsets(comp_avs, interface.access)) |
|
elif key == "hard_map": |
|
comp_avs = [["$1", "baz_t", "file", "getattr"], |
|
["$2", "baz_t", "file", "read"], |
|
["$3", "baz_t", "file", "write"], |
|
|
|
["$2", "usr_t", "dir", "create", "add_name"], |
|
["$2", "usr_t", "file", "read", "write"], |
|
["$1", "bar_t", "file", "read"], |
|
["$2", "bar_t", "file", "write"], |
|
|
|
["$3", "usr_t", "dir", "create", "add_name"], |
|
["$3", "usr_t", "file", "read", "write"], |
|
["$2", "bar_t", "file", "read"], |
|
["$3", "bar_t", "file", "write"]] |
|
self.assertTrue(compare_avsets(comp_avs, interface.access)) |
|
|
|
|
|
def test_export(self): |
|
h = refparser.parse(interface_example) |
|
i = interfaces.InterfaceSet() |
|
i.add_headers(h) |
|
f = open("output", "w") |
|
i.to_file(f) |
|
f.close() |
|
|
|
i2 = interfaces.InterfaceSet() |
|
f = open("output") |
|
i2.from_file(f) |
|
f.close() |
|
if_status = [False, False, False] |
|
for ifv in i2.interfaces.values(): |
|
if ifv.name == "files_search_usr": |
|
if_status[0] = True |
|
if ifv.name == "files_list_usr": |
|
if_status[1] = True |
|
if ifv.name == "files_exec_usr_files": |
|
if_status[2] = True |
|
|
|
self.assertEqual(if_status[0], True) |
|
self.assertEqual(if_status[1], True) |
|
self.assertEqual(if_status[2], True)
|
|
|