mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-09-01 23:05:11 +00:00
Code Issues Releases Wiki Activity

With the export of more AA_MAY_ defines from apparmor.h

Browse Source 
The local defines in the link_subset test collide and result in build
warnings. Replace the defines with a naming that won't collide and
makes it clear a local define for the test is being used.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
This commit is contained in:
John Johansen
2015-07-14 10:35:01 -07:00
parent 4ff04c991c
commit 2d1fc26f54
1 changed files with 64 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files

127
tests/regression/apparmor/link_subset.c
View File

@@ -15,37 +15,38 @@
#include "changehat.h" #include "changehat.h"
/* actual mapping does not match kernel, just needed for bit manging */ /* Create all possible link + other permission combinations
#define AA_MAY_EXEC 0x001 * actual mapping does NOT match kernel, just needed for bit mangling */
#define AA_MAY_WRITE 0x002 #define TEST_MAY_EXEC 0x001
#define AA_MAY_READ 0x004 #define TEST_MAY_WRITE 0x002
#define AA_MAY_APPEND 0x008 #define TEST_MAY_READ 0x004
#define TEST_MAY_APPEND 0x008
#define AA_MAY_LINK 0x0010 #define TEST_MAY_LINK 0x0010
#define AA_MAY_LOCK 0x0020 #define TEST_MAY_LOCK 0x0020
#define AA_MAY_MOUNT 0x0040 #define TEST_MAY_MOUNT 0x0040
#define AA_EXEC_MMAP 0x0080 #define TEST_EXEC_MMAP 0x0080
#define AA_EXEC_UNSAFE 0x0100 #define TEST_EXEC_UNSAFE 0x0100
#define AA_EXEC_INHERIT 0x0200 #define TEST_EXEC_INHERIT 0x0200
#define AA_EXEC_MOD_0 0x0400 #define TEST_EXEC_MOD_0 0x0400
#define AA_EXEC_MOD_1 0x0800 #define TEST_EXEC_MOD_1 0x0800
#define AA_EXEC_MOD_2 0x1000 #define TEST_EXEC_MOD_2 0x1000
#define AA_EXEC_MOD_3 0x2000 #define TEST_EXEC_MOD_3 0x2000
#define AA_EXEC_MODIFIERS (AA_EXEC_MOD_0 | AA_EXEC_MOD_1 | \ #define TEST_EXEC_MODIFIERS (TEST_EXEC_MOD_0 | TEST_EXEC_MOD_1 | \
AA_EXEC_MOD_2 | AA_EXEC_MOD_3) TEST_EXEC_MOD_2 | TEST_EXEC_MOD_3)
#define AA_EXEC_TYPE (AA_MAY_EXEC | AA_EXEC_UNSAFE | AA_EXEC_INHERIT | \ #define TEST_EXEC_TYPE (TEST_MAY_EXEC | TEST_EXEC_UNSAFE | TEST_EXEC_INHERIT | \
AA_EXEC_MODIFIERS) TEST_EXEC_MODIFIERS)
#define AA_EXEC_UNCONFINED AA_EXEC_MOD_0 #define TEST_EXEC_UNCONFINED TEST_EXEC_MOD_0
#define AA_EXEC_PROFILE AA_EXEC_MOD_1 #define TEST_EXEC_PROFILE TEST_EXEC_MOD_1
#define AA_EXEC_LOCAL (AA_EXEC_MOD_0 | AA_EXEC_MOD_1) #define TEST_EXEC_LOCAL (TEST_EXEC_MOD_0 | TEST_EXEC_MOD_1)
#define MAX_PERM (AA_EXEC_MOD_2) #define MAX_PERM (TEST_EXEC_MOD_2)
#define MAX_PERM_LEN 10 #define MAX_PERM_LEN 10
@@ -57,38 +58,38 @@
int valid_link_perm_subset(int tperm, int lperm) int valid_link_perm_subset(int tperm, int lperm)
{ {
/* link must always have link bit set */ /* link must always have link bit set */
if (!(lperm & AA_MAY_LINK)) if (!(lperm & TEST_MAY_LINK))
return 0; return 0;
lperm = lperm & ~AA_MAY_LINK; lperm = lperm & ~TEST_MAY_LINK;
/* an empty permission set is always a subset of target */ /* an empty permission set is always a subset of target */
if (!lperm) if (!lperm)
return 1; return 1;
/* ix implies mix */ /* ix implies mix */
if (lperm & AA_EXEC_INHERIT) if (lperm & TEST_EXEC_INHERIT)
lperm |= AA_EXEC_MMAP; lperm |= TEST_EXEC_MMAP;
if (tperm & AA_EXEC_INHERIT) if (tperm & TEST_EXEC_INHERIT)
tperm |= AA_EXEC_MMAP; tperm |= TEST_EXEC_MMAP;
/* w implies a */ /* w implies a */
if (lperm & AA_MAY_WRITE) if (lperm & TEST_MAY_WRITE)
lperm |= AA_MAY_APPEND; lperm |= TEST_MAY_APPEND;
if (tperm & AA_MAY_WRITE) if (tperm & TEST_MAY_WRITE)
tperm |= AA_MAY_APPEND; tperm |= TEST_MAY_APPEND;
/* currently no such thing as a safe ix - probably should be /* currently no such thing as a safe ix - probably should be
* depending on how the rule is written */ * depending on how the rule is written */
// if ((tperm & AA_EXEC_MODIFIERS) == AA_EXEC_INHERIT && !(tperm & AA_EXEC_UNSAFE)) // if ((tperm & TEST_EXEC_MODIFIERS) == TEST_EXEC_INHERIT && !(tperm & TEST_EXEC_UNSAFE))
// tperm |= AA_EXEC_UNSAFE; // tperm |= TEST_EXEC_UNSAFE;
/* treat safe exec as subset of unsafe exec */ /* treat safe exec as subset of unsafe exec */
if (!(lperm & AA_EXEC_UNSAFE)) if (!(lperm & TEST_EXEC_UNSAFE))
lperm |= AA_EXEC_UNSAFE & tperm; lperm |= TEST_EXEC_UNSAFE & tperm;
/* check that exec mode, if present, matches */ /* check that exec mode, if present, matches */
if ((lperm & AA_MAY_EXEC) && ((lperm & AA_EXEC_TYPE) != (tperm & AA_EXEC_TYPE))) if ((lperm & TEST_MAY_EXEC) && ((lperm & TEST_EXEC_TYPE) != (tperm & TEST_EXEC_TYPE)))
return 0; return 0;
return !(lperm & ~tperm); return !(lperm & ~tperm);
@@ -98,51 +99,51 @@ void permstring(char *buffer, int mask)
{ {
char *b = buffer; char *b = buffer;
if (mask & AA_EXEC_MMAP) if (mask & TEST_EXEC_MMAP)
*b++ = 'm'; *b++ = 'm';
if (mask & AA_MAY_READ) if (mask & TEST_MAY_READ)
*b++ = 'r'; *b++ = 'r';
if (mask & AA_MAY_WRITE) if (mask & TEST_MAY_WRITE)
*b++ = 'w'; *b++ = 'w';
else if (mask & AA_MAY_APPEND) else if (mask & TEST_MAY_APPEND)
*b++ = 'a'; *b++ = 'a';
if (mask & AA_MAY_EXEC) { if (mask & TEST_MAY_EXEC) {
if (mask & AA_EXEC_UNSAFE) { if (mask & TEST_EXEC_UNSAFE) {
switch(mask & AA_EXEC_MODIFIERS) { switch(mask & TEST_EXEC_MODIFIERS) {
case AA_EXEC_UNCONFINED: case TEST_EXEC_UNCONFINED:
*b++ = 'u'; *b++ = 'u';
break; break;
case AA_EXEC_PROFILE: case TEST_EXEC_PROFILE:
*b++ = 'p'; *b++ = 'p';
break; break;
case AA_EXEC_LOCAL: case TEST_EXEC_LOCAL:
*b++ = 'c'; *b++ = 'c';
break; break;
default: default:
*b++ = 'y'; *b++ = 'y';
} }
} else { } else {
switch(mask & AA_EXEC_MODIFIERS) { switch(mask & TEST_EXEC_MODIFIERS) {
case AA_EXEC_UNCONFINED: case TEST_EXEC_UNCONFINED:
*b++ = 'U'; *b++ = 'U';
break; break;
case AA_EXEC_PROFILE: case TEST_EXEC_PROFILE:
*b++ = 'P'; *b++ = 'P';
break; break;
case AA_EXEC_LOCAL: case TEST_EXEC_LOCAL:
*b++ = 'C'; *b++ = 'C';
break; break;
default: default:
*b++ = 'Y'; *b++ = 'Y';
} }
} }
if (mask & AA_EXEC_INHERIT) if (mask & TEST_EXEC_INHERIT)
*b++ = 'i'; *b++ = 'i';
*b++ = 'x'; *b++ = 'x';
} }
if (mask & AA_MAY_LINK) if (mask & TEST_MAY_LINK)
*b++ = 'l'; *b++ = 'l';
if (mask & AA_MAY_LOCK) if (mask & TEST_MAY_LOCK)
*b++ = 'k'; *b++ = 'k';
*b++ = '\0'; *b++ = '\0';
} }
@@ -156,30 +157,30 @@ void build_filename(const char *name, int perm, char *buffer)
} }
int is_valid_perm_set(int perm) { int is_valid_perm_set(int perm) {
if (AA_EXEC_TYPE & perm) { if (TEST_EXEC_TYPE & perm) {
/* exec mods need the perm bit set */ /* exec mods need the perm bit set */
if (!(perm & AA_MAY_EXEC)) if (!(perm & TEST_MAY_EXEC))
return 0; return 0;
/* unconfined can't inherit */ /* unconfined can't inherit */
if (((perm & AA_EXEC_MODIFIERS) == AA_EXEC_UNCONFINED) && if (((perm & TEST_EXEC_MODIFIERS) == TEST_EXEC_UNCONFINED) &&
(perm & AA_EXEC_INHERIT)) (perm & TEST_EXEC_INHERIT))
return 0; return 0;
/* no such thing as an unsafe ix */ /* no such thing as an unsafe ix */
if ((perm & AA_EXEC_MODIFIERS) == 0 && (perm & AA_EXEC_INHERIT) && (perm & AA_EXEC_UNSAFE)) if ((perm & TEST_EXEC_MODIFIERS) == 0 && (perm & TEST_EXEC_INHERIT) && (perm & TEST_EXEC_UNSAFE))
return 0; return 0;
/* check exec_modifiers in range */ /* check exec_modifiers in range */
if (!((perm & AA_EXEC_MODIFIERS) > 0 && (perm & AA_EXEC_MODIFIERS) < AA_EXEC_MOD_2)) if (!((perm & TEST_EXEC_MODIFIERS) > 0 && (perm & TEST_EXEC_MODIFIERS) < TEST_EXEC_MOD_2))
return 0; return 0;
} }
/* only 1 of append or write should be set */ /* only 1 of append or write should be set */
if ((perm & AA_MAY_WRITE) && (perm & AA_MAY_APPEND)) if ((perm & TEST_MAY_WRITE) && (perm & TEST_MAY_APPEND))
return 0; return 0;
/* not using mount yet, how should mount perms affect link? */ /* not using mount yet, how should mount perms affect link? */
if (perm & AA_MAY_MOUNT) if (perm & TEST_MAY_MOUNT)
return 0; return 0;
return 1; return 1;