diff --git a/.gitignore b/.gitignore index d2043ecd1..3d0eb258b 100644 --- a/.gitignore +++ b/.gitignore @@ -230,6 +230,7 @@ tests/regression/apparmor/chgrp tests/regression/apparmor/chmod tests/regression/apparmor/chown tests/regression/apparmor/clone +tests/regression/apparmor/complain tests/regression/apparmor/dbus_eavesdrop tests/regression/apparmor/dbus_message tests/regression/apparmor/dbus_service diff --git a/tests/regression/apparmor/Makefile b/tests/regression/apparmor/Makefile index f31687da8..2d70cd1f0 100644 --- a/tests/regression/apparmor/Makefile +++ b/tests/regression/apparmor/Makefile @@ -90,6 +90,7 @@ SRC=access.c \ chmod.c \ chown.c \ clone.c \ + complain.c \ coredump.c \ deleted.c \ environ.c \ @@ -242,6 +243,7 @@ TESTS=aa_exec \ changehat_misc \ chdir \ clone \ + complain \ coredump \ deleted \ e2e \ diff --git a/tests/regression/apparmor/complain.c b/tests/regression/apparmor/complain.c new file mode 100644 index 000000000..1a7d1c863 --- /dev/null +++ b/tests/regression/apparmor/complain.c @@ -0,0 +1,38 @@ +#include +#include +#include + +void print_usage() { + fprintf(stderr, "Usage: ./complain (read|exec) [args]\n"); +} + +int main(int argc, char **argv) { + if (argc < 3) { + print_usage(); + return 1; + } + if (strcmp(argv[1], "read") == 0) { + FILE *file = fopen(argv[2], "r"); + if (file == NULL) { + perror("FAIL: Could not open file"); + return 2; + } + long file_len = ftell(file); + if (file_len == -1) { + perror("FAIL: Could not get file len"); + fclose(file); + return 1; + } + // Don't need to do anything else for now + fprintf(stderr, "PASS\n"); + return 0; + } else if (strcmp(argv[1], "exec") == 0) { + execvp(argv[2], &argv[2]); + // execvp failed + fprintf(stderr, "FAIL: execvp of %s failed\n", argv[1]); + return 1; + } else { + print_usage(); + return 1; + } +} \ No newline at end of file diff --git a/tests/regression/apparmor/complain.sh b/tests/regression/apparmor/complain.sh new file mode 100644 index 000000000..ffca342e7 --- /dev/null +++ b/tests/regression/apparmor/complain.sh @@ -0,0 +1,33 @@ +#! /bin/bash +# Copyright (C) 2024 Canonical, Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, version 2 of the +# License. + +#=NAME complain +#=DESCRIPTION +# Verifies that complain-mode profiles work as expected and do not block +# operations disallowed by policy +#=END + +pwd=`dirname $0` +pwd=`cd $pwd ; /bin/pwd` + +bin=$pwd + +. "$bin/prologue.inc" + +tmpfile=$tmpdir/file + +touch $tmpfile + +genprofile -C +runchecktest "Complain mode profile (file read)" pass read $tmpfile +runchecktest "Complain mode profile (file exec no permission entry)" pass exec echo PASS + +# This test will fail on a kernel that doesn't have +# https://lists.ubuntu.com/archives/apparmor/2024-August/013338.html applied +genprofile -C $(which echo):cx +runchecktest "Complain mode profile (file exec cx permission entry)" pass exec echo PASS