mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-09-01 14:55:10 +00:00
Code Issues Releases Wiki Activity

Add aa-complain tests for profile with hats and subprofiles

Browse Source 
So far, change_profile_flags() in aa.py is the only user of
ProfileStorage's 'name'.

Rewrite minitools test_cleanprof() so that most of its code can be
reused, and add a test that runs 'aa-complain
/usr/bin/a/simple/cleanprof/test/profile' on cleanprof.in to ensure
aa-complain still works as expected on subprofiles and hats.

Note: aa-complain $profilename will change the flags of hats, but not
child profiles. This is a known issue, and doesn't change with this MR.
This commit is contained in:
Christian Boltz
2024-10-06 16:45:54 +02:00
parent cb943e4efc
commit d8e86fee75
2 changed files with 124 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
utils/test/test-minitools.py
View File

@@ -199,26 +199,44 @@ class MinitoolsTest(AATest):
self.assertIsNot(output_force, '', 'Failed to run aa-unconfined in paranoid mode')
def test_cleanprof(self):
def _test_with_cleanprof_profile(self, command, output_file, errormsg, delete_first_line):
input_file = 'cleanprof_test.in'
output_file = 'cleanprof_test.out'
profile = '/usr/bin/a/simple/cleanprof/test/profile'
# We position the local testfile
shutil.copy('./' + input_file, self.profile_dir)
# Our silly test program whose profile we wish to clean
cleanprof_test = '/usr/bin/a/simple/cleanprof/test/profile'
subprocess.check_output(
'{} ./../aa-cleanprof --no-reload -d {} -s {} --configdir ./'.format(
python_interpreter, self.profile_dir, cleanprof_test),
'{} ./../{} --no-reload -d {} {} --configdir ./'.format(
python_interpreter, command, self.profile_dir, profile),
shell=True)
# Strip off the first line (#modified line)
subprocess.check_output('sed -i 1d {}/{}'.format(self.profile_dir, input_file), shell=True)
if delete_first_line:
subprocess.check_output('sed -i 1d {}/{}'.format(self.profile_dir, input_file), shell=True)
exp_content = read_file('./' + output_file)
real_content = read_file('{}/{}'.format(self.profile_dir, input_file))
self.maxDiff = None
self.assertEqual(exp_content, real_content, 'Failed to cleanup profile properly')
self.assertEqual(exp_content, real_content, errormsg)
def test_cleanprof(self):
''' run aa-cleanprof on cleanprof.in and check if it matches cleanprof.out '''
command = 'aa-cleanprof -s'
output_file = 'cleanprof_test.out'
errormsg = 'Failed to cleanup profile properly'
self._test_with_cleanprof_profile(command, output_file, errormsg, True)
def test_complain_cleanprof(self):
''' test if all child profiles in cleanprof_test.in get the complain flag added when switching the profile to complain mode '''
# TODO: works for hats, but not for child profiles
command = 'aa-complain'
output_file = 'cleanprof_test.complain'
errormsg = 'Failed to switch profile to complain mode'
self._test_with_cleanprof_profile(command, output_file, errormsg, False)
setup_aa(apparmor)