mirror of
https://gitlab.com/apparmor/apparmor
synced 2025-08-22 10:07:12 +00:00
add log testcases for exec with and without target=
- in complain mode, exec events include target=... - in enforce mode, the log message doesn't include target=... Note that the utils tests skip exec events (they'd be interactive), therefore exec*.profile doesn't contain an exec rule.
This commit is contained in:
parent
db1f391844
commit
dc3d11bf0a
1
libraries/libapparmor/testsuite/test_multi/exec01.in
Normal file
1
libraries/libapparmor/testsuite/test_multi/exec01.in
Normal file
@ -0,0 +1 @@
|
||||
type=AVC msg=audit(1556742889.059:3686): apparmor="ALLOWED" operation="exec" profile="/home/cb/bin/hello.sh" name="/usr/bin/rm" pid=13108 comm="hello.sh" requested_mask="x" denied_mask="x" fsuid=1000 ouid=0 target="/home/cb/bin/hello.sh//null-/usr/bin/rm"
|
16
libraries/libapparmor/testsuite/test_multi/exec01.out
Normal file
16
libraries/libapparmor/testsuite/test_multi/exec01.out
Normal file
@ -0,0 +1,16 @@
|
||||
START
|
||||
File: exec01.in
|
||||
Event type: AA_RECORD_ALLOWED
|
||||
Audit ID: 1556742889.059:3686
|
||||
Operation: exec
|
||||
Mask: x
|
||||
Denied Mask: x
|
||||
fsuid: 1000
|
||||
ouid: 0
|
||||
Profile: /home/cb/bin/hello.sh
|
||||
Name: /usr/bin/rm
|
||||
Command: hello.sh
|
||||
Name2: /home/cb/bin/hello.sh//null-/usr/bin/rm
|
||||
PID: 13108
|
||||
Epoch: 1556742889
|
||||
Audit subid: 3686
|
@ -0,0 +1,2 @@
|
||||
/home/cb/bin/hello.sh {
|
||||
}
|
1
libraries/libapparmor/testsuite/test_multi/exec02.in
Normal file
1
libraries/libapparmor/testsuite/test_multi/exec02.in
Normal file
@ -0,0 +1 @@
|
||||
type=AVC msg=audit(1564250674.378:1307): apparmor="DENIED" operation="exec" profile="/usr/bin/wireshark" name="/usr/lib64/wireshark/extcap/androiddump" pid=23247 comm="pool" requested_mask="x" denied_mask="x" fsuid=1000 ouid=0
|
15
libraries/libapparmor/testsuite/test_multi/exec02.out
Normal file
15
libraries/libapparmor/testsuite/test_multi/exec02.out
Normal file
@ -0,0 +1,15 @@
|
||||
START
|
||||
File: exec02.in
|
||||
Event type: AA_RECORD_DENIED
|
||||
Audit ID: 1564250674.378:1307
|
||||
Operation: exec
|
||||
Mask: x
|
||||
Denied Mask: x
|
||||
fsuid: 1000
|
||||
ouid: 0
|
||||
Profile: /usr/bin/wireshark
|
||||
Name: /usr/lib64/wireshark/extcap/androiddump
|
||||
Command: pool
|
||||
PID: 23247
|
||||
Epoch: 1564250674
|
||||
Audit subid: 1307
|
@ -0,0 +1,2 @@
|
||||
/usr/bin/wireshark {
|
||||
}
|
Loading…
x
Reference in New Issue
Block a user