2
0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-22 10:07:12 +00:00

add log testcases for exec with and without target=

- in complain mode, exec events include target=...
- in enforce mode, the log message doesn't include target=...

Note that the utils tests skip exec events (they'd be interactive),
therefore exec*.profile doesn't contain an exec rule.
This commit is contained in:
Christian Boltz 2019-07-27 22:23:15 +02:00
parent db1f391844
commit dc3d11bf0a
No known key found for this signature in database
GPG Key ID: C6A682EA63C82F1C
8 changed files with 37 additions and 0 deletions

View File

@ -0,0 +1 @@
type=AVC msg=audit(1556742889.059:3686): apparmor="ALLOWED" operation="exec" profile="/home/cb/bin/hello.sh" name="/usr/bin/rm" pid=13108 comm="hello.sh" requested_mask="x" denied_mask="x" fsuid=1000 ouid=0 target="/home/cb/bin/hello.sh//null-/usr/bin/rm"

View File

@ -0,0 +1,16 @@
START
File: exec01.in
Event type: AA_RECORD_ALLOWED
Audit ID: 1556742889.059:3686
Operation: exec
Mask: x
Denied Mask: x
fsuid: 1000
ouid: 0
Profile: /home/cb/bin/hello.sh
Name: /usr/bin/rm
Command: hello.sh
Name2: /home/cb/bin/hello.sh//null-/usr/bin/rm
PID: 13108
Epoch: 1556742889
Audit subid: 3686

View File

@ -0,0 +1,2 @@
/home/cb/bin/hello.sh {
}

View File

@ -0,0 +1 @@
type=AVC msg=audit(1564250674.378:1307): apparmor="DENIED" operation="exec" profile="/usr/bin/wireshark" name="/usr/lib64/wireshark/extcap/androiddump" pid=23247 comm="pool" requested_mask="x" denied_mask="x" fsuid=1000 ouid=0

View File

@ -0,0 +1,15 @@
START
File: exec02.in
Event type: AA_RECORD_DENIED
Audit ID: 1564250674.378:1307
Operation: exec
Mask: x
Denied Mask: x
fsuid: 1000
ouid: 0
Profile: /usr/bin/wireshark
Name: /usr/lib64/wireshark/extcap/androiddump
Command: pool
PID: 23247
Epoch: 1564250674
Audit subid: 1307

View File

@ -0,0 +1,2 @@
/usr/bin/wireshark {
}