mirror of
https://gitlab.com/apparmor/apparmor
synced 2025-08-22 01:57:43 +00:00
c0fcd1698b
Add basic support for the priority rules prefix. This patch does not allow the utils to set or suggest priorities. It allows parsing and retaining of the priority prefix if it already exists on rules and checking if it's in the supported range. Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com> Signed-off-by: John Johansen <john.johansen@canonical.com>
434 lines
18 KiB
Python
434 lines
18 KiB
Python
#!/usr/bin/python3
|
|
# ----------------------------------------------------------------------
|
|
# Copyright (C) 2020 Christian Boltz <apparmor@cboltz.de>
|
|
#
|
|
# This program is free software; you can redistribute it and/or
|
|
# modify it under the terms of version 2 of the GNU General Public
|
|
# License as published by the Free Software Foundation.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# ----------------------------------------------------------------------
|
|
|
|
import unittest
|
|
from collections import namedtuple
|
|
from common_test import AATest, setup_all_loops
|
|
|
|
from apparmor.common import AppArmorBug, AppArmorException
|
|
from apparmor.rule.variable import VariableRule, VariableRuleset, separate_vars
|
|
from apparmor.translations import init_translation
|
|
|
|
_ = init_translation()
|
|
|
|
exp = namedtuple('exp', ('comment', 'varname', 'mode', 'values'))
|
|
|
|
# --- tests for single VariableRule --- #
|
|
|
|
|
|
class VariableTest(AATest):
|
|
def _compare_obj(self, obj, expected):
|
|
# variables don't support the allow, audit, deny, or priority keyword
|
|
self.assertEqual(False, obj.allow_keyword)
|
|
self.assertEqual(False, obj.audit)
|
|
self.assertEqual(False, obj.deny)
|
|
self.assertEqual(None, obj.priority)
|
|
|
|
self.assertEqual(expected.varname, obj.varname)
|
|
self.assertEqual(expected.mode, obj.mode)
|
|
self.assertEqual(expected.values, obj.values)
|
|
self.assertEqual(expected.comment, obj.comment)
|
|
|
|
|
|
class AaTest_separate_vars(AATest):
|
|
tests = (
|
|
('', set()),
|
|
(' ', set()),
|
|
(' foo bar', {'foo', 'bar'}),
|
|
('foo " ', AppArmorException),
|
|
(' " foo ', AppArmorException), # half-quoted
|
|
(' foo bar ', {'foo', 'bar'}),
|
|
(' foo bar # comment', {'foo', 'bar', '#', 'comment'}), # XXX should comments be stripped?
|
|
('foo', {'foo'}),
|
|
('"foo" "bar baz"', {'foo', 'bar baz'}),
|
|
('foo "bar baz" xy', {'foo', 'bar baz', 'xy'}),
|
|
('foo "bar baz ', AppArmorException), # half-quoted
|
|
(' " foo" bar', {' foo', 'bar'}),
|
|
(' " foo" bar x', {' foo', 'bar', 'x'}),
|
|
('""', {''}), # empty value
|
|
('"" foo', {'', 'foo'}), # empty value + 'foo'
|
|
('"" foo "bar"', {'', 'foo', 'bar'}), # empty value + 'foo' + 'bar' (bar has superfluous quotes)
|
|
('"bar"', {'bar'}), # 'bar' with superfluous quotes
|
|
)
|
|
|
|
def _run_test(self, params, expected):
|
|
if expected == AppArmorException:
|
|
with self.assertRaises(expected):
|
|
separate_vars(params)
|
|
else:
|
|
result = separate_vars(params)
|
|
self.assertEqual(result, expected)
|
|
|
|
|
|
class VariableTestParse(VariableTest):
|
|
tests = (
|
|
# rawrule comment varname mode values
|
|
('@{foo}=/bar', exp('', '@{foo}', '=', {'/bar'})),
|
|
('@{foo}+=/bar', exp('', '@{foo}', '+=', {'/bar'})),
|
|
(' @{foo} = /bar ', exp('', '@{foo}', '=', {'/bar'})),
|
|
(' @{foo} += /bar', exp('', '@{foo}', '+=', {'/bar'})),
|
|
(' @{foo} = /bar # comment', exp(' # comment', '@{foo}', '=', {'/bar'})),
|
|
(' @{foo} += /bar # comment', exp(' # comment', '@{foo}', '+=', {'/bar'})),
|
|
('@{foo}=/bar /baz', exp('', '@{foo}', '=', {'/bar', '/baz'})),
|
|
('@{foo} = "/bar," # comment', exp(' # comment', '@{foo}', '=', {'/bar,'})), # value with trailing comma, needs to be quoted
|
|
)
|
|
|
|
def _run_test(self, rawrule, expected):
|
|
self.assertTrue(VariableRule.match(rawrule))
|
|
obj = VariableRule.create_instance(rawrule)
|
|
self.assertEqual(rawrule.strip(), obj.raw_rule)
|
|
self._compare_obj(obj, expected)
|
|
|
|
|
|
class VariableTestParseInvalid(VariableTest):
|
|
tests = (
|
|
# rawrule matches regex exception
|
|
('@{foo} =', (False, AppArmorException)),
|
|
('@ {foo} = # comment', (False, AppArmorException)),
|
|
('@ {foo} = ', (False, AppArmorException)),
|
|
('@{foo} = /foo,', (True, AppArmorException)), # trailing comma
|
|
('@{foo} = /foo, ', (True, AppArmorException)), # trailing comma
|
|
('@{foo} = /foo, # comment', (True, AppArmorException)), # trailing comma
|
|
('@{foo} = /foo, /bar', (True, AppArmorException)), # trailing comma in first value
|
|
('@{foo = /foo f', (True, AppArmorException)), # variable name broken, missing }
|
|
)
|
|
|
|
def _run_test(self, rawrule, expected):
|
|
self.assertEqual(VariableRule.match(rawrule), expected[0])
|
|
with self.assertRaises(expected[1]):
|
|
VariableRule.create_instance(rawrule)
|
|
|
|
|
|
class VariableFromInit(VariableTest):
|
|
tests = (
|
|
# VariableRule object comment varname mode values
|
|
(VariableRule('@{foo}', '=', {'/bar'}), exp('', '@{foo}', '=', {'/bar'})),
|
|
(VariableRule('@{foo}', '+=', {'/bar'}), exp('', '@{foo}', '+=', {'/bar'})),
|
|
(VariableRule('@{foo}', '=', {'/bar', '/baz'}), exp('', '@{foo}', '=', {'/bar', '/baz'})),
|
|
(VariableRule('@{foo}', '+=', {'/bar', '/baz'}), exp('', '@{foo}', '+=', {'/bar', '/baz'})),
|
|
(VariableRule('@{foo}', '=', {'/bar'}, comment='# cmt'), exp('# cmt', '@{foo}', '=', {'/bar'})),
|
|
(VariableRule('@{foo}', '+=', {'/bar'}, comment='# cmt'), exp('# cmt', '@{foo}', '+=', {'/bar'})),
|
|
)
|
|
|
|
def _run_test(self, obj, expected):
|
|
self._compare_obj(obj, expected)
|
|
|
|
|
|
class InvalidVariableInit(AATest):
|
|
tests = (
|
|
# init params expected exception
|
|
((None, '=', ['/bar']), AppArmorBug), # varname not a str
|
|
(('', '=', ['/bar']), AppArmorException), # empty varname
|
|
(('foo', '=', ['/bar']), AppArmorException), # varname not starting with '@{'
|
|
(('foo', '=', ['/bar']), AppArmorException), # varname not starting with '@{'
|
|
|
|
(('@{foo}', '', ['/bar']), AppArmorBug), # mode not '=' or '+='
|
|
(('@{foo}', '-=', ['/bar']), AppArmorBug), # mode not '=' or '+='
|
|
(('@{foo}', ' ', ['/bar']), AppArmorBug), # mode not '=' or '+='
|
|
(('@{foo}', None, ['/bar']), AppArmorBug), # mode not '=' or '+='
|
|
|
|
(('@{foo}', '=', None), AppArmorBug), # values not a set
|
|
(('@{foo}', '=', set()), AppArmorException), # empty values
|
|
)
|
|
|
|
def _run_test(self, params, expected):
|
|
with self.assertRaises(expected):
|
|
VariableRule(*params)
|
|
|
|
def test_missing_params_1(self):
|
|
with self.assertRaises(TypeError):
|
|
VariableRule()
|
|
|
|
def test_missing_params_2(self):
|
|
with self.assertRaises(TypeError):
|
|
VariableRule('@{foo}')
|
|
|
|
def test_missing_params_3(self):
|
|
with self.assertRaises(TypeError):
|
|
VariableRule('@{foo}', '=')
|
|
|
|
def test_invalid_audit(self):
|
|
with self.assertRaises(AppArmorBug):
|
|
VariableRule('@{foo}', '=', '/bar', audit=True)
|
|
|
|
def test_invalid_deny(self):
|
|
with self.assertRaises(AppArmorBug):
|
|
VariableRule('@{foo}', '=', '/bar', deny=True)
|
|
|
|
def test_invalid_priority_1(self):
|
|
with self.assertRaises(AppArmorBug):
|
|
VariableRule('@{foo}', '=', '/bar', priority=98)
|
|
|
|
def test_invalid_priority_2(self):
|
|
with self.assertRaises(AppArmorBug):
|
|
VariableRule('@{foo}', '=', '/bar', priority=0)
|
|
|
|
|
|
class InvalidVariableTest(AATest):
|
|
def _check_invalid_rawrule(self, rawrule, matches_regex=False):
|
|
obj = None
|
|
self.assertEqual(VariableRule.match(rawrule), matches_regex)
|
|
with self.assertRaises(AppArmorException):
|
|
obj = VariableRule.create_instance(rawrule)
|
|
|
|
self.assertIsNone(obj, 'VariableRule handed back an object unexpectedly')
|
|
|
|
def test_invalid_missing_values(self):
|
|
self._check_invalid_rawrule('@{foo} = ', matches_regex=True) # missing values
|
|
|
|
def test_invalid_net_non_VariableRule(self):
|
|
self._check_invalid_rawrule('dbus,') # not a variable rule
|
|
|
|
|
|
class WriteVariableTestAATest(AATest):
|
|
tests = (
|
|
# raw rule clean rule
|
|
(' @{foo} = /bar ', '@{foo} = /bar'),
|
|
(' @{foo} = /bar # comment', '@{foo} = /bar'),
|
|
(' @{foo} = /bar ""', '@{foo} = "" /bar'),
|
|
(' @{foo} += /bar ', '@{foo} += /bar'),
|
|
(' @{foo} += /bar # comment', '@{foo} += /bar'),
|
|
(' @{foo} += /bar /baz', '@{foo} += /bar /baz'),
|
|
(' @{foo} += /bar /baz', '@{foo} += /bar /baz'),
|
|
(' @{foo} += /bar @{baz}', '@{foo} += /bar @{baz}'),
|
|
(' @{foo} += /bar @{baz}', '@{foo} += /bar @{baz}'),
|
|
)
|
|
|
|
def _run_test(self, rawrule, expected):
|
|
self.assertTrue(VariableRule.match(rawrule))
|
|
obj = VariableRule.create_instance(rawrule)
|
|
clean = obj.get_clean()
|
|
raw = obj.get_raw()
|
|
|
|
self.assertEqual(expected.strip(), clean, 'unexpected clean rule')
|
|
self.assertEqual(rawrule.strip(), raw, 'unexpected raw rule')
|
|
|
|
def test_write_manually_1(self):
|
|
obj = VariableRule('@{foo}', '=', {'/bar'})
|
|
|
|
expected = ' @{foo} = /bar'
|
|
|
|
self.assertEqual(expected, obj.get_clean(2), 'unexpected clean rule')
|
|
self.assertEqual(expected, obj.get_raw(2), 'unexpected raw rule')
|
|
|
|
def test_write_manually_2(self):
|
|
obj = VariableRule('@{foo}', '=', {'/bar', ''})
|
|
|
|
expected = ' @{foo} = "" /bar'
|
|
|
|
self.assertEqual(expected, obj.get_clean(2), 'unexpected clean rule')
|
|
self.assertEqual(expected, obj.get_raw(2), 'unexpected raw rule')
|
|
|
|
|
|
class VariableCoveredTest(AATest):
|
|
def _run_test(self, param, expected):
|
|
obj = VariableRule.create_instance(self.rule)
|
|
check_obj = VariableRule.create_instance(param)
|
|
|
|
self.assertTrue(VariableRule.match(param))
|
|
|
|
self.assertEqual(obj.is_equal(check_obj), expected[0], 'Mismatch in is_equal, expected {}'.format(expected[0]))
|
|
self.assertEqual(obj.is_equal(check_obj, True), expected[1], 'Mismatch in is_equal/strict, expected {}'.format(expected[1]))
|
|
|
|
self.assertEqual(obj.is_covered(check_obj), expected[2], 'Mismatch in is_covered, expected {}'.format(expected[2]))
|
|
self.assertEqual(obj.is_covered(check_obj, True, True), expected[3], 'Mismatch in is_covered/exact, expected {}'.format(expected[3]))
|
|
|
|
|
|
class VariableCoveredTest_01(VariableCoveredTest):
|
|
rule = '@{foo} = /bar'
|
|
|
|
tests = (
|
|
# rule equal strict equal covered covered exact
|
|
(' @{foo} = /bar', (True, True, True, True)),
|
|
(' @{foo} += /bar', (False, False, False, False)),
|
|
(' @{foo} = /bar # comment', (True, False, True, True)),
|
|
(' @{foo} += /bar # comment', (False, False, False, False)),
|
|
(' @{foo} = /baz /bar', (False, False, False, False)),
|
|
(' @{foo} += /baz /bar', (False, False, False, False)),
|
|
(' @{foo} = /baz /bar # cmt', (False, False, False, False)),
|
|
(' @{foo} += /baz /bar # cmt', (False, False, False, False)),
|
|
(' @{bar} = /bar', (False, False, False, False)), # different variable name
|
|
)
|
|
|
|
|
|
class VariableCoveredTest_02(VariableCoveredTest):
|
|
rule = '@{foo} = /bar /baz'
|
|
|
|
tests = (
|
|
# rule equal strict equal covered covered exact
|
|
(' @{foo} = /bar /baz', (True, True, True, True)),
|
|
(' @{foo} += /bar /baz', (False, False, False, False)),
|
|
(' @{foo} = /bar /baz # cmt', (True, False, True, True)),
|
|
(' @{foo} += /bar /baz # cmt', (False, False, False, False)),
|
|
# changed order of values
|
|
(' @{foo} = /baz /bar', (True, False, True, True)),
|
|
(' @{foo} += /baz /bar', (False, False, False, False)),
|
|
(' @{foo} = /baz /bar # cmt', (True, False, True, True)),
|
|
(' @{foo} += /baz /bar # cmt', (False, False, False, False)),
|
|
# only one value
|
|
(' @{foo} = /bar', (False, False, True, True)),
|
|
(' @{foo} += /bar', (False, False, False, False)),
|
|
(' @{foo} = /bar # comment', (False, False, True, True)),
|
|
(' @{foo} += /bar # comment', (False, False, False, False)),
|
|
(' @{bar} = /bar', (False, False, False, False)), # different variable name
|
|
)
|
|
|
|
|
|
class VariableCoveredTest_Invalid(AATest):
|
|
# def test_borked_obj_is_covered_1(self):
|
|
# obj = VariableRule.create_instance('@{foo} = /bar')
|
|
#
|
|
# testobj = VariableRule('@{foo}', '=', '/bar')
|
|
# testobj.mode = ''
|
|
#
|
|
# with self.assertRaises(AppArmorBug):
|
|
# obj.is_covered(testobj)
|
|
|
|
def test_borked_obj_is_covered_2(self):
|
|
obj = VariableRule.create_instance('@{foo} = /bar')
|
|
|
|
testobj = VariableRule('@{foo}', '=', {'/bar'})
|
|
testobj.values = ''
|
|
|
|
with self.assertRaises(AppArmorBug):
|
|
obj.is_covered(testobj)
|
|
|
|
def test_invalid_is_covered_3(self):
|
|
raw_rule = '@{foo} = /bar'
|
|
|
|
class SomeOtherClass(VariableRule):
|
|
pass
|
|
|
|
obj = VariableRule.create_instance(raw_rule)
|
|
testobj = SomeOtherClass.create_instance(raw_rule) # different type
|
|
with self.assertRaises(AppArmorBug):
|
|
obj.is_covered(testobj)
|
|
|
|
def test_invalid_is_equal(self):
|
|
raw_rule = '@{foo} = /bar'
|
|
|
|
class SomeOtherClass(VariableRule):
|
|
pass
|
|
|
|
obj = VariableRule.create_instance(raw_rule)
|
|
testobj = SomeOtherClass.create_instance(raw_rule) # different type
|
|
with self.assertRaises(AppArmorBug):
|
|
obj.is_equal(testobj)
|
|
|
|
|
|
class VariableLogprofHeaderTest(AATest):
|
|
tests = (
|
|
('@{foo} = /bar', [_('Variable'), '@{foo} = /bar']),
|
|
)
|
|
|
|
def _run_test(self, params, expected):
|
|
obj = VariableRule.create_instance(params)
|
|
self.assertEqual(obj.logprof_header(), expected)
|
|
|
|
# --- tests for VariableRuleset --- #
|
|
|
|
|
|
class VariableRulesTest(AATest):
|
|
def test_empty_ruleset(self):
|
|
ruleset = VariableRuleset()
|
|
ruleset_2 = VariableRuleset()
|
|
self.assertEqual([], ruleset.get_raw(2))
|
|
self.assertEqual([], ruleset.get_clean(2))
|
|
self.assertEqual([], ruleset_2.get_raw(2))
|
|
self.assertEqual([], ruleset_2.get_clean(2))
|
|
self.assertEqual({'=': {}, '+=': {}}, ruleset_2.get_merged_variables())
|
|
|
|
def test_ruleset_1(self):
|
|
ruleset = VariableRuleset()
|
|
rules = (
|
|
'@{foo} = /bar',
|
|
'@{baz}= /asdf',
|
|
'@{foo} += /whatever',
|
|
'@{foo} += /morestuff',
|
|
)
|
|
|
|
expected_raw = [
|
|
'@{foo} = /bar',
|
|
'@{baz}= /asdf',
|
|
'@{foo} += /whatever',
|
|
'@{foo} += /morestuff',
|
|
'',
|
|
]
|
|
|
|
expected_clean = [
|
|
'@{baz} = /asdf',
|
|
'@{foo} += /morestuff',
|
|
'@{foo} += /whatever',
|
|
'@{foo} = /bar',
|
|
'',
|
|
]
|
|
|
|
expected_clean_unsorted = [
|
|
'@{foo} = /bar',
|
|
'@{baz} = /asdf',
|
|
'@{foo} += /whatever',
|
|
'@{foo} += /morestuff',
|
|
'',
|
|
]
|
|
|
|
expected_merged = {
|
|
'=': {
|
|
'@{foo}': {'/bar'},
|
|
'@{baz}': {'/asdf'},
|
|
},
|
|
'+=': {
|
|
'@{foo}': {'/whatever', '/morestuff'},
|
|
}
|
|
}
|
|
|
|
for rule in rules:
|
|
ruleset.add(VariableRule.create_instance(rule))
|
|
|
|
self.assertEqual(expected_raw, ruleset.get_raw())
|
|
self.assertEqual(expected_clean, ruleset.get_clean())
|
|
self.assertEqual(expected_clean_unsorted, ruleset.get_clean_unsorted())
|
|
self.assertEqual(expected_merged, ruleset.get_merged_variables())
|
|
|
|
def test_ruleset_overwrite(self):
|
|
ruleset = VariableRuleset()
|
|
|
|
ruleset.add(VariableRule.create_instance('@{foo} = /bar'))
|
|
with self.assertRaises(AppArmorException):
|
|
ruleset.add(VariableRule.create_instance('@{foo} = /asdf')) # attempt to redefine @{foo}
|
|
self.assertEqual({'=': {'@{foo}': {'/bar'}}, '+=': {}}, ruleset.get_merged_variables())
|
|
|
|
|
|
class VariableGlobTestAATest(AATest):
|
|
def setUp(self):
|
|
self.ruleset = VariableRuleset()
|
|
|
|
# def test_glob_1(self):
|
|
# with self.assertRaises(NotImplementedError):
|
|
# self.ruleset.get_glob('@{foo} = /bar')
|
|
|
|
def test_glob_ext(self):
|
|
with self.assertRaises(NotImplementedError):
|
|
# get_glob_ext is not available for change_profile rules
|
|
self.ruleset.get_glob_ext('@{foo} = /bar')
|
|
|
|
|
|
class VariableDeleteTestAATest(AATest):
|
|
pass
|
|
|
|
|
|
setup_all_loops(__name__)
|
|
if __name__ == '__main__':
|
|
unittest.main(verbosity=1)
|