mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-22 10:07:12 +00:00
Code Issues Releases Wiki Activity
apparmor/utils/test/test-include.py
John Johansen c0fcd1698b utils: add support for priority rule prefix 
Add basic support for the priority rules prefix. This patch does not
allow the utils to set or suggest priorities. It allows parsing and
retaining of the priority prefix if it already exists on rules and
checking if it's in the supported range.

Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-05-05 14:54:22 -03:00

508 lines
23 KiB
Python
Raw Blame History

#!/usr/bin/python3
# ----------------------------------------------------------------------
# Copyright (C) 2020 Christian Boltz <apparmor@cboltz.de>
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of version 2 of the GNU General Public
# License as published by the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# ----------------------------------------------------------------------
import os
import shutil
import unittest
from collections import namedtuple
from apparmor.common import AppArmorBug, AppArmorException
from apparmor.rule.include import IncludeRule, IncludeRuleset
from apparmor.translations import init_translation
from common_test import AATest, setup_all_loops, write_file
_ = init_translation()
exp = namedtuple(
'exp', ( # 'audit', 'allow_keyword', 'deny',
'comment', 'path', 'ifexists', 'ismagic'))
# --- tests for single IncludeRule --- #
class IncludeTest(AATest):
def _compare_obj(self, obj, expected):
self.assertEqual(False, obj.allow_keyword) # not supported in include rules, expected to be always False
self.assertEqual(False, obj.audit) # not supported in include rules, expected to be always False
self.assertEqual(False, obj.deny) # not supported in include rules, expected to be always False
self.assertEqual(None, obj.priority) # not supported in include rules, expected to be always None
self.assertEqual(expected.comment, obj.comment)
self.assertEqual(expected.path, obj.path)
self.assertEqual(expected.ifexists, obj.ifexists)
self.assertEqual(expected.ismagic, obj.ismagic)
class IncludeTestParse(IncludeTest):
tests = (
# IncludeRule object comment path if exists ismagic
# #include
('#include <abstractions/base>', exp('', 'abstractions/base', False, True)), # magic path
('#include <abstractions/base> # comment', exp(' # comment', 'abstractions/base', False, True)),
('#include<abstractions/base>#comment', exp(' #comment', 'abstractions/base', False, True)),
(' #include <abstractions/base> ', exp('', 'abstractions/base', False, True)),
('#include "/foo/bar"', exp('', '/foo/bar', False, False)), # absolute path
('#include "/foo/bar" # comment', exp(' # comment', '/foo/bar', False, False)),
('#include "/foo/bar"#comment', exp(' #comment', '/foo/bar', False, False)),
(' #include "/foo/bar" ', exp('', '/foo/bar', False, False)),
# include (without #)
('include <abstractions/base>', exp('', 'abstractions/base', False, True)), # magic path
('include <abstractions/base> # comment', exp(' # comment', 'abstractions/base', False, True)),
('include<abstractions/base>#comment', exp(' #comment', 'abstractions/base', False, True)),
(' include <abstractions/base> ', exp('', 'abstractions/base', False, True)),
('include "/foo/bar"', exp('', '/foo/bar', False, False)), # absolute path
('include "/foo/bar" # comment', exp(' # comment', '/foo/bar', False, False)),
('include "/foo/bar"#comment', exp(' #comment', '/foo/bar', False, False)),
(' include "/foo/bar" ', exp('', '/foo/bar', False, False)),
# #include if exists
('#include if exists <abstractions/base>', exp('', 'abstractions/base', True, True)), # magic path
('#include if exists <abstractions/base> # comment', exp(' # comment', 'abstractions/base', True, True)),
('#include if exists<abstractions/base>#comment', exp(' #comment', 'abstractions/base', True, True)),
(' #include if exists<abstractions/base> ', exp('', 'abstractions/base', True, True)),
('#include if exists "/foo/bar"', exp('', '/foo/bar', True, False)), # absolute path
('#include if exists "/foo/bar" # comment', exp(' # comment', '/foo/bar', True, False)),
('#include if exists "/foo/bar"#comment', exp(' #comment', '/foo/bar', True, False)),
(' #include if exists "/foo/bar" ', exp('', '/foo/bar', True, False)),
# include if exists (without #)
('include if exists <abstractions/base>', exp('', 'abstractions/base', True, True)), # magic path
('include if exists <abstractions/base> # comment', exp(' # comment', 'abstractions/base', True, True)),
('include if exists<abstractions/base>#comment', exp(' #comment', 'abstractions/base', True, True)),
(' include if exists<abstractions/base> ', exp('', 'abstractions/base', True, True)),
('include if exists "/foo/bar"', exp('', '/foo/bar', True, False)), # absolute path
('include if exists "/foo/bar" # comment', exp(' # comment', '/foo/bar', True, False)),
('include if exists "/foo/bar"#comment', exp(' #comment', '/foo/bar', True, False)),
(' include if exists "/foo/bar" ', exp('', '/foo/bar', True, False)),
)
def _run_test(self, rawrule, expected):
self.assertTrue(IncludeRule.match(rawrule))
obj = IncludeRule.create_instance(rawrule)
self.assertEqual(rawrule.strip(), obj.raw_rule)
self._compare_obj(obj, expected)
class IncludeTestParseInvalid(IncludeTest):
tests = (
# (' some #include if exists <abstractions/base>', AppArmorException),
# (' /etc/fstab r,', AppArmorException),
# ('/usr/include r,', AppArmorException),
# ('/include r,', AppArmorException),
)
def _run_test(self, rawrule, expected):
self.assertTrue(IncludeRule.match(rawrule)) # the above invalid rules still match the main regex!
with self.assertRaises(expected):
IncludeRule.create_instance(rawrule)
# class IncludeTestParseFromLog(IncludeTest): # we'll never have log events for includes
class IncludeFromInit(IncludeTest):
tests = (
# IncludeRule object ifexists ismagic comment path ifexists ismagic
(IncludeRule('abstractions/base', False, False), exp('', 'abstractions/base', False, False)),
(IncludeRule('foo', True, False), exp('', 'foo', True, False)),
(IncludeRule('bar', False, True), exp('', 'bar', False, True)),
(IncludeRule('baz', True, True), exp('', 'baz', True, True)),
(IncludeRule('comment', False, False, comment='# cmt'), exp('# cmt', 'comment', False, False)),
)
def _run_test(self, obj, expected):
self._compare_obj(obj, expected)
class InvalidIncludeInit(AATest):
tests = (
# init params expected exception
((False, False, False), AppArmorBug), # wrong type for path
(('', False, False), AppArmorBug), # empty path
((None, False, False), AppArmorBug), # wrong type for path
# ((' ', False, False), AppArmorBug), # whitespace-only path
(('foo', None, False), AppArmorBug), # wrong type for ifexists
(('foo', '', False), AppArmorBug), # wrong type for ifexists
(('foo', False, None), AppArmorBug), # wrong type for ismagic
(('foo', False, ''), AppArmorBug), # wrong type for ismagic
)
def _run_test(self, params, expected):
with self.assertRaises(expected):
IncludeRule(*params)
def test_missing_params_1(self):
with self.assertRaises(TypeError):
IncludeRule()
def test_missing_params_2(self):
with self.assertRaises(TypeError):
IncludeRule('foo')
def test_missing_params_3(self):
with self.assertRaises(TypeError):
IncludeRule('foo', False)
def test_audit_true(self):
with self.assertRaises(AppArmorBug):
IncludeRule('foo', False, False, audit=True)
def test_deny_true(self):
with self.assertRaises(AppArmorBug):
IncludeRule('foo', False, False, deny=True)
def test_priority_true(self):
with self.assertRaises(AppArmorBug):
IncludeRule('foo', False, False, priority=0)
class InvalidIncludeTest(AATest):
def _check_invalid_rawrule(self, rawrule, matches_regex=False):
obj = None
self.assertEqual(IncludeRule.match(rawrule), matches_regex)
with self.assertRaises(AppArmorException):
obj = IncludeRule.create_instance(rawrule)
self.assertIsNone(obj, 'IncludeRule handed back an object unexpectedly')
def test_invalid_include_missing_path(self):
self._check_invalid_rawrule('include', matches_regex=True) # missing path
def test_invalid_non_IncludeRule(self):
self._check_invalid_rawrule('dbus,') # not a include rule
# def test_empty_data_1(self):
# obj = IncludeRule('foo', False, False)
# obj.path = ''
# # no path set
# with self.assertRaises(AppArmorBug):
# obj.get_clean(1)
class WriteIncludeTestAATest(AATest):
def _run_test(self, rawrule, expected):
self.assertTrue(IncludeRule.match(rawrule))
obj = IncludeRule.create_instance(rawrule)
clean = obj.get_clean()
raw = obj.get_raw()
self.assertEqual(expected.strip(), clean, 'unexpected clean rule')
self.assertEqual(rawrule.strip(), raw, 'unexpected raw rule')
tests = (
# (raw rule, clean rule)
(' include <foo> ', 'include <foo>'),
# (' include foo ', 'include "foo"'), # several test cases disabled due to implementation restrictions, see re_match_include_parse()
# (' include "foo" ', 'include "foo"'),
# (' include /foo ', 'include "/foo"'),
(' include "/foo" ', 'include "/foo"'),
(' include <foo> # bar ', 'include <foo> # bar'),
# (' include foo # bar ', 'include "foo" # bar'),
# (' include "foo" # bar ', 'include "foo" # bar'),
# (' include /foo # bar ', 'include "/foo" # bar'),
(' include "/foo" # bar ', 'include "/foo" # bar'),
(' include if exists <foo> ', 'include if exists <foo>'),
# (' include if exists foo ', 'include if exists "foo"'),
# (' include if exists "foo" ', 'include if exists "foo"'),
# (' include if exists /foo ', 'include if exists "/foo"'),
(' include if exists "/foo" ', 'include if exists "/foo"'),
# and the same again with #include...
(' #include <foo> ', 'include <foo>'),
# (' #include foo ', 'include "foo"'),
# (' #include "foo" ', 'include "foo"'),
# (' #include /foo ', 'include "/foo"'),
(' #include "/foo" ', 'include "/foo"'),
(' #include <foo> # bar ', 'include <foo> # bar'),
# (' #include foo # bar ', 'include "foo" # bar'),
# (' #include "foo" # bar ', 'include "foo" # bar'),
# (' #include /foo # bar ', 'include "/foo" # bar'),
(' #include "/foo" # bar ', 'include "/foo" # bar'),
(' #include if exists <foo> ', 'include if exists <foo>'),
# (' #include if exists foo ', 'include if exists "foo"'),
# (' #include if exists "foo" ', 'include if exists "foo"'),
# (' #include if exists /foo ', 'include if exists "/foo"'),
(' #include if exists "/foo" ', 'include if exists "/foo"'),
)
def test_write_manually(self):
obj = IncludeRule('abs/foo', False, True, comment=' # cmt')
expected = ' include <abs/foo> # cmt'
self.assertEqual(expected, obj.get_clean(2), 'unexpected clean rule')
self.assertEqual(expected, obj.get_raw(2), 'unexpected raw rule')
class IncludeCoveredTest(AATest):
def _run_test(self, param, expected):
obj = IncludeRule.create_instance(self.rule)
check_obj = IncludeRule.create_instance(param)
self.assertTrue(IncludeRule.match(param))
self.assertEqual(obj.is_equal(check_obj), expected[0], 'Mismatch in is_equal, expected {}'.format(expected[0]))
self.assertEqual(obj.is_equal(check_obj, True), expected[1], 'Mismatch in is_equal/strict, expected {}'.format(expected[1]))
self.assertEqual(obj.is_covered(check_obj), expected[2], 'Mismatch in is_covered, expected {}'.format(expected[2]))
self.assertEqual(obj.is_covered(check_obj, True, True), expected[3], 'Mismatch in is_covered/exact, expected {}'.format(expected[3]))
class IncludeCoveredTest_01(IncludeCoveredTest):
rule = 'include <foo>'
tests = (
# rule equal strict equal covered covered exact
('include <foo>', (True, True, True, True)),
('#include <foo>', (True, False, True, True)),
('include if exists <foo>', (False, False, True, True)),
('#include if exists <foo>', (False, False, True, True)),
('include <foobar>', (False, False, False, False)),
# ('include "foo"', (False, False, False, False)), # disabled due to implementation restrictions, see re_match_include_parse()
# ('include if exists "foo"', (False, False, False, False)),
)
class IncludeCoveredTest_02(IncludeCoveredTest):
rule = 'include if exists <foo>'
tests = (
# rule equal strict equal covered covered exact
('include <foo>', (False, False, False, False)),
('#include <foo>', (False, False, False, False)),
('#include if exists <foo>', (True, False, True, True)),
('include <foobar>', (False, False, False, False)),
# ('include "foo"', (False, False, False, False)), # disabled due to implementation restrictions, see re_match_include_parse()
# ('include if exists "foo"', (False, False, False, False)),
)
class IncludeCoveredTest_Invalid(AATest):
# def test_borked_obj_is_covered_1(self):
# obj = IncludeRule.create_instance('include <foo>')
#
# testobj = IncludeRule('foo', True, True)
# testobj.path = ''
#
# with self.assertRaises(AppArmorBug):
# obj.is_covered(testobj)
def test_invalid_is_covered(self):
raw_rule = 'include <abstractions/base>'
class SomeOtherClass(IncludeRule):
pass
obj = IncludeRule.create_instance(raw_rule)
testobj = SomeOtherClass.create_instance(raw_rule) # different type
with self.assertRaises(AppArmorBug):
obj.is_covered(testobj)
def test_invalid_is_equal(self):
raw_rule = 'include <abstractions/base>'
class SomeOtherClass(IncludeRule):
pass
obj = IncludeRule.create_instance(raw_rule)
testobj = SomeOtherClass.create_instance(raw_rule) # different type
with self.assertRaises(AppArmorBug):
obj.is_equal(testobj)
class IncludeLogprofHeaderTest(AATest):
tests = (
('include <abstractions/base>', [_('Include'), 'include <abstractions/base>']),
('include "/what/ever"', [_('Include'), 'include "/what/ever"']),
)
def _run_test(self, params, expected):
obj = IncludeRule.create_instance(params)
self.assertEqual(obj.logprof_header(), expected)
class IncludeFullPathsTest(AATest):
def AASetup(self):
self.createTmpdir()
# copy the local profiles to the test directory
self.profile_dir = self.tmpdir + '/profiles'
shutil.copytree('../../profiles/apparmor.d/', self.profile_dir, symlinks=True)
inc_dir = os.path.join(self.profile_dir, 'abstractions/inc.d')
os.mkdir(inc_dir, 0o755)
write_file(inc_dir, 'incfoo', '/incfoo r,')
write_file(inc_dir, 'incbar', '/incbar r,')
write_file(inc_dir, 'README', '# README') # gets skipped
sub_dir = os.path.join(self.profile_dir, 'abstractions/inc.d/subdir') # gets skipped
os.mkdir(sub_dir, 0o755)
empty_dir = os.path.join(self.profile_dir, 'abstractions/empty.d')
os.mkdir(empty_dir, 0o755)
tests = (
# @@ will be replaced with self.profile_dir
('include <abstractions/base>', ('@@/abstractions/base',)),
# ('include "foo"', ('@@/foo',)), # TODO: adjust logic to honor quoted vs. magic paths (and allow quoted relative paths in re_match_include_parse())
('include "/foo/bar"', ('/foo/bar',)),
('include <abstractions/inc.d>', ('@@/abstractions/inc.d/incbar', '@@/abstractions/inc.d/incfoo')),
('include <abstractions/empty.d>', ()),
('include <abstractions/not_found>', ('@@/abstractions/not_found',)),
('include if exists <abstractions/not_found>', ()),
)
def _run_test(self, params, expected):
exp2 = []
for path in expected:
exp2.append(path.replace('@@', self.profile_dir))
obj = IncludeRule.create_instance(params)
self.assertEqual(obj.get_full_paths(self.profile_dir), exp2)
# --- tests for IncludeRuleset --- #
class IncludeRulesTest(AATest):
def AASetup(self):
self.createTmpdir()
# copy the local profiles to the test directory
self.profile_dir = self.tmpdir + '/profiles'
shutil.copytree('../../profiles/apparmor.d/', self.profile_dir, symlinks=True)
write_file(self.profile_dir, 'baz', '/baz r,')
def test_empty_ruleset(self):
ruleset = IncludeRuleset()
ruleset_2 = IncludeRuleset()
self.assertEqual([], ruleset.get_raw(2))
self.assertEqual([], ruleset.get_clean(2))
self.assertEqual([], ruleset_2.get_raw(2))
self.assertEqual([], ruleset_2.get_clean(2))
self.assertEqual([], ruleset_2.get_clean_unsorted(2))
self.assertEqual([], ruleset.get_all_full_paths(self.profile_dir))
def test_ruleset_1(self):
ruleset = IncludeRuleset()
rules = (
' include <foo> ',
' #include "/bar" ',
)
expected_raw = [
'include <foo>',
'#include "/bar"',
'',
]
expected_clean = [
'include "/bar"',
'include <foo>',
'',
]
expected_clean_unsorted = [
'include <foo>',
'include "/bar"',
'',
]
expected_fullpaths = [
os.path.join(self.profile_dir, 'foo'),
'/bar'
]
for rule in rules:
ruleset.add(IncludeRule.create_instance(rule))
self.assertEqual(expected_raw, ruleset.get_raw())
self.assertEqual(expected_clean, ruleset.get_clean())
self.assertEqual(expected_clean_unsorted, ruleset.get_clean_unsorted())
self.assertEqual(expected_fullpaths, ruleset.get_all_full_paths(self.profile_dir))
def test_ruleset_2(self):
ruleset = IncludeRuleset()
rules = (
' include if exists <baz> ',
' include <foo> ',
' #include "/bar" ',
'#include if exists "/asdf" ',
)
expected_raw = [
'include if exists <baz>',
'include <foo>',
'#include "/bar"',
'#include if exists "/asdf"',
'',
]
expected_clean = [
'include "/bar"',
'include <foo>',
'include if exists "/asdf"',
'include if exists <baz>',
'',
]
expected_clean_unsorted = [
'include if exists <baz>',
'include <foo>',
'include "/bar"',
'include if exists "/asdf"',
'',
]
expected_fullpaths = [
os.path.join(self.profile_dir, 'baz'),
os.path.join(self.profile_dir, 'foo'),
'/bar',
]
for rule in rules:
ruleset.add(IncludeRule.create_instance(rule))
self.assertEqual(expected_raw, ruleset.get_raw())
self.assertEqual(expected_clean, ruleset.get_clean())
self.assertEqual(expected_clean_unsorted, ruleset.get_clean_unsorted())
self.assertEqual(expected_fullpaths, ruleset.get_all_full_paths(self.profile_dir))
class IncludeGlobTestAATest(AATest):
def setUp(self):
self.maxDiff = None
self.ruleset = IncludeRuleset()
# def test_glob(self):
# with self.assertRaises(NotImplementedError):
# # get_glob_ext is not available for include rules
# self.ruleset.get_glob('include send set=int,')
def test_glob_ext(self):
with self.assertRaises(NotImplementedError):
# get_glob_ext is not available for include rules
self.ruleset.get_glob_ext('include send set=int,')
# class IncludeDeleteTestAATest(AATest):
# pass
setup_all_loops(__name__)
if __name__ == '__main__':
unittest.main(verbosity=1)
Reference in New Issue View Git Blame Copy Permalink