2 * Copyright (c) 2016-2017 Samsung Electronics Co., Ltd All Rights Reserved
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
8 * http://www.apache.org/licenses/LICENSE-2.0
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
17 // cstdlibg has to be included before attr/xattr
19 #include <attr/xattr.h>
24 #include <sys/capability.h>
25 #include <sys/smack.h>
26 #include <sys/types.h>
29 #include <cynara-admin.h>
31 #include <app_install_helper.h>
32 #include <cynara_test_admin.h>
33 #include <dpl/test/test_runner.h>
34 #include <label_generator.h>
35 #include <message_pipe.h>
36 #include <policy_configuration.h>
37 #include <scoped_installer.h>
38 #include <scoped_label.h>
39 #include <service_manager.h>
41 #include <sm_commons.h>
42 #include <sm_request.h>
43 #include <synchronization_pipe.h>
44 #include <temp_test_user.h>
45 #include <tests_common.h>
46 #include <tzplatform.h>
49 using namespace SecurityManagerTest;
52 std::vector<std::string> merge(const std::vector<std::string> &one, const std::vector<std::string> &two) {
53 std::vector<std::string> sum;
54 sum.reserve(one.size() + two.size());
55 sum.insert(sum.end(), one.begin(), one.end());
56 sum.insert(sum.end(), two.begin(), two.end());
61 RUNNER_TEST_GROUP_INIT(SECURITY_MANAGER)
63 RUNNER_TEST(security_manager_01a_app_double_install_double_uninstall)
65 AppInstallHelper app("sm_test_01a_app");
67 ScopedInstaller appInstall(app);
68 check_app_after_install(app.getAppId(), app.getPkgId());
70 ScopedInstaller appInstall2(app);
71 check_app_after_install(app.getAppId(), app.getPkgId());
73 check_app_after_uninstall(app.getAppId(), app.getPkgId());
77 RUNNER_TEST(security_manager_01b_app_double_install_wrong_pkg_id)
79 AppInstallHelper app("sm_test_01b");
81 ScopedInstaller appInstall(app);
83 InstallRequest requestInst2;
84 requestInst2.setAppId(app.getAppId());
85 requestInst2.setPkgId(app.getPkgId() + "_wrong");
87 Api::install(requestInst2, SECURITY_MANAGER_ERROR_INPUT_PARAM);
89 check_app_after_install(app.getAppId(), app.getPkgId());
91 check_app_after_uninstall(app.getAppId(), app.getPkgId());
94 RUNNER_TEST(security_manager_01c_app_uninstall_wrong_pkg_id)
96 AppInstallHelper app("sm_test_01c");
97 ScopedInstaller appInstall(app);
99 check_app_after_install(app.getAppId(), app.getPkgId());
101 InstallRequest requestUninst;
102 requestUninst.setAppId(app.getAppId());
103 requestUninst.setPkgId(app.getPkgId() + "_wrong_pkg_id");
105 Api::uninstall(requestUninst, SECURITY_MANAGER_ERROR_NO_SUCH_OBJECT);
109 * This test uses files installed with security-tests package
111 RUNNER_TEST(security_manager_01d_app_install_complicated_dir_tree)
113 const std::string appId = "sm_test_01d_app_id_full";
114 const std::string pkgId = "sm_test_01d_pkg_id_full";
116 const std::string rootDir = TzPlatformConfig::globalAppDir() + "/" + pkgId + "/";
117 const std::string privateDir = rootDir + "app_dir/";
118 const std::string privateRODir = rootDir + "app_dir_ro/";
119 const std::string publicRODir = rootDir + "app_dir_public_ro/";
120 const std::string sharedRODir = rootDir + "app_dir_rw_others_ro/";
122 int result = nftw(rootDir.c_str(), &nftw_remove_labels, FTW_MAX_FDS, FTW_PHYS);
123 RUNNER_ASSERT_MSG(result == 0, "Unable to clean Smack labels in " << rootDir);
125 InstallRequest requestInst;
126 requestInst.setAppId(appId);
127 requestInst.setPkgId(pkgId);
128 requestInst.addPath(privateDir, SECURITY_MANAGER_PATH_RW);
129 requestInst.addPath(privateRODir, SECURITY_MANAGER_PATH_RO);
130 requestInst.addPath(publicRODir, SECURITY_MANAGER_PATH_PUBLIC_RO);
131 requestInst.addPath(sharedRODir, SECURITY_MANAGER_PATH_OWNER_RW_OTHER_RO);
132 Api::install(requestInst);
134 std::unique_ptr<InstallRequest, std::function<void(InstallRequest*)>> appCleanup(&requestInst,
135 [](InstallRequest *req) {
136 Api::uninstall(*req);
139 check_path(privateDir, generatePathRWLabel(pkgId));
140 check_path(privateRODir, generatePathROLabel(pkgId), false);
141 check_path(publicRODir, getPublicPathLabel());
142 check_path(sharedRODir, generatePathSharedROLabel(pkgId));
145 RUNNER_TEST(security_manager_02_app_install_uninstall_full)
147 PolicyConfiguration policy;
148 PolicyConfiguration::PrivGroupMap privGroupMap = policy.getPrivGroupMap();
150 RUNNER_ASSERT_MSG(privGroupMap.size() >= 4, "Failed to get policy of a suitable size");
152 privileges_t allowedPrivs;
153 privileges_t someDeniedPrivs;
156 for (auto const &it: privGroupMap) {
158 allowedPrivs.push_back(it.first);
159 else if (counter < 4)
160 someDeniedPrivs.push_back(it.first);
166 AppInstallHelper app("sm_test_02");
167 app.createPrivateDir();
168 app.createPrivateRODir();
169 app.createPublicDir();
170 app.createSharedRODir();
171 app.addPrivileges(allowedPrivs);
173 ScopedInstaller appInstall(app);
175 check_app_after_install(app.getAppId(), app.getPkgId(),
176 app.getPrivilegesNames(), someDeniedPrivs);
178 check_path(app.getPrivateDir(), generatePathRWLabel(app.getPkgId()));
179 check_path(app.getPrivateRODir(), generatePathROLabel(app.getPkgId()), false);
180 check_path(app.getPublicDir(), getPublicPathLabel());
181 check_path(app.getSharedRODir(), generatePathSharedROLabel(app.getPkgId()));
184 check_app_after_uninstall(app.getAppId(), app.getPkgId(), app.getPrivilegesNames());
187 RUNNER_CHILD_TEST_SMACK(security_manager_03_set_label_from_appid)
189 std::string expectedSockLabel = "labelExpectedOnlyFromSocket";
191 AppInstallHelper app("sm_test_03a");
192 std::string expectedProcLabel = generateProcessLabel(app.getAppId(), app.getPkgId());
194 const auto sockaddr = UDSHelpers::makeAbstractAddress("sm_test_03a.socket");
195 int sock = UDSHelpers::createServer(&sockaddr);
196 SockUniquePtr sockPtr(&sock);
198 //Set socket label to something different than expeced process label
199 int result = smack_set_label_for_file(*sockPtr, XATTR_NAME_SMACKIPIN, expectedSockLabel.c_str());
200 RUNNER_ASSERT_ERRNO_MSG(result == 0,
201 "Can't set socket label. Result: " << result);
202 result = smack_set_label_for_file(*sockPtr, XATTR_NAME_SMACKIPOUT, expectedSockLabel.c_str());
203 RUNNER_ASSERT_ERRNO_MSG(result == 0,
204 "Can't set socket label. Result: " << result);
206 ScopedInstaller appInstall(app);
209 RUNNER_ASSERT_ERRNO_MSG(pid >= 0, "Fork failed");
210 if (pid == 0) { // child
211 Api::setProcessLabel(app.getAppId());
213 char *label = nullptr;
215 result = smack_new_label_from_file(*sockPtr, XATTR_NAME_SMACKIPIN, &label);
216 RUNNER_ASSERT_ERRNO_MSG(result != -1, "smack_new_label_from_file failed: " << label);
217 labelPtr.reset(label);
218 result = expectedSockLabel.compare(label);
219 RUNNER_ASSERT_MSG(result == 0, "Socket label is incorrect. Expected: " <<
220 expectedProcLabel << " Actual: " << label);
222 result = smack_new_label_from_file(*sockPtr, XATTR_NAME_SMACKIPOUT, &label);
223 RUNNER_ASSERT_ERRNO_MSG(result != -1, "smack_new_label_from_file failed: " << label);
224 labelPtr.reset(label);
225 result = expectedSockLabel.compare(label);
226 RUNNER_ASSERT_MSG(result == 0, "Socket label is incorrect. Expected: " <<
227 expectedProcLabel << " Actual: " << label);
229 result = smack_new_label_from_self(&label);
230 RUNNER_ASSERT_MSG(result >= 0,
231 " Error getting current process label");
232 RUNNER_ASSERT_MSG(label != nullptr,
233 " Process label is not set");
234 labelPtr.reset(label);
236 result = expectedProcLabel.compare(label);
237 RUNNER_ASSERT_MSG(result == 0,
238 " Process label is incorrect. Expected: \"" << expectedProcLabel <<
239 "\" Actual: \"" << label << "\"");
245 RUNNER_CHILD_TEST(security_manager_04a_app_install_uninstall_by_app_user_for_self)
247 const std::vector<std::string> allowedPrivs = {
248 "http://tizen.org/privilege/bluetooth",
249 "http://tizen.org/privilege/power"
251 const std::vector<std::string> someDeniedPrivs = {
252 "http://tizen.org/privilege/display",
253 "http://tizen.org/privilege/nfc"
256 TemporaryTestUser testUser("sm_test_04a_user_name", GUM_USERTYPE_NORMAL);
259 AppInstallHelper app("sm_test_04a", testUser.getUid());
260 app.addPrivileges(allowedPrivs);
262 RUNNER_ASSERT_ERRNO_MSG(drop_root_privileges(testUser.getUid(), testUser.getGid()) == 0,
263 "drop_root_privileges failed");
265 ScopedInstaller appInstall(app, false);
266 check_app_permissions(app.getAppId(), app.getPkgId(), testUser.getUidString(),
267 allowedPrivs, someDeniedPrivs);
269 check_app_permissions(app.getAppId(), app.getPkgId(), testUser.getUidString(),
270 {}, merge(allowedPrivs, someDeniedPrivs));
273 RUNNER_CHILD_TEST(security_manager_04b_app_install_by_root_for_app_user) {
274 const std::vector<std::string> allowedPrivs = {
275 "http://tizen.org/privilege/internet",
276 "http://tizen.org/privilege/led"
278 const std::vector<std::string> someDeniedPrivs = {
279 "http://tizen.org/privilege/location",
280 "http://tizen.org/privilege/notification"
283 TemporaryTestUser testUser("sm_test_04b_user_name", GUM_USERTYPE_NORMAL);
286 AppInstallHelper app("sm_test_04b", testUser.getUid());
287 app.addPrivileges(allowedPrivs);
290 ScopedInstaller appInstall(app);
291 check_app_permissions(app.getAppId(), app.getPkgId(), testUser.getUidString(),
292 allowedPrivs, someDeniedPrivs);
294 RUNNER_ASSERT_ERRNO_MSG(drop_root_privileges(testUser.getUid(), testUser.getGid()) == 0,
295 "drop_root_privileges failed");
297 check_app_permissions(app.getAppId(), app.getPkgId(), testUser.getUidString(),
298 {}, merge(allowedPrivs, someDeniedPrivs));
301 RUNNER_CHILD_TEST(security_manager_05_drop_process_capabilities)
304 CapsSetsUniquePtr caps_empty(cap_init());
305 auto caps = setCaps("all=eip");
306 Api::dropProcessPrivileges();
308 caps.reset(cap_get_proc());
309 RUNNER_ASSERT_MSG(caps, "can't get proc capabilities");
311 result = cap_compare(caps.get(), caps_empty.get());
312 RUNNER_ASSERT_MSG(result == 0,
313 "capabilities not dropped. Current: " << cap_to_text(caps.get(), NULL));
316 RUNNER_TEST(security_manager_06_install_app_offline)
318 ServiceManager("security-manager.service").stopService();
320 ServiceManager serviceManager("security-manager.socket");
321 serviceManager.stopService();
323 AppInstallHelper app("sm_test_06");
324 ScopedInstaller appInstall(app);
325 // TODO - check if app is installed properly
326 // start service before uninstall, offline mode doesn't support uninstall
327 serviceManager.startService();
328 appInstall.uninstallApp();
329 // TODO - check if app is uninstalled properly
332 RUNNER_TEST(security_manager_07a_user_add_app_install)
334 const std::vector<std::string> allowedPrivs = {
335 "http://tizen.org/privilege/internet",
336 "http://tizen.org/privilege/led"
338 const std::vector<std::string> someDeniedPrivs = {
339 "http://tizen.org/privilege/location",
340 "http://tizen.org/privilege/notification"
343 TemporaryTestUser testUser("sm_test_07a_user_name", GUM_USERTYPE_NORMAL);
346 AppInstallHelper app("sm_test_07a", testUser.getUid());
347 app.addPrivileges(allowedPrivs);
350 req.setAppId(app.getAppId());
351 req.setPkgId(app.getPkgId());
352 req.setUid(app.getUID());
353 for (const auto &priv: app.getPrivileges()) {
354 req.addPrivilege(priv);
358 check_app_permissions(app.getAppId(), app.getPkgId(), testUser.getUidString(),
359 allowedPrivs, someDeniedPrivs);
363 check_app_permissions(app.getAppId(), app.getPkgId(), testUser.getUidString(),
364 {}, merge(allowedPrivs, someDeniedPrivs));
366 // TODO - check if app is uninstalled
369 RUNNER_TEST(security_manager_07b_user_add_offline)
371 ServiceManager("security-manager.service").stopService();
373 ServiceManager serviceManager("security-manager.socket");
374 serviceManager.stopService();
376 TemporaryTestUser testUser("sm_test_07b_user_name", GUM_USERTYPE_NORMAL, true);
379 AppInstallHelper app("sm_test_07b", testUser.getUid());
380 ScopedInstaller appInstall(app);
382 serviceManager.startService();
383 check_app_after_install(app.getAppId(), app.getPkgId());
386 check_app_after_uninstall(app.getAppId(), app.getPkgId());
389 RUNNER_TEST(security_manager_08_user_double_add_double_remove)
391 std::vector<std::string> somePrivs = {
392 "http://tizen.org/privilege/internet", "http://tizen.org/privilege/led",
393 "http://tizen.org/privilege/location", "http://tizen.org/privilege/notification"
396 TemporaryTestUser testUser("sm_test_08_user_name", GUM_USERTYPE_NORMAL);
400 UserRequest addUserRequest;
401 addUserRequest.setUid(testUser.getUid());
402 addUserRequest.setUserType(SM_USER_TYPE_NORMAL);
403 Api::addUser(addUserRequest);
405 AppInstallHelper app("sm_test_08", testUser.getUid());
406 ScopedInstaller appInstall(app);
408 check_app_after_install(app.getAppId(), app.getPkgId());
409 check_app_permissions(app.getAppId(), app.getPkgId(), testUser.getUidString(), {}, somePrivs);
414 check_app_after_uninstall(app.getAppId(), app.getPkgId());
415 check_app_permissions(app.getAppId(), app.getPkgId(), testUser.getUidString(), {}, somePrivs);
418 UserRequest deleteUserRequest;
419 deleteUserRequest.setUid(testUser.getUid());
420 Api::deleteUser(deleteUserRequest);
423 RUNNER_TEST(security_manager_09_app_install_constraint_check)
425 auto install = [](const TemporaryTestUser& user,
431 enum lib_retcode expected,
432 bool uninstall = true)
434 InstallRequest request;
435 request.setAppId(appId);
436 request.setPkgId(pkgId);
437 request.setAppTizenVersion(version);
438 request.setAuthorId(author);
439 request.setUid(user.getUid());
442 Api::install(request, expected);
444 if(expected == SECURITY_MANAGER_SUCCESS && uninstall) {
445 Api::uninstall(request);
449 auto update = [](const TemporaryTestUser& user,
455 enum lib_retcode expected,
456 bool uninstall = true)
458 InstallRequest request;
459 request.setAppId(appId);
460 request.setPkgId(pkgId);
461 request.setAppTizenVersion(version);
462 request.setAuthorId(author);
463 request.setUid(user.getUid());
466 Api::update(request, expected);
468 if(expected == SECURITY_MANAGER_SUCCESS && uninstall) {
469 Api::uninstall(request);
473 std::vector<TemporaryTestUser> users = {
474 {"sm_test_09_user_name_0", GUM_USERTYPE_NORMAL, false},
475 {"sm_test_09_user_name_1", GUM_USERTYPE_NORMAL, false}
478 for(auto& gu : users)
481 const char *const pkgId[] = {"sm_test_09_pkg_id_0", "sm_test_09_pkg_id_1"};
482 const char *const appId[] = {"sm_test_09_app_id_0", "sm_test_09_app_id_1"};
483 const char *const version[] = {"sm_test_09_version_0", "sm_test_09_version_1"};
484 const char *const author[] = {"sm_test_09_author_0", "sm_test_09_author_1"};
485 bool hybrid[] = {false, true};
487 // uid_0, pkg_0, app_0, version_0, author_0, not hybrid
488 install(users[0], pkgId[0], appId[0], version[0], author[0], hybrid[0], SECURITY_MANAGER_SUCCESS, false);
489 // uid_1, pkg_0, app_0, version_0, author_0, not hybrid -> ok (different uid)
490 install(users[1], pkgId[0], appId[0], version[0], author[0], hybrid[0], SECURITY_MANAGER_SUCCESS);
491 // uid_0, pkg_0, app_0, version_0, author_0, hybrid -> ok for update (different hybrid setting)
492 install(users[0], pkgId[0], appId[0], version[0], author[0], hybrid[1], SECURITY_MANAGER_ERROR_INPUT_PARAM);
493 update(users[0], pkgId[0], appId[0], version[0], author[0], hybrid[1], SECURITY_MANAGER_SUCCESS, false);
494 // uid_0, pkg_0, app_1, version_0, author_0, hybrid -> ok (new app id)
495 install(users[0], pkgId[0], appId[1], version[0], author[0], hybrid[1], SECURITY_MANAGER_SUCCESS, false);
496 // uid_1, pkg_0, app_0, version_0, author_0, hybrid -> ok (different hybrid setting)
497 install(users[1], pkgId[0], appId[0], version[0], author[0], hybrid[1], SECURITY_MANAGER_SUCCESS, false);
498 // uid_1, pkg_0, app_0, version_0, author_1, not hybrid -> fail (author of app_0 must be the same)
499 install(users[1], pkgId[0], appId[0], version[0], author[1], hybrid[0], SECURITY_MANAGER_ERROR_INPUT_PARAM);
500 // uid_1, pkg_0, app_0, version_1, author_0, not hybrid -> ok (version upgrade and different hybrid setting)
501 install(users[1], pkgId[0], appId[0], version[1], author[0], hybrid[0], SECURITY_MANAGER_ERROR_INPUT_PARAM);
502 update(users[1], pkgId[0], appId[0], version[1], author[0], hybrid[0], SECURITY_MANAGER_SUCCESS);
503 // uid_1, pkg_1, app_0, version_0, author_0, not hybrid -> fail (pkg of app_0 must be the same)
504 install(users[1], pkgId[1], appId[0], version[0], author[0], hybrid[0], SECURITY_MANAGER_ERROR_INPUT_PARAM);
505 // uid_0, pkg_0, app_0, version_0, author_0, not hybrid -> ok (the same app again)
506 install(users[0], pkgId[0], appId[0], version[0], author[0], hybrid[0], SECURITY_MANAGER_SUCCESS, false);
507 // uid_0, pkg_1, app_0, version_0, author_0, not hybrid -> fail (app_name + uid must be unique)
508 install(users[0], pkgId[1], appId[0], version[0], author[0], hybrid[0], SECURITY_MANAGER_ERROR_INPUT_PARAM);
509 // uid_0, pkg_0, app_0, version_0, author_1, not hybrid -> fail (app_name + uid must be unique)
510 install(users[0], pkgId[0], appId[0], version[0], author[1], hybrid[0], SECURITY_MANAGER_ERROR_INPUT_PARAM);
513 RUNNER_CHILD_TEST(security_manager_10_app_has_privilege)
515 const std::vector<std::string> allowedPrivs = {
516 "http://tizen.org/privilege/wifidirect",
517 "http://tizen.org/privilege/telephony"
519 const std::vector<std::string> someDeniedPrivs = {
520 "http://tizen.org/privilege/vpnservice",
521 "http://tizen.org/privilege/notification"
523 AppInstallHelper app("sm_test_10");
524 app.addPrivileges(allowedPrivs);
525 ScopedInstaller appInstall(app);
527 sm_app_has_privileges(app, allowedPrivs, 1);
528 // FIXME - all other existing privileges should be checked
529 sm_app_has_privileges(app, someDeniedPrivs, 0);
532 RUNNER_TEST_GROUP_INIT(SECURITY_MANAGER_POLICY)
534 RUNNER_TEST(security_manager_20_user_cynara_policy)
536 // FIXME - whitebox - cynara
537 const char *const MAIN_BUCKET = "MAIN";
538 const char *const MANIFESTS_GLOBAL_BUCKET = "MANIFESTS_GLOBAL";
539 const char *const MANIFESTS_LOCAL_BUCKET = "MANIFESTS_LOCAL";
540 const char *const ADMIN_BUCKET = "ADMIN";
541 const char *const USER_TYPE_NORMAL_BUCKET = "USER_TYPE_NORMAL";
542 CynaraTestAdmin::Admin admin;
544 TemporaryTestUser user("sm_test_20_user_name", GUM_USERTYPE_NORMAL, false);
546 std::string uid_string = user.getUidString();
548 CynaraTestAdmin::CynaraPoliciesContainer nonemptyContainer;
549 nonemptyContainer.add(MAIN_BUCKET,CYNARA_ADMIN_WILDCARD, uid_string.c_str(), CYNARA_ADMIN_WILDCARD, CYNARA_ADMIN_BUCKET, USER_TYPE_NORMAL_BUCKET);
550 admin.listPolicies(MAIN_BUCKET, CYNARA_ADMIN_WILDCARD, uid_string.c_str(), CYNARA_ADMIN_WILDCARD, nonemptyContainer,CYNARA_API_SUCCESS);
553 CynaraTestAdmin::CynaraPoliciesContainer emptyContainer;
555 admin.listPolicies(MAIN_BUCKET, CYNARA_ADMIN_WILDCARD, uid_string.c_str(), CYNARA_ADMIN_WILDCARD, emptyContainer, CYNARA_API_SUCCESS);
556 admin.listPolicies(MANIFESTS_GLOBAL_BUCKET, CYNARA_ADMIN_WILDCARD, uid_string.c_str(), CYNARA_ADMIN_WILDCARD, emptyContainer, CYNARA_API_SUCCESS);
557 admin.listPolicies(MANIFESTS_LOCAL_BUCKET, CYNARA_ADMIN_WILDCARD, uid_string.c_str(), CYNARA_ADMIN_WILDCARD, emptyContainer, CYNARA_API_SUCCESS);
558 admin.listPolicies(CYNARA_ADMIN_DEFAULT_BUCKET, CYNARA_ADMIN_WILDCARD, uid_string.c_str(), CYNARA_ADMIN_WILDCARD, emptyContainer, CYNARA_API_SUCCESS);
559 admin.listPolicies(ADMIN_BUCKET, CYNARA_ADMIN_WILDCARD, uid_string.c_str(), CYNARA_ADMIN_WILDCARD, emptyContainer, CYNARA_API_SUCCESS);
562 RUNNER_CHILD_TEST(security_manager_21_security_manager_admin_deny_user_priv)
564 const privileges_t adminRequiredPrivs = {
565 "http://tizen.org/privilege/notexist",
566 "http://tizen.org/privilege/internal/usermanagement"
568 const privileges_t manifestPrivs = {
569 "http://tizen.org/privilege/internet",
570 "http://tizen.org/privilege/datasharing"
572 const privileges_t allowedPrivsAfterChange = {"http://tizen.org/privilege/datasharing"};
573 const privileges_t deniedPrivsAfterChange = {"http://tizen.org/privilege/internet"};
574 TemporaryTestUser adminUser("sm_test_21_admin_user_name", GUM_USERTYPE_ADMIN, false);
575 TemporaryTestUser normalUser("sm_test_21_normal_user_name", GUM_USERTYPE_NORMAL, false);
579 std::string childUidStr = normalUser.getUidString();
581 AppInstallHelper adminApp("sm_test_21_admin", adminUser.getUid());
582 adminApp.addPrivileges(adminRequiredPrivs);
583 ScopedInstaller adminAppInstall(adminApp);
585 AppInstallHelper normalApp("sm_test_21_normal", normalUser.getUid());
586 normalApp.addPrivileges(manifestPrivs);
587 ScopedInstaller normalAppInstall(normalApp);
589 check_app_permissions(normalApp.getAppId(), normalApp.getPkgId(), childUidStr,
593 RUNNER_ASSERT_MSG(pid >= 0, "fork failed");
594 if (pid != 0) { //parent process
596 check_app_permissions(normalApp.getAppId(), normalApp.getPkgId(), childUidStr,
597 allowedPrivsAfterChange, deniedPrivsAfterChange);
599 Api::setProcessLabel(adminApp.getAppId());
600 RUNNER_ASSERT_ERRNO_MSG(drop_root_privileges(adminUser.getUid(),adminUser.getGid()) == 0,
601 "drop_root_privileges failed");
603 PolicyRequest addPolicyReq;
604 for (auto &deniedPriv : deniedPrivsAfterChange) {
605 PolicyEntry entry(SECURITY_MANAGER_ANY, normalUser.getUidString(), deniedPriv);
606 entry.setMaxLevel("Deny");
607 addPolicyReq.addEntry(entry);
609 Api::sendPolicy(addPolicyReq);
614 RUNNER_TEST_GROUP_INIT(SECURITY_MANAGER_CMD)
616 RUNNER_TEST(security_manager_22_security_manager_cmd_install)
619 const int SUCCESS = 0;
620 const int FAILURE = 256;
621 const std::string app_id = "sm_test_22_app_id";
622 const std::string pkg_id = "sm_test_22_pkg_id";
623 const std::string username("sm_test_22_user_name");
625 TemporaryTestUser user(username, GUM_USERTYPE_NORMAL);
628 const std::string path1 = TzPlatformConfig::appDirPath(user, app_id, pkg_id) + "/p1";
629 const std::string path2 = TzPlatformConfig::appDirPath(user, app_id, pkg_id) + "/p2";
630 const std::string pkgopt = " --pkg=" + pkg_id;
631 const std::string appopt = " --app=" + app_id;
632 const std::string uidopt = " --uid=" + user.getUidString();
634 mktreeSafe(path1.c_str(), 0);
635 mktreeSafe(path2.c_str(), 0);
637 const std::string installcmd = "security-manager-cmd --install " + appopt + pkgopt + uidopt;
643 std::vector<struct operation> operations = {
644 {"security-manager-cmd", FAILURE},//no option
645 {"security-manager-cmd --blah", FAILURE},//blah option is not known
646 {"security-manager-cmd --help", SUCCESS},
647 {"security-manager-cmd --install", FAILURE},//no params
648 {"security-manager-cmd -i", FAILURE},//no params
649 {"security-manager-cmd --i --app=app_id_10 --pkg=pkg_id_10", FAILURE},//no uid
650 {installcmd, SUCCESS},
651 {"security-manager-cmd -i -a" + app_id + " -g" + pkg_id + uidopt, SUCCESS},
652 {installcmd + " --path " + path1 + " rw", SUCCESS},
653 {installcmd + " --path " + path1, FAILURE},//no path type
654 {installcmd + " --path " + path1 + " rw" + " --path " + path2 + " ro", SUCCESS},
655 {installcmd + " --path " + path1 + " prie" + " --path " + path2 + " ro", FAILURE},//wrong path type
656 {installcmd + " --path " + path1 + " rw" + " --privilege somepriv --privilege somepriv2" , SUCCESS},
659 for (auto &op : operations) {
660 ret = system((op.command + " 1>/dev/null 2>&1").c_str());
661 RUNNER_ASSERT_MSG(ret == op.expected_result,
662 "Unexpected result for command '" << op.command <<"': "
663 << ret << " Expected was: "<< op.expected_result);
667 RUNNER_TEST(security_manager_23_security_manager_cmd_users)
669 const int SUCCESS = 0;
670 const int FAILURE = 256;
671 TemporaryTestUser user("sm_test_23_user_name", GUM_USERTYPE_NORMAL, false);
673 const std::string uidopt = " --uid=" + user.getUidString();
679 std::vector<struct operation> operations = {
680 {"security-manager-cmd --manage-users=remove", FAILURE},//no params
681 {"security-manager-cmd -m", FAILURE},//no params
682 {"security-manager-cmd -mr", FAILURE},//no uid
683 {"security-manager-cmd -mr --uid" + uidopt, FAILURE},//no uid
684 {"security-manager-cmd -mr --sdfj" + uidopt, FAILURE},//sdfj?
685 {"security-manager-cmd --msdf -u2004" , FAILURE},//sdf?
686 {"security-manager-cmd -mr" + uidopt, SUCCESS},//ok, removed
687 {"security-manager-cmd -mr --blah" + uidopt, FAILURE},//blah
688 {"security-manager-cmd -ma" + uidopt, SUCCESS},//ok, added
689 {"security-manager-cmd -ma --usertype=normal" + uidopt, SUCCESS},//ok, added
690 {"security-manager-cmd -ma --usertype=mal" + uidopt, FAILURE},//ok, added
693 for (auto &op : operations) {
694 int ret = system((op.command + " 1>/dev/null 2>&1").c_str());
695 RUNNER_ASSERT_MSG(ret == op.expected_result,
696 "Unexpected result for command '" << op.command <<"': "
697 << ret << " Expected was: "<< op.expected_result);
701 RUNNER_TEST_GROUP_INIT(SECURITY_MANAGER_GROUPS)
703 RUNNER_TEST(security_manager_24_groups_get)
705 PolicyConfiguration pc;
709 Api::getSecurityManagerGroups(&c_groups, &count);
710 std::unique_ptr<gid_t, decltype(free)*> groupsPtr(c_groups, free);
712 auto policyGroups = pc.getGid();
713 RUNNER_ASSERT_MSG(count == policyGroups.size(), "security_manager_groups_get should set count to: "
714 << policyGroups.size() << " but count is: " << count);
716 for (const auto &group : policyGroups) {
718 for (size_t i = 0; i < count; ++i) {
719 if (group == c_groups[i]) {
724 RUNNER_ASSERT_MSG(found, "PrivilegeGroup: " << group << " was not found");
728 RUNNER_TEST_GROUP_INIT(SECURITY_MANAGER_INSTALL_TYPE)
730 RUNNER_TEST(security_manager_25a_global_user_set_install_type_global)
732 AppInstallHelper app("sm_test_25a");
733 app.setInstallType(SM_APP_INSTALL_GLOBAL);
735 ScopedInstaller appInstall(app);
737 check_app_after_install(app.getAppId(), app.getPkgId());
740 // Check records in the security-manager database
741 check_app_after_uninstall(app.getAppId(), app.getPkgId());
744 RUNNER_TEST(security_manager_25b_global_user_set_install_type_local)
746 AppInstallHelper app("sm_test_25b");
748 InstallRequest requestInst;
749 requestInst.setAppId(app.getAppId());
750 requestInst.setPkgId(app.getPkgId());
751 requestInst.setInstallType(SM_APP_INSTALL_LOCAL);
753 Api::install(requestInst, (lib_retcode)SECURITY_MANAGER_ERROR_SERVER_ERROR);
756 RUNNER_TEST(security_manager_25c_global_user_set_install_type_preloaded)
758 AppInstallHelper app("sm_test_25c");
759 app.setInstallType(SM_APP_INSTALL_PRELOADED);
761 ScopedInstaller appInstall(app);
762 check_app_after_install(app.getAppId(), app.getPkgId());
764 check_app_after_uninstall(app.getAppId(), app.getPkgId());
767 RUNNER_TEST(security_manager_25d_local_user_set_install_type_invalid)
769 InstallRequest requestPrivateUser;
770 requestPrivateUser.setInstallType((app_install_type)0, (lib_retcode)SECURITY_MANAGER_ERROR_INPUT_PARAM);
771 requestPrivateUser.setInstallType((app_install_type)22, (lib_retcode)SECURITY_MANAGER_ERROR_INPUT_PARAM);
775 * It is possible for local user to install global application but one needs app_install privileges
776 * By default only global user or root can install global apps (or "User", "System", "System::Privileged"...)
778 RUNNER_CHILD_TEST(security_manager_25e_unprivileged_install_type_global)
780 TemporaryTestUser testUser("sm_test_25e_user_name", GUM_USERTYPE_NORMAL);
783 AppInstallHelper app("sm_test_25e");
786 RUNNER_ASSERT_ERRNO_MSG(drop_root_privileges(testUser.getUid(), testUser.getGid()) == 0,
787 "drop_root_privileges failed");
789 InstallRequest invalidReq;
790 invalidReq.setAppId(app.getAppId());
791 invalidReq.setPkgId(app.getPkgId());
792 invalidReq.setInstallType(SM_APP_INSTALL_GLOBAL);
794 Api::install(invalidReq, (lib_retcode)SECURITY_MANAGER_ERROR_AUTHENTICATION_FAILED);
797 RUNNER_CHILD_TEST(security_manager_25f_unprivileged_install_type_preloaded)
799 TemporaryTestUser testUser("sm_test_25f_user_name", GUM_USERTYPE_NORMAL);
802 AppInstallHelper app("sm_test_25f");
805 RUNNER_ASSERT_ERRNO_MSG(drop_root_privileges(testUser.getUid(), testUser.getGid()) == 0,
806 "drop_root_privileges failed");
807 InstallRequest invalidReq;
808 invalidReq.setAppId(app.getAppId());
809 invalidReq.setPkgId(app.getPkgId());
810 invalidReq.setInstallType(SM_APP_INSTALL_PRELOADED);
811 Api::install(invalidReq, (lib_retcode)SECURITY_MANAGER_ERROR_AUTHENTICATION_FAILED);
815 RUNNER_CHILD_TEST(security_manager_25g_local_user_set_install_type_local)
817 std::vector<std::string> allowedPrivs = {
818 "http://tizen.org/privilege/volume.set",
819 "http://tizen.org/privilege/systemmonitor",
820 "http://tizen.org/privilege/internet"
822 std::vector<std::string> someDeniedPrivs = {
823 "http://tizen.org/privilege/push",
824 "http://tizen.org/privilege/power",
825 "http://tizen.org/privilege/notification"
828 TemporaryTestUser testUser("sm_test_25g_user_name", GUM_USERTYPE_NORMAL);
831 AppInstallHelper app("sm_test_25g", testUser.getUid());
832 app.createPrivateDir();
833 app.setInstallType(SM_APP_INSTALL_LOCAL);
834 app.addPrivileges(allowedPrivs);
836 RUNNER_ASSERT_ERRNO_MSG(drop_root_privileges(testUser.getUid(), testUser.getGid()) == 0,
837 "drop_root_privileges failed");
839 ScopedInstaller appInstall(app);
840 check_app_permissions(app.getAppId(), app.getPkgId(), testUser.getUidString(),
841 allowedPrivs, someDeniedPrivs);
844 check_app_permissions(app.getAppId(), app.getPkgId(), testUser.getUidString(),
845 {}, merge(allowedPrivs, someDeniedPrivs));
846 // TODO - check if app is properly uninstalled
849 RUNNER_CHILD_TEST(security_manager_25h_local_path_global_install)
851 TemporaryTestUser testUser("sm_test_25h_user_name", GUM_USERTYPE_NORMAL);
854 AppInstallHelper app("sm_test_25h", testUser.getUid());
855 app.createPrivateDir();
857 InstallRequest invalidReq;
858 invalidReq.setAppId(app.getAppId());
859 invalidReq.setPkgId(app.getPkgId());
860 invalidReq.addPath(app.getPrivateDir(), SECURITY_MANAGER_PATH_RW);
861 invalidReq.setInstallType(SM_APP_INSTALL_GLOBAL);
862 Api::install(invalidReq, (lib_retcode)SECURITY_MANAGER_ERROR_NOT_PATH_OWNER);
865 RUNNER_CHILD_TEST(security_manager_25i_local_path_preloaded_install)
867 TemporaryTestUser testUser("sm_test_25i_user_name", GUM_USERTYPE_NORMAL);
870 AppInstallHelper app("sm_test_25i", testUser.getUid());
871 app.createPrivateDir();
873 InstallRequest invalidReq;
874 invalidReq.setAppId(app.getAppId());
875 invalidReq.setPkgId(app.getPkgId());
876 invalidReq.addPath(app.getPrivateDir(), SECURITY_MANAGER_PATH_RW);
877 invalidReq.setInstallType(SM_APP_INSTALL_PRELOADED);
878 Api::install(invalidReq, (lib_retcode)SECURITY_MANAGER_ERROR_NOT_PATH_OWNER);
881 RUNNER_CHILD_TEST(security_manager_25j_global_path_local_install)
883 TemporaryTestUser testUser("sm_test_25j_user_name", GUM_USERTYPE_NORMAL);
886 AppInstallHelper appLocal("sm_test_25j", testUser.getUid());
888 AppInstallHelper appGlobal("sm_test_25");
889 appGlobal.createPrivateDir();
891 RUNNER_ASSERT_ERRNO_MSG(drop_root_privileges(testUser.getUid(), testUser.getGid()) == 0,
892 "drop_root_privileges failed");
894 InstallRequest invalidReq;
895 invalidReq.setAppId(appLocal.getAppId());
896 invalidReq.setPkgId(appLocal.getPkgId());
897 invalidReq.addPath(appGlobal.getPrivateDir(), SECURITY_MANAGER_PATH_RW);
898 invalidReq.setInstallType(SM_APP_INSTALL_LOCAL);
900 Api::install(invalidReq, SECURITY_MANAGER_ERROR_NOT_PATH_OWNER);
903 RUNNER_CHILD_TEST(security_manager_26_hybrid_pkg_uninstall_artifacts_check)
905 TemporaryTestUser testUser("sm_test_26_user_name", GUM_USERTYPE_NORMAL);
908 const std::vector<std::string> allowedPrivs = {
909 "http://tizen.org/privilege/wifidirect",
910 "http://tizen.org/privilege/telephony"
913 AppInstallHelper app1("sm_test_26_1", "sm_test_26", testUser.getUid());
914 app1.addPrivileges(allowedPrivs);
917 AppInstallHelper app2("sm_test_26_2", "sm_test_26", testUser.getUid());
918 app2.addPrivileges(allowedPrivs);
922 ScopedInstaller appInstall1(app1);
923 ScopedInstaller appInstall2(app2);
924 check_app_permissions(app1.getAppId(), app1.getPkgId(), testUser.getUidString(),
925 allowedPrivs, {}, app1.getIsHybrid());
926 check_app_permissions(app2.getAppId(), app2.getPkgId(), testUser.getUidString(),
927 allowedPrivs, {}, app2.getIsHybrid());
930 check_app_permissions(app1.getAppId(), app1.getPkgId(), testUser.getUidString(),
931 {}, allowedPrivs, app1.getIsHybrid());
932 check_app_permissions(app2.getAppId(), app2.getPkgId(), testUser.getUidString(),
933 {}, allowedPrivs, app2.getIsHybrid());