src/test-libdbuspolicy1-access-deny-gdi.cpp

   1 #include "internal/include/fb_generated.h"
   2 #include "internal/naive_policy_checker.hpp"
   3 #include "internal/policy.hpp"
   4 #include "internal/serializer.hpp"
   5 #include "internal/storage_backend_serialized.hpp"
   6 #include "internal/storage_backend_xml.hpp"
   7 #include "internal/tslog.hpp"
   8 #include <dbuspolicy1/libdbuspolicy1.h>
   9 #include <map>
  10 #include <string>
  11 #include <vector>
  12
  13 using namespace ldp_xml_parser;
  14
  15 struct AccessTest {
  16         Decision expected_result;
  17         uid_t user;
  18         gid_t group;
  19         const char* label;
  20 };
  21
  22 const char* DEFAULT_LABEL = "User::Shell";
  23 const char* PRIVILEGED_LABEL = "System::Privileged";
  24
  25 std::map<Decision, const char*> DECISIONS {
  26                 {Decision::ANY, "ANY"},
  27                 {Decision::ALLOW, "ALLOW"},
  28                 {Decision::DENY, "DENY"},
  29                 {Decision::CHECK, "CHECK"}};
  30
  31
  32 const std::vector<AccessTest> default_allow_tests = {
  33         {Decision::ALLOW, 0, 0, PRIVILEGED_LABEL},
  34         {Decision::ALLOW, 2, 20, DEFAULT_LABEL},        //deny user, allow group
  35         {Decision::ALLOW, 3, 30, DEFAULT_LABEL},        //deny group, allow user
  36         {Decision::DENY, 4, 30, DEFAULT_LABEL}, //deny group, no user rule
  37         {Decision::ALLOW, 5, 5, DEFAULT_LABEL}, //no rules
  38         {Decision::DENY, 6, 6, DEFAULT_LABEL},  //deny user (mandatory)
  39         {Decision::DENY, 7, 7, DEFAULT_LABEL},  //allow user (def), deny user (mandatory)
  40         {Decision::ALLOW, 8, 8, DEFAULT_LABEL}, //deny user (def), allow user (mandatory)
  41         {Decision::CHECK, 9991, 9991, DEFAULT_LABEL},   //check-user=allow (def)
  42         {Decision::CHECK, 9992, 9992, DEFAULT_LABEL},   //check-user=allow (def), check-group=deny (mandatory)
  43         {Decision::CHECK, 9993, 9993, DEFAULT_LABEL},   //check-user=allow (def, mandatory)
  44         {Decision::CHECK, 888, 888, PRIVILEGED_LABEL}   //check-user=allow (def) (label)
  45 };
  46
  47 const std::vector<AccessTest> default_deny_tests = {
  48         {Decision::DENY, 0, 0, PRIVILEGED_LABEL},
  49         {Decision::ALLOW, 2, 20, DEFAULT_LABEL},
  50         {Decision::ALLOW, 3, 30, DEFAULT_LABEL},
  51         {Decision::DENY, 4, 30, DEFAULT_LABEL},
  52         {Decision::DENY, 5, 5, DEFAULT_LABEL},  // no rules, so denied by default
  53         {Decision::DENY, 6, 6, DEFAULT_LABEL},
  54         {Decision::DENY, 7, 7, DEFAULT_LABEL},
  55         {Decision::ALLOW, 8, 8, DEFAULT_LABEL},
  56         {Decision::CHECK, 9991, 9991, DEFAULT_LABEL},
  57         {Decision::CHECK, 9992, 9992, DEFAULT_LABEL},
  58         {Decision::CHECK, 9993, 9993, DEFAULT_LABEL},
  59         {Decision::CHECK, 888, 888, PRIVILEGED_LABEL}
  60 };
  61
  62 const uid_t bus_owner = 500;
  63
  64 const std::vector<AccessTest> session_tests = {
  65         {Decision::ALLOW, 500, 500, DEFAULT_LABEL},     // allowed implicitly as the bus owner
  66         {Decision::ANY, 400, 500, DEFAULT_LABEL},
  67         {Decision::ANY, 0, 0, PRIVILEGED_LABEL},
  68         {Decision::ANY, 900, 900, DEFAULT_LABEL},
  69         {Decision::ALLOW, 600, 600, DEFAULT_LABEL},     // allowed explicitly in policy (user)
  70         {Decision::ALLOW, 700, 700, DEFAULT_LABEL},     // allowed explicitly in policy (group)
  71         {Decision::DENY, 800, 700, DEFAULT_LABEL}       // allow group, deny user
  72 };
  73
  74 typedef std::pair<std::string, std::vector<AccessTest>> TestBusSetup;
  75
  76 const std::vector<std::pair<TestBusSetup, TestBusSetup>> access_tests{
  77         {{"tests/default_deny/system.conf", default_allow_tests}, {"tests/default_deny/session.conf", session_tests}},
  78         {{"tests/default_deny/system-au.conf", default_allow_tests}, {}},
  79         {{"tests/default_deny/system-ag.conf", default_allow_tests}, {}},
  80         {{"tests/default_deny/system-du.conf", default_deny_tests}, {}},
  81         {{"tests/default_deny/system-dg.conf", default_deny_tests}, {}}
  82 };
  83
  84 void print_test(const struct AccessTest* t, bool result) {
  85         printf("uid = %lu, gid = %lu, label = %s, expected = %d, result = %d",
  86                    (unsigned long)t->user, (unsigned long)t->group, t->label, (int)t->expected_result, (int)result);
  87 }
  88
  89 template <typename DB>
  90 bool run_tests_for_bus(const DB &db, NaivePolicyChecker &checker, const std::vector<AccessTest>& test_setup, int& i, bool& passed) {
  91         for (const auto& test : test_setup) {
  92                 checker.updateGroupDb(test.user, test.group);
  93
  94                 const auto &gids = *checker.getGroups<MatchItemAccess>(test.user, test.group);
  95                 auto m_item = MatchItemAccess(test.user, gids);
  96                 auto decision = db.getDecisionItemContextMandatory(m_item).getDecision();
  97                 if (decision == Decision::ANY)
  98                         decision = db.getDecisionItemContextDefault(m_item).getDecision();
  99                 if (decision == Decision::ANY) {
 100                         if (bus_owner == test.user)
 101                                 decision = Decision::ALLOW;
 102
 103                 }
 104                 bool res = decision == test.expected_result;
 105                 if (!res) {
 106                         printf("[ERROR][%d] access test failed: %s %s ", i, DECISIONS[test.expected_result],
 107                                                                                                                                 DECISIONS[decision]);
 108                         print_test(&test, res);
 109                         printf("\n");
 110                         passed = false;
 111                 }
 112                 i++;
 113         }
 114         return passed;
 115 }
 116
 117 bool run_policy_db(const std::pair<TestBusSetup, TestBusSetup> access_test) {
 118         bool passed = true;
 119         int i = 0;
 120         const auto& system_bus_setup = access_test.first;
 121         const auto& session_bus_setup = access_test.second;
 122
 123         auto &checker_system = policy_checker_system();
 124         auto &checker_session = policy_checker_session();
 125
 126         checker_system.initDb(system_bus_setup.first.c_str());
 127         if (session_bus_setup.first != "") {
 128                 checker_session.initDb(session_bus_setup.first.c_str());
 129         }
 130
 131         printf("POLICY_DB:\n");
 132         return run_tests_for_bus(checker_system.getPolicyDb(), checker_system, system_bus_setup.second, i, passed) &&
 133                 run_tests_for_bus(checker_session.getPolicyDb(), checker_session, session_bus_setup.second, i, passed);
 134 }
 135
 136 bool run_fb(const std::pair<TestBusSetup, TestBusSetup> access_test) {
 137         bool passed = true;
 138         int i = 0;
 139         ldp_serializer::Serializer serializer;
 140
 141         const auto& system_bus_setup = access_test.first;
 142         const auto& session_bus_setup = access_test.second;
 143
 144         size_t size;
 145
 146         uint8_t *buff_sys = nullptr, *buff_ses = nullptr;
 147         buff_sys = serializer.serialize(system_bus_setup.first.c_str(), size);
 148         if (session_bus_setup.first == "")
 149                 buff_ses = serializer.serialize(session_bus_setup.first.c_str(), size);
 150
 151         ldp_serialized::StorageBackendSerialized storage_sys, storage_ses;
 152
 153         printf("FLATBUFFERS:\n");
 154
 155         storage_sys.initFromData(buff_sys);
 156         bool res = run_tests_for_bus(storage_sys, policy_checker_system(), system_bus_setup.second, i, passed);
 157
 158         if (buff_ses) {
 159                 storage_ses.initFromData(buff_ses);
 160                 res &= run_tests_for_bus(storage_ses, policy_checker_session(), session_bus_setup.second, i, passed);
 161         }
 162         return res;
 163 }
 164
 165 bool run_xml(const std::pair<TestBusSetup, TestBusSetup> access_test) {
 166         (void)access_test;
 167         return true;
 168 }
 169
 170 bool run_tests() {
 171         bool passed = true;
 172         for (const auto& access_test : access_tests) {
 173                 printf("f: %s s: %s\n", access_test.first.first.c_str(), access_test.second.first.c_str());
 174                 passed &= run_policy_db(access_test);
 175                 passed &= run_fb(access_test);
 176                 passed &= run_xml(access_test);
 177         }
 178
 179         return passed;
 180 }
 181
 182 int main() {
 183         tslog::init();
 184         if (!run_tests())
 185                 return -1;
 186         return 0;
 187 }