tests/libprivilege-control-tests/test_cases.cpp

   1 /*
   2  * Copyright (c) 2012 Samsung Electronics Co., Ltd All Rights Reserved
   3  *
   4  *    Licensed under the Apache License, Version 2.0 (the "License");
   5  *    you may not use this file except in compliance with the License.
   6  *    You may obtain a copy of the License at
   7  *
   8  *        http://www.apache.org/licenses/LICENSE-2.0
   9  *
  10  *    Unless required by applicable law or agreed to in writing, software
  11  *    distributed under the License is distributed on an "AS IS" BASIS,
  12  *    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13  *    See the License for the specific language governing permissions and
  14  *    limitations under the License.
  15 */
  16
  17 /*
  18  * @file        test_cases.cpp
  19  * @author      Jan Olszak (j.olszak@samsung.com)
  20  * @author      Rafal Krypa (r.krypa@samsung.com)
  21  * @author      Lukasz Wojciechowski (l.wojciechow@partner.samsung.com)
  22  * @version     1.0
  23  * @brief       libprivilege-control test runner
  24  */
  25
  26 #include <string>
  27 #include <vector>
  28 #include <fstream>
  29 #include <sstream>
  30 #include <set>
  31
  32 #include <fcntl.h>
  33 #include <errno.h>
  34 #include <unistd.h>
  35
  36 #include <sys/types.h>
  37 #include <sys/stat.h>
  38
  39 #include <sys/socket.h>
  40 #include <sys/un.h>
  41 #include <sys/smack.h>
  42
  43 #include <privilege-control.h>
  44 #include <dpl/test/test_runner.h>
  45 #include <dpl/test/test_runner_child.h>
  46 #include <dpl/test/test_runner_multiprocess.h>
  47 #include <dpl/log/log.h>
  48 #include <tests_common.h>
  49 #include <libprivilege-control_test_common.h>
  50 #include "common/duplicates.h"
  51 #include "common/db.h"
  52 #include "memory.h"
  53
  54 // Error codes for test_libprivilege_strerror
  55 const std::vector<int> error_codes {
  56     PC_OPERATION_SUCCESS, PC_ERR_FILE_OPERATION, PC_ERR_MEM_OPERATION, PC_ERR_NOT_PERMITTED,
  57     PC_ERR_INVALID_PARAM, PC_ERR_INVALID_OPERATION, PC_ERR_DB_OPERATION, PC_ERR_DB_LABEL_TAKEN,
  58     PC_ERR_DB_QUERY_PREP, PC_ERR_DB_QUERY_BIND, PC_ERR_DB_QUERY_STEP, PC_ERR_DB_CONNECTION,
  59     PC_ERR_DB_NO_SUCH_APP, PC_ERR_DB_PERM_FORBIDDEN
  60 };
  61
  62 namespace {
  63
  64 std::vector<std::string> gen_names(std::string prefix, std::string suffix, size_t size)
  65 {
  66     std::vector<std::string> names;
  67     for(size_t i = 0; i < size; ++i) {
  68         names.push_back(prefix + "_" + std::to_string(i) + suffix);
  69     }
  70     return names;
  71 }
  72
  73 const char *OSP_BLAHBLAH = "/usr/share/privilege-control/OSP_feature.blah.blahblah.smack";
  74 const char *WRT_BLAHBLAH  ="/usr/share/privilege-control/WGT_blahblah.smack";
  75 const char *OTHER_BLAHBLAH  ="/usr/share/privilege-control/blahblah.smack";
  76 const std::vector<std::string> OSP_BLAHBLAH_DAC = gen_names("/usr/share/privilege-control/OSP_feature.blah.blahblah", ".dac", 16);
  77 const char *WRT_BLAHBLAH_DAC  ="/usr/share/privilege-control/WGT_blahblah.dac";
  78 const char *OTHER_BLAHBLAH_DAC = "/usr/share/privilege-control/blahblah.dac";
  79 const std::vector<std::string> BLAHBLAH_FEATURE = gen_names("http://feature/blah/blahblah", "", 16);
  80
  81 int nftw_check_labels_app_shared_dir(const char *fpath, const struct stat *sb,
  82                                      int /*typeflag*/, struct FTW* /*ftwbuf*/)
  83 {
  84     int result;
  85     char *label;
  86
  87     /* ACCESS */
  88     result = smack_lgetlabel(fpath, &label, SMACK_LABEL_ACCESS);
  89     RUNNER_ASSERT_MSG_BT(result == 0, "Could not get label for the path");
  90     RUNNER_ASSERT_MSG_BT(label != NULL, "ACCESS label on " << fpath << " is not set");
  91     result = strcmp(APPID_SHARED_DIR, label);
  92     RUNNER_ASSERT_MSG_BT(result == 0, "ACCESS label on " << fpath << " is incorrect");
  93
  94     result = smack_have_access(USER_APP_ID, APPID_SHARED_DIR, "rwxatl");
  95     RUNNER_ASSERT_MSG_BT(result == 1,
  96         "Error rwxatl access was not given shared dir. Subject: " <<
  97         USER_APP_ID << ". Object: " << APPID_SHARED_DIR << ". Result: " << result);
  98     /* EXEC */
  99     result = smack_lgetlabel(fpath, &label, SMACK_LABEL_EXEC);
 100     RUNNER_ASSERT_MSG_BT(result == 0, "Could not get label for the path");
 101     RUNNER_ASSERT_MSG_BT(label == NULL, "EXEC label on " << fpath << " is set");
 102
 103     /* TRANSMUTE */
 104     result = smack_lgetlabel(fpath, &label, SMACK_LABEL_TRANSMUTE);
 105     RUNNER_ASSERT_MSG_BT(result == 0, "Could not get label for the path");
 106     if (S_ISDIR(sb->st_mode)) {
 107         RUNNER_ASSERT_MSG_BT(label != NULL, "TRANSMUTE label on " << fpath << " is not set");
 108         result = strcmp("TRUE", label);
 109         RUNNER_ASSERT_MSG_BT(result == 0, "TRANSMUTE label on " << fpath << " is not set");
 110     } else
 111         RUNNER_ASSERT_MSG_BT(label == NULL, "TRANSMUTE label on " << fpath << " is set");
 112
 113     return 0;
 114 }
 115
 116 void osp_blahblah_dac_check(int line_no, const std::vector<unsigned> &gids, std::string dac_file_path)
 117 {
 118     std::ifstream dac_file(dac_file_path);
 119     RUNNER_ASSERT_MSG_BT(dac_file, "Line: " << line_no << " Failed to create " << dac_file_path);
 120
 121     auto it = gids.begin();
 122     std::string line;
 123     while (std::getline(dac_file,line)) {
 124         std::istringstream is(line);
 125         unsigned gid;
 126         is >> gid;
 127         RUNNER_ASSERT_MSG_BT(it != gids.end(), "Line: " << line_no << "Additional line in file: " << gid);
 128         RUNNER_ASSERT_MSG_BT(*it == gid, "Line: " << line_no << " " << *it << "!=" << gid);
 129         it++;
 130     }
 131
 132     RUNNER_ASSERT_MSG_BT(it == gids.end(), "Line: " << line_no << " Missing line in file: " << *it);
 133
 134     dac_file.close();
 135 }
 136
 137 void remove_smack_files()
 138 {
 139     // TODO array
 140     unlink(OSP_BLAHBLAH);
 141     unlink(WRT_BLAHBLAH);
 142     unlink(OTHER_BLAHBLAH);
 143     unlink(WRT_BLAHBLAH_DAC);
 144     unlink(OTHER_BLAHBLAH_DAC);
 145
 146     for(size_t i=0; i<OSP_BLAHBLAH_DAC.size(); ++i)
 147         unlink(OSP_BLAHBLAH_DAC[i].c_str());
 148
 149     for(size_t i=0; i<OSP_BLAHBLAH_DAC.size(); ++i)
 150         unlink(OSP_BLAHBLAH_DAC[i].c_str());
 151 }
 152
 153 } // namespace
 154
 155 RUNNER_TEST_GROUP_INIT(libprivilegecontrol)
 156
 157 /**
 158  * Test setting labels for all files and folders in given path.
 159  */
 160 RUNNER_TEST(privilege_control02_app_label_dir)
 161 {
 162     int result;
 163
 164     result = nftw(TEST_APP_DIR, &nftw_remove_labels, FTW_MAX_FDS, FTW_PHYS);
 165     RUNNER_ASSERT_MSG_BT(result == 0, "Unable to clean up Smack labels in " << TEST_APP_DIR);
 166
 167     result = nftw(TEST_NON_APP_DIR, &nftw_set_labels_non_app_dir, FTW_MAX_FDS, FTW_PHYS);
 168     RUNNER_ASSERT_MSG_BT(result == 0, "Unable to clean up Smack labels in " << TEST_NON_APP_DIR);
 169
 170     DB_BEGIN
 171
 172     result = perm_app_setup_path(APPID_DIR, TEST_APP_DIR, APP_PATH_PRIVATE);
 173     RUNNER_ASSERT_MSG_BT(result == 0, "perm_app_setup_path() failed");
 174
 175     DB_END
 176
 177     result = nftw(TEST_APP_DIR, &nftw_check_labels_app_dir, FTW_MAX_FDS, FTW_PHYS);
 178     RUNNER_ASSERT_MSG_BT(result == 0, "Unable to check Smack labels for app dir");
 179
 180     result = nftw(TEST_NON_APP_DIR, &nftw_check_labels_non_app_dir, FTW_MAX_FDS, FTW_PHYS);
 181     RUNNER_ASSERT_MSG_BT(result == 0, "Unable to check Smack labels for non-app dir");
 182 }
 183
 184 RUNNER_TEST_SMACK(privilege_control03_app_label_shared_dir)
 185 {
 186     int result;
 187
 188     DB_BEGIN
 189
 190     result = perm_app_install(APP_ID);
 191     RUNNER_ASSERT_MSG_BT(result == 0, "perm_app_install returned " << result << ". Errno: " << strerror(errno));
 192
 193     result = perm_app_setup_path(APP_ID, TEST_APP_DIR, APP_PATH_GROUP_RW, USER_APP_ID);
 194     RUNNER_ASSERT_MSG_BT(result != 0, "perm_app_setup_path(APP_ID, USER_APP_ID) didn't fail");
 195
 196     DB_END
 197
 198     result = nftw(TEST_APP_DIR, &nftw_remove_labels, FTW_MAX_FDS, FTW_PHYS);
 199     RUNNER_ASSERT_MSG_BT(result == 0, "Unable to clean up Smack labels in " << TEST_APP_DIR);
 200
 201     result = nftw(TEST_NON_APP_DIR, &nftw_set_labels_non_app_dir, FTW_MAX_FDS, FTW_PHYS);
 202     RUNNER_ASSERT_MSG_BT(result == 0, "Unable to clean up Smack labels in " << TEST_NON_APP_DIR);
 203
 204     DB_BEGIN
 205
 206     result = perm_app_setup_path(APP_ID, TEST_APP_DIR, APP_PATH_GROUP_RW, APPID_SHARED_DIR);
 207     RUNNER_ASSERT_MSG_BT(result == 0, "perm_app_setup_path() failed");
 208
 209     DB_END
 210
 211     result = nftw(TEST_APP_DIR, &nftw_check_labels_app_shared_dir, FTW_MAX_FDS, FTW_PHYS);
 212     RUNNER_ASSERT_MSG_BT(result == 0, "Unable to check Smack labels for shared app dir");
 213
 214     result = nftw(TEST_NON_APP_DIR, &nftw_check_labels_non_app_dir, FTW_MAX_FDS, FTW_PHYS);
 215     RUNNER_ASSERT_MSG_BT(result == 0, "Unable to check Smack labels for non-app dir");
 216
 217     DB_BEGIN
 218
 219     result = perm_app_uninstall(APP_ID);
 220     RUNNER_ASSERT_MSG_BT(result == 0, "perm_app_uninstall returned " << result << ". Errno: " << strerror(errno));
 221
 222     DB_END
 223 }
 224
 225 /**
 226  * Revoke permissions from the list. Should be executed as privileged user.
 227  */
 228 RUNNER_CHILD_TEST_SMACK(privilege_control06_revoke_permissions_wgt)
 229 {
 230     test_revoke_permissions(__LINE__, WGT_APP_ID);
 231 }
 232
 233 /**
 234  * Revoke permissions from the list. Should be executed as privileged user.
 235  */
 236 RUNNER_CHILD_TEST_SMACK(privilege_control06_revoke_permissions_osp)
 237 {
 238     test_revoke_permissions(__LINE__, OSP_APP_ID);
 239 }
 240
 241 void test_set_app_privilege(
 242                        const char* app_id, app_type_t APP_TYPE,
 243                        const char** privileges, const char* type,
 244                        const char* app_path, const char* dac_file,
 245                        const rules_t &rules) {
 246     check_app_installed(app_path);
 247
 248     int result;
 249
 250     DB_BEGIN
 251
 252     result = perm_app_uninstall(app_id);
 253     RUNNER_ASSERT_MSG_BT(result == 0,
 254             " perm_app_uninstall returned " << result << ". "
 255                     "Errno: " << strerror(errno));
 256
 257     result = perm_app_install(app_id);
 258     RUNNER_ASSERT_MSG_BT(result == 0,
 259             " perm_app_install returned " << result << ". "
 260                     "Errno: " << strerror(errno));
 261
 262     // TEST:
 263     result = perm_app_enable_permissions(app_id, APP_TYPE, privileges, false);
 264     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS,
 265         " Error registering app permissions. Result: " << result);
 266
 267     DB_END
 268
 269     result = test_have_all_accesses(rules);
 270     RUNNER_ASSERT_MSG_BT(result == 1, "Permissions not added.");
 271
 272     std::set<unsigned> groups_before;
 273     read_user_gids(groups_before, APP_UID);
 274
 275     result = perm_app_set_privilege(app_id, type, app_path);
 276     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS,
 277             " Error in perm_app_set_privilege. Error: " << result);
 278
 279     // Check if SMACK label really set
 280     char *label;
 281     result = smack_new_label_from_self(&label);
 282     RUNNER_ASSERT_MSG_BT(result >= 0,
 283             " Error getting current process label");
 284     RUNNER_ASSERT_MSG_BT(label != NULL,
 285             " Process label is not set");
 286
 287     result = strcmp(USER_APP_ID, label);
 288     RUNNER_ASSERT_MSG_BT(result == 0,
 289             " Process label " << label << " is incorrect");
 290
 291     check_groups(groups_before, dac_file);
 292 }
 293
 294 /**
 295  * Set APP privileges. wgt.
 296  */
 297 RUNNER_CHILD_TEST_SMACK(privilege_control05_set_app_privilege_wgt)
 298 {
 299     test_set_app_privilege(WGT_APP_ID, APP_TYPE_WGT, PRIVS_WGT, "wgt", WGT_APP_PATH,
 300             LIBPRIVILEGE_TEST_DAC_FILE_WGT, rules_wgt);
 301 }
 302
 303 /**
 304  * Set APP privileges. osp app.
 305  */
 306 RUNNER_CHILD_TEST_SMACK(privilege_control05_set_app_privilege_osp)
 307 {
 308     test_set_app_privilege(OSP_APP_ID, APP_TYPE_OSP, PRIVS_OSP, "tpk", OSP_APP_PATH,
 309             LIBPRIVILEGE_TEST_DAC_FILE_OSP, rules_osp);
 310 }
 311
 312 RUNNER_CHILD_TEST_SMACK(privilege_control05_set_app_privilege_efl)
 313 {
 314     test_set_app_privilege(EFL_APP_ID, APP_TYPE_EFL, PRIVS_EFL,
 315             "rpm", EFL_APP_PATH,
 316             LIBPRIVILEGE_TEST_DAC_FILE_EFL, rules_efl);
 317 }
 318
 319 /**
 320  * Add new API feature
 321  */
 322 RUNNER_TEST(privilege_control11_add_api_feature)
 323 {
 324     int result;
 325
 326     remove_smack_files();
 327
 328     DB_BEGIN
 329
 330     // argument validation
 331     result = perm_add_api_feature(APP_TYPE_OSP, NULL, NULL, NULL, 0);
 332     RUNNER_ASSERT_BT(result == PC_ERR_INVALID_PARAM);
 333
 334     result = perm_add_api_feature(APP_TYPE_OSP,"", NULL, NULL, 0);
 335     RUNNER_ASSERT_BT(result == PC_ERR_INVALID_PARAM);
 336
 337
 338     // Already existing feature:
 339     // TODO: Database will be malformed. (Rules for these features will be removed.)
 340     result = perm_add_api_feature(APP_TYPE_OSP,"http://tizen.org/privilege/messaging.read", NULL, NULL, 0);
 341     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS, "perm_add_api_feature returned: " << result);
 342
 343     result = perm_add_api_feature(APP_TYPE_WGT,"http://tizen.org/privilege/messaging.sms", NULL, NULL, 0);
 344     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS, "perm_add_api_feature returned: " << result);
 345
 346     // empty features
 347     result = perm_add_api_feature(APP_TYPE_OSP,"blahblah", NULL, NULL, 0);
 348     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS, "perm_add_api_feature returned: " << result);
 349
 350     result = perm_add_api_feature(APP_TYPE_WGT,"blahblah", NULL, NULL, 0);
 351     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS, "perm_add_api_feature returned: " << result);
 352
 353     // empty rules
 354     const char *test1[] = { NULL };
 355     result = perm_add_api_feature(APP_TYPE_OSP, BLAHBLAH_FEATURE[0].c_str(), test1, NULL, 0);
 356     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS, "perm_add_api_feature returned: " << result);
 357
 358     const char *test2[] = { "", NULL };
 359     result = perm_add_api_feature(APP_TYPE_OSP, BLAHBLAH_FEATURE[1].c_str(), test2, NULL, 0);
 360     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS, "perm_add_api_feature returned: " << result);
 361
 362     const char *test3[] = { " \t\n", "\t \n", "\n\t  ", NULL };
 363     result = perm_add_api_feature(APP_TYPE_OSP, BLAHBLAH_FEATURE[2].c_str(), test3, NULL, 0);
 364     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS, "perm_add_api_feature returned: " << result);
 365
 366     // malformed rules
 367     const char *test4[] = { "malformed", NULL };
 368     result = perm_add_api_feature(APP_TYPE_OSP, BLAHBLAH_FEATURE[3].c_str(), test4, NULL, 0);
 369     RUNNER_ASSERT_MSG_BT(result == PC_ERR_INVALID_PARAM, "perm_add_api_feature returned: " << result);
 370
 371     const char *test5[] = { "malformed malformed", NULL };
 372     result = perm_add_api_feature(APP_TYPE_OSP, BLAHBLAH_FEATURE[4].c_str(), test5, NULL, 0);
 373     RUNNER_ASSERT_MSG_BT(result == PC_ERR_INVALID_PARAM, "perm_add_api_feature returned: " << result);
 374
 375     const char *test6[] = { "-malformed malformed rwxat", NULL };
 376     result = perm_add_api_feature(APP_TYPE_OSP, BLAHBLAH_FEATURE[5].c_str(), test6, NULL, 0);
 377     RUNNER_ASSERT_MSG_BT(result == PC_ERR_INVALID_PARAM, "perm_add_api_feature returned: " << result);
 378
 379     const char *test7[] = { "~/\"\\ malformed rwxat", NULL };
 380     result = perm_add_api_feature(APP_TYPE_OSP, BLAHBLAH_FEATURE[6].c_str(), test7, NULL, 0);
 381     RUNNER_ASSERT_MSG_BT(result == PC_ERR_INVALID_PARAM, "perm_add_api_feature returned: " << result);
 382
 383     const char *test8[] = { "subject object rwxat something else", NULL };
 384     result = perm_add_api_feature(APP_TYPE_OSP, BLAHBLAH_FEATURE[7].c_str(), test8, NULL, 0);
 385     RUNNER_ASSERT_MSG_BT(result == PC_ERR_INVALID_PARAM, "perm_add_api_feature returned: " << result);
 386
 387
 388     // correct rules
 389     const char *test9[] = {
 390             "~APP~    object\t rwxatl",
 391             " \t \n",
 392             "subject2\t~APP~ ltxarw",
 393             "",
 394             NULL};
 395
 396     result = perm_add_api_feature(APP_TYPE_OSP, BLAHBLAH_FEATURE[8].c_str(), test9, NULL, 0);
 397     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS, "perm_add_api_feature returned: " << result);
 398
 399     const char *test10[] = { "Sub::jE,ct ~APP~ a-rwxl", NULL };
 400     result = perm_add_api_feature(APP_TYPE_OSP, BLAHBLAH_FEATURE[9].c_str(), test10, NULL, 0);
 401     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS, "perm_add_api_feature returned: " << result);
 402
 403     const char *test11[] = { "Sub::sjE,ct ~APP~ a-RwXL", NULL }; // TODO This fails.
 404     result = perm_add_api_feature(APP_TYPE_OSP, BLAHBLAH_FEATURE[10].c_str(), test11, NULL, 0);
 405     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS, "perm_add_api_feature returned: " << result);
 406
 407
 408     // TODO For now identical/complementary rules are not merged.
 409     const char *test12[] = {
 410             "subject1 ~APP~ rwxatl",
 411             " \t \n",
 412             "subject2 ~APP~ ltxarw",
 413             "",
 414             NULL};
 415     result = perm_add_api_feature(APP_TYPE_OSP, BLAHBLAH_FEATURE[11].c_str(), test12, NULL, 0);
 416     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS, "perm_add_api_feature returned: " << result);
 417
 418     // empty group ids
 419     const char *test13[] = { "~APP~ b a", NULL};
 420     result = perm_add_api_feature(APP_TYPE_OSP, BLAHBLAH_FEATURE[12].c_str(), test13,(const gid_t[]) {0,1,2},0);
 421     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS, "perm_add_api_feature returned: " << result);
 422     result = file_exists(OSP_BLAHBLAH_DAC[12].c_str());
 423     RUNNER_ASSERT_BT(result == -1);
 424     remove_smack_files();
 425
 426
 427     // valid group ids
 428     result = perm_add_api_feature(APP_TYPE_OSP,BLAHBLAH_FEATURE[13].c_str(), test13,(const gid_t[]) {0,1,2},3);
 429     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS, "perm_add_api_feature returned: " << result);
 430     osp_blahblah_dac_check(__LINE__, {0,1,2}, OSP_BLAHBLAH_DAC[13]);
 431     remove_smack_files();
 432
 433     result = perm_add_api_feature(APP_TYPE_OSP, BLAHBLAH_FEATURE[14].c_str(), test13,(const gid_t[]) {0,1,2},1);
 434     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS, "perm_add_api_feature returned: " << result);
 435     osp_blahblah_dac_check(__LINE__, {0}, OSP_BLAHBLAH_DAC[14]);
 436     remove_smack_files();
 437
 438     result = perm_add_api_feature(APP_TYPE_OSP, BLAHBLAH_FEATURE[15].c_str(), test13,(const gid_t[]) {1,1,1},3);
 439     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS, "perm_add_api_feature returned: " << result);
 440     osp_blahblah_dac_check(__LINE__, {1,1,1},OSP_BLAHBLAH_DAC[15]);
 441     remove_smack_files();
 442
 443     DB_END
 444 }
 445
 446 /*
 447  * Check perm_app_uninstall function
 448  */
 449 void check_perm_app_uninstall(const char* pkg_id)
 450 {
 451     int result;
 452
 453     DB_BEGIN
 454
 455     result = perm_app_uninstall(pkg_id);
 456     RUNNER_ASSERT_MSG_BT(result == 0, "perm_app_uninstall returned: " << perm_strerror(result));
 457
 458     DB_END
 459 }
 460
 461 RUNNER_TEST(privilege_control07_app_uninstall)
 462 {
 463     check_perm_app_uninstall(APP_ID);
 464 }
 465
 466 /*
 467  * Check perm_app_install function
 468  */
 469 void check_perm_app_install(const char* pkg_id)
 470 {
 471     int result;
 472
 473     DB_BEGIN
 474
 475     result = perm_app_install(pkg_id);
 476     RUNNER_ASSERT_MSG_BT(result == 0, "perm_app_install returned: " << perm_strerror(result));
 477
 478     DB_END
 479
 480     TestLibPrivilegeControlDatabase db_test;
 481     db_test.test_db_after__perm_app_install(USER_APP_ID);
 482 }
 483
 484 RUNNER_TEST(privilege_control01_app_install)
 485 {
 486     check_perm_app_uninstall(APP_ID);
 487     check_perm_app_install(APP_ID);
 488     // try install second time app with the same ID - it should pass.
 489     check_perm_app_install(APP_ID);
 490 }
 491
 492 /*
 493  * Check perm_rollback function
 494  */
 495 RUNNER_TEST(privilege_control07_app_rollback)
 496 {
 497     check_perm_app_uninstall(APP_ID);
 498
 499     int result;
 500
 501     DB_BEGIN
 502
 503     result = perm_app_install(APP_ID);
 504     RUNNER_ASSERT_MSG_BT(result == 0, "perm_app_install returned: " << perm_strerror(result));
 505
 506     // transaction rollback
 507     result = perm_rollback();
 508     RUNNER_ASSERT_MSG_BT(result == 0, "perm_rollback returned: " << perm_strerror(result));
 509
 510     DB_END
 511 }
 512
 513 RUNNER_TEST(privilege_control07_app_rollback_2)
 514 {
 515     check_perm_app_uninstall(APP_ID);
 516
 517     int result;
 518
 519     DB_BEGIN
 520
 521     result = perm_app_install(APP_ID);
 522     RUNNER_ASSERT_MSG_BT(result == 0, "perm_app_install returned: " << perm_strerror(result));
 523
 524     // transaction rollback
 525     result = perm_rollback();
 526     RUNNER_ASSERT_MSG_BT(result == 0, "perm_rollback returned: " << perm_strerror(result));
 527
 528     // install once again after the rollback
 529     result = perm_app_install(APP_ID);
 530     RUNNER_ASSERT_MSG_BT(result == 0, "perm_app_install returned: " << perm_strerror(result));
 531
 532     DB_END
 533
 534     TestLibPrivilegeControlDatabase db_test;
 535     db_test.test_db_after__perm_app_install(USER_APP_ID);
 536 }
 537
 538 /**
 539  * Grant SMACK permissions based on permissions list.
 540  */
 541 RUNNER_TEST_SMACK(privilege_control11_app_enable_permissions)
 542 {
 543     int result;
 544
 545     // Clean up after test:
 546     DB_BEGIN
 547
 548     result = perm_app_uninstall(WGT_APP_ID);
 549     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS, "perm_app_uninstall returned " << result << ". Errno: " << strerror(errno));
 550     result = perm_app_install(WGT_APP_ID);
 551     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS, "perm_app_install returned " << result << ". Errno: " << strerror(errno));
 552
 553 /**
 554  * Test - Enabling all permissions with persistant mode enabled
 555  */
 556     result = perm_app_revoke_permissions(WGT_APP_ID);
 557     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS,
 558         "Error revoking app permissions. Result: " << result);
 559
 560     result = perm_app_enable_permissions(WGT_APP_ID, APP_TYPE_WGT, PRIVS2, false);
 561     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS,
 562         " Error registering app permissions. Result: " << result);
 563
 564     DB_END
 565
 566     // Check if the accesses are realy applied..
 567     result = test_have_all_accesses(rules2);
 568     RUNNER_ASSERT_MSG_BT(result == 1, "Permissions not added.");
 569
 570     DB_BEGIN
 571
 572     // Clean up
 573     result = perm_app_revoke_permissions(WGT_APP_ID);
 574     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS,
 575         "Error revoking app permissions. Result: " << result);
 576
 577     DB_END
 578
 579 /**
 580  * Test - Enabling all permissions with persistant mode disabled
 581  */
 582
 583     DB_BEGIN
 584     result = perm_app_enable_permissions(WGT_APP_ID, APP_TYPE_WGT, PRIVS2, false);
 585     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS,
 586         " Error registering app permissions. Result: " << result);
 587
 588     result = perm_app_enable_permissions(WGT_APP_ID, APP_TYPE_WGT, PRIVS2, false);
 589     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS,
 590         " Error enabling app permissions. Result: " << result);
 591
 592     DB_END
 593
 594     // Check if the accesses are realy applied..
 595     result = test_have_all_accesses(rules2);
 596     RUNNER_ASSERT_MSG_BT(result == 1, "Permissions not added.");
 597
 598     DB_BEGIN
 599
 600     // Clean up
 601     result = perm_app_revoke_permissions(WGT_APP_ID);
 602     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS,
 603         "Error revoking app permissions. Result: " << result);
 604
 605     DB_END
 606
 607 /**
 608  * Test - Registering new permissions in two complementary files
 609  */
 610
 611     DB_BEGIN
 612
 613     result = perm_app_enable_permissions(WGT_APP_ID, APP_TYPE_WGT, PRIVS2_R_AND_NO_R, false);
 614     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS,
 615         " Error registering app permissions. Result: " << result);
 616
 617     DB_END
 618
 619     // Check if the accesses are realy applied..
 620     result = test_have_all_accesses(rules2_no_r);
 621     RUNNER_ASSERT_MSG_BT(result == 1, "Permissions not added.");
 622
 623     DB_BEGIN
 624
 625     // Clean up
 626     result = perm_app_revoke_permissions(WGT_APP_ID);
 627     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS,
 628         "Error revoking app permissions. Result: " << result);
 629
 630     DB_END
 631
 632 /**
 633  * Test - Enabling some permissions and then enabling complementary permissions
 634  */
 635
 636     DB_BEGIN
 637
 638     // Register permission for rules 2 no r
 639     result = perm_app_enable_permissions(WGT_APP_ID, APP_TYPE_WGT, PRIVS2_NO_R, false);
 640     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS,
 641         " Error registering app permissions without r. Result: " << result);
 642
 643     DB_END
 644
 645     // Check if the accesses are realy applied..
 646     result = test_have_all_accesses(rules2_no_r);
 647     RUNNER_ASSERT_MSG_BT(result == 1, "Permissions without r not added.");
 648
 649     DB_BEGIN
 650
 651     // Register permission for rules 2
 652     result = perm_app_enable_permissions(WGT_APP_ID, APP_TYPE_WGT, PRIVS2, false);
 653     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS,
 654         " Error registering app all permissions. Result: " << result);
 655
 656     DB_END
 657
 658     // Check if the accesses are realy applied..
 659     result = test_have_all_accesses(rules2);
 660     RUNNER_ASSERT_MSG_BT(result == 1, "Permissions all not added.");
 661
 662     DB_BEGIN
 663
 664     // Clean up
 665     result = perm_app_revoke_permissions(WGT_APP_ID);
 666     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS,
 667         "Error revoking app permissions. Result: " << result);
 668
 669 /**
 670  * Test - Enabling some permissions and then enabling all permissions
 671  */
 672
 673     // Enable permission for rules 2 no r
 674     result = perm_app_enable_permissions(WGT_APP_ID, APP_TYPE_WGT, PRIVS2_NO_R, false);
 675     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS,
 676         " Error registering app permissions without r. Result: " << result);
 677
 678     DB_END
 679
 680     // Check if the accesses are realy applied..
 681     result = test_have_all_accesses(rules2_no_r);
 682     RUNNER_ASSERT_MSG_BT(result == 1, "Permissions without r not added.");
 683
 684     DB_BEGIN
 685
 686     // Enable permission for rules 2
 687     result = perm_app_enable_permissions(WGT_APP_ID, APP_TYPE_WGT, PRIVS2_R, false);
 688     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS,
 689         " Error registering app permissions with only r. Result: " << result);
 690
 691     DB_END
 692
 693     // Check if the accesses are realy applied..
 694     result = test_have_all_accesses(rules2_r);
 695     RUNNER_ASSERT_MSG_BT(result == 1, "Permissions with only r not added.");
 696
 697     DB_BEGIN
 698
 699     // Clean up
 700     result = perm_app_revoke_permissions(WGT_APP_ID);
 701     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS,
 702         "Error revoking app permissions. Result: " << result);
 703
 704
 705
 706     // Clean up after test:
 707     result = perm_app_uninstall(WGT_APP_ID);
 708     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS, "perm_app_uninstall returned " << result << ". Errno: " << strerror(errno));
 709
 710     DB_END
 711 }
 712
 713 RUNNER_CHILD_TEST_SMACK(privilege_control11_app_enable_permissions_efl)
 714 {
 715     test_app_enable_permissions_efl(true);
 716 }
 717
 718 /*
 719  * Check perm_app_install function
 720  */
 721 RUNNER_CHILD_TEST_SMACK(privilege_control12_app_disable_permissions_efl)
 722 {
 723     test_app_disable_permissions_efl(true);
 724 }
 725
 726
 727 /**
 728  * Remove previously granted SMACK permissions based on permissions list.
 729  */
 730 RUNNER_TEST_SMACK(privilege_control12_app_disable_permissions)
 731 {
 732     test_app_disable_permissions(true);
 733 }
 734
 735 /**
 736  * Reset SMACK permissions for an application by revoking all previously
 737  * granted rules and enabling them again from a rules file from disk.
 738  */
 739 // TODO: This test is incomplete.
 740 RUNNER_TEST_SMACK(privilege_control13_app_reset_permissions)
 741 {
 742     int result;
 743
 744 /**
 745  * Test - doing reset and checking if rules exist again.
 746  */
 747
 748     DB_BEGIN
 749
 750     result = perm_app_install(WGT_APP_ID);
 751     RUNNER_ASSERT_MSG_BT(result == 0, "perm_app_install returned " << result << ". Errno: " << strerror(errno));
 752
 753     // Disable permissions
 754     result = perm_app_disable_permissions(WGT_APP_ID, APP_TYPE_WGT, PRIVS2);
 755     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS,
 756         "Error disabling app permissions. Result: " << result);
 757
 758     // Prepare permissions to reset
 759     result = perm_app_enable_permissions(WGT_APP_ID, APP_TYPE_WGT, PRIVS2, true);
 760     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS,
 761         " Error registering app permissions. Result: " << result);
 762
 763     // Reset permissions
 764     result = perm_app_reset_permissions(WGT_APP_ID);
 765     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS,
 766         "Error reseting app permissions. Result: " << result);
 767
 768     DB_END
 769
 770     // Are all second permissions not disabled?
 771     result = test_have_all_accesses(rules2);
 772     RUNNER_ASSERT_MSG_BT(result == 1, "Not all permissions added.");
 773
 774     DB_BEGIN
 775
 776     // Disable permissions
 777     result = perm_app_disable_permissions(WGT_APP_ID, APP_TYPE_WGT, PRIVS2);
 778     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS,
 779         "Error disabling app permissions. Result: " << result);
 780
 781     result = perm_app_uninstall(WGT_APP_ID);
 782     RUNNER_ASSERT_MSG_BT(result == 0, "perm_app_uninstall returned " << result << ". Errno: " << strerror(errno));
 783
 784     DB_END
 785 }
 786
 787 static void smack_set_random_label_based_on_pid_on_self(void)
 788 {
 789     int result;
 790     std::stringstream ss;
 791
 792     ss << "s-" << getpid() << "-" << getppid();
 793     result = smack_set_label_for_self(ss.str().c_str());
 794     RUNNER_ASSERT_MSG_BT(result == 0, "smack_set_label_for_self("
 795         << ss.str().c_str() << ") failed");
 796 }
 797
 798 static void smack_unix_sock_server(int sock)
 799 {
 800     int fd, result;
 801     char *smack_label;
 802
 803     alarm(2);
 804     fd = accept(sock, NULL, NULL);
 805     alarm(0);
 806     if (fd < 0)
 807         return;
 808     result = smack_new_label_from_self(&smack_label);
 809     if (result < 0) {
 810         close(fd);
 811         close(sock);
 812         free(smack_label);
 813         RUNNER_ASSERT_MSG_BT(0, "smack_new_label_from_self() failed");
 814     }
 815     result = write(fd, smack_label, strlen(smack_label));
 816     if (result != (int)strlen(smack_label)) {
 817         close(fd);
 818         close(sock);
 819         free(smack_label);
 820         RUNNER_ASSERT_MSG_BT(0, "write() failed: " << strerror(errno));
 821     }
 822     close(fd);
 823     free(smack_label);
 824 }
 825
 826 RUNNER_MULTIPROCESS_TEST_SMACK(privilege_control15_app_id_from_socket)
 827 {
 828     int pid;
 829     struct sockaddr_un sockaddr = {AF_UNIX, SOCK_PATH};
 830
 831     unlink(SOCK_PATH);
 832     pid = fork();
 833     RUNNER_ASSERT_MSG_BT(pid >= 0, "Fork failed");
 834
 835     smack_set_random_label_based_on_pid_on_self();
 836
 837     if (!pid) { /* child process, server */
 838         int sock, result;
 839
 840         /* Set the process label before creating a socket */
 841         sock = socket(AF_UNIX, SOCK_STREAM, 0);
 842         RUNNER_ASSERT_MSG_BT(sock >= 0, "socket failed: " << strerror(errno));
 843         result = bind(sock,
 844             (struct sockaddr*) &sockaddr, sizeof(struct sockaddr_un));
 845         if (result != 0) {
 846             close(sock);
 847             RUNNER_ASSERT_MSG_BT(0, "bind failed: " << strerror(errno));
 848         }
 849         result = listen(sock, 1);
 850         if (result != 0) {
 851             close(sock);
 852             RUNNER_ASSERT_MSG_BT(0, "listen failed: " << strerror(errno));
 853         }
 854         smack_unix_sock_server(sock);
 855
 856         /* Change the process label with listening socket */
 857         smack_unix_sock_server(sock);
 858
 859         pid = fork();
 860         RUNNER_ASSERT_MSG_BT(pid >= 0, "Fork failed");
 861         /* Now running two concurrent servers.
 862            Test if socket label was unaffected by fork() */
 863         smack_unix_sock_server(sock);
 864         /* Let's give the two servers different labels */
 865         smack_unix_sock_server(sock);
 866         close(sock);
 867
 868         exit(0);
 869     } else { /* parent process, client */
 870         sleep(1); /* Give server some time to setup listening socket */
 871         int i;
 872         for (i = 0; i < 4; ++i) {
 873             int sock;
 874             int result;
 875             char smack_label1[SMACK_LABEL_LEN + 1];
 876             char *smack_label2;
 877
 878             sock = socket(AF_UNIX, SOCK_STREAM, 0);
 879             RUNNER_ASSERT_MSG_BT(sock >= 0,
 880                 "socket failed: " << strerror(errno));
 881             result = connect(sock,
 882                 (struct sockaddr*) &sockaddr, sizeof(struct sockaddr_un));
 883             if (result != 0) {
 884                 close(sock);
 885                 RUNNER_ASSERT_MSG_BT(0, "connect failed: " << strerror(errno));
 886             }
 887
 888             alarm(2);
 889             result = read(sock, smack_label1, SMACK_LABEL_LEN);
 890             alarm(0);
 891             if (result < 0) {
 892                 close(sock);
 893                 RUNNER_ASSERT_MSG_BT(0, "read failed: " << strerror(errno));
 894             }
 895             smack_label1[result] = '\0';
 896             smack_label2 = perm_app_id_from_socket(sock);
 897             if (smack_label2 == NULL) {
 898                 close(sock);
 899                 RUNNER_ASSERT_MSG_BT(0, "perm_app_id_from_socket failed");
 900             }
 901             result = strcmp(smack_label1, smack_label2);
 902             if (result != 0) {
 903                 close(sock);
 904                 RUNNER_ASSERT_MSG_BT(0, "smack labels differ: '" << smack_label1
 905                     << "' != '" << smack_label2 << "-" << random() << "'");
 906             }
 907             close(sock);
 908         }
 909     }
 910 }
 911
 912 RUNNER_TEST(privilege_control16_app_setup_path){
 913     const char *path1 = "/usr/share/privilege-control/app_setup_access_test";
 914     const char *path2 = "/usr/share/privilege-control/app_setup_access_test/directory";
 915     const char *path3 = "/usr/share/privilege-control/app_setup_access_test/one";
 916     const char *path4 = "/usr/share/privilege-control/app_setup_access_test/directory/two";
 917     const char *label1 = "qwert123456za";
 918     const char *label2 = "trewq654123az";
 919
 920     CStringPtr labelPtr;
 921
 922     mkdir(path1,0);
 923     mkdir(path2,0);
 924
 925     int fd = creat(path3, S_IRWXU);
 926     if (fd >= 0)
 927         close(fd);
 928     fd = creat(path4, S_IRWXU);
 929     if (fd >= 0)
 930         close(fd);
 931
 932     char *label = NULL;
 933
 934     DB_BEGIN
 935
 936     RUNNER_ASSERT_BT(PC_OPERATION_SUCCESS == perm_app_setup_path("somepackageid", path1, APP_PATH_ANY_LABEL, label1));
 937
 938     DB_END
 939
 940     RUNNER_ASSERT_BT(0 == smack_lgetlabel(path3, &label, SMACK_LABEL_ACCESS));
 941     labelPtr.reset(label);
 942     label = NULL;
 943     RUNNER_ASSERT_BT(0 == strcmp(labelPtr.get(), label1));
 944
 945     DB_BEGIN
 946
 947     RUNNER_ASSERT_BT(PC_OPERATION_SUCCESS == perm_app_setup_path("somepackageid", path1, APP_PATH_ANY_LABEL, label2));
 948
 949     DB_END
 950
 951     RUNNER_ASSERT_BT(0 == smack_lgetlabel(path4, &label, SMACK_LABEL_EXEC));
 952     labelPtr.reset(label);
 953     label = NULL;
 954     RUNNER_ASSERT_BT(0 == strcmp(labelPtr.get(), label2));
 955
 956     RUNNER_ASSERT_BT(0 == smack_lgetlabel(path1, &label, SMACK_LABEL_EXEC));
 957     labelPtr.reset(label);
 958     label = NULL;
 959     RUNNER_ASSERT_BT(labelPtr.get() == NULL);
 960 }
 961
 962 RUNNER_TEST_SMACK(privilege_control17_appsettings_privilege)
 963 {
 964     test_appsettings_privilege(true);
 965 }
 966
 967 void test_app_setup_path(int line_no, app_path_type_t PATH_TYPE) {
 968     int result;
 969
 970     DB_BEGIN
 971
 972     result = perm_app_uninstall(APP_ID);
 973     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS, "Line: " << line_no <<
 974             " Error in perm_app_uninstall." << result);
 975
 976     result = perm_app_install(APP_ID);
 977     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS, "Line: " << line_no <<
 978             " Error in perm_app_install." << result);
 979
 980     DB_END
 981
 982     result = nftw(TEST_APP_DIR, &nftw_remove_labels, FTW_MAX_FDS, FTW_PHYS);
 983     RUNNER_ASSERT_MSG_BT(result == 0, "Line: " << line_no <<
 984             " Unable to clean up Smack labels in " << TEST_APP_DIR);
 985
 986     result = nftw(TEST_NON_APP_DIR, &nftw_set_labels_non_app_dir, FTW_MAX_FDS, FTW_PHYS);
 987     RUNNER_ASSERT_MSG_BT(result == 0, "Line: " << line_no <<
 988             " Unable to clean up Smack labels in " << TEST_NON_APP_DIR);
 989
 990     DB_BEGIN
 991
 992     result = perm_app_setup_path(APP_ID, TEST_APP_DIR, PATH_TYPE);
 993     RUNNER_ASSERT_MSG_BT(result == 0, "Line: " << line_no <<
 994             " perm_app_setup_path() failed");
 995
 996     DB_END
 997
 998     result = nftw(TEST_NON_APP_DIR, &nftw_check_labels_non_app_dir, FTW_MAX_FDS, FTW_PHYS);
 999     RUNNER_ASSERT_MSG_BT(result == 0, "Line: " << line_no <<
1000             " Unable to check Smack labels for non-app dir");
1001
1002     DB_BEGIN
1003
1004     result = perm_app_uninstall(APP_ID);
1005     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS, "Line: " << line_no <<
1006             " Error in perm_app_uninstall." << result);
1007
1008     DB_END
1009 }
1010
1011 RUNNER_TEST_SMACK(privilege_control18_app_setup_path_public)
1012 {
1013     test_app_setup_path(__LINE__, APP_PATH_PUBLIC_RO);
1014 }
1015
1016 RUNNER_TEST_SMACK(privilege_control19_app_setup_path_settings)
1017 {
1018     test_app_setup_path(__LINE__, APP_PATH_SETTINGS_RW);
1019 }
1020
1021 void check_perm_app_has_permission(const char* app_label, const char* permission, bool is_enabled_expected)
1022 {
1023     int result;
1024     bool is_enabled;
1025
1026     result = perm_app_has_permission(app_label, APP_TYPE_WGT, permission, &is_enabled);
1027     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS,
1028             "Error calling perm_app_has_permission. Result: " << result);
1029
1030     RUNNER_ASSERT_MSG_BT(is_enabled == is_enabled_expected,
1031             "Result of perm_app_has_permission should be: " << is_enabled_expected);
1032 }
1033
1034 RUNNER_TEST(privilege_control20_perm_app_has_permission)
1035 {
1036     int result;
1037     const char *other_app_label = "test_other_app_label";
1038
1039     DB_BEGIN
1040
1041     result = perm_app_uninstall(WGT_APP_ID);
1042     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS,
1043             "Error uninstalling app. Result" << result);
1044
1045     result = perm_app_install(WGT_APP_ID);
1046     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS,
1047             "Error installing app. Result" << result);
1048
1049     result = perm_app_disable_permissions(WGT_APP_ID, APP_TYPE_WGT, PRIVS2_R_AND_NO_R);
1050     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS,
1051             "Error disabling app r and no r permissions. Result: " << result);
1052
1053     DB_END
1054
1055     check_perm_app_has_permission(USER_APP_ID, PRIVS2_R[0], false);
1056     check_perm_app_has_permission(USER_APP_ID, PRIVS2_NO_R[0], false);
1057     check_perm_app_has_permission(other_app_label, PRIVS2_R[0], false);
1058     check_perm_app_has_permission(other_app_label, PRIVS2_NO_R[0], false);
1059
1060     DB_BEGIN
1061
1062     result = perm_app_enable_permissions(WGT_APP_ID, APP_TYPE_WGT, PRIVS2_R, false);
1063     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS,
1064             "Error registering app r permissions. Result: " << result);
1065
1066     DB_END
1067
1068     check_perm_app_has_permission(USER_APP_ID, PRIVS2_R[0], true);
1069     check_perm_app_has_permission(USER_APP_ID, PRIVS2_NO_R[0], false);
1070     check_perm_app_has_permission(other_app_label, PRIVS2_R[0], false);
1071     check_perm_app_has_permission(other_app_label, PRIVS2_NO_R[0], false);
1072
1073     DB_BEGIN
1074
1075     result = perm_app_enable_permissions(WGT_APP_ID, APP_TYPE_WGT, PRIVS2_NO_R, false);
1076     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS,
1077             "Error registering app r permissions. Result: " << result);
1078
1079     DB_END
1080
1081     check_perm_app_has_permission(USER_APP_ID, PRIVS2_R[0], true);
1082     check_perm_app_has_permission(USER_APP_ID, PRIVS2_NO_R[0], true);
1083     check_perm_app_has_permission(other_app_label, PRIVS2_R[0], false);
1084     check_perm_app_has_permission(other_app_label, PRIVS2_NO_R[0], false);
1085
1086     DB_BEGIN
1087
1088     result = perm_app_disable_permissions(WGT_APP_ID, APP_TYPE_WGT, PRIVS2_R);
1089     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS,
1090             "Error disabling app r and no r permissions. Result: " << result);
1091
1092     DB_END
1093
1094     check_perm_app_has_permission(USER_APP_ID, PRIVS2_R[0], false);
1095     check_perm_app_has_permission(USER_APP_ID, PRIVS2_NO_R[0], true);
1096     check_perm_app_has_permission(other_app_label, PRIVS2_R[0], false);
1097     check_perm_app_has_permission(other_app_label, PRIVS2_NO_R[0], false);
1098
1099     DB_BEGIN
1100
1101     result = perm_app_disable_permissions(WGT_APP_ID, APP_TYPE_WGT, PRIVS2_NO_R);
1102     RUNNER_ASSERT_MSG_BT(result == PC_OPERATION_SUCCESS,
1103             "Error disabling app r and no r permissions. Result: " << result);
1104
1105     DB_END
1106
1107     check_perm_app_has_permission(USER_APP_ID, PRIVS2_R[0], false);
1108     check_perm_app_has_permission(USER_APP_ID, PRIVS2_NO_R[0], false);
1109     check_perm_app_has_permission(other_app_label, PRIVS2_R[0], false);
1110     check_perm_app_has_permission(other_app_label, PRIVS2_NO_R[0], false);
1111 }
1112
1113 RUNNER_TEST(privilege_control25_test_libprivilege_strerror) {
1114     int POSITIVE_ERROR_CODE = 1;
1115     int NONEXISTING_ERROR_CODE = -239042;
1116     const char *result;
1117
1118     for (auto itr = error_codes.begin(); itr != error_codes.end(); ++itr) {
1119         RUNNER_ASSERT_MSG_BT(strcmp(perm_strerror(*itr), "Unknown error") != 0,
1120                 "Returned invalid error code description.");
1121     }
1122
1123     result = perm_strerror(POSITIVE_ERROR_CODE);
1124     RUNNER_ASSERT_MSG_BT(strcmp(result, "Unknown error") == 0,
1125             "Bad message returned for invalid error code: \"" << result << "\"");
1126
1127     result = perm_strerror(NONEXISTING_ERROR_CODE);
1128     RUNNER_ASSERT_MSG_BT(strcmp(result, "Unknown error") == 0,
1129             "Bad message returned for invalid error code: \"" << result << "\"");
1130 }