tests/security-server-tests/cookie_api.cpp

   1 /*
   2  * Copyright (c) 2013 Samsung Electronics Co., Ltd All Rights Reserved
   3  */
   4
   5 /*
   6  * @file    security_server_tests_cookie_api.cpp
   7  * @author  Pawel Polawski (p.polawski@partner.samsung.com)
   8  * @version 1.0
   9  * @brief   Test cases for security server cookie api
  10  *
  11  */
  12
  13 /*
  14 Tested API functions in this file:
  15
  16 Protected by "security-server::api-cookie-get" label:
  17     int security_server_get_cookie_size(void);
  18     int security_server_request_cookie(char *cookie, size_t bufferSize);
  19
  20
  21 Protected by "security-server::api-cookie-check" label:
  22     int security_server_check_privilege(const char *cookie, gid_t privilege);
  23     int security_server_check_privilege_by_cookie(const char *cookie,
  24                                                   const char *object,
  25                                                   const char *access_rights);
  26     int security_server_get_cookie_pid(const char *cookie);
  27     char *security_server_get_smacklabel_cookie(const char *cookie);
  28     int security_server_get_uid_by_cookie(const char *cookie, uid_t *uid);
  29     int security_server_get_gid_by_cookie(const char *cookie, gid_t *gid);
  30 */
  31
  32 #include <dpl/test/test_runner.h>
  33 #include <dpl/test/test_runner_multiprocess.h>
  34 #include <tests_common.h>
  35 #include <sys/smack.h>
  36 #include <cstddef>
  37 #include <sys/types.h>
  38 #include <unistd.h>
  39 #include <access_provider.h>
  40 #include <security-server.h>
  41 #include <smack_access.h>
  42
  43 const char *ROOT_USER = "root";
  44 const char *PROC_AUDIO_GROUP_NAME = "audio";
  45
  46 typedef std::unique_ptr<char, void(*)(void *)> UniquePtrCstring;
  47 const int KNOWN_COOKIE_SIZE = 20;
  48 typedef std::vector<char> Cookie;
  49
  50 Cookie getCookieFromSS() {
  51     Cookie cookie(security_server_get_cookie_size());
  52
  53     RUNNER_ASSERT_MSG_BT(SECURITY_SERVER_API_SUCCESS ==
  54             security_server_request_cookie(cookie.data(), cookie.size()),
  55         "Error in security_server_request_cookie.");
  56
  57     return cookie;
  58 }
  59
  60 RUNNER_TEST_GROUP_INIT(COOKIE_API_TESTS)
  61
  62 /*
  63  * **************************************************************************
  64  * Test cases fot check various functions input params cases
  65  * **************************************************************************
  66  */
  67
  68 //---------------------------------------------------------------------------
  69 //passing NULL as a buffer pointer
  70 RUNNER_CHILD_TEST(tc_arguments_01_01_security_server_request_cookie)
  71 {
  72     int ret = security_server_request_cookie(NULL, KNOWN_COOKIE_SIZE);
  73     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_INPUT_PARAM,
  74                       "Error in security_server_request_cookie() argument checking: " << ret);
  75 }
  76
  77 //passing too small value as a buffer size
  78 RUNNER_CHILD_TEST(tc_arguments_01_02_security_server_request_cookie)
  79 {
  80     Cookie cookie(KNOWN_COOKIE_SIZE);
  81
  82     int ret = security_server_request_cookie(cookie.data(), KNOWN_COOKIE_SIZE - 1);
  83     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_BUFFER_TOO_SMALL,
  84                       "Error in security_server_request_cookie() argument checking: " << ret);
  85 }
  86
  87 //---------------------------------------------------------------------------
  88 //passing NULL as a cookie pointer
  89 RUNNER_CHILD_TEST(tc_arguments_02_01_security_server_check_privilege)
  90 {
  91     int ret = security_server_check_privilege(NULL, 0);
  92     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_INPUT_PARAM,
  93                       "Error in security_server_check_privilege() argument checking: " << ret);
  94 }
  95
  96 //---------------------------------------------------------------------------
  97 //passing NULL as a cookie pointer
  98 RUNNER_CHILD_TEST(tc_arguments_03_01_security_server_check_privilege_by_cookie)
  99 {
 100     int ret = security_server_check_privilege_by_cookie(NULL, "wiadro", "rwx");
 101     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_INPUT_PARAM,
 102                       "Error in security_server_check_privilege_by_cookie() argument checking: "
 103                       << ret);
 104 }
 105
 106 //passing NULL as an object pointer
 107 RUNNER_CHILD_TEST(tc_arguments_03_02_security_server_check_privilege_by_cookie)
 108 {
 109     Cookie cookie = getCookieFromSS();
 110
 111     int ret = security_server_check_privilege_by_cookie(cookie.data(), NULL, "rwx");
 112     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_INPUT_PARAM,
 113                       "Error in security_server_check_privilege_by_cookie() argument checking: "
 114                       << ret);
 115 }
 116
 117 //passing NULL as an access pointer
 118 RUNNER_CHILD_TEST(tc_arguments_03_03_security_server_check_privilege_by_cookie)
 119 {
 120     Cookie cookie = getCookieFromSS();
 121
 122     int ret = security_server_check_privilege_by_cookie(cookie.data(), "wiadro", NULL);
 123     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_INPUT_PARAM,
 124                       "Error in security_server_check_privilege_by_cookie() argument checking: "
 125                       << ret);
 126 }
 127
 128 //---------------------------------------------------------------------------
 129 //passing NULL as a cookie pointer
 130 RUNNER_CHILD_TEST(tc_arguments_04_01_security_server_get_cookie_pid)
 131 {
 132     int ret = security_server_get_cookie_pid(NULL);
 133     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_INPUT_PARAM,
 134                       "Error in security_server_get_cookie_pid() argument checking: " << ret);
 135 }
 136
 137 //getting pid of non existing cookie
 138 RUNNER_TEST(tc_arguments_04_02_security_server_get_cookie_pid)
 139 {
 140     const char wrong_cookie[KNOWN_COOKIE_SIZE] = {'w', 'a', 't', '?'};
 141     RUNNER_ASSERT_BT(security_server_get_cookie_pid(wrong_cookie) ==
 142                   SECURITY_SERVER_API_ERROR_NO_SUCH_COOKIE);
 143 }
 144
 145 //---------------------------------------------------------------------------
 146 //passing NULL as a cookie pointer
 147 RUNNER_CHILD_TEST(tc_arguments_05_01_security_server_get_smacklabel_cookie)
 148 {
 149     char *label = NULL;
 150     label = security_server_get_smacklabel_cookie(NULL);
 151     RUNNER_ASSERT_MSG_BT(label == NULL,
 152                       "Error in security_server_get_smacklabel_cookie() argument checking");
 153 }
 154
 155 //---------------------------------------------------------------------------
 156 //passing NULL as a cookie pointer
 157 RUNNER_CHILD_TEST(tc_arguments_06_01_security_server_get_uid_by_cookie)
 158 {
 159     uid_t uid;
 160     int ret = security_server_get_uid_by_cookie(NULL, &uid);
 161     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_INPUT_PARAM,
 162                       "Error in security_server_get_uid_by_cookie() argument checking: "
 163                       << ret);
 164 }
 165
 166 //passing NULL as an uid pointer
 167 RUNNER_CHILD_TEST(tc_arguments_06_02_security_server_get_uid_by_cookie)
 168 {
 169     Cookie cookie = getCookieFromSS();
 170
 171     int ret = security_server_get_uid_by_cookie(cookie.data(), NULL);
 172     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_INPUT_PARAM,
 173                       "Error in security_server_get_uid_by_cookie() argument checking: "
 174                       << ret);
 175 }
 176
 177 //---------------------------------------------------------------------------
 178 //passing NULL as an cookie pointer
 179 RUNNER_CHILD_TEST(tc_arguments_07_01_security_server_get_gid_by_cookie)
 180 {
 181     gid_t gid;
 182     int ret = security_server_get_gid_by_cookie(NULL, &gid);
 183     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_INPUT_PARAM,
 184                       "Error in security_server_get_gid_by_cookie() argument checking: "
 185                       << ret);
 186 }
 187
 188 //passing NULL as an gid pointer
 189 RUNNER_CHILD_TEST(tc_arguments_07_02_security_server_get_gid_by_cookie)
 190 {
 191     Cookie cookie = getCookieFromSS();
 192
 193     int ret = security_server_get_gid_by_cookie(cookie.data(), NULL);
 194     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_INPUT_PARAM,
 195                       "Error in security_server_get_gid_by_cookie() argument checking: "
 196                       << ret);
 197 }
 198
 199
 200
 201 /*
 202  * **************************************************************************
 203  * Unit tests for each function from API
 204  * **************************************************************************
 205  */
 206
 207 //---------------------------------------------------------------------------
 208 //root has access to API
 209 RUNNER_CHILD_TEST(tc_unit_01_01_security_server_get_cookie_size)
 210 {
 211     int ret = security_server_get_cookie_size();
 212     RUNNER_ASSERT_MSG_BT(ret == KNOWN_COOKIE_SIZE,
 213                       "Error in security_server_get_cookie_size(): " << ret);
 214 }
 215
 216 //---------------------------------------------------------------------------
 217 // security_server_get_cookie_size() is no longer ptotected by SMACK
 218 RUNNER_CHILD_TEST(tc_unit_01_02_security_server_get_cookie_size)
 219 {
 220     SecurityServer::AccessProvider provider("selflabel_01_02");
 221     provider.applyAndSwithToUser(APP_UID, APP_GID);
 222
 223     int ret = security_server_get_cookie_size();
 224     RUNNER_ASSERT_MSG_BT(ret == KNOWN_COOKIE_SIZE,
 225                       "Error in security_server_get_cookie_size(): " << ret);
 226 }
 227
 228 //---------------------------------------------------------------------------
 229 //root has access to API
 230 RUNNER_CHILD_TEST(tc_unit_02_01_security_server_request_cookie)
 231 {
 232     int cookieSize = security_server_get_cookie_size();
 233     RUNNER_ASSERT_MSG_BT(cookieSize == KNOWN_COOKIE_SIZE,
 234                       "Error in security_server_get_cookie_size(): " << cookieSize);
 235
 236     Cookie cookie(cookieSize);
 237     int ret = security_server_request_cookie(cookie.data(), cookie.size());
 238     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS,
 239                       "Error in security_server_request_cookie(): " << ret);
 240 }
 241
 242 //---------------------------------------------------------------------------
 243 //root has access to API
 244 RUNNER_CHILD_TEST(tc_unit_03_01_security_server_check_privilege)
 245 {
 246     Cookie cookie = getCookieFromSS();
 247
 248     int ret = security_server_check_privilege(cookie.data(), 0);
 249     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS,
 250                       "Error in security_server_check_privilege(): " << ret);
 251 }
 252
 253 //privileges drop and no smack rule
 254 RUNNER_CHILD_TEST_SMACK(tc_unit_03_02_security_server_check_privilege)
 255 {
 256     Cookie cookie = getCookieFromSS();
 257
 258     SecurityServer::AccessProvider provider("selflabel_03_02");
 259     provider.applyAndSwithToUser(APP_UID, APP_GID);
 260
 261     int ret = security_server_check_privilege(cookie.data(), 0);
 262     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_ACCESS_DENIED,
 263                       "Error in security_server_check_privilege(): " << ret);
 264 }
 265
 266 //privileges drop and added smack rule
 267 RUNNER_CHILD_TEST_SMACK(tc_unit_03_03_security_server_check_privilege)
 268 {
 269     Cookie cookie = getCookieFromSS();
 270
 271     SecurityServer::AccessProvider provider("selflabel_03_03");
 272     provider.allowFunction("security_server_check_privilege");
 273     provider.applyAndSwithToUser(APP_UID, APP_GID);
 274
 275     int ret = security_server_check_privilege(cookie.data(), 0);
 276     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS,
 277                       "Error in security_server_check_privilege(): " << ret);
 278 }
 279
 280 // invalid gid
 281 RUNNER_CHILD_TEST(tc_unit_03_04_security_server_check_privilege_neg)
 282 {
 283     remove_process_group(PROC_AUDIO_GROUP_NAME);
 284
 285     Cookie cookie = getCookieFromSS();
 286     int audio_gid = security_server_get_gid(PROC_AUDIO_GROUP_NAME);
 287     RUNNER_ASSERT_MSG_BT(audio_gid > -1,
 288                          "security_server_get_gid() failed. result = " << audio_gid);
 289
 290     int ret = security_server_check_privilege(cookie.data(), audio_gid);
 291
 292     // security_server_check_privilege fails, because the process does not belong to "audio" group
 293     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_ACCESS_DENIED, "ret: " << ret);
 294 }
 295
 296 // add gid
 297 RUNNER_CHILD_TEST(tc_unit_03_05_security_server_check_privilege)
 298 {
 299     add_process_group(PROC_AUDIO_GROUP_NAME);
 300
 301     Cookie cookie = getCookieFromSS();
 302     int audio_gid = security_server_get_gid(PROC_AUDIO_GROUP_NAME);
 303     RUNNER_ASSERT_MSG_BT(audio_gid > -1,
 304                          "security_server_get_gid() failed. result = " << audio_gid);
 305
 306     int ret = security_server_check_privilege(cookie.data(), audio_gid);
 307     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret: " << ret);
 308 }
 309
 310 // test invalid cookie name
 311 RUNNER_TEST(tc_unit_03_06_security_server_check_privilege)
 312 {
 313     // create invalid cookie
 314     int size = security_server_get_cookie_size();
 315     RUNNER_ASSERT_MSG_BT(size == KNOWN_COOKIE_SIZE, "Wrong cookie size. size = " << size);
 316
 317     Cookie cookie(size);
 318     cookie[0] = 'a';
 319     int ret = security_server_check_privilege(cookie.data(), 0);
 320     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_ACCESS_DENIED, "ret: " << ret);
 321 }
 322
 323 //---------------------------------------------------------------------------
 324 //root has access to API
 325 RUNNER_CHILD_TEST(tc_unit_05_01_security_server_get_cookie_pid)
 326 {
 327     Cookie cookie = getCookieFromSS();
 328
 329     int ret = security_server_get_cookie_pid(cookie.data());
 330     RUNNER_ASSERT_MSG_BT(ret > -1, "Error in security_server_get_cookie_pid(): " << ret);
 331
 332     int pid = getpid();
 333     RUNNER_ASSERT_MSG_BT(pid == ret, "No match in PID received from cookie");
 334 }
 335
 336 //privileges drop and no smack rule
 337 RUNNER_CHILD_TEST_SMACK(tc_unit_05_02_security_server_get_cookie_pid)
 338 {
 339     Cookie cookie = getCookieFromSS();
 340
 341     SecurityServer::AccessProvider provider("selflabel_05_02");
 342     provider.applyAndSwithToUser(APP_UID, APP_GID);
 343
 344     int ret = security_server_get_cookie_pid(cookie.data());
 345     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_ACCESS_DENIED,
 346                       "Error in security_server_get_cookie_pid(): " << ret);
 347 }
 348
 349 //privileges drop and added smack rule
 350 RUNNER_CHILD_TEST_SMACK(tc_unit_05_03_security_server_get_cookie_pid)
 351 {
 352     Cookie cookie = getCookieFromSS();
 353
 354     SecurityServer::AccessProvider provider("selflabel_05_03");
 355     provider.allowFunction("security_server_get_cookie_pid");
 356     provider.applyAndSwithToUser(APP_UID, APP_GID);
 357
 358     int ret = security_server_get_cookie_pid(cookie.data());
 359     RUNNER_ASSERT_MSG_BT(ret > -1, "Error in security_server_get_cookie_pid(): " << ret);
 360
 361     int pid = getpid();
 362     RUNNER_ASSERT_MSG_BT(pid == ret, "No match in PID received from cookie");
 363 }
 364
 365 //---------------------------------------------------------------------------
 366 //root has access to API
 367 RUNNER_CHILD_TEST(tc_unit_06_01_security_server_get_smacklabel_cookie)
 368 {
 369     setLabelForSelf(__LINE__, "selflabel_06_01");
 370
 371     Cookie cookie = getCookieFromSS();
 372
 373     UniquePtrCstring label(security_server_get_smacklabel_cookie(cookie.data()), free);
 374     RUNNER_ASSERT_MSG_BT(strcmp(label.get(), "selflabel_06_01") == 0,
 375                       "No match in smack label received from cookie, received label: "
 376                       << label.get());
 377 }
 378
 379 //privileges drop and no smack rule
 380 RUNNER_CHILD_TEST_SMACK(tc_unit_06_02_security_server_get_smacklabel_cookie)
 381 {
 382     Cookie cookie = getCookieFromSS();
 383
 384     SecurityServer::AccessProvider provider("selflabel_06_02");
 385     provider.applyAndSwithToUser(APP_UID, APP_GID);
 386
 387     UniquePtrCstring label(security_server_get_smacklabel_cookie(cookie.data()), free);
 388     RUNNER_ASSERT_MSG_BT(label.get() == NULL,
 389                       "NULL should be received due to access denied, received label: "
 390                       << label.get());
 391 }
 392
 393 //privileges drop and added smack rule
 394 RUNNER_CHILD_TEST_SMACK(tc_unit_06_03_security_server_get_smacklabel_cookie)
 395 {
 396     SecurityServer::AccessProvider provider("selflabel_06_03");
 397     provider.allowFunction("security_server_get_smacklabel_cookie");
 398     provider.applyAndSwithToUser(APP_UID, APP_GID);
 399
 400     Cookie cookie = getCookieFromSS();
 401
 402     UniquePtrCstring label(security_server_get_smacklabel_cookie(cookie.data()), free);
 403     RUNNER_ASSERT_MSG_BT(strcmp(label.get(), "selflabel_06_03") == 0,
 404                       "No match in smack label received from cookie, received label: "
 405                       << label.get());
 406 }
 407
 408 //---------------------------------------------------------------------------
 409 //root has access to API
 410 RUNNER_CHILD_TEST(tc_unit_07_01_security_server_get_uid_by_cookie)
 411 {
 412     Cookie cookie = getCookieFromSS();
 413
 414     uid_t uid;
 415     int ret = security_server_get_uid_by_cookie(cookie.data(), &uid);
 416     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS,
 417                       "Error in security_server_get_uid_by_cookie(): " << ret);
 418     ret = getuid();
 419     RUNNER_ASSERT_MSG_BT(ret == (int)uid, "No match in UID received from cookie");
 420 }
 421
 422 //privileges drop and no smack rule
 423 RUNNER_CHILD_TEST_SMACK(tc_unit_07_02_security_server_get_uid_by_cookie)
 424 {
 425     SecurityServer::AccessProvider provider("selflabel_07_02");
 426     provider.applyAndSwithToUser(APP_UID, APP_GID);
 427
 428     Cookie cookie(KNOWN_COOKIE_SIZE);
 429     uid_t uid;
 430
 431     int ret = security_server_get_uid_by_cookie(cookie.data(), &uid);
 432     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_ACCESS_DENIED,
 433                       "Error in security_server_get_uid_by_cookie(): " << ret);
 434 }
 435
 436 //privileges drop and added smack rule
 437 RUNNER_CHILD_TEST_SMACK(tc_unit_07_03_security_server_get_uid_by_cookie)
 438 {
 439     SecurityServer::AccessProvider provider("selflabel_07_02");
 440     provider.allowFunction("security_server_get_uid_by_cookie");
 441     provider.applyAndSwithToUser(APP_UID, APP_GID);
 442
 443     Cookie cookie = getCookieFromSS();
 444     uid_t uid;
 445
 446     int ret = security_server_get_uid_by_cookie(cookie.data(), &uid);
 447     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS,
 448                       "Error in security_server_get_uid_by_cookie(): " << ret);
 449     ret = getuid();
 450     RUNNER_ASSERT_MSG_BT(ret == (int)uid, "No match in UID received from cookie");
 451 }
 452
 453 //---------------------------------------------------------------------------
 454 //root has access to API
 455 RUNNER_CHILD_TEST(tc_unit_08_01_security_server_get_gid_by_cookie)
 456 {
 457     Cookie cookie = getCookieFromSS();
 458
 459     gid_t gid;
 460
 461     int ret = security_server_get_gid_by_cookie(cookie.data(), &gid);
 462     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS,
 463                       "Error in security_server_get_gid_by_cookie(): " << ret);
 464     ret = getgid();
 465     RUNNER_ASSERT_MSG_BT(ret == (int)gid, "No match in GID received from cookie");
 466 }
 467
 468 //privileges drop and no smack rule
 469 RUNNER_CHILD_TEST_SMACK(tc_unit_08_02_security_server_get_gid_by_cookie)
 470 {
 471     SecurityServer::AccessProvider provider("selflabel_08_02");
 472     provider.applyAndSwithToUser(APP_UID, APP_GID);
 473
 474     Cookie cookie(KNOWN_COOKIE_SIZE);
 475     gid_t gid;
 476
 477     int ret = security_server_get_gid_by_cookie(cookie.data(), &gid);
 478     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_ACCESS_DENIED,
 479                       "Error in security_server_get_gid_by_cookie(): " << ret);
 480 }
 481
 482 //privileges drop and added smack rule
 483 RUNNER_CHILD_TEST_SMACK(tc_unit_08_03_security_server_get_gid_by_cookie)
 484 {
 485     SecurityServer::AccessProvider provider("selflabel_08_03");
 486     provider.allowFunction("security_server_get_gid_by_cookie");
 487     provider.applyAndSwithToUser(APP_UID, APP_GID);
 488
 489     Cookie cookie = getCookieFromSS();
 490     gid_t gid;
 491
 492     int ret = security_server_get_gid_by_cookie(cookie.data(), &gid);
 493     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS,
 494                       "Error in security_server_get_gid_by_cookie(): " << ret);
 495     ret = getgid();
 496     RUNNER_ASSERT_MSG_BT(ret == (int)gid, "No match in GID received from cookie");
 497 }
 498
 499 //---------------------------------------------------------------------------
 500 // apply smack labels and drop privileges
 501 RUNNER_CHILD_TEST_SMACK(tc_unit_09_01_cookie_API_access_allow)
 502 {
 503     add_process_group(PROC_AUDIO_GROUP_NAME);
 504
 505     SecurityServer::AccessProvider provider("subject_1d6eda7d");
 506     provider.allowFunction("security_server_get_gid");
 507     provider.allowFunction("security_server_request_cookie");
 508     provider.allowFunction("security_server_check_privilege");
 509     provider.allowFunction("security_server_get_cookie_pid");
 510     provider.allowFunction("security_server_get_smacklabel_cookie");
 511     provider.allowFunction("security_server_check_privilege_by_pid");
 512     provider.applyAndSwithToUser(APP_UID, APP_GID);
 513
 514     Cookie cookie = getCookieFromSS();
 515
 516     int ret = security_server_get_gid(PROC_AUDIO_GROUP_NAME);
 517     RUNNER_ASSERT_MSG_BT(ret > -1, "Failed to get \"" << PROC_AUDIO_GROUP_NAME
 518                          << "\" gid. Result: " << ret);
 519
 520     ret = security_server_check_privilege(cookie.data(), ret);
 521     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret: " << ret);
 522
 523     int root_gid = security_server_get_gid(ROOT_USER);
 524     RUNNER_ASSERT_MSG_BT(root_gid > -1, "root_gid: " << root_gid);
 525
 526     ret = security_server_get_cookie_pid(cookie.data());
 527     RUNNER_ASSERT_MSG_BT(ret == getpid(), "ret: " << ret);
 528
 529     UniquePtrCstring ss_label(security_server_get_smacklabel_cookie(cookie.data()), free);
 530     RUNNER_ASSERT_MSG_BT(ss_label.get() != NULL, "ss_label: " << ss_label.get());
 531
 532     ret = security_server_check_privilege_by_pid(getpid(), "_", "rx");
 533     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret: " << ret);
 534 }
 535
 536 // disable access and drop privileges
 537 RUNNER_CHILD_TEST(tc_unit_09_02_cookie_API_access_deny)
 538 {
 539     SecurityServer::AccessProvider provider("subject_1d414140");
 540     provider.applyAndSwithToUser(APP_UID, APP_GID);
 541
 542     Cookie cookie = getCookieFromSS();
 543
 544     int ret = security_server_check_privilege(cookie.data(), DB_ALARM_GID);
 545     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_ACCESS_DENIED, "ret: " << ret);
 546
 547     ret = security_server_get_gid(ROOT_USER);
 548     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_ACCESS_DENIED, "ret: " << ret);
 549
 550     ret = security_server_get_cookie_pid(cookie.data());
 551     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_ACCESS_DENIED, "ret: " << ret);
 552
 553     UniquePtrCstring ss_label(security_server_get_smacklabel_cookie(cookie.data()), free);
 554     RUNNER_ASSERT_MSG_BT(ss_label.get() == NULL, "ss_label: " << ss_label.get());
 555
 556     ret = security_server_check_privilege_by_pid(getpid(), "_", "rx");
 557     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_ACCESS_DENIED, "ret: " << ret);
 558 }
 559
 560 // NOSMACK version of the test above
 561 RUNNER_CHILD_TEST_NOSMACK(tc_unit_09_01_cookie_API_access_allow_nosmack)
 562 {
 563     add_process_group(PROC_AUDIO_GROUP_NAME);
 564
 565     // drop root privileges
 566     int ret = drop_root_privileges();
 567     RUNNER_ASSERT_MSG_BT(ret == 0,
 568             "Failed to drop root privileges. Result: " << ret << "uid = " << getuid());
 569
 570     Cookie cookie = getCookieFromSS();
 571
 572     ret = security_server_get_gid(PROC_AUDIO_GROUP_NAME);
 573     RUNNER_ASSERT_MSG_BT(ret > -1, "Failed to get \"" << PROC_AUDIO_GROUP_NAME
 574                          << "\" gid. Result: " << ret);
 575
 576     ret = security_server_check_privilege(cookie.data(), ret);
 577     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS,
 578                          "check_privilege failed. Result: " << ret);
 579
 580     ret = security_server_get_gid(ROOT_USER);
 581     RUNNER_ASSERT_MSG_BT(ret > -1, "Failed to get \"root\" gid. Result: " << ret);
 582
 583     ret = security_server_get_cookie_pid(cookie.data());
 584     RUNNER_ASSERT_MSG_BT(ret == getpid(),
 585             "get_cookie_pid returned different pid than it should. Result: " << ret);
 586
 587     UniquePtrCstring ss_label(security_server_get_smacklabel_cookie(cookie.data()), free);
 588     RUNNER_ASSERT_MSG_BT(ss_label.get() != NULL, "get_smacklabel_cookie failed.");
 589
 590     ret = security_server_check_privilege_by_pid(getpid(), "_", "rx");
 591     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS,
 592                          "check_privilege_by_pid failed. Result: " << ret);
 593 }