tests/security-server-tests/security_server_tests_client_smack.cpp

   1 /*
   2  * Copyright (c) 2013 Samsung Electronics Co., Ltd All Rights Reserved
   3  */
   4 /*
   5  * @file    security_server_tests_client_smack.cpp
   6  * @author  Bartlomiej Grzelewski (b.grzelewski@samsung.com)
   7  * @version 1.1
   8  * @brief   Test cases for security-server-client-smack.
   9  */
  10
  11 #include <unistd.h>
  12 #include <stdlib.h>
  13 #include <sys/types.h>
  14 #include <sys/socket.h>
  15 #include <sys/smack.h>
  16 #include <sys/wait.h>
  17 #include <sys/un.h>
  18 #include <sys/stat.h>
  19 #include <fcntl.h>
  20 #include <errno.h>
  21
  22 #include <memory>
  23 #include <functional>
  24
  25 #include <dpl/log/log.h>
  26 #include <dpl/test/test_runner.h>
  27 #include <dpl/test/test_runner_child.h>
  28 #include <dpl/test/test_runner_multiprocess.h>
  29 #include "security_server_mockup.h"
  30
  31 #include <security-server.h>
  32
  33 #include "tests_common.h"
  34
  35 #define PROPER_COOKIE_SIZE 20
  36
  37 #define ENVIRONMENT                                                       \
  38     do {                                                                  \
  39         const char *subject_label = "mylabel";                            \
  40         RUNNER_ASSERT_MSG(-1 != system("touch /opt/home/root/pid_cycle"), \
  41             "Cannot prepare environment for test.");                      \
  42         RUNNER_ASSERT_MSG(0 == smack_set_label_for_self(subject_label),   \
  43             "Cannot prepare environment for test.");                      \
  44         RUNNER_ASSERT_MSG(-1 != setgid(1),                                \
  45             "Cannot prepare environment for test.");                      \
  46         RUNNER_ASSERT_MSG(-1 != setuid(1),                                \
  47             "Cannot prepare environment for test");                       \
  48     } while (0)
  49
  50
  51 /**
  52  * Environment preparation should only differ in setting label. On NOSMACK system
  53  * smack_set_label_for_self returns error because of no access to /proc/self/attr/current.
  54  */
  55 #define ENVIRONMENT_NOSMACK                                               \
  56     do {                                                                  \
  57         int fd = open("/opt/home/root/pid_cycle", O_CREAT|O_APPEND, 0444);\
  58         RUNNER_ASSERT_MSG(fd >= 0,                                        \
  59             "Couldn't create pid_cycle file. errno: " << strerror(errno));\
  60         close(fd);                                                        \
  61         RUNNER_ASSERT_MSG(-1 != setgid(1),                                \
  62             "Cannot prepare environment for test.");                      \
  63         RUNNER_ASSERT_MSG(-1 != setuid(1),                                \
  64             "Cannot prepare environment for test");                       \
  65     } while (0)
  66
  67
  68 /**
  69  * Unique_ptr typedef for NOSMACK version of tc06 test
  70  */
  71 void closesockfdptr(int* sockfd_ptr)
  72 {
  73     close(*sockfd_ptr);
  74 }
  75 typedef std::unique_ptr<int, std::function<void(int*)> > SockFDUniquePtr;
  76
  77 /**
  78  * Dropping root privileges
  79  * returns 0 on success, 1 on error
  80  */
  81 int drop_root_privileges()
  82 {
  83     if (getuid() == 0) {
  84         /* process is running as root, drop privileges */
  85         if (setgid(5000) != 0)
  86             return 1;
  87         if (setuid(5000) != 0)
  88             return 1;
  89     }
  90     int uid = getuid();
  91     if (uid == 5000)
  92         return 0;
  93
  94     return 1;
  95 }
  96
  97 RUNNER_TEST_GROUP_INIT(SECURITY_SERVER_TESTS_CLIENT_SMACK)
  98
  99 /*
 100  * test: Check cookie size returned by security_server_get_cookie_size.
 101  * description: Cookie used by security-server is 20 bytes long.
 102  * Any other size of cookies should be treated as error.
 103  * expected: Function security_server_get_cookie_size returns 20.
 104  */
 105 RUNNER_CHILD_TEST_SMACK(tc01_security_server_get_cookie_size)
 106 {
 107     ENVIRONMENT;
 108
 109     int ret = security_server_get_cookie_size();
 110     RUNNER_ASSERT_MSG(20 == ret, "ret = " << ret);
 111 }
 112
 113 /*
 114  * test: security_server_request_cookie
 115  * description: Function security_server_request_cookie will return
 116  * 20 bytes long cookie.
 117  * expected: function will set up cookie in the array and return
 118  * SECURITY_SERVER_API_SUCCESS.
 119  */
 120 RUNNER_CHILD_TEST_SMACK(tc02_security_server_request_cookie_normal_case)
 121 {
 122     ENVIRONMENT;
 123
 124     char cookie[20];
 125     int ret = security_server_request_cookie(cookie, 20);
 126     LogDebug("ret = " << ret);
 127     RUNNER_ASSERT(SECURITY_SERVER_API_SUCCESS == ret);
 128 }
 129
 130 /*
 131  * test: security_server_request_cookie
 132  * description: Function security_server_request_cookie will return
 133  * 20 bytes long cookie.
 134  * expected: function will set up cookie in the array and return
 135  * SECURITY_SERVER_API_SUCCESS.
 136  */
 137 RUNNER_CHILD_TEST_SMACK(tc03_security_server_request_cookie_too_small_buffer_size)
 138 {
 139     ENVIRONMENT;
 140
 141     char cookie[20];
 142     int ret = security_server_request_cookie(cookie, 10);
 143     LogDebug("ret = " << ret);
 144     RUNNER_ASSERT(SECURITY_SERVER_API_ERROR_BUFFER_TOO_SMALL == ret);
 145 }
 146
 147 /*
 148  * test: tc04_security_server_get_gid
 149  * description: Checking for security_server_get_gid
 150  *              with nonexisting gid and existing one
 151  * expected: security_server_get_gid should return
 152  *           SECURITY_SERVER_ERROR_NO_SUCH_OBJECT with first call
 153  *           and group id with second call
 154  */
 155 RUNNER_CHILD_TEST_SMACK(tc04_security_server_get_gid)
 156 {
 157     ENVIRONMENT;
 158
 159     int ret = security_server_get_gid("abc123xyz_pysiaczek");
 160     LogDebug("ret = " << ret);
 161     RUNNER_ASSERT_MSG(SECURITY_SERVER_API_ERROR_NO_SUCH_OBJECT == ret, "Ret: " << ret);
 162     ret = security_server_get_gid("root");
 163     LogDebug("ret = " << ret);
 164     RUNNER_ASSERT_MSG(0 == ret, "Ret: " << ret);
 165 }
 166
 167 /*
 168  * test: tc05_check_privilege_by_cookie
 169  * description: Function security_server_check_privilege_by_cookie should
 170  * return status of access rights of cookie owner. In this case cookie owner
 171  * is the same process that ask for the rights.
 172  * expected: Function call with access rights set to "r" should return SUCCESS,
 173  * with "rw" should return ACCESS DENIED.
 174  */
 175 RUNNER_CHILD_TEST_SMACK(tc05_check_privilege_by_cookie)
 176 {
 177     char cookie[20];
 178     const char *object_label = "tc05objectlabel";
 179     const char *access_rights = "r";
 180     const char *access_rights_ext = "rw";
 181     const char *subject_label = "tc05subjectlabel";
 182
 183     smack_accesses *handle;
 184
 185     RUNNER_ASSERT(0 == smack_accesses_new(&handle));
 186
 187     RUNNER_ASSERT(0 == smack_accesses_add(handle,
 188             subject_label,
 189             object_label,
 190             access_rights));
 191
 192     RUNNER_ASSERT(0 == smack_accesses_apply(handle));
 193
 194     smack_accesses_free(handle);
 195
 196     RUNNER_ASSERT(0 == smack_set_label_for_self(subject_label));
 197
 198     RUNNER_ASSERT(SECURITY_SERVER_API_SUCCESS ==
 199         security_server_request_cookie(cookie,20));
 200
 201     RUNNER_ASSERT_MSG(drop_root_privileges() == 0, "uid = " << getuid());
 202
 203     RUNNER_ASSERT(SECURITY_SERVER_API_SUCCESS ==
 204         security_server_check_privilege_by_cookie(
 205             cookie,
 206             object_label,
 207             access_rights));
 208
 209     RUNNER_ASSERT(SECURITY_SERVER_API_ERROR_ACCESS_DENIED ==
 210         security_server_check_privilege_by_cookie(
 211             cookie,
 212             object_label,
 213             access_rights_ext));
 214 }
 215
 216 /*
 217  * test: security_server_check_privilege_by_sockfd
 218  * description: This test will create dummy server that will accept connection
 219  * and die. The client will try to check access rights using connection descriptor.
 220  * expected: Function call with access rights set to "r" should return SUCCESS,
 221  * with "rw" should return ACCESS DENIED.
 222  */
 223 RUNNER_MULTIPROCESS_TEST_SMACK(tc06_check_privilege_by_sockfd)
 224 {
 225     const char *object_label = "tc06objectlabel";
 226     const char *access_rights = "r";
 227     const char *access_rights_ext = "rw";
 228     const char *subject_label = "tc06subjectlabel";
 229
 230     int result1 = -1;
 231     int result2 = -1;
 232
 233     smack_accesses *handle;
 234     RUNNER_ASSERT(0 == smack_accesses_new(&handle));
 235     RUNNER_ASSERT(0 == smack_accesses_add(handle,
 236             subject_label,
 237             object_label,
 238             access_rights));
 239     RUNNER_ASSERT(0 == smack_accesses_apply(handle));
 240     smack_accesses_free(handle);
 241
 242     int pid = fork();
 243     char *label;
 244     RUNNER_ASSERT(-1 != pid);
 245
 246     if (0 == pid) {
 247         // child
 248         RUNNER_ASSERT_MSG(0 == smack_set_label_for_self(subject_label), "child label " << subject_label << " not set");
 249
 250         int sockfd = create_new_socket();
 251         RUNNER_ASSERT_MSG(sockfd >= 0, "create_new_socket() failed");
 252
 253         SockFDUniquePtr sockfd_ptr(&sockfd, closesockfdptr);
 254
 255         label = security_server_get_smacklabel_sockfd(sockfd);
 256         RUNNER_ASSERT_MSG(label != NULL, "security_server_get_smacklabel_sockfd failed");
 257         RUNNER_ASSERT_MSG(strcmp(label,"") == 0, "label is \"" << label << "\"");
 258         free(label);
 259
 260         RUNNER_ASSERT_MSG(drop_root_privileges() == 0, "uid = " << getuid());
 261
 262         RUNNER_ASSERT_MSG(listen(sockfd, 5) >= 0, "child listen failed");
 263
 264         label = security_server_get_smacklabel_sockfd(sockfd);
 265         RUNNER_ASSERT_MSG(label != NULL, "security_server_get_smacklabel_sockfd failed");
 266         RUNNER_ASSERT_MSG(strcmp(label,"") == 0, "label is \"" << label << "\"");
 267         free(label);
 268
 269         struct sockaddr_un client_addr;
 270         socklen_t client_len = sizeof(client_addr);
 271         int csockfd;
 272         RUNNER_ASSERT_MSG((csockfd = accept(sockfd,(struct sockaddr*)&client_addr, &client_len)) > 0, "child accept failed");
 273
 274         usleep(500);
 275
 276         close(csockfd);
 277         exit(0);
 278     } else {
 279         // parent
 280         sleep(1);
 281         int sockfd = connect_to_testserver();
 282         RUNNER_ASSERT_MSG(sockfd >= 0, "connect_to_testserver() failed");
 283
 284         SockFDUniquePtr sockfd_ptr(&sockfd, closesockfdptr);
 285
 286         label = security_server_get_smacklabel_sockfd(sockfd);
 287         RUNNER_ASSERT_MSG(label != NULL, "security_server_get_smacklabel_sockfd failed");
 288         RUNNER_ASSERT_MSG(strcmp(label,subject_label) == 0, "label is \"" << label << "\"" << ", subject_label is \"" << subject_label << "\"" );
 289         free(label);
 290
 291         result1 = security_server_check_privilege_by_sockfd(
 292             sockfd,
 293             object_label,
 294             access_rights);
 295         result2 = security_server_check_privilege_by_sockfd(
 296             sockfd,
 297             object_label,
 298             access_rights_ext);
 299     }
 300
 301     RUNNER_ASSERT_MSG(SECURITY_SERVER_API_SUCCESS == result1, "result = " << result1);
 302     RUNNER_ASSERT_MSG(SECURITY_SERVER_API_ERROR_ACCESS_DENIED == result2, "result = " << result2);
 303 }
 304
 305 /*
 306  * test: security_server_check_privilege_by_sockfd
 307  * description: This test will create dummy server that will accept connection
 308  * and die. The client will try to check access rights using connection descriptor.
 309  * Because we read a smack label not from socket directly, but from from pid of process
 310  * on the other end of socket - that's why smack label will be updated.
 311  * In this test client is running under root and server is not - to test the extreme case.
 312  * expected: Function call with access rights set to "r" should return SUCCESS,
 313  * with "rw" should return ACCESS DENIED.
 314  */
 315 RUNNER_MULTIPROCESS_TEST_SMACK(tc07_check_privilege_by_sockfd)
 316 {
 317     RUNNER_IGNORED_MSG("This test drop privileges");
 318     const char *object_label = "tc07objectlabel";
 319     const char *access_rights = "r";
 320     const char *access_rights_ext = "rw";
 321     const char *subject_label = "tc07subjectlabel";
 322
 323     int result1 = -1;
 324     int result2 = -1;
 325
 326     smack_accesses *handle;
 327     RUNNER_ASSERT(0 == smack_accesses_new(&handle));
 328     RUNNER_ASSERT(0 == smack_accesses_add(handle,
 329             subject_label,
 330             object_label,
 331             access_rights));
 332     RUNNER_ASSERT(0 == smack_accesses_apply(handle));
 333     smack_accesses_free(handle);
 334
 335     int pid = fork();
 336     RUNNER_ASSERT(-1 != pid);
 337
 338     if (0 == pid) {
 339         // child
 340         int sockfd = create_new_socket();
 341         RUNNER_ASSERT_MSG(sockfd >= 0, "create_new_socket() failed");
 342
 343         SockFDUniquePtr sockfd_ptr(&sockfd, closesockfdptr);
 344
 345         RUNNER_ASSERT_MSG(0 == smack_set_label_for_self(subject_label), "child label " << subject_label << " not set");
 346
 347         RUNNER_ASSERT_MSG(drop_root_privileges() == 0, "uid = " << getuid());
 348
 349         RUNNER_ASSERT_MSG(listen(sockfd, 5) >= 0, "child listen failed");
 350
 351         struct sockaddr_un client_addr;
 352         socklen_t client_len = sizeof(client_addr);
 353         int csockfd = TEMP_FAILURE_RETRY(accept(sockfd,(struct sockaddr*)&client_addr, &client_len));
 354         if (csockfd >= 0)
 355             close(csockfd);
 356         LogDebug("Exit!");
 357         exit(0);
 358     } else {
 359         // parent
 360
 361         RUNNER_ASSERT_MSG(drop_root_privileges() == 0, "uid = " << getuid());
 362
 363         sleep(1);
 364         int sockfd = connect_to_testserver();
 365         RUNNER_ASSERT_MSG(sockfd >= 0, "connect_to_testserver() failed");
 366
 367         result1 = security_server_check_privilege_by_sockfd(
 368             sockfd,
 369             object_label,
 370             access_rights);
 371         result2 = security_server_check_privilege_by_sockfd(
 372             sockfd,
 373             object_label,
 374             access_rights_ext);
 375
 376         close(sockfd);
 377     }
 378
 379     RUNNER_ASSERT_MSG(SECURITY_SERVER_API_SUCCESS == result1, "result1 = " << result1);
 380     RUNNER_ASSERT_MSG(SECURITY_SERVER_API_ERROR_ACCESS_DENIED == result2, " result2 = " << result2);
 381 }
 382
 383 ///////////////////////////
 384 /////NOSMACK ENV TESTS/////
 385 ///////////////////////////
 386
 387 /**
 388  * First four test cases are the same as their SMACK versions. The only difference is environment
 389  * preparation (described near ENVIRONMENT_NOSMACK macro).
 390  */
 391 RUNNER_CHILD_TEST_NOSMACK(tc01_security_server_get_cookie_size_nosmack)
 392 {
 393     ENVIRONMENT_NOSMACK;
 394
 395     int ret = security_server_get_cookie_size();
 396     RUNNER_ASSERT_MSG(ret == 20, "ret = " << ret);
 397 }
 398
 399 RUNNER_CHILD_TEST_NOSMACK(tc02_security_server_request_cookie_normal_case_nosmack)
 400 {
 401     ENVIRONMENT_NOSMACK;
 402
 403     char cookie[20];
 404     int ret = security_server_request_cookie(cookie, 20);
 405     RUNNER_ASSERT_MSG(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 406 }
 407
 408 RUNNER_CHILD_TEST_NOSMACK(tc03_security_server_request_cookie_too_small_buffer_size_nosmack)
 409 {
 410     ENVIRONMENT_NOSMACK;
 411
 412     char cookie[20];
 413     int ret = security_server_request_cookie(cookie, 10);
 414     RUNNER_ASSERT_MSG(ret == SECURITY_SERVER_API_ERROR_BUFFER_TOO_SMALL, "ret = " << ret);
 415 }
 416
 417 RUNNER_CHILD_TEST_NOSMACK(tc04_security_server_get_gid_nosmack)
 418 {
 419     ENVIRONMENT_NOSMACK;
 420
 421     int ret = security_server_get_gid("definitely_not_existing_object");
 422     RUNNER_ASSERT_MSG(ret == SECURITY_SERVER_API_ERROR_NO_SUCH_OBJECT, "ret = " << ret);
 423     ret = security_server_get_gid("root");
 424     RUNNER_ASSERT_MSG(ret == 0, "ret = " << ret);
 425 }
 426
 427 /*
 428  * NOSMACK version of tc05 test.
 429  *
 430  * Correct behaviour of smack_accesses_apply and smack_set_label_for_self was checked by libsmack
 431  * tests. We assume, that those tests pass. Additionally security_server_check_privilege_by_cookie
 432  * should return SUCCESS no matter what access_rights we give to this function.
 433  */
 434 RUNNER_CHILD_TEST_NOSMACK(tc05_check_privilege_by_cookie_nosmack)
 435 {
 436     char cookie[20];
 437     const char* object_label = "tc05objectlabel";
 438
 439     RUNNER_ASSERT(security_server_request_cookie(cookie,20) == SECURITY_SERVER_API_SUCCESS);
 440
 441     RUNNER_ASSERT_MSG(drop_root_privileges() == 0, "uid = " << getuid());
 442
 443     RUNNER_ASSERT(SECURITY_SERVER_API_SUCCESS ==
 444         security_server_check_privilege_by_cookie(cookie, object_label, "r"));
 445
 446     //On NOSMACK env security server should return success on any accesses, even those that are
 447     //incorrect.
 448     RUNNER_ASSERT(SECURITY_SERVER_API_SUCCESS ==
 449         security_server_check_privilege_by_cookie(cookie, object_label, "rw"));
 450 }
 451
 452 /**
 453  * NOSMACK version of tc06 test.
 454  *
 455  * Differences between this and SMACK version (server):
 456  * - Skipped setting access_rights
 457  * - Skipped setting label for server
 458  * - get_smacklabel_sockfd is called only once for server, almost right after fork and creation
 459  *   of socket (because it should do nothing when SMACK is off)
 460  * - After get_smacklabel_sockfd privileges are dropped and server is prepared to accept connections
 461  *   from client
 462  *
 463  * For client the only difference are expected results from check_privilege_by_sockfd - both should
 464  * return SUCCESS.
 465  */
 466 RUNNER_MULTIPROCESS_TEST_NOSMACK(tc06_check_privilege_by_sockfd_nosmack)
 467 {
 468     const char* object_label = "tc06objectlabel";
 469
 470     int result1 = -1;
 471     int result2 = -1;
 472
 473     int pid = fork();
 474     char* label;
 475     RUNNER_ASSERT(pid >= 0);
 476
 477     int ret;
 478
 479     if (pid == 0) { //child process - server
 480         //create new socket
 481         int sockfd = create_new_socket();
 482         RUNNER_ASSERT_MSG(sockfd >= 0, "create_new_socket() failed");
 483
 484         SockFDUniquePtr sockfd_ptr(&sockfd, closesockfdptr);
 485
 486         //check if get_smacklabel_sockfd works correctly
 487         label = security_server_get_smacklabel_sockfd(sockfd);
 488         RUNNER_ASSERT_MSG(label != NULL, "security_server_get_smacklabel_sockfd failed");
 489         ret = strcmp(label, "");
 490         free(label);
 491         RUNNER_ASSERT_MSG(ret == 0, "label is \"" << label << "\"");
 492
 493         RUNNER_ASSERT_MSG(drop_root_privileges() == 0, "uid = " << getuid());
 494
 495         RUNNER_ASSERT_MSG(listen(sockfd, 5) >= 0, "child listen failed");
 496
 497         struct sockaddr_un client_addr;
 498         socklen_t client_len = sizeof(client_addr);
 499
 500         int csockfd;
 501         RUNNER_ASSERT_MSG((csockfd = accept(sockfd,(struct sockaddr*)&client_addr, &client_len)) > 0, "child accept failed");
 502
 503         //wait a little bit for parent to do it's job
 504         usleep(200);
 505
 506         //if everything works, cleanup and return 0
 507         close(csockfd);
 508         exit(0);
 509     } else {
 510         //parent
 511         sleep(1);
 512         int sockfd = connect_to_testserver();
 513         RUNNER_ASSERT_MSG(sockfd >= 0, "Failed to connect to server.");
 514
 515         SockFDUniquePtr sockfd_ptr(&sockfd, closesockfdptr);
 516
 517         label = security_server_get_smacklabel_sockfd(sockfd);
 518         RUNNER_ASSERT_MSG(label != NULL, "get_smacklabel_sockfd failed.");
 519         ret = strcmp(label, "");
 520         free(label);
 521         RUNNER_ASSERT_MSG(ret == 0, "label is \"" << label << "\"");
 522
 523         result1 = security_server_check_privilege_by_sockfd(sockfd, object_label, "r");
 524         result2 = security_server_check_privilege_by_sockfd(sockfd, object_label, "rw");
 525     }
 526
 527     RUNNER_ASSERT_MSG(result1 == SECURITY_SERVER_API_SUCCESS, "result = " << result1);
 528     RUNNER_ASSERT_MSG(result2 == SECURITY_SERVER_API_SUCCESS, "result = " << result2);
 529 }
 530
 531 /**
 532  * NOSMACK version of tc07 test.
 533  */
 534 RUNNER_MULTIPROCESS_TEST_NOSMACK(tc07_check_privilege_by_sockfd_nosmack)
 535 {
 536     RUNNER_IGNORED_MSG("This test drop privileges");
 537     const char* object_label = "tc07objectlabel";
 538
 539     int result1 = -1;
 540     int result2 = -1;
 541
 542     int pid = fork();
 543     RUNNER_ASSERT(-1 != pid);
 544
 545     if (pid == 0) { //child process
 546         //Create socket
 547         int sockfd = create_new_socket();
 548         RUNNER_ASSERT_MSG(sockfd >= 0, "create_new_socket() failed");
 549
 550         SockFDUniquePtr sockfd_ptr(&sockfd, closesockfdptr);
 551
 552         //Drop privileges
 553         RUNNER_ASSERT_MSG(drop_root_privileges() == 0, "uid = " << getuid());
 554
 555         //Prepare for accepting
 556         RUNNER_ASSERT_MSG(listen(sockfd, 5) >= 0, "child listen failed");
 557
 558         struct sockaddr_un client_addr;
 559         socklen_t client_len = sizeof(client_addr);
 560
 561         //Accept connections
 562         int csockfd;
 563         RUNNER_ASSERT_MSG((csockfd = accept(sockfd,(struct sockaddr*)&client_addr, &client_len)) > 0, "child accept failed");
 564
 565         //wait a little bit for parent to do it's job
 566         usleep(200);
 567
 568         //cleanup and kill child
 569         close(csockfd);
 570         exit(0);
 571     } else {    //parent process
 572         //Drop root privileges
 573         RUNNER_ASSERT_MSG(drop_root_privileges() == 0, "uid = " << getuid());
 574
 575         //Wait for server to set up
 576         sleep(1);
 577
 578         //Connect and check privileges
 579         int sockfd = connect_to_testserver();
 580         RUNNER_ASSERT_MSG(sockfd >= 0, "Failed to create socket fd.");
 581
 582         result1 = security_server_check_privilege_by_sockfd(sockfd, object_label, "r");
 583         result2 = security_server_check_privilege_by_sockfd(sockfd, object_label, "rw");
 584
 585         close(sockfd);
 586     }
 587
 588     //Both results (just like in the previous test case) should return success.
 589     RUNNER_ASSERT_MSG(SECURITY_SERVER_API_SUCCESS == result1, "result1 = " << result1);
 590     RUNNER_ASSERT_MSG(SECURITY_SERVER_API_SUCCESS == result2, "result2 = " << result2);
 591 }
 592
 593 int apply_smack_rule(const char *subject, const char *object, const char *rule)
 594 {
 595     struct smack_accesses *ruleHandler = NULL;
 596     if (smack_accesses_new(&ruleHandler) != 0)
 597         goto error;
 598     if (smack_accesses_add(ruleHandler, subject, object, rule) != 0)
 599         goto error;
 600     if (smack_accesses_apply(ruleHandler) != 0)
 601         goto error;
 602
 603     smack_accesses_free(ruleHandler);
 604     return 0;
 605
 606 error:
 607     smack_accesses_free(ruleHandler);
 608     return -1;
 609 }
 610
 611 RUNNER_TEST(tc10_security_server_get_uid_by_cookie)
 612 {
 613     int cookieSize = security_server_get_cookie_size();
 614     RUNNER_ASSERT_MSG(cookieSize == 20, "Wrong cookie size");
 615
 616     std::vector<char> cookie(cookieSize);
 617     int retval = security_server_request_cookie(&cookie[0], cookieSize);
 618     RUNNER_ASSERT_MSG(retval == SECURITY_SERVER_API_SUCCESS, "Unable to get cookie");
 619
 620     //checking function
 621     uid_t cookieUid, realUid;
 622     realUid = getuid();
 623     retval = security_server_get_uid_by_cookie(&cookie[0], &cookieUid);
 624     RUNNER_ASSERT_MSG(retval == SECURITY_SERVER_API_SUCCESS, "Unable to get UID from cookie. My uid: " << realUid << " Server error: " << retval);
 625     RUNNER_ASSERT_MSG(realUid == cookieUid, "No match in received UID");
 626
 627     //checking for input parameters
 628     retval = security_server_get_uid_by_cookie(NULL, &cookieUid);
 629     RUNNER_ASSERT_MSG(retval == SECURITY_SERVER_API_ERROR_INPUT_PARAM, "Error in checking input parameters by function");
 630     retval = security_server_get_uid_by_cookie(&cookie[0], NULL);
 631     RUNNER_ASSERT_MSG(retval == SECURITY_SERVER_API_ERROR_INPUT_PARAM, "Error in checking input parameters by function");
 632 }
 633
 634 RUNNER_CHILD_TEST(tc11_security_server_get_uid_by_cookie)
 635 {
 636     int cookieSize = security_server_get_cookie_size();
 637     RUNNER_ASSERT_MSG(cookieSize == 20, "Wrong cookie size");
 638
 639     std::vector<char> cookie(cookieSize);
 640     int retval = security_server_request_cookie(&cookie[0], cookieSize);
 641     RUNNER_ASSERT_MSG(retval == SECURITY_SERVER_API_SUCCESS, "Unable to get cookie");
 642
 643     //preapare SMACK environment
 644     RUNNER_ASSERT_MSG(smack_set_label_for_self("BialyMis") == 0, "Unable to set label for self");
 645     RUNNER_ASSERT_MSG(smack_revoke_subject("BialyMis") == 0, "Error in smack_revoke_subject");
 646     //drop privileges
 647     RUNNER_ASSERT_MSG(setuid(5000) == 0, "Unable to drop privileges");
 648
 649     //checking function
 650     uid_t cookieUid;
 651     retval = security_server_get_uid_by_cookie(&cookie[0], &cookieUid);
 652     RUNNER_ASSERT_MSG(retval == SECURITY_SERVER_API_ERROR_ACCESS_DENIED, "Socket not protected by smack");
 653 }
 654
 655 RUNNER_CHILD_TEST(tc12_security_server_get_uid_by_cookie)
 656 {
 657     int cookieSize = security_server_get_cookie_size();
 658     RUNNER_ASSERT_MSG(cookieSize == 20, "Wrong cookie size");
 659
 660     uid_t realUid = getuid();
 661
 662     std::vector<char> cookie(cookieSize);
 663     int retval = security_server_request_cookie(&cookie[0], cookieSize);
 664     RUNNER_ASSERT_MSG(retval == SECURITY_SERVER_API_SUCCESS, "Unable to get cookie");
 665
 666     //preapare SMACK environment
 667     RUNNER_ASSERT_MSG(smack_set_label_for_self("BialyMis") == 0, "Unable to set label for self");
 668     RUNNER_ASSERT_MSG(apply_smack_rule("BialyMis", "security-server::api-cookie-check", "w") == 0, "Error in adding rule");
 669     //drop privileges
 670     RUNNER_ASSERT_MSG(setuid(5000) == 0, "Unable to drop privileges");
 671
 672     //checking function
 673     uid_t cookieUid;
 674     retval = security_server_get_uid_by_cookie(&cookie[0], &cookieUid);
 675     RUNNER_ASSERT_MSG(retval == SECURITY_SERVER_API_SUCCESS, "Unable to get UID from cookie");
 676     RUNNER_ASSERT_MSG(realUid == cookieUid, "No match in received UID");
 677 }
 678
 679 RUNNER_CHILD_TEST(tc13_security_server_get_uid_by_cookie)
 680 {
 681     int cookieSize = security_server_get_cookie_size();
 682     RUNNER_ASSERT_MSG(cookieSize == 20, "Wrong cookie size");
 683
 684     //preapare SMACK environment
 685     RUNNER_ASSERT_MSG(smack_set_label_for_self("BialyMis") == 0, "Unable to set label for self");
 686     RUNNER_ASSERT_MSG(apply_smack_rule("BialyMis", "security-server::api-cookie-check", "w") == 0, "Error in adding rule");
 687     RUNNER_ASSERT_MSG(apply_smack_rule("BialyMis", "security-server::api-cookie-get", "w") == 0, "Error in adding rule");
 688     //drop privileges
 689     RUNNER_ASSERT_MSG(setuid(5000) == 0, "Unable to drop privileges");
 690
 691     std::vector<char> cookie(cookieSize);
 692     int retval = security_server_request_cookie(&cookie[0], cookieSize);
 693     RUNNER_ASSERT_MSG(retval == SECURITY_SERVER_API_SUCCESS, "Unable to get cookie");
 694
 695     //checking function
 696     uid_t cookieUid, realUid = getuid();
 697     retval = security_server_get_uid_by_cookie(&cookie[0], &cookieUid);
 698     RUNNER_ASSERT_MSG(retval == SECURITY_SERVER_API_SUCCESS, "Unable to get UID from cookie");
 699     RUNNER_ASSERT_MSG(realUid == cookieUid, "No match in received UID");
 700 }
 701
 702 RUNNER_TEST(tc14_security_server_get_gid_by_cookie)
 703 {
 704     int cookieSize = security_server_get_cookie_size();
 705     RUNNER_ASSERT_MSG(cookieSize == 20, "Wrong cookie size");
 706
 707     std::vector<char> cookie(cookieSize);
 708     int retval = security_server_request_cookie(&cookie[0], cookieSize);
 709     RUNNER_ASSERT_MSG(retval == SECURITY_SERVER_API_SUCCESS, "Unable to get cookie");
 710
 711     //checking function
 712     gid_t cookieGid, realGid;
 713     realGid = getgid();
 714     retval = security_server_get_gid_by_cookie(&cookie[0], &cookieGid);
 715     RUNNER_ASSERT_MSG(retval == SECURITY_SERVER_API_SUCCESS, "Unable to get GID from cookie");
 716     RUNNER_ASSERT_MSG(realGid == cookieGid, "No match in received GID");
 717
 718     //checking for input parameters
 719     retval = security_server_get_gid_by_cookie(NULL, &cookieGid);
 720     RUNNER_ASSERT_MSG(retval == SECURITY_SERVER_API_ERROR_INPUT_PARAM, "Error in checking input parameters by function");
 721     retval = security_server_get_gid_by_cookie(&cookie[0], NULL);
 722     RUNNER_ASSERT_MSG(retval == SECURITY_SERVER_API_ERROR_INPUT_PARAM, "Error in checking input parameters by function");
 723
 724 }
 725
 726 RUNNER_CHILD_TEST(tc15_security_server_get_gid_by_cookie)
 727 {
 728     int cookieSize = security_server_get_cookie_size();
 729     RUNNER_ASSERT_MSG(cookieSize == 20, "Wrong cookie size");
 730
 731     std::vector<char> cookie(cookieSize);
 732     int retval = security_server_request_cookie(&cookie[0], cookieSize);
 733     RUNNER_ASSERT_MSG(retval == SECURITY_SERVER_API_SUCCESS, "Unable to get cookie");
 734
 735     //preapare SMACK environment
 736     RUNNER_ASSERT_MSG(smack_set_label_for_self("BialyMis") == 0, "Unable to set label for self");
 737     RUNNER_ASSERT_MSG(smack_revoke_subject("BialyMis") == 0, "Error in smack_revoke_subject");
 738     //drop privileges
 739     RUNNER_ASSERT_MSG(setgid(5000) == 0, "Unable to drop privileges");
 740     RUNNER_ASSERT_MSG(setuid(5000) == 0, "Unable to drop privileges");
 741
 742     //checking function
 743     gid_t cookieGid, realGid;
 744     realGid = getgid();
 745     retval = security_server_get_gid_by_cookie(&cookie[0], &cookieGid);
 746     RUNNER_ASSERT_MSG(retval == SECURITY_SERVER_API_ERROR_ACCESS_DENIED, "Socket not protected by smack");
 747 }
 748
 749 RUNNER_CHILD_TEST(tc16_security_server_get_gid_by_cookie)
 750 {
 751     int cookieSize = security_server_get_cookie_size();
 752     RUNNER_ASSERT_MSG(cookieSize == 20, "Wrong cookie size");
 753
 754     std::vector<char> cookie(cookieSize);
 755
 756     gid_t realGid = getgid();
 757     int retval = security_server_request_cookie(&cookie[0], cookieSize);
 758     RUNNER_ASSERT_MSG(retval == SECURITY_SERVER_API_SUCCESS, "Unable to get cookie");
 759
 760     //preapare SMACK environment
 761     RUNNER_ASSERT_MSG(smack_set_label_for_self("BialyMis") == 0, "Unable to set label for self");
 762     RUNNER_ASSERT_MSG(apply_smack_rule("BialyMis", "security-server::api-cookie-check", "w") == 0, "Error in adding rule");
 763     //drop privileges
 764     RUNNER_ASSERT_MSG(setgid(5000) == 0, "Unable to drop privileges");
 765     RUNNER_ASSERT_MSG(setuid(5000) == 0, "Unable to drop privileges");
 766
 767     //checking function
 768     gid_t cookieGid;
 769     retval = security_server_get_gid_by_cookie(&cookie[0], &cookieGid);
 770     RUNNER_ASSERT_MSG(retval == SECURITY_SERVER_API_SUCCESS, "Unable to get GID from cookie");
 771     RUNNER_ASSERT_MSG(realGid == cookieGid, "No match in received GID. ReadGid: " << realGid << " CookieGid: " << cookieGid);
 772 }
 773
 774 RUNNER_CHILD_TEST(tc17_security_server_get_gid_by_cookie)
 775 {
 776     int cookieSize = security_server_get_cookie_size();
 777     RUNNER_ASSERT_MSG(cookieSize == 20, "Wrong cookie size");
 778
 779     //preapare SMACK environment
 780     RUNNER_ASSERT_MSG(smack_set_label_for_self("BialyMis") == 0, "Unable to set label for self");
 781     RUNNER_ASSERT_MSG(apply_smack_rule("BialyMis", "security-server::api-cookie-check", "w") == 0, "Error in adding rule");
 782     RUNNER_ASSERT_MSG(apply_smack_rule("BialyMis", "security-server::api-cookie-get", "w") == 0, "Error in adding rule");
 783     //drop privileges
 784     RUNNER_ASSERT_MSG(setgid(5000) == 0, "Unable to drop privileges");
 785     RUNNER_ASSERT_MSG(setuid(5000) == 0, "Unable to drop privileges");
 786
 787     std::vector<char> cookie(cookieSize);
 788     int retval = security_server_request_cookie(&cookie[0], cookieSize);
 789     RUNNER_ASSERT_MSG(retval == SECURITY_SERVER_API_SUCCESS, "Unable to get cookie");
 790
 791     //checking function
 792     gid_t cookieGid, realGid = getgid();
 793     retval = security_server_get_gid_by_cookie(&cookie[0], &cookieGid);
 794     RUNNER_ASSERT_MSG(retval == SECURITY_SERVER_API_SUCCESS, "Unable to get GID from cookie");
 795     RUNNER_ASSERT_MSG(realGid == cookieGid, "No match in received GID. ReadGid: " << realGid << " CookieGid: " << cookieGid);
 796 }
 797
 798
 799 RUNNER_TEST_SMACK(tc18_security_server_get_smacklabel_cookie) {
 800     int res;
 801
 802     pid_t mypid;
 803
 804     char *label_smack = NULL;
 805     char *label_ss = NULL;
 806     char *cookie = NULL;
 807
 808     int cookie_size = security_server_get_cookie_size();
 809     RUNNER_ASSERT_MSG(PROPER_COOKIE_SIZE == cookie_size, "Wrong cookie size from security-server");
 810
 811     mypid = getpid();
 812
 813     cookie = (char*) calloc(cookie_size, 1);
 814     RUNNER_ASSERT_MSG(NULL != cookie, "Memory allocation error");
 815
 816     res = security_server_request_cookie(cookie, cookie_size);
 817     if (res != SECURITY_SERVER_API_SUCCESS) {
 818         free(cookie);
 819         RUNNER_ASSERT_MSG(res == SECURITY_SERVER_API_SUCCESS, "Error in requesting cookie from security-server");
 820     }
 821
 822     label_ss = security_server_get_smacklabel_cookie(cookie);
 823     free(cookie);
 824     RUNNER_ASSERT_MSG(label_ss != NULL, "Error in getting label by cookie");
 825
 826
 827     std::string label_cookie(label_ss);
 828     free(label_ss);
 829
 830     res = smack_new_label_from_self(&label_smack);
 831     if (res < 0) {
 832         free(label_smack);
 833         RUNNER_ASSERT_MSG(res == 0, "Error in getting self SMACK label");
 834     }
 835     std::string label_self(label_smack ? label_smack : "");
 836     free(label_smack);
 837
 838     RUNNER_ASSERT_MSG(label_self == label_cookie, "No match in SMACK labels");
 839
 840
 841     //TODO: here could be label change using SMACK API and checking if it
 842     //is changed using security-server API function based on the same cookie
 843 }
 844
 845 /**
 846  * NOSMACK version of tc_security_server_get_smacklabel_cookie test.
 847  *
 848  * Most of this test goes exactly as the original one. The only difference are the labels:
 849  * - We assume that libsmack tests passed and smack_new_label_from_self will return -1 and NULL
 850  *   label - there is no need to re-check it.
 851  * - Label acquired from security_server_get_smacklabel_cookie should be an empty string.
 852  */
 853 RUNNER_TEST_NOSMACK(tc_security_server_get_smacklabel_cookie_nosmack) {
 854     int res;
 855
 856     pid_t mypid;
 857
 858     char* label_ss = NULL;
 859     char* cookie = NULL;
 860
 861     int cookie_size = security_server_get_cookie_size();
 862     RUNNER_ASSERT_MSG(PROPER_COOKIE_SIZE == cookie_size,
 863             "Wrong cookie size from security-server. Size: " << cookie_size);
 864
 865     cookie = (char*) calloc(cookie_size, sizeof(char));
 866     RUNNER_ASSERT_MSG(NULL != cookie, "Memory allocation error");
 867
 868     mypid = getpid();
 869
 870     //Request cookie from SS
 871     res = security_server_request_cookie(cookie, cookie_size);
 872     std::unique_ptr<char, std::function<void(char*)> > cookie_ptr(cookie, free);
 873     cookie = NULL;
 874     if (res != SECURITY_SERVER_API_SUCCESS) {
 875         RUNNER_ASSERT_MSG(res == SECURITY_SERVER_API_SUCCESS,
 876                 "Error in requesting cookie from security-server. Result: " << res);
 877     }
 878
 879     label_ss = security_server_get_smacklabel_cookie(cookie_ptr.get());
 880     RUNNER_ASSERT_MSG(label_ss != NULL, "Error in getting label by cookie");
 881
 882     //Check if label_ss is correct, that is only one NULL character.
 883     if (label_ss[0] != '\0') {
 884         free(label_ss);
 885         RUNNER_ASSERT_MSG(label_ss[0] == '\0', "label_ss was not an empty string.");
 886     }
 887
 888     free(label_ss);
 889 }
 890
 891 ////////////////////
 892 /////MAIN///////////
 893 ////////////////////
 894
 895 int main(int argc, char *argv[])
 896 {
 897     return
 898         DPL::Test::TestRunnerSingleton::Instance().ExecTestRunner(argc, argv);
 899 }