tests/security-server-tests/security_server_tests_client_smack.cpp

   1 /*
   2  * Copyright (c) 2013 Samsung Electronics Co., Ltd All Rights Reserved
   3  */
   4 /*
   5  * @file    security_server_tests_client_smack.cpp
   6  * @author  Bartlomiej Grzelewski (b.grzelewski@samsung.com)
   7  * @version 1.1
   8  * @brief   Test cases for security-server-client-smack.
   9  */
  10
  11 #include <unistd.h>
  12 #include <stdlib.h>
  13 #include <sys/types.h>
  14 #include <sys/socket.h>
  15 #include <sys/smack.h>
  16 #include <sys/wait.h>
  17 #include <sys/un.h>
  18 #include <sys/stat.h>
  19 #include <fcntl.h>
  20 #include <errno.h>
  21
  22 #include <memory>
  23 #include <functional>
  24
  25 #include <dpl/log/log.h>
  26 #include <dpl/test/test_runner.h>
  27 #include <dpl/test/test_runner_child.h>
  28 #include <dpl/test/test_runner_multiprocess.h>
  29 #include "security_server_mockup.h"
  30
  31 #include <security-server.h>
  32
  33 #include "tests_common.h"
  34
  35 #define PROPER_COOKIE_SIZE 20
  36
  37 #define ENVIRONMENT                                                       \
  38     do {                                                                  \
  39         const char *subject_label = "mylabel";                            \
  40         RUNNER_ASSERT_MSG(-1 != system("touch /opt/home/root/pid_cycle"), \
  41             "Cannot prepare environment for test.");                      \
  42         RUNNER_ASSERT_MSG(0 == smack_set_label_for_self(subject_label),   \
  43             "Cannot prepare environment for test.");                      \
  44         RUNNER_ASSERT_MSG(-1 != setgid(1),                                \
  45             "Cannot prepare environment for test.");                      \
  46         RUNNER_ASSERT_MSG(-1 != setuid(1),                                \
  47             "Cannot prepare environment for test");                       \
  48     } while (0)
  49
  50
  51 /**
  52  * Environment preparation should only differ in setting label. On NOSMACK system
  53  * smack_set_label_for_self returns error because of no access to /proc/self/attr/current.
  54  */
  55 #define ENVIRONMENT_NOSMACK                                               \
  56     do {                                                                  \
  57         int fd = open("/opt/home/root/pid_cycle", O_CREAT|O_APPEND, 0444);\
  58         RUNNER_ASSERT_MSG(fd >= 0,                                        \
  59             "Couldn't create pid_cycle file. errno: " << strerror(errno));\
  60         close(fd);                                                        \
  61         RUNNER_ASSERT_MSG(-1 != setgid(1),                                \
  62             "Cannot prepare environment for test.");                      \
  63         RUNNER_ASSERT_MSG(-1 != setuid(1),                                \
  64             "Cannot prepare environment for test");                       \
  65     } while (0)
  66
  67
  68 /**
  69  * Unique_ptr typedef for NOSMACK version of tc06 test
  70  */
  71 void closesockfdptr(int* sockfd_ptr)
  72 {
  73     close(*sockfd_ptr);
  74 }
  75 typedef std::unique_ptr<int, std::function<void(int*)> > SockFDUniquePtr;
  76
  77 /**
  78  * Dropping root privileges
  79  * returns 0 on success, 1 on error
  80  */
  81 int drop_root_privileges()
  82 {
  83     if (getuid() == 0) {
  84         /* process is running as root, drop privileges */
  85         if (setgid(5000) != 0)
  86             return 1;
  87         if (setuid(5000) != 0)
  88             return 1;
  89     }
  90     int uid = getuid();
  91     if (uid == 5000)
  92         return 0;
  93
  94     return 1;
  95 }
  96
  97 RUNNER_TEST_GROUP_INIT(SECURITY_SERVER_TESTS_CLIENT_SMACK)
  98
  99 /*
 100  * test: Check cookie size returned by security_server_get_cookie_size.
 101  * description: Cookie used by security-server is 20 bytes long.
 102  * Any other size of cookies should be treated as error.
 103  * expected: Function security_server_get_cookie_size returns 20.
 104  */
 105 RUNNER_CHILD_TEST_SMACK(tc01_security_server_get_cookie_size)
 106 {
 107     ENVIRONMENT;
 108
 109     int ret = security_server_get_cookie_size();
 110     RUNNER_ASSERT_MSG(20 == ret, "ret = " << ret);
 111 }
 112
 113 /*
 114  * test: security_server_request_cookie
 115  * description: Function security_server_request_cookie will return
 116  * 20 bytes long cookie.
 117  * expected: function will set up cookie in the array and return
 118  * SECURITY_SERVER_API_SUCCESS.
 119  */
 120 RUNNER_CHILD_TEST_SMACK(tc02_security_server_request_cookie_normal_case)
 121 {
 122     ENVIRONMENT;
 123
 124     char cookie[20];
 125     int ret = security_server_request_cookie(cookie, 20);
 126     LogDebug("ret = " << ret);
 127     RUNNER_ASSERT(SECURITY_SERVER_API_SUCCESS == ret);
 128 }
 129
 130 /*
 131  * test: security_server_request_cookie
 132  * description: Function security_server_request_cookie will return
 133  * 20 bytes long cookie.
 134  * expected: function will set up cookie in the array and return
 135  * SECURITY_SERVER_API_SUCCESS.
 136  */
 137 RUNNER_CHILD_TEST_SMACK(tc03_security_server_request_cookie_too_small_buffer_size)
 138 {
 139     ENVIRONMENT;
 140
 141     char cookie[20];
 142     int ret = security_server_request_cookie(cookie, 10);
 143     LogDebug("ret = " << ret);
 144     RUNNER_ASSERT(SECURITY_SERVER_API_ERROR_BUFFER_TOO_SMALL == ret);
 145 }
 146
 147 /*
 148  * test: tc04_security_server_get_gid
 149  * description: Checking for security_server_get_gid
 150  *              with nonexisting gid and existing one
 151  * expected: security_server_get_gid should return
 152  *           SECURITY_SERVER_ERROR_NO_SUCH_OBJECT with first call
 153  *           and group id with second call
 154  */
 155 RUNNER_CHILD_TEST_SMACK(tc04_security_server_get_gid)
 156 {
 157     ENVIRONMENT;
 158
 159     int ret = security_server_get_gid("abc123xyz_pysiaczek");
 160     LogDebug("ret = " << ret);
 161     RUNNER_ASSERT_MSG(SECURITY_SERVER_API_ERROR_NO_SUCH_OBJECT == ret, "Ret: " << ret);
 162     ret = security_server_get_gid("root");
 163     LogDebug("ret = " << ret);
 164     RUNNER_ASSERT_MSG(0 == ret, "Ret: " << ret);
 165 }
 166
 167 /*
 168  * test: tc05_check_privilege_by_cookie
 169  * description: Function security_server_check_privilege_by_cookie should
 170  * return status of access rights of cookie owner. In this case cookie owner
 171  * is the same process that ask for the rights.
 172  * expected: Function call with access rights set to "r" should return SUCCESS,
 173  * with "rw" should return ACCESS DENIED.
 174  */
 175 RUNNER_CHILD_TEST_SMACK(tc05_check_privilege_by_cookie)
 176 {
 177     char cookie[20];
 178     const char *object_label = "tc05objectlabel";
 179     const char *access_rights = "r";
 180     const char *access_rights_ext = "rw";
 181     const char *subject_label = "tc05subjectlabel";
 182
 183     smack_accesses *handle;
 184
 185     RUNNER_ASSERT(0 == smack_accesses_new(&handle));
 186
 187     RUNNER_ASSERT(0 == smack_accesses_add(handle,
 188             subject_label,
 189             object_label,
 190             access_rights));
 191
 192     RUNNER_ASSERT(0 == smack_accesses_apply(handle));
 193
 194     smack_accesses_free(handle);
 195
 196     RUNNER_ASSERT(0 == smack_set_label_for_self(subject_label));
 197
 198     RUNNER_ASSERT(SECURITY_SERVER_API_SUCCESS ==
 199         security_server_request_cookie(cookie,20));
 200
 201     RUNNER_ASSERT_MSG(drop_root_privileges() == 0, "uid = " << getuid());
 202
 203     RUNNER_ASSERT(SECURITY_SERVER_API_SUCCESS ==
 204         security_server_check_privilege_by_cookie(
 205             cookie,
 206             object_label,
 207             access_rights));
 208
 209     RUNNER_ASSERT(SECURITY_SERVER_API_ERROR_ACCESS_DENIED ==
 210         security_server_check_privilege_by_cookie(
 211             cookie,
 212             object_label,
 213             access_rights_ext));
 214 }
 215
 216 /*
 217  * test: security_server_check_privilege_by_sockfd
 218  * description: This test will create dummy server that will accept connection
 219  * and die. The client will try to check access rights using connection descriptor.
 220  * expected: Function call with access rights set to "r" should return SUCCESS,
 221  * with "rw" should return ACCESS DENIED.
 222  */
 223 RUNNER_MULTIPROCESS_TEST_SMACK(tc06_check_privilege_by_sockfd)
 224 {
 225     const char *object_label = "tc06objectlabel";
 226     const char *access_rights = "r";
 227     const char *access_rights_ext = "rw";
 228     const char *subject_label = "tc06subjectlabel";
 229
 230     int result1 = -1;
 231     int result2 = -1;
 232
 233     smack_accesses *handle;
 234     RUNNER_ASSERT(0 == smack_accesses_new(&handle));
 235     RUNNER_ASSERT(0 == smack_accesses_add(handle,
 236             subject_label,
 237             object_label,
 238             access_rights));
 239     RUNNER_ASSERT(0 == smack_accesses_apply(handle));
 240     smack_accesses_free(handle);
 241
 242     int pid = fork();
 243     char *label;
 244     RUNNER_ASSERT(-1 != pid);
 245
 246     if (0 == pid) {
 247         // child
 248         RUNNER_ASSERT_MSG(0 == smack_set_label_for_self(subject_label), "child label " << subject_label << " not set");
 249
 250         int sockfd = create_new_socket();
 251         RUNNER_ASSERT_MSG(sockfd >= 0, "create_new_socket() failed");
 252
 253         SockFDUniquePtr sockfd_ptr(&sockfd, closesockfdptr);
 254
 255         label = security_server_get_smacklabel_sockfd(sockfd);
 256         RUNNER_ASSERT_MSG(label != NULL, "security_server_get_smacklabel_sockfd failed");
 257         RUNNER_ASSERT_MSG(strcmp(label,"") == 0, "label is \"" << label << "\"");
 258         free(label);
 259
 260         RUNNER_ASSERT_MSG(drop_root_privileges() == 0, "uid = " << getuid());
 261
 262         RUNNER_ASSERT_MSG(listen(sockfd, 5) >= 0, "child listen failed");
 263
 264         label = security_server_get_smacklabel_sockfd(sockfd);
 265         RUNNER_ASSERT_MSG(label != NULL, "security_server_get_smacklabel_sockfd failed");
 266         RUNNER_ASSERT_MSG(strcmp(label,"") == 0, "label is \"" << label << "\"");
 267         free(label);
 268
 269         struct sockaddr_un client_addr;
 270         socklen_t client_len = sizeof(client_addr);
 271         int csockfd;
 272         RUNNER_ASSERT_MSG((csockfd = accept(sockfd,(struct sockaddr*)&client_addr, &client_len)) > 0, "child accept failed");
 273
 274         usleep(500);
 275
 276         close(csockfd);
 277         exit(0);
 278     } else {
 279         // parent
 280         sleep(1);
 281         int sockfd = connect_to_testserver();
 282         RUNNER_ASSERT_MSG(sockfd >= 0, "connect_to_testserver() failed");
 283
 284         SockFDUniquePtr sockfd_ptr(&sockfd, closesockfdptr);
 285
 286         label = security_server_get_smacklabel_sockfd(sockfd);
 287         RUNNER_ASSERT_MSG(label != NULL, "security_server_get_smacklabel_sockfd failed");
 288         RUNNER_ASSERT_MSG(strcmp(label,subject_label) == 0, "label is \"" << label << "\"" << ", subject_label is \"" << subject_label << "\"" );
 289         free(label);
 290
 291         result1 = security_server_check_privilege_by_sockfd(
 292             sockfd,
 293             object_label,
 294             access_rights);
 295         result2 = security_server_check_privilege_by_sockfd(
 296             sockfd,
 297             object_label,
 298             access_rights_ext);
 299     }
 300
 301     RUNNER_ASSERT_MSG(SECURITY_SERVER_API_SUCCESS == result1, "result = " << result1);
 302     RUNNER_ASSERT_MSG(SECURITY_SERVER_API_ERROR_ACCESS_DENIED == result2, "result = " << result2);
 303 }
 304
 305 /*
 306  * test: security_server_check_privilege_by_sockfd
 307  * description: This test will create dummy server that will accept connection
 308  * and die. The client will try to check access rights using connection descriptor.
 309  * Because we read a smack label not from socket directly, but from from pid of process
 310  * on the other end of socket - that's why smack label will be updated.
 311  * In this test client is running under root and server is not - to test the extreme case.
 312  * expected: Function call with access rights set to "r" should return SUCCESS,
 313  * with "rw" should return ACCESS DENIED.
 314  */
 315 RUNNER_MULTIPROCESS_TEST_SMACK(tc07_check_privilege_by_sockfd)
 316 {
 317     const char *object_label = "tc07objectlabel";
 318     const char *access_rights = "r";
 319     const char *access_rights_ext = "rw";
 320     const char *subject_label = "tc07subjectlabel";
 321
 322     int result1 = -1;
 323     int result2 = -1;
 324
 325     smack_accesses *handle;
 326     RUNNER_ASSERT(0 == smack_accesses_new(&handle));
 327     RUNNER_ASSERT(0 == smack_accesses_add(handle,
 328             subject_label,
 329             object_label,
 330             access_rights));
 331     RUNNER_ASSERT(0 == smack_accesses_apply(handle));
 332     smack_accesses_free(handle);
 333
 334     int pid = fork();
 335     RUNNER_ASSERT(-1 != pid);
 336
 337     if (0 == pid) {
 338
 339         pid = fork();
 340         RUNNER_ASSERT(-1 != pid);
 341
 342         if (0 == pid) {
 343             // child
 344             int sockfd = create_new_socket();
 345             RUNNER_ASSERT_MSG(sockfd >= 0, "create_new_socket() failed");
 346
 347             SockFDUniquePtr sockfd_ptr(&sockfd, closesockfdptr);
 348
 349             RUNNER_ASSERT_MSG(0 == smack_set_label_for_self(subject_label), "child label " << subject_label << " not set");
 350
 351             RUNNER_ASSERT_MSG(drop_root_privileges() == 0, "uid = " << getuid());
 352
 353             RUNNER_ASSERT_MSG(listen(sockfd, 5) >= 0, "child listen failed");
 354
 355             struct sockaddr_un client_addr;
 356             socklen_t client_len = sizeof(client_addr);
 357             int csockfd = TEMP_FAILURE_RETRY(accept(sockfd,(struct sockaddr*)&client_addr, &client_len));
 358             if (csockfd >= 0)
 359                 close(csockfd);
 360             LogDebug("Exit!");
 361             exit(0);
 362         } else {
 363             // parent
 364
 365             RUNNER_ASSERT_MSG(drop_root_privileges() == 0, "uid = " << getuid());
 366
 367             sleep(1);
 368             int sockfd = connect_to_testserver();
 369             RUNNER_ASSERT_MSG(sockfd >= 0, "connect_to_testserver() failed");
 370
 371             result1 = security_server_check_privilege_by_sockfd(
 372                 sockfd,
 373                 object_label,
 374                 access_rights);
 375             result2 = security_server_check_privilege_by_sockfd(
 376                 sockfd,
 377                 object_label,
 378                 access_rights_ext);
 379
 380             close(sockfd);
 381
 382             RUNNER_ASSERT_MSG(SECURITY_SERVER_API_SUCCESS == result1, "result1 = " << result1);
 383             RUNNER_ASSERT_MSG(SECURITY_SERVER_API_ERROR_ACCESS_DENIED == result2, " result2 = " << result2);
 384         }
 385     }
 386 }
 387
 388 ///////////////////////////
 389 /////NOSMACK ENV TESTS/////
 390 ///////////////////////////
 391
 392 /**
 393  * First four test cases are the same as their SMACK versions. The only difference is environment
 394  * preparation (described near ENVIRONMENT_NOSMACK macro).
 395  */
 396 RUNNER_CHILD_TEST_NOSMACK(tc01_security_server_get_cookie_size_nosmack)
 397 {
 398     ENVIRONMENT_NOSMACK;
 399
 400     int ret = security_server_get_cookie_size();
 401     RUNNER_ASSERT_MSG(ret == 20, "ret = " << ret);
 402 }
 403
 404 RUNNER_CHILD_TEST_NOSMACK(tc02_security_server_request_cookie_normal_case_nosmack)
 405 {
 406     ENVIRONMENT_NOSMACK;
 407
 408     char cookie[20];
 409     int ret = security_server_request_cookie(cookie, 20);
 410     RUNNER_ASSERT_MSG(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 411 }
 412
 413 RUNNER_CHILD_TEST_NOSMACK(tc03_security_server_request_cookie_too_small_buffer_size_nosmack)
 414 {
 415     ENVIRONMENT_NOSMACK;
 416
 417     char cookie[20];
 418     int ret = security_server_request_cookie(cookie, 10);
 419     RUNNER_ASSERT_MSG(ret == SECURITY_SERVER_API_ERROR_BUFFER_TOO_SMALL, "ret = " << ret);
 420 }
 421
 422 RUNNER_CHILD_TEST_NOSMACK(tc04_security_server_get_gid_nosmack)
 423 {
 424     ENVIRONMENT_NOSMACK;
 425
 426     int ret = security_server_get_gid("definitely_not_existing_object");
 427     RUNNER_ASSERT_MSG(ret == SECURITY_SERVER_API_ERROR_NO_SUCH_OBJECT, "ret = " << ret);
 428     ret = security_server_get_gid("root");
 429     RUNNER_ASSERT_MSG(ret == 0, "ret = " << ret);
 430 }
 431
 432 /*
 433  * NOSMACK version of tc05 test.
 434  *
 435  * Correct behaviour of smack_accesses_apply and smack_set_label_for_self was checked by libsmack
 436  * tests. We assume, that those tests pass. Additionally security_server_check_privilege_by_cookie
 437  * should return SUCCESS no matter what access_rights we give to this function.
 438  */
 439 RUNNER_CHILD_TEST_NOSMACK(tc05_check_privilege_by_cookie_nosmack)
 440 {
 441     char cookie[20];
 442     const char* object_label = "tc05objectlabel";
 443
 444     RUNNER_ASSERT(security_server_request_cookie(cookie,20) == SECURITY_SERVER_API_SUCCESS);
 445
 446     RUNNER_ASSERT_MSG(drop_root_privileges() == 0, "uid = " << getuid());
 447
 448     RUNNER_ASSERT(SECURITY_SERVER_API_SUCCESS ==
 449         security_server_check_privilege_by_cookie(cookie, object_label, "r"));
 450
 451     //On NOSMACK env security server should return success on any accesses, even those that are
 452     //incorrect.
 453     RUNNER_ASSERT(SECURITY_SERVER_API_SUCCESS ==
 454         security_server_check_privilege_by_cookie(cookie, object_label, "rw"));
 455 }
 456
 457 /**
 458  * NOSMACK version of tc06 test.
 459  *
 460  * Differences between this and SMACK version (server):
 461  * - Skipped setting access_rights
 462  * - Skipped setting label for server
 463  * - get_smacklabel_sockfd is called only once for server, almost right after fork and creation
 464  *   of socket (because it should do nothing when SMACK is off)
 465  * - After get_smacklabel_sockfd privileges are dropped and server is prepared to accept connections
 466  *   from client
 467  *
 468  * For client the only difference are expected results from check_privilege_by_sockfd - both should
 469  * return SUCCESS.
 470  */
 471 RUNNER_MULTIPROCESS_TEST_NOSMACK(tc06_check_privilege_by_sockfd_nosmack)
 472 {
 473     const char* object_label = "tc06objectlabel";
 474
 475     int result1 = -1;
 476     int result2 = -1;
 477
 478     int pid = fork();
 479     char* label;
 480     RUNNER_ASSERT(pid >= 0);
 481
 482     int ret;
 483
 484     if (pid == 0) { //child process - server
 485         //create new socket
 486         int sockfd = create_new_socket();
 487         RUNNER_ASSERT_MSG(sockfd >= 0, "create_new_socket() failed");
 488
 489         SockFDUniquePtr sockfd_ptr(&sockfd, closesockfdptr);
 490
 491         //check if get_smacklabel_sockfd works correctly
 492         label = security_server_get_smacklabel_sockfd(sockfd);
 493         RUNNER_ASSERT_MSG(label != NULL, "security_server_get_smacklabel_sockfd failed");
 494         ret = strcmp(label, "");
 495         free(label);
 496         RUNNER_ASSERT_MSG(ret == 0, "label is \"" << label << "\"");
 497
 498         RUNNER_ASSERT_MSG(drop_root_privileges() == 0, "uid = " << getuid());
 499
 500         RUNNER_ASSERT_MSG(listen(sockfd, 5) >= 0, "child listen failed");
 501
 502         struct sockaddr_un client_addr;
 503         socklen_t client_len = sizeof(client_addr);
 504
 505         int csockfd;
 506         RUNNER_ASSERT_MSG((csockfd = accept(sockfd,(struct sockaddr*)&client_addr, &client_len)) > 0, "child accept failed");
 507
 508         //wait a little bit for parent to do it's job
 509         usleep(200);
 510
 511         //if everything works, cleanup and return 0
 512         close(csockfd);
 513         exit(0);
 514     } else {
 515         //parent
 516         sleep(1);
 517         int sockfd = connect_to_testserver();
 518         RUNNER_ASSERT_MSG(sockfd >= 0, "Failed to connect to server.");
 519
 520         SockFDUniquePtr sockfd_ptr(&sockfd, closesockfdptr);
 521
 522         label = security_server_get_smacklabel_sockfd(sockfd);
 523         RUNNER_ASSERT_MSG(label != NULL, "get_smacklabel_sockfd failed.");
 524         ret = strcmp(label, "");
 525         free(label);
 526         RUNNER_ASSERT_MSG(ret == 0, "label is \"" << label << "\"");
 527
 528         result1 = security_server_check_privilege_by_sockfd(sockfd, object_label, "r");
 529         result2 = security_server_check_privilege_by_sockfd(sockfd, object_label, "rw");
 530     }
 531
 532     RUNNER_ASSERT_MSG(result1 == SECURITY_SERVER_API_SUCCESS, "result = " << result1);
 533     RUNNER_ASSERT_MSG(result2 == SECURITY_SERVER_API_SUCCESS, "result = " << result2);
 534 }
 535
 536 /**
 537  * NOSMACK version of tc07 test.
 538  */
 539 RUNNER_MULTIPROCESS_TEST_NOSMACK(tc07_check_privilege_by_sockfd_nosmack)
 540 {
 541     const char* object_label = "tc07objectlabel";
 542
 543     int result1 = -1;
 544     int result2 = -1;
 545
 546     int pid = fork();
 547     RUNNER_ASSERT(-1 != pid);
 548
 549     if (pid == 0) {
 550
 551         pid = fork();
 552         RUNNER_ASSERT(-1 != pid);
 553
 554         if (pid == 0) { //child process
 555             //Create socket
 556             int sockfd = create_new_socket();
 557             RUNNER_ASSERT_MSG(sockfd >= 0, "create_new_socket() failed");
 558
 559             SockFDUniquePtr sockfd_ptr(&sockfd, closesockfdptr);
 560
 561             //Drop privileges
 562             RUNNER_ASSERT_MSG(drop_root_privileges() == 0, "uid = " << getuid());
 563
 564             //Prepare for accepting
 565             RUNNER_ASSERT_MSG(listen(sockfd, 5) >= 0, "child listen failed");
 566
 567             struct sockaddr_un client_addr;
 568             socklen_t client_len = sizeof(client_addr);
 569
 570             //Accept connections
 571             int csockfd;
 572             RUNNER_ASSERT_MSG((csockfd = accept(sockfd,(struct sockaddr*)&client_addr, &client_len)) > 0, "child accept failed");
 573
 574             //wait a little bit for parent to do it's job
 575             usleep(200);
 576
 577             //cleanup and kill child
 578             close(csockfd);
 579             exit(0);
 580         } else {    //parent process
 581             //Drop root privileges
 582             RUNNER_ASSERT_MSG(drop_root_privileges() == 0, "uid = " << getuid());
 583
 584             //Wait for server to set up
 585             sleep(1);
 586
 587             //Connect and check privileges
 588             int sockfd = connect_to_testserver();
 589             RUNNER_ASSERT_MSG(sockfd >= 0, "Failed to create socket fd.");
 590
 591             result1 = security_server_check_privilege_by_sockfd(sockfd, object_label, "r");
 592             result2 = security_server_check_privilege_by_sockfd(sockfd, object_label, "rw");
 593
 594             close(sockfd);
 595
 596             //Both results (just like in the previous test case) should return success.
 597             RUNNER_ASSERT_MSG(SECURITY_SERVER_API_SUCCESS == result1, "result1 = " << result1);
 598             RUNNER_ASSERT_MSG(SECURITY_SERVER_API_SUCCESS == result2, "result2 = " << result2);
 599         }
 600     }
 601 }
 602
 603 int apply_smack_rule(const char *subject, const char *object, const char *rule)
 604 {
 605     struct smack_accesses *ruleHandler = NULL;
 606     if (smack_accesses_new(&ruleHandler) != 0)
 607         goto error;
 608     if (smack_accesses_add(ruleHandler, subject, object, rule) != 0)
 609         goto error;
 610     if (smack_accesses_apply(ruleHandler) != 0)
 611         goto error;
 612
 613     smack_accesses_free(ruleHandler);
 614     return 0;
 615
 616 error:
 617     smack_accesses_free(ruleHandler);
 618     return -1;
 619 }
 620
 621 RUNNER_TEST(tc10_security_server_get_uid_by_cookie)
 622 {
 623     int cookieSize = security_server_get_cookie_size();
 624     RUNNER_ASSERT_MSG(cookieSize == 20, "Wrong cookie size");
 625
 626     std::vector<char> cookie(cookieSize);
 627     int retval = security_server_request_cookie(&cookie[0], cookieSize);
 628     RUNNER_ASSERT_MSG(retval == SECURITY_SERVER_API_SUCCESS, "Unable to get cookie");
 629
 630     //checking function
 631     uid_t cookieUid, realUid;
 632     realUid = getuid();
 633     retval = security_server_get_uid_by_cookie(&cookie[0], &cookieUid);
 634     RUNNER_ASSERT_MSG(retval == SECURITY_SERVER_API_SUCCESS, "Unable to get UID from cookie. My uid: " << realUid << " Server error: " << retval);
 635     RUNNER_ASSERT_MSG(realUid == cookieUid, "No match in received UID");
 636
 637     //checking for input parameters
 638     retval = security_server_get_uid_by_cookie(NULL, &cookieUid);
 639     RUNNER_ASSERT_MSG(retval == SECURITY_SERVER_API_ERROR_INPUT_PARAM, "Error in checking input parameters by function");
 640     retval = security_server_get_uid_by_cookie(&cookie[0], NULL);
 641     RUNNER_ASSERT_MSG(retval == SECURITY_SERVER_API_ERROR_INPUT_PARAM, "Error in checking input parameters by function");
 642 }
 643
 644 RUNNER_CHILD_TEST(tc11_security_server_get_uid_by_cookie)
 645 {
 646     int cookieSize = security_server_get_cookie_size();
 647     RUNNER_ASSERT_MSG(cookieSize == 20, "Wrong cookie size");
 648
 649     std::vector<char> cookie(cookieSize);
 650     int retval = security_server_request_cookie(&cookie[0], cookieSize);
 651     RUNNER_ASSERT_MSG(retval == SECURITY_SERVER_API_SUCCESS, "Unable to get cookie");
 652
 653     //preapare SMACK environment
 654     RUNNER_ASSERT_MSG(smack_set_label_for_self("BialyMis") == 0, "Unable to set label for self");
 655     RUNNER_ASSERT_MSG(smack_revoke_subject("BialyMis") == 0, "Error in smack_revoke_subject");
 656     //drop privileges
 657     RUNNER_ASSERT_MSG(setuid(5000) == 0, "Unable to drop privileges");
 658
 659     //checking function
 660     uid_t cookieUid;
 661     retval = security_server_get_uid_by_cookie(&cookie[0], &cookieUid);
 662     RUNNER_ASSERT_MSG(retval == SECURITY_SERVER_API_ERROR_ACCESS_DENIED, "Socket not protected by smack");
 663 }
 664
 665 RUNNER_CHILD_TEST(tc12_security_server_get_uid_by_cookie)
 666 {
 667     int cookieSize = security_server_get_cookie_size();
 668     RUNNER_ASSERT_MSG(cookieSize == 20, "Wrong cookie size");
 669
 670     uid_t realUid = getuid();
 671
 672     std::vector<char> cookie(cookieSize);
 673     int retval = security_server_request_cookie(&cookie[0], cookieSize);
 674     RUNNER_ASSERT_MSG(retval == SECURITY_SERVER_API_SUCCESS, "Unable to get cookie");
 675
 676     //preapare SMACK environment
 677     RUNNER_ASSERT_MSG(smack_set_label_for_self("BialyMis") == 0, "Unable to set label for self");
 678     RUNNER_ASSERT_MSG(apply_smack_rule("BialyMis", "security-server::api-cookie-check", "w") == 0, "Error in adding rule");
 679     //drop privileges
 680     RUNNER_ASSERT_MSG(setuid(5000) == 0, "Unable to drop privileges");
 681
 682     //checking function
 683     uid_t cookieUid;
 684     retval = security_server_get_uid_by_cookie(&cookie[0], &cookieUid);
 685     RUNNER_ASSERT_MSG(retval == SECURITY_SERVER_API_SUCCESS, "Unable to get UID from cookie");
 686     RUNNER_ASSERT_MSG(realUid == cookieUid, "No match in received UID");
 687 }
 688
 689 RUNNER_CHILD_TEST(tc13_security_server_get_uid_by_cookie)
 690 {
 691     int cookieSize = security_server_get_cookie_size();
 692     RUNNER_ASSERT_MSG(cookieSize == 20, "Wrong cookie size");
 693
 694     //preapare SMACK environment
 695     RUNNER_ASSERT_MSG(smack_set_label_for_self("BialyMis") == 0, "Unable to set label for self");
 696     RUNNER_ASSERT_MSG(apply_smack_rule("BialyMis", "security-server::api-cookie-check", "w") == 0, "Error in adding rule");
 697     RUNNER_ASSERT_MSG(apply_smack_rule("BialyMis", "security-server::api-cookie-get", "w") == 0, "Error in adding rule");
 698     //drop privileges
 699     RUNNER_ASSERT_MSG(setuid(5000) == 0, "Unable to drop privileges");
 700
 701     std::vector<char> cookie(cookieSize);
 702     int retval = security_server_request_cookie(&cookie[0], cookieSize);
 703     RUNNER_ASSERT_MSG(retval == SECURITY_SERVER_API_SUCCESS, "Unable to get cookie");
 704
 705     //checking function
 706     uid_t cookieUid, realUid = getuid();
 707     retval = security_server_get_uid_by_cookie(&cookie[0], &cookieUid);
 708     RUNNER_ASSERT_MSG(retval == SECURITY_SERVER_API_SUCCESS, "Unable to get UID from cookie");
 709     RUNNER_ASSERT_MSG(realUid == cookieUid, "No match in received UID");
 710 }
 711
 712 RUNNER_TEST(tc14_security_server_get_gid_by_cookie)
 713 {
 714     int cookieSize = security_server_get_cookie_size();
 715     RUNNER_ASSERT_MSG(cookieSize == 20, "Wrong cookie size");
 716
 717     std::vector<char> cookie(cookieSize);
 718     int retval = security_server_request_cookie(&cookie[0], cookieSize);
 719     RUNNER_ASSERT_MSG(retval == SECURITY_SERVER_API_SUCCESS, "Unable to get cookie");
 720
 721     //checking function
 722     gid_t cookieGid, realGid;
 723     realGid = getgid();
 724     retval = security_server_get_gid_by_cookie(&cookie[0], &cookieGid);
 725     RUNNER_ASSERT_MSG(retval == SECURITY_SERVER_API_SUCCESS, "Unable to get GID from cookie");
 726     RUNNER_ASSERT_MSG(realGid == cookieGid, "No match in received GID");
 727
 728     //checking for input parameters
 729     retval = security_server_get_gid_by_cookie(NULL, &cookieGid);
 730     RUNNER_ASSERT_MSG(retval == SECURITY_SERVER_API_ERROR_INPUT_PARAM, "Error in checking input parameters by function");
 731     retval = security_server_get_gid_by_cookie(&cookie[0], NULL);
 732     RUNNER_ASSERT_MSG(retval == SECURITY_SERVER_API_ERROR_INPUT_PARAM, "Error in checking input parameters by function");
 733
 734 }
 735
 736 RUNNER_CHILD_TEST(tc15_security_server_get_gid_by_cookie)
 737 {
 738     int cookieSize = security_server_get_cookie_size();
 739     RUNNER_ASSERT_MSG(cookieSize == 20, "Wrong cookie size");
 740
 741     std::vector<char> cookie(cookieSize);
 742     int retval = security_server_request_cookie(&cookie[0], cookieSize);
 743     RUNNER_ASSERT_MSG(retval == SECURITY_SERVER_API_SUCCESS, "Unable to get cookie");
 744
 745     //preapare SMACK environment
 746     RUNNER_ASSERT_MSG(smack_set_label_for_self("BialyMis") == 0, "Unable to set label for self");
 747     RUNNER_ASSERT_MSG(smack_revoke_subject("BialyMis") == 0, "Error in smack_revoke_subject");
 748     //drop privileges
 749     RUNNER_ASSERT_MSG(setgid(5000) == 0, "Unable to drop privileges");
 750     RUNNER_ASSERT_MSG(setuid(5000) == 0, "Unable to drop privileges");
 751
 752     //checking function
 753     gid_t cookieGid, realGid;
 754     realGid = getgid();
 755     retval = security_server_get_gid_by_cookie(&cookie[0], &cookieGid);
 756     RUNNER_ASSERT_MSG(retval == SECURITY_SERVER_API_ERROR_ACCESS_DENIED, "Socket not protected by smack");
 757 }
 758
 759 RUNNER_CHILD_TEST(tc16_security_server_get_gid_by_cookie)
 760 {
 761     int cookieSize = security_server_get_cookie_size();
 762     RUNNER_ASSERT_MSG(cookieSize == 20, "Wrong cookie size");
 763
 764     std::vector<char> cookie(cookieSize);
 765
 766     gid_t realGid = getgid();
 767     int retval = security_server_request_cookie(&cookie[0], cookieSize);
 768     RUNNER_ASSERT_MSG(retval == SECURITY_SERVER_API_SUCCESS, "Unable to get cookie");
 769
 770     //preapare SMACK environment
 771     RUNNER_ASSERT_MSG(smack_set_label_for_self("BialyMis") == 0, "Unable to set label for self");
 772     RUNNER_ASSERT_MSG(apply_smack_rule("BialyMis", "security-server::api-cookie-check", "w") == 0, "Error in adding rule");
 773     //drop privileges
 774     RUNNER_ASSERT_MSG(setgid(5000) == 0, "Unable to drop privileges");
 775     RUNNER_ASSERT_MSG(setuid(5000) == 0, "Unable to drop privileges");
 776
 777     //checking function
 778     gid_t cookieGid;
 779     retval = security_server_get_gid_by_cookie(&cookie[0], &cookieGid);
 780     RUNNER_ASSERT_MSG(retval == SECURITY_SERVER_API_SUCCESS, "Unable to get GID from cookie");
 781     RUNNER_ASSERT_MSG(realGid == cookieGid, "No match in received GID. ReadGid: " << realGid << " CookieGid: " << cookieGid);
 782 }
 783
 784 RUNNER_CHILD_TEST(tc17_security_server_get_gid_by_cookie)
 785 {
 786     int cookieSize = security_server_get_cookie_size();
 787     RUNNER_ASSERT_MSG(cookieSize == 20, "Wrong cookie size");
 788
 789     //preapare SMACK environment
 790     RUNNER_ASSERT_MSG(smack_set_label_for_self("BialyMis") == 0, "Unable to set label for self");
 791     RUNNER_ASSERT_MSG(apply_smack_rule("BialyMis", "security-server::api-cookie-check", "w") == 0, "Error in adding rule");
 792     RUNNER_ASSERT_MSG(apply_smack_rule("BialyMis", "security-server::api-cookie-get", "w") == 0, "Error in adding rule");
 793     //drop privileges
 794     RUNNER_ASSERT_MSG(setgid(5000) == 0, "Unable to drop privileges");
 795     RUNNER_ASSERT_MSG(setuid(5000) == 0, "Unable to drop privileges");
 796
 797     std::vector<char> cookie(cookieSize);
 798     int retval = security_server_request_cookie(&cookie[0], cookieSize);
 799     RUNNER_ASSERT_MSG(retval == SECURITY_SERVER_API_SUCCESS, "Unable to get cookie");
 800
 801     //checking function
 802     gid_t cookieGid, realGid = getgid();
 803     retval = security_server_get_gid_by_cookie(&cookie[0], &cookieGid);
 804     RUNNER_ASSERT_MSG(retval == SECURITY_SERVER_API_SUCCESS, "Unable to get GID from cookie");
 805     RUNNER_ASSERT_MSG(realGid == cookieGid, "No match in received GID. ReadGid: " << realGid << " CookieGid: " << cookieGid);
 806 }
 807
 808
 809 RUNNER_TEST_SMACK(tc18_security_server_get_smacklabel_cookie) {
 810     int res;
 811
 812     pid_t mypid;
 813
 814     char *label_smack = NULL;
 815     char *label_ss = NULL;
 816     char *cookie = NULL;
 817
 818     int cookie_size = security_server_get_cookie_size();
 819     RUNNER_ASSERT_MSG(PROPER_COOKIE_SIZE == cookie_size, "Wrong cookie size from security-server");
 820
 821     mypid = getpid();
 822
 823     cookie = (char*) calloc(cookie_size, 1);
 824     RUNNER_ASSERT_MSG(NULL != cookie, "Memory allocation error");
 825
 826     res = security_server_request_cookie(cookie, cookie_size);
 827     if (res != SECURITY_SERVER_API_SUCCESS) {
 828         free(cookie);
 829         RUNNER_ASSERT_MSG(res == SECURITY_SERVER_API_SUCCESS, "Error in requesting cookie from security-server");
 830     }
 831
 832     label_ss = security_server_get_smacklabel_cookie(cookie);
 833     free(cookie);
 834     RUNNER_ASSERT_MSG(label_ss != NULL, "Error in getting label by cookie");
 835
 836
 837     std::string label_cookie(label_ss);
 838     free(label_ss);
 839
 840     res = smack_new_label_from_self(&label_smack);
 841     if (res < 0) {
 842         free(label_smack);
 843         RUNNER_ASSERT_MSG(res == 0, "Error in getting self SMACK label");
 844     }
 845     std::string label_self(label_smack ? label_smack : "");
 846     free(label_smack);
 847
 848     RUNNER_ASSERT_MSG(label_self == label_cookie, "No match in SMACK labels");
 849
 850
 851     //TODO: here could be label change using SMACK API and checking if it
 852     //is changed using security-server API function based on the same cookie
 853 }
 854
 855 /**
 856  * NOSMACK version of tc_security_server_get_smacklabel_cookie test.
 857  *
 858  * Most of this test goes exactly as the original one. The only difference are the labels:
 859  * - We assume that libsmack tests passed and smack_new_label_from_self will return -1 and NULL
 860  *   label - there is no need to re-check it.
 861  * - Label acquired from security_server_get_smacklabel_cookie should be an empty string.
 862  */
 863 RUNNER_TEST_NOSMACK(tc_security_server_get_smacklabel_cookie_nosmack) {
 864     int res;
 865
 866     pid_t mypid;
 867
 868     char* label_ss = NULL;
 869     char* cookie = NULL;
 870
 871     int cookie_size = security_server_get_cookie_size();
 872     RUNNER_ASSERT_MSG(PROPER_COOKIE_SIZE == cookie_size,
 873             "Wrong cookie size from security-server. Size: " << cookie_size);
 874
 875     cookie = (char*) calloc(cookie_size, sizeof(char));
 876     RUNNER_ASSERT_MSG(NULL != cookie, "Memory allocation error");
 877
 878     mypid = getpid();
 879
 880     //Request cookie from SS
 881     res = security_server_request_cookie(cookie, cookie_size);
 882     std::unique_ptr<char, std::function<void(char*)> > cookie_ptr(cookie, free);
 883     cookie = NULL;
 884     if (res != SECURITY_SERVER_API_SUCCESS) {
 885         RUNNER_ASSERT_MSG(res == SECURITY_SERVER_API_SUCCESS,
 886                 "Error in requesting cookie from security-server. Result: " << res);
 887     }
 888
 889     label_ss = security_server_get_smacklabel_cookie(cookie_ptr.get());
 890     RUNNER_ASSERT_MSG(label_ss != NULL, "Error in getting label by cookie");
 891
 892     //Check if label_ss is correct, that is only one NULL character.
 893     if (label_ss[0] != '\0') {
 894         free(label_ss);
 895         RUNNER_ASSERT_MSG(label_ss[0] == '\0', "label_ss was not an empty string.");
 896     }
 897
 898     free(label_ss);
 899 }
 900
 901 ////////////////////
 902 /////MAIN///////////
 903 ////////////////////
 904
 905 int main(int argc, char *argv[])
 906 {
 907     return
 908         DPL::Test::TestRunnerSingleton::Instance().ExecTestRunner(argc, argv);
 909 }