#include <sys/capability.h>
#include <semaphore.h>
+#include <unistd.h>
+#include <sys/types.h>
+#include <sys/wait.h>
#include <sys/socket.h>
#include <sys/un.h>
#include <attr/xattr.h>
std::string uid_string;
TemporaryTestUser test_user(new_user_name, GUM_USERTYPE_NORMAL, false);
test_user.create();
- uid_string = std::to_string(static_cast<unsigned int>(test_user.getUid()));
+ test_user.getUidString(uid_string);
install_app(sm_app_id, sm_pkg_id, test_user.getUid());
// gumd user add
TemporaryTestUser test_user(new_user_name, GUM_USERTYPE_NORMAL, false);
test_user.create();
- uid_string = std::to_string(static_cast<unsigned int>(test_user.getUid()));
+ test_user.getUidString(uid_string);
addUserRequest.setUid(test_user.getUid());
addUserRequest.setUserType(SM_USER_TYPE_NORMAL);
const char *const USER_TYPE_NORMAL_BUCKET = "USER_TYPE_NORMAL";
const std::string username("sm_test_10_user_cynara_policy");
CynaraTestAdmin::Admin admin;
+ std::string uid_string;
TemporaryTestUser user(username, GUM_USERTYPE_NORMAL, true);
user.create();
- std::string uid_string = std::to_string(static_cast<unsigned int>(user.getUid()));
+ user.getUidString(uid_string);
CynaraTestAdmin::CynaraPoliciesContainer nonemptyContainer;
nonemptyContainer.add(MAIN_BUCKET,CYNARA_ADMIN_WILDCARD, uid_string.c_str(), CYNARA_ADMIN_WILDCARD, CYNARA_ADMIN_BUCKET, USER_TYPE_NORMAL_BUCKET);
const std::string app_id = "security_manager_10_app";
const std::string pkg_id = "security_manager_10_pkg";
const std::string username("sm_test_10_user_name");
+ std::string uid_string;
TemporaryTestUser user(username, GUM_USERTYPE_NORMAL, true);
user.create();
+ user.getUidString(uid_string);
const std::string path1 = "/home/" + username + "/p1";
const std::string path2 = "/home/" + username + "/p2";
const std::string pkgopt = " --pkg=" + pkg_id;
const std::string appopt = " --app=" + app_id;
- const std::string uidopt = " --uid=" + std::to_string(static_cast<unsigned int>(user.getUid()));
+ const std::string uidopt = " --uid=" + uid_string;
mkdir(path1.c_str(), 0);
mkdir(path2.c_str(), 0);
const int SUCCESS = 0;
const int FAILURE = 256;
const std::string username("sm_test_11_user_name");
+ std::string uid_string;
TemporaryTestUser user(username, GUM_USERTYPE_NORMAL, true);
user.create();
- const std::string uidopt = " --uid=" + std::to_string(static_cast<unsigned int>(user.getUid()));
+ user.getUidString(uid_string);
+ const std::string uidopt = " --uid=" + uid_string;
struct operation {
std::string command;
}
}
+RUNNER_MULTIPROCESS_TEST(security_manager_13_security_manager_admin_deny_user_priv)
+{
+ const int BUFFER_SIZE = 128;
+ struct message {
+ uid_t uid;
+ gid_t gid;
+ char buf[BUFFER_SIZE];
+ } msg;
+
+ privileges_t admin_required_privs = {
+ "http://tizen.org/privilege/systemsettings.admin",
+ "http://tizen.org/privilege/systemsettings"};
+ privileges_t manifest_privs = {
+ "http://tizen.org/privilege/internet",
+ "http://tizen.org/privilege/camera"};
+ privileges_t real_privs_allow = {"http://tizen.org/privilege/camera"};
+ privileges_t real_privs_deny = {"http://tizen.org/privilege/internet"};
+
+ const std::string pirivman_id = "sm_test_13_ADMIN_APP";
+ const std::string pirivman_pkg_id = "sm_test_13_ADMIN_PKG";
+ const std::string app_id = "sm_test_13_SOME_APP";
+ const std::string pkg_id = "sm_test_13_SOME_PKG";
+
+ int pipefd[2];
+ pid_t pid;
+ int result = 0;
+
+ RUNNER_ASSERT_MSG((pipe(pipefd) != -1),"pipe failed");
+ pid = fork();
+ RUNNER_ASSERT_MSG(pid >= 0, "fork failed");
+ if (pid != 0)//parent process
+ {
+ std::string childuidstr;
+ TemporaryTestUser admin("sm_test_13_ADMIN_USER", GUM_USERTYPE_ADMIN, true);
+ TemporaryTestUser child("sm_test_13_NORMAL_USER", GUM_USERTYPE_NORMAL, true);
+
+ InstallRequest request,request2;
+ FdUniquePtr pipeptr(pipefd+1);
+ close(pipefd[0]);
+
+ admin.create();
+ child.create();
+ child.getUidString(childuidstr);
+
+ //install privacy manager for admin
+ request.setAppId(pirivman_id.c_str());
+ request.setPkgId(pirivman_pkg_id.c_str());
+ request.setUid(admin.getUid());
+ for (auto &priv: admin_required_privs)
+ request.addPrivilege(priv.c_str());
+ Api::install(request);
+
+ //install app for child that has internet privilege
+ request2.setAppId(app_id.c_str());
+ request2.setPkgId(pkg_id.c_str());
+ request2.setUid(child.getUid());
+ for (auto &priv: manifest_privs)
+ request2.addPrivilege(priv.c_str());
+ Api::install(request2);
+
+ check_app_permissions(app_id.c_str(), pkg_id.c_str(), childuidstr.c_str(),
+ manifest_privs, SM_NO_PRIVILEGES);
+
+ //send info to child
+ msg.uid = admin.getUid();
+ msg.gid = admin.getGid();
+ strncpy (msg.buf, childuidstr.c_str(), BUFFER_SIZE);
+
+ ssize_t written = TEMP_FAILURE_RETRY(write(pipefd[1], &msg, sizeof(struct message)));
+ RUNNER_ASSERT_MSG((written == sizeof(struct message)),"write failed");
+
+ //wait for child
+ RUNNER_ASSERT_MSG(wait(&result) == pid, "wait failed");
+
+ check_app_permissions(app_id.c_str(), pkg_id.c_str(), childuidstr.c_str(),
+ real_privs_allow, real_privs_deny);
+ }
+ if (pid == 0)//child
+ {
+ FdUniquePtr pipeptr(pipefd);
+ close(pipefd[1]);
+
+ ssize_t fetched = TEMP_FAILURE_RETRY(read(pipefd[0], &msg, sizeof(struct message)));
+ RUNNER_ASSERT_MSG(fetched == sizeof(struct message), "read failed");
+
+ //become admin privacy manager manager
+ Api::setProcessLabel(pirivman_id.c_str());
+ result = drop_root_privileges(msg.uid, msg.gid);
+ RUNNER_ASSERT_MSG(result == 0, "drop_root_privileges failed");
+ PolicyRequest addPolicyReq;
+ //change rights
+ for (auto &denypriv:real_privs_deny) {
+ /*this entry will deny some privileges for user whose uid (as c string)
+ was sent in message's buf field.
+ That user would be denying internet for child in this case*/
+ PolicyEntry entry(SECURITY_MANAGER_ANY, msg.buf, denypriv);
+ entry.setMaxLevel("Deny");
+ addPolicyReq.addEntry(entry);
+ }
+ Api::sendPolicy(addPolicyReq);
+ exit(0);
+ }
+}
+
int main(int argc, char *argv[])
{
return DPL::Test::TestRunnerSingleton::Instance().ExecTestRunner(argc, argv);
projects / platform / core / test / security-tests.git / blobdiff