SM : Cleanup - private sharing test cases

* Rename getSharedPath and createSharedFile in AppInstallHelper
  to getPrivateFile and createPrivateFile (path is installed as simple
  private RW path)
* Move runAccessTest to SM test commons
* Add runAccessTest for non applications
* Change smack access checks to access checks done in proper context

Change-Id: I11a96be86ce323e21709e9d59de0042e2966d899

diff --git a/src/security-manager-tests/common/app_install_helper.cpp b/src/security-manager-tests/common/app_install_helper.cpp
index 09e45ec7dc27e6abed21268772b3735036ebf5d8..5ac0f7c8bc94968988b89fa310d1d36fb0932698 100644 (file)
--- a/src/security-manager-tests/common/app_install_helper.cpp
+++ b/src/security-manager-tests/common/app_install_helper.cpp
@@ -63,7 +63,7 @@ std::string AppInstallHelper::getPublicDir() const {
     return getInstallDir() + "/app_public_ro/";
 }
 
-std::string AppInstallHelper::getSharedPath(int i) const {
+std::string AppInstallHelper::getPrivatePath(int i) const {
     return getPrivateDir() + "shareme" + std::to_string(i);
 }
 
@@ -116,9 +116,11 @@ void AppInstallHelper::createPublicDir() {
     }
 }
 
-void AppInstallHelper::createSharedFile(int i) {
-    if (create(creat, getSharedPath(i)))
-        m_fileTypeMap[SECURITY_MANAGER_PATH_RW].emplace_back(getSharedPath(i));
+void AppInstallHelper::createPrivateFile(int i) {
+    // This is intentional, let all private file be in one directory
+    createPrivateDir();
+    if (create(creat, getPrivatePath(i)))
+        m_fileTypeMap[SECURITY_MANAGER_PATH_RW].emplace_back(getPrivatePath(i));
 }
 
 void AppInstallHelper::createSharedRODir(int i) {

diff --git a/src/security-manager-tests/common/app_install_helper.h b/src/security-manager-tests/common/app_install_helper.h
index 13addfc158c0795d4a2eeb0b9cf49dbfee8bf24c..883dd0ec6f8e9d84e1619e46d228f692a9373035 100644 (file)
--- a/src/security-manager-tests/common/app_install_helper.h
+++ b/src/security-manager-tests/common/app_install_helper.h
@@ -89,7 +89,7 @@ struct AppInstallHelper {
     void createTrustedDir(int i = 0);
     void createPrivateDir(int i = 0);
     void createPublicDir();
-    void createSharedFile(int i = 0);
+    void createPrivateFile(int i = 0);
     void createSharedRODir(int i = 0);
     void createPrivateRODir(int i = 0);
     void removePaths();
@@ -100,7 +100,7 @@ struct AppInstallHelper {
     std::string getPrivateDir(int i = 0) const;
     std::string getPrivateRODir(int i = 0) const;
     std::string getPublicDir() const;
-    std::string getSharedPath(int i = 0) const;
+    std::string getPrivatePath(int i = 0) const;
     std::string getSharedRODir(int i = 0) const;
     const TypePathsMap& getDirsMap() const;
     const TypePathsMap& getFilesMap() const;

diff --git a/src/security-manager-tests/common/sm_commons.cpp b/src/security-manager-tests/common/sm_commons.cpp
index 9d1db71c0de351d0a9aa022ec2d5735def50595d..5eb69fa3c05c928cee7c1314e0eec68d804c701f 100644 (file)
--- a/src/security-manager-tests/common/sm_commons.cpp
+++ b/src/security-manager-tests/common/sm_commons.cpp
@@ -23,6 +23,7 @@
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <unistd.h>
+#include <unordered_map>
 #include <cstdlib>
 
 #include <unordered_set>
@@ -378,3 +379,75 @@ void runInChildParentWait(const std::function<void(void)> &process) {
         waitPid(pid);
     }
 }
+
+static int getOppositeAccessType(int accessType) {
+    return accessType ^ (R_OK | W_OK | X_OK);
+}
+
+static const std::unordered_map<int, const char* const> accessTypeToString {
+    std::make_pair(0, "F_OK"),
+    std::make_pair(1, "X_OK"),
+    std::make_pair(2, "W_OK"),
+    std::make_pair(3, "W_OK|X_OK"),
+    std::make_pair(4, "R_OK"),
+    std::make_pair(5, "R_OK|X_OK"),
+    std::make_pair(6, "R_OK|W_OK"),
+    std::make_pair(7, "R_OK|W_OK|X_OK")
+};
+
+void accessCheck(const std::string &id, const std::string &path, int accessType,
+                 int expected)
+{
+    RUNNER_ASSERT_MSG(::access(path.c_str(), accessType) == expected,
+                      "access from " << id << " to path " << path
+                       << (expected == 0 ? " not granted" : " unnecessarily granted")
+                       << " (" << accessTypeToString.at(accessType) << ")");
+}
+
+void runAccessTest(const std::string &label, uid_t uid, gid_t gid,
+                   const std::string &testPath, int accessType) {
+    auto fun = [&](){
+        int oppositeAccessType = getOppositeAccessType(accessType);
+        change_label(label.c_str());
+        RUNNER_ASSERT_ERRNO_MSG(0 == drop_root_privileges(uid, gid),
+                                "drop_root_privileges failed.");
+
+        if (accessType != 0)
+            accessCheck(label, testPath, accessType, 0);
+        if (oppositeAccessType != 0) {
+            std::vector<int> singleAccessTypes = {R_OK, W_OK, X_OK};
+            for (auto singleAccessType : singleAccessTypes)
+                if (oppositeAccessType & singleAccessType)
+                    accessCheck(label, testPath, singleAccessType, -1);
+        }
+    };
+
+    runInChildParentWait(fun);
+}
+
+void runAccessTest(const AppInstallHelper &app, const std::string &testPath, int accessType) {
+    auto fun = [&](){
+        int oppositeAccessType = getOppositeAccessType(accessType);
+        Api::setProcessLabel(app.getAppId());
+        RUNNER_ASSERT_ERRNO_MSG(0 == drop_root_privileges(app.getUID(), app.getGID()),
+                                "drop_root_privileges failed.");
+        if (accessType != 0)
+            accessCheck(app.getAppId(), testPath, accessType, 0);
+        if (oppositeAccessType != 0) {
+            std::vector<int> singleAccessTypes = {R_OK, W_OK, X_OK};
+            for (auto singleAccessType : singleAccessTypes)
+                if (oppositeAccessType & singleAccessType)
+                    accessCheck(app.getAppId(), testPath, singleAccessType, -1);
+        }
+    };
+
+    runInChildParentWait(fun);
+}
+
+static const std::vector<std::string> SM_SYSTEM_LABELS = {"System", "System::Privileged", "User"};
+
+void runSystemAccessTest(uid_t uid, gid_t gid, const std::string &testPath, int accessType) {
+    for (const auto &label : SM_SYSTEM_LABELS)
+        runAccessTest(label, uid, gid, testPath, accessType);
+}
+

diff --git a/src/security-manager-tests/common/sm_commons.h b/src/security-manager-tests/common/sm_commons.h
index 23ef4e3141e2047a9949d2cc08e03308f2868714..fd426800ab7c7e3fd0d36189d6e894c25545db53 100644 (file)
--- a/src/security-manager-tests/common/sm_commons.h
+++ b/src/security-manager-tests/common/sm_commons.h
@@ -21,7 +21,6 @@
 #include <sys/capability.h>
 #include <sys/stat.h>
 #include <sys/types.h>
-
 #include <vector>
 #include <functional>
 
@@ -78,3 +77,7 @@ CapsSetsUniquePtr setCaps(const char *cap_string);
 pid_t runInChild(const std::function<void(void)> &process);
 
 void runInChildParentWait(const std::function<void(void)> &process);
+void runAccessTest(const std::string &label, uid_t uid, gid_t gid,
+                   const std::string &testPath, int accessType);
+void runAccessTest(const AppInstallHelper &app, const std::string &testPath, int accessType);
+void runSystemAccessTest(uid_t uid, gid_t gid, const std::string &testPath, int accessType);

diff --git a/src/security-manager-tests/test_cases_private_sharing.cpp b/src/security-manager-tests/test_cases_private_sharing.cpp
index f9f7a99ae291bb014ef58895e0d1b900262df37a..4e02d19f187172ae0c876d66f5f802d4a3a85734 100644 (file)
--- a/src/security-manager-tests/test_cases_private_sharing.cpp
+++ b/src/security-manager-tests/test_cases_private_sharing.cpp
@@ -28,6 +28,7 @@
 #include <app_install_helper.h>
 #include <dpl/test/test_runner.h>
 #include <memory.h>
+#include <scoped_installer.h>
 #include <sm_api.h>
 #include <sm_commons.h>
 #include <sm_request.h>
@@ -35,103 +36,28 @@
 #include <tests_common.h>
 
 using namespace SecurityManagerTest;
-namespace {
-const char *const owner_access = "rwxat";
-const char *const target_path_access = "rxl";
-const char *const target_dir_access = "x";
-const char *const no_access = "";
-
-void check_system_access(const std::string pathLabel, bool apply = true) {
-    check_exact_smack_accesses("User", pathLabel, (apply ? owner_access : no_access));
-    check_exact_smack_accesses("System", pathLabel, (apply ? owner_access : no_access));
-}
-
-void check_owner_access(const std::string &ownerLabel, const std::string &pathLabel, bool apply = true) {
-    check_exact_smack_accesses(ownerLabel, pathLabel, (apply ? owner_access : no_access));
-}
-
-void check_target_access(const std::string &ownerPkgLabel, const std::string &targetLabel,
-        const std::string &pathLabel, bool pathShared = true, bool anyPathShared = true) {
-    check_exact_smack_accesses(targetLabel, pathLabel, (pathShared ? target_path_access : no_access));
-    check_exact_smack_accesses(targetLabel, ownerPkgLabel, (anyPathShared ? target_dir_access : no_access));
-}
-
-void check_path_label(const std::string &path, const std::string &expectedLabel) {
-    char *label = nullptr;
-    int ret = smack_new_label_from_path(path.c_str(), XATTR_NAME_SMACK, 0, &label);
-    RUNNER_ASSERT_MSG(ret > 0, "smack_new_label_from_path failed for " << path);
-    SmackLabelPtr realLabel(label);
-    RUNNER_ASSERT_MSG(realLabel.get() == expectedLabel, "Fetched label from " << path << " different"
-            " than expected, is : " << realLabel.get() << " should be " << expectedLabel);
-}
-
-void createFile(const std::string &filePath)
-{
-    //create temporary file and set label for it
-    mode_t systemMask;
-
-    unlink(filePath.c_str());
-    //allow to create file with 777 rights
-    systemMask = umask(0000);
-    int fd = open(filePath.c_str(), O_RDWR | O_CREAT, S_IRWXU | S_IRWXG | S_IRWXO);
-    //restore system mask
-    umask(systemMask);
-    RUNNER_ASSERT_ERRNO_MSG(fd > -1, "Unable to create file for tests");
-
-    //for descriptor protection
-    FdUniquePtr fd_ptr(&fd);
-
-    //change owner and group to user APP
-    int ret = chown(filePath.c_str(), APP_UID, APP_GID);
-    RUNNER_ASSERT_ERRNO_MSG(ret == 0, "Unable to change file owner");
-}
-
-struct PathInfo {
-    const std::string &path;
-    app_install_path_type path_type;
-};
-
-InstallRequest createInstallReq(const std::string &appName, const std::string &pkgName,
-                                       const std::vector<PathInfo> &paths){
-    InstallRequest req;
-    req.setAppId(appName);
-    req.setPkgId(pkgName);
-    for (const auto &pathInfo : paths) {
-        req.addPath(pathInfo.path, pathInfo.path_type);
-    }
-    return req;
-}
-
-InstallRequest createInstallReq(const AppInstallHelper &info,
-                                       const std::vector<PathInfo> &paths = std::vector<PathInfo>()){
-    return createInstallReq(info.getAppId(), info.getPkgId(), paths);
-}
-
-void clearLabels(const std::string &path) {
-    int result = nftw(path.c_str(), &nftw_remove_labels, FTW_MAX_FDS, FTW_PHYS);
-    RUNNER_ASSERT_MSG(result == 0, "Unable to remove Smack labels in " << path);
-}
-
-}
 
 RUNNER_TEST_GROUP_INIT(SECURIT_MANAGER_PRIVATE_SHARING)
 
+/*
+ * Check if request is rejected when incomplete
+ */
 RUNNER_TEST(security_manager_30a_send_incomplete_req1)
 {
     SharingRequest request;
     Api::applySharing(request, SECURITY_MANAGER_ERROR_REQ_NOT_COMPLETE);
-    request.setOwnerAppId("someOwner");
+    request.setOwnerAppId("sm_test_30a_owner_app_id");
     Api::applySharing(request, SECURITY_MANAGER_ERROR_REQ_NOT_COMPLETE);
-    request.setTargetAppId("someTarget");
+    request.setTargetAppId("sm_test_30a_target_app_id");
     Api::applySharing(request, SECURITY_MANAGER_ERROR_REQ_NOT_COMPLETE);
 }
 
 RUNNER_TEST(security_manager_30b_send_incomplete_req2)
 {
     SharingRequest request;
-    request.setTargetAppId("someTarget");
+    request.setTargetAppId("sm_test_30b_target_app_id");
     Api::applySharing(request, SECURITY_MANAGER_ERROR_REQ_NOT_COMPLETE);
-    request.setOwnerAppId("someOwner");
+    request.setOwnerAppId("sm_test_30b_owner_app_id");
     Api::applySharing(request, SECURITY_MANAGER_ERROR_REQ_NOT_COMPLETE);
 }
 
@@ -141,940 +67,701 @@ RUNNER_TEST(security_manager_30c_send_incomplete_req3)
     const char *somePaths[] = {"path1", "path2"};
     request.addPaths(somePaths, sizeof(somePaths)/sizeof(somePaths[0]));
     Api::applySharing(request, SECURITY_MANAGER_ERROR_REQ_NOT_COMPLETE);
-    request.setOwnerAppId("someOwner");
+    request.setOwnerAppId("sm_test_30_b_owner_app_id");
     Api::applySharing(request, SECURITY_MANAGER_ERROR_REQ_NOT_COMPLETE);
 }
 
+/*
+ * Check if sharing request for unknown owner app is rejected
+ */
+
 RUNNER_TEST(security_manager_30d_unknown_owner)
 {
-    // This test depends on order of checks in security-manager service implementation
+    AppInstallHelper target("sm_test_30d_target");
+    ScopedInstaller targetInstall(target);
+
+    AppInstallHelper notInstalledOwner("sm_test_30d_notinstalled_owner");
+    notInstalledOwner.createPrivateFile();
+
     SharingRequest request;
-    request.setOwnerAppId("ImPrettySureIDontExist");
-    request.setTargetAppId("IDontMatter");
-    const char *somePaths[] = {"path1", "path2"};
-    request.addPaths(somePaths, sizeof(somePaths)/sizeof(somePaths[0]));
+    request.setOwnerAppId(notInstalledOwner.getAppId());
+    request.setTargetAppId(target.getAppId());
+
+    std::string sharedPath = notInstalledOwner.getPrivatePath();
+    const char *paths[] = {sharedPath.c_str()};
+    request.addPaths(paths, 1);
     Api::applySharing(request, SECURITY_MANAGER_ERROR_APP_UNKNOWN);
 }
 
+/*
+ * Check if sharing request for unknown target app is rejected
+ */
 RUNNER_TEST(security_manager_30e_unknown_target)
 {
-    // This test depends on order of checks in security-manager service implementation
-    AppInstallHelper owner("installedApp");
-    owner.revokeRules();
-    InstallRequest ownerInst;
-    ownerInst.setAppId(owner.getAppId());
-    ownerInst.setPkgId(owner.getPkgId());
-    Api::install(ownerInst);
+    AppInstallHelper owner("sm_test_30e_owner");
+    owner.createPrivateFile();
+    ScopedInstaller ownerInstall(owner);
 
     SharingRequest request;
     request.setOwnerAppId(owner.getAppId());
-    request.setTargetAppId("NowImPrettySureIDontExist");
-    const char *somePaths[] = {"path1", "path2"};
-    request.addPaths(somePaths, sizeof(somePaths)/sizeof(somePaths[0]));
-    Api::applySharing(request, SECURITY_MANAGER_ERROR_APP_UNKNOWN);
+    request.setTargetAppId("sm_test_30e_notinstalled_target");
 
-    Api::uninstall(ownerInst);
+    std::string sharedPath = owner.getPrivatePath();
+    const char *paths[] = {sharedPath.c_str()};
+    request.addPaths(paths, 1);
+    Api::applySharing(request, SECURITY_MANAGER_ERROR_APP_UNKNOWN);
 }
 
+/*
+ * Check if sharing not owned path is rejected
+ */
 RUNNER_TEST(security_manager_30f_bad_paths)
 {
-    // This test depends on order of checks in security-manager service implementation
-    AppInstallHelper owner("installedApp");
-    owner.revokeRules();
-    InstallRequest ownerInst = createInstallReq(owner);
-    Api::install(ownerInst);
+    AppInstallHelper owner("sm_test_30f_owner");
+    ScopedInstaller ownerInstall(owner);
 
-    AppInstallHelper target("secondInstalledApp");
-    target.revokeRules();
-    InstallRequest targetInst = createInstallReq(target);
-    Api::install(targetInst);
-
-    SharingRequest request;
-    request.setOwnerAppId(owner.getAppId());
-    request.setTargetAppId(target.getAppId());
+    AppInstallHelper target("sm_test_30f_target");
+    target.createPrivateFile();
+    ScopedInstaller targetInstall(target);
 
-    const char *somePath = "/tmp/somePath";
-    createFile(somePath);
-    const char *somePaths[] = {somePath};
-    request.addPaths(somePaths, sizeof(somePaths)/sizeof(somePaths[0]));
-    Api::applySharing(request, SECURITY_MANAGER_ERROR_APP_NOT_PATH_OWNER);
+    SharingRequest share;
+    share.setOwnerAppId(owner.getAppId());
+    share.setTargetAppId(target.getAppId());
 
-    Api::uninstall(ownerInst);
-    Api::uninstall(targetInst);
+    std::string sharedPath = target.getPrivatePath();
+    const char *paths[] = {sharedPath.c_str()};
+    share.addPaths(paths, 1);
+    Api::applySharing(share, SECURITY_MANAGER_ERROR_APP_NOT_PATH_OWNER);
 }
 
-RUNNER_TEST(security_manager_31_simple_share)
+/*
+ * Check proper access for sharing one path between applications from different packages
+ */
+RUNNER_CHILD_TEST(security_manager_31_simple_share)
 {
-    std::vector<AppInstallHelper> helper {{"app31a"}, {"app31b"}};
-    auto &owner = helper[0];
-    auto &target = helper[1];
-
-    for (auto &e : helper) {
-        e.revokeRules();
-    }
-
-    owner.createPrivateDir();
-    owner.createSharedFile();
-    clearLabels(owner.getInstallDir());
-    InstallRequest ownerReq = createInstallReq(owner,
-            {PathInfo{owner.getSharedPath(), SECURITY_MANAGER_PATH_RW}});
-    Api::install(ownerReq);
-
-    InstallRequest targetReq = createInstallReq(target);
-    Api::install(targetReq);
-
-    SharingRequest share1;
-    std::string sharedPath = owner.getSharedPath();
-    share1.setOwnerAppId(owner.getAppId());
-    share1.setTargetAppId(target.getAppId());
-    const char *path[] = {sharedPath.c_str()};
-    share1.addPaths(path, 1);
-    Api::applySharing(share1);
-
-    TestSecurityManagerDatabase db;
-    std::string pathLabel1 = db.get_path_label(sharedPath.c_str());
-    RUNNER_ASSERT_MSG(!pathLabel1.empty(), "Couldn't fetch path label from database for file " << sharedPath);
-
-    check_system_access(pathLabel1);
-    check_owner_access(owner.generateAppLabel(), pathLabel1);
-    check_target_access(owner.generatePkgLabel(), target.generateAppLabel(), pathLabel1);
-    check_path_label(sharedPath, pathLabel1);
-
-    Api::dropSharing(share1);
-    check_system_access(pathLabel1, false);
-    check_owner_access(owner.generateAppLabel(), pathLabel1, false);
-    check_target_access(owner.generatePkgLabel(), target.generateAppLabel(), pathLabel1, false, false);
-    check_path_label(sharedPath, owner.generatePkgLabel());
-
-    Api::uninstall(ownerReq);
-    Api::uninstall(targetReq);
+    AppInstallHelper owner("sm_test_31_owner");
+    owner.createPrivateFile(0);
+    owner.createPrivateFile(1);
+    ScopedInstaller ownerInstall(owner);
+
+    AppInstallHelper target("sm_test_31_target");
+    ScopedInstaller targetInstall(target);
+
+    SharingRequest share;
+    std::string sharedPath = owner.getPrivatePath(0);
+    std::string privatePath = owner.getPrivatePath(1);
+    share.setOwnerAppId(owner.getAppId());
+    share.setTargetAppId(target.getAppId());
+    const char *paths[] = {sharedPath.c_str()};
+    share.addPaths(paths, 1);
+    Api::applySharing(share);
+
+    runAccessTest(owner, sharedPath, R_OK|W_OK|X_OK);
+    runAccessTest(target, sharedPath, R_OK|X_OK);
+    //execute access is given to directory containing file. files have the same label as directories.
+    runAccessTest(target, privatePath, X_OK);
+    runSystemAccessTest(geteuid(), getegid(), sharedPath, R_OK|W_OK|X_OK);
+
+    Api::dropSharing(share);
+    runAccessTest(owner, sharedPath, R_OK|W_OK|X_OK);
+    runAccessTest(target, sharedPath, 0);
+    runAccessTest(target, privatePath, 0);
+    runSystemAccessTest(geteuid(), getegid(), sharedPath, R_OK|W_OK|X_OK);
 }
-
-RUNNER_TEST(security_manager_32_double_share)
+/*
+ * Private sharing can be applied multiple times. Check if double private path sharing applying
+ * between two applications from different package is accepted and if access is properly set after
+ * fist and second apply and if is properly revoked only after second drop.
+ *
+ */
+RUNNER_CHILD_TEST(security_manager_32_double_share)
 {
-    std::vector<AppInstallHelper> helper {{"app32a"}, {"app32b"}};
-    auto &owner = helper[0];
-    auto &target = helper[1];
-
-    // cleanup
-    for (auto &e : helper) {
-        e.revokeRules();
-    }
-    owner.createPrivateDir();
-    owner.createSharedFile();
-    clearLabels(owner.getInstallDir());
-
-    InstallRequest ownerReq = createInstallReq(owner,
-            {PathInfo{owner.getSharedPath(), SECURITY_MANAGER_PATH_RW}});
-    Api::install(ownerReq);
-
-    InstallRequest targetReq = createInstallReq(target);
-    Api::install(targetReq);
-
-    SharingRequest share1;
-    std::string sharedPath = owner.getSharedPath(0);
-    share1.setOwnerAppId(owner.getAppId());
-    share1.setTargetAppId(target.getAppId());
-    const char *path[] = {sharedPath.c_str()};
-    share1.addPaths(path, 1);
-    Api::applySharing(share1);
-
-    TestSecurityManagerDatabase db;
-    std::string pathLabel = db.get_path_label(sharedPath.c_str());
-    RUNNER_ASSERT_MSG(!pathLabel.empty(), "Couldn't fetch path label from database for file " << sharedPath);
-
-    check_system_access(pathLabel);
-    check_owner_access(owner.generateAppLabel(), pathLabel);
-    check_target_access(owner.generatePkgLabel(), target.generateAppLabel(), pathLabel);
-    check_path_label(sharedPath, pathLabel);
-
-    Api::applySharing(share1);
-    check_system_access(pathLabel);
-    check_owner_access(owner.generateAppLabel(), pathLabel);
-    check_target_access(owner.generatePkgLabel(), target.generateAppLabel(), pathLabel);
-    check_path_label(sharedPath, pathLabel);
-
-    Api::dropSharing(share1);
-    check_system_access(pathLabel);
-    check_owner_access(owner.generateAppLabel(), pathLabel);
-    check_target_access(owner.generatePkgLabel(), target.generateAppLabel(), pathLabel);
-    check_path_label(sharedPath, pathLabel);
-
-    Api::dropSharing(share1);
-    check_system_access(pathLabel, false);
-    check_owner_access(owner.generateAppLabel(), pathLabel, false);
-    check_target_access(owner.generatePkgLabel(), target.generateAppLabel(), pathLabel, false, false);
-    check_path_label(sharedPath, owner.generatePkgLabel());
-
-    Api::uninstall(ownerReq);
-    Api::uninstall(targetReq);
+    AppInstallHelper owner("sm_test_32_owner");
+    owner.createPrivateFile();
+    ScopedInstaller ownerInstall(owner);
+
+    AppInstallHelper target("sm_test_32_target");
+    ScopedInstaller targetInstall(target);
+
+    SharingRequest share;
+    std::string sharedPath = owner.getPrivatePath();
+    share.setOwnerAppId(owner.getAppId());
+    share.setTargetAppId(target.getAppId());
+    const char *paths[] = {sharedPath.c_str()};
+    share.addPaths(paths, 1);
+
+    Api::applySharing(share);
+    runAccessTest(owner, sharedPath, R_OK|W_OK|X_OK);
+    runAccessTest(target, sharedPath, R_OK|X_OK);
+    runSystemAccessTest(geteuid(), getegid(), sharedPath, R_OK|W_OK|X_OK);
+
+    Api::applySharing(share);
+    runAccessTest(owner, sharedPath, R_OK|W_OK|X_OK);
+    runAccessTest(target, sharedPath, R_OK|X_OK);
+    runSystemAccessTest(geteuid(), getegid(), sharedPath, R_OK|W_OK|X_OK);
+
+    Api::dropSharing(share);
+    runAccessTest(owner, sharedPath, R_OK|W_OK|X_OK);
+    runAccessTest(target, sharedPath, R_OK|X_OK);
+    runSystemAccessTest(geteuid(), getegid(), sharedPath, R_OK|W_OK|X_OK);
+
+    Api::dropSharing(share);
+    runAccessTest(owner, sharedPath, R_OK|W_OK|X_OK);
+    runAccessTest(target, sharedPath, 0);
+    runSystemAccessTest(geteuid(), getegid(), sharedPath, R_OK|W_OK|X_OK);
 }
-RUNNER_TEST(security_manager_33_share_two_with_one)
+
+/*
+ * Check access after sharing separate private paths with one application in two separate
+ * sharing requests.
+ */
+RUNNER_CHILD_TEST(security_manager_33a_share_two_with_one)
 {
-    std::vector<AppInstallHelper> helper {{"app33a"}, {"app33b"}};
-    auto &owner = helper[0];
-    auto &target = helper[1];
-
-    // cleanup
-    for (auto &e : helper) {
-        e.revokeRules();
-    }
-    owner.createPrivateDir();
-    owner.createSharedFile(0);
-    owner.createSharedFile(1);
-    clearLabels(owner.getInstallDir());
-    InstallRequest ownerReq = createInstallReq(owner,
-        {PathInfo{owner.getSharedPath(0), SECURITY_MANAGER_PATH_RW},
-         PathInfo{owner.getSharedPath(1), SECURITY_MANAGER_PATH_RW}});
-    Api::install(ownerReq);
-
-    InstallRequest targetReq = createInstallReq(target);
-    Api::install(targetReq);
+    AppInstallHelper owner("sm_test_33a_owner");
+    owner.createPrivateFile(0);
+    owner.createPrivateFile(1);
+    ScopedInstaller ownerInstall(owner);
+
+    AppInstallHelper target("sm_test_33a_target");
+    ScopedInstaller targetInstall(target);
 
     SharingRequest share1, share2;
-    std::string sharedPath1 = owner.getSharedPath(0);
-    std::string sharedPath2 = owner.getSharedPath(1);
+    std::string sharedPath1 = owner.getPrivatePath(0);
+    std::string sharedPath2 = owner.getPrivatePath(1);
     share1.setOwnerAppId(owner.getAppId());
     share2.setOwnerAppId(owner.getAppId());
     share1.setTargetAppId(target.getAppId());
     share2.setTargetAppId(target.getAppId());
-    const char *path1[] = {sharedPath1.c_str()};
-    const char *path2[] = {sharedPath2.c_str()};
-    share1.addPaths(path1, 1);
-    share2.addPaths(path2, 1);
+    const char *paths1[] = {sharedPath1.c_str()};
+    share1.addPaths(paths1, 1);
+    const char *paths2[] = {sharedPath2.c_str()};
+    share2.addPaths(paths2, 1);
 
     Api::applySharing(share1);
-    TestSecurityManagerDatabase db;
-    std::string pathLabel1 = db.get_path_label(sharedPath1.c_str());
-    RUNNER_ASSERT_MSG(!pathLabel1.empty(), "Couldn't fetch path label from database for file " << sharedPath1);
-
-    check_system_access(pathLabel1);
-    check_owner_access(owner.generateAppLabel(), pathLabel1);
-    check_target_access(owner.generatePkgLabel(), target.generateAppLabel(), pathLabel1);
-    check_path_label(sharedPath1, pathLabel1);
+    runAccessTest(owner, sharedPath1, R_OK|W_OK|X_OK);
+    runAccessTest(target, sharedPath1, R_OK|X_OK);
+    runSystemAccessTest(geteuid(), getegid(), sharedPath1, R_OK|W_OK|X_OK);
 
     Api::applySharing(share2);
-    std::string pathLabel2 = db.get_path_label(sharedPath2.c_str());
-    RUNNER_ASSERT_MSG(!pathLabel2.empty(), "Couldn't fetch path label from database for file " << sharedPath2);
-    RUNNER_ASSERT_MSG(pathLabel1 != pathLabel2, "Labels for private shared paths should be unique!");
-
-    check_system_access(pathLabel1);
-    check_system_access(pathLabel2);
-    check_owner_access(owner.generateAppLabel(), pathLabel1);
-    check_owner_access(owner.generateAppLabel(), pathLabel2);
-    check_target_access(owner.generatePkgLabel(), target.generateAppLabel(), pathLabel1);
-    check_target_access(owner.generatePkgLabel(), target.generateAppLabel(), pathLabel2);
-    check_path_label(sharedPath1, pathLabel1);
-    check_path_label(sharedPath2, pathLabel2);
+    runAccessTest(owner, sharedPath2, R_OK|W_OK|X_OK);
+    runAccessTest(target, sharedPath2, R_OK|X_OK);
+    runSystemAccessTest(geteuid(), getegid(), sharedPath2, R_OK|W_OK|X_OK);
 
     Api::dropSharing(share1);
-    check_system_access(pathLabel1, false);
-    check_system_access(pathLabel2);
-    check_owner_access(owner.generateAppLabel(), pathLabel1, false);
-    check_target_access(owner.generatePkgLabel(), target.generateAppLabel(), pathLabel1, false);
-    check_target_access(owner.generatePkgLabel(), target.generateAppLabel(), pathLabel2);
-    check_path_label(sharedPath1, owner.generatePkgLabel());
-    check_path_label(sharedPath2, pathLabel2);
+    runAccessTest(owner, sharedPath1, R_OK|W_OK|X_OK);
+    //execute access is given to directory containing file. files have the same label as directories.
+    runAccessTest(target, sharedPath1, X_OK);
+    runSystemAccessTest(geteuid(), getegid(), sharedPath1, R_OK|W_OK|X_OK);
+    runAccessTest(owner, sharedPath2, R_OK|W_OK|X_OK);
+    runAccessTest(target, sharedPath2, R_OK|X_OK);
+    runSystemAccessTest(geteuid(), getegid(), sharedPath2, R_OK|W_OK|X_OK);
 
     Api::dropSharing(share2);
-    check_system_access(pathLabel1, false);
-    check_system_access(pathLabel2, false);
-    check_owner_access(owner.generateAppLabel(), pathLabel1, false);
-    check_owner_access(owner.generateAppLabel(), pathLabel2, false);
-    check_target_access(owner.generatePkgLabel(), target.generateAppLabel(), pathLabel1, false, false);
-    check_target_access(owner.generatePkgLabel(), target.generateAppLabel(), pathLabel2, false, false);
-    check_path_label(sharedPath1, owner.generatePkgLabel());
-    check_path_label(sharedPath2, owner.generatePkgLabel());
-
-    Api::uninstall(ownerReq);
-    Api::uninstall(targetReq);
+    runAccessTest(owner, sharedPath2, R_OK|W_OK|X_OK);
+    runAccessTest(target, sharedPath2, 0);
+    runSystemAccessTest(geteuid(), getegid(), sharedPath1, R_OK|W_OK|X_OK);
 }
 
-RUNNER_TEST(security_manager_34_share_one_with_two)
+/*
+ * Check access after sharing separate private paths with one application in one sharing requests.
+ */
+RUNNER_CHILD_TEST(security_manager_33b_share_two_with_one)
+{
+    AppInstallHelper owner("sm_test_33b_owner");
+    owner.createPrivateFile(0);
+    owner.createPrivateFile(1);
+    ScopedInstaller ownerInstall(owner);
+
+    AppInstallHelper target("sm_test_33b_target");
+    ScopedInstaller targetInstall(target);
+
+    SharingRequest share;
+    std::string sharedPath1 = owner.getPrivatePath(0);
+    std::string sharedPath2 = owner.getPrivatePath(1);
+    share.setOwnerAppId(owner.getAppId());
+    share.setTargetAppId(target.getAppId());
+    const char *paths[] = {sharedPath1.c_str(), sharedPath2.c_str()};
+
+    share.addPaths(paths, 2);
+
+    Api::applySharing(share);
+    runAccessTest(owner, sharedPath1, R_OK|W_OK|X_OK);
+    runAccessTest(target, sharedPath1, R_OK|X_OK);
+    runSystemAccessTest(geteuid(), getegid(), sharedPath1, R_OK|W_OK|X_OK);
+    runAccessTest(owner, sharedPath2, R_OK|W_OK|X_OK);
+    runAccessTest(target, sharedPath2, R_OK|X_OK);
+    runSystemAccessTest(geteuid(), getegid(), sharedPath2, R_OK|W_OK|X_OK);
+
+    Api::dropSharing(share);
+    runAccessTest(owner, sharedPath1, R_OK|W_OK|X_OK);
+    runAccessTest(owner, sharedPath2, R_OK|W_OK|X_OK);
+    runAccessTest(target, sharedPath1, 0);
+    runAccessTest(target, sharedPath2, 0);
+    runSystemAccessTest(geteuid(), getegid(), sharedPath1, R_OK|W_OK|X_OK);
+    runSystemAccessTest(geteuid(), getegid(), sharedPath2, R_OK|W_OK|X_OK);
+}
+
+/*
+ * Check access when sharing one private path with two separate applications.
+ */
+RUNNER_CHILD_TEST(security_manager_34_share_one_with_two)
 {
-    std::vector<AppInstallHelper> helper {{"app34a"}, {"app34b"}, {"app34c"}};
-    auto &owner = helper[0];
-    auto &target1 = helper[1];
-    auto &target2 = helper[2];
-
-    // cleanup
-    for (auto &e : helper) {
-        e.revokeRules();
-    }
-    owner.createPrivateDir();
-    owner.createSharedFile();
-    clearLabels(owner.getInstallDir());
-
-    InstallRequest ownerReq = createInstallReq(owner,
-                               {PathInfo{owner.getSharedPath(), SECURITY_MANAGER_PATH_RW}});
-    Api::install(ownerReq);
-
-    for (size_t i = 1; i < helper.size(); i++) {
-        InstallRequest targetReq = createInstallReq(helper[i]);
-        Api::install(targetReq);
-    }
+    AppInstallHelper owner("sm_test_34_owner");
+    owner.createPrivateFile();
+    ScopedInstaller ownerInstall(owner);
+
+    AppInstallHelper target1("sm_test_34_target1");
+    ScopedInstaller targetInstall1(target1);
+
+    AppInstallHelper target2("sm_test_34_target2");
+    ScopedInstaller targetInstall2(target2);
 
     SharingRequest share1, share2;
-    std::string sharedPath = owner.getSharedPath(0).c_str();
+    std::string sharedPath = owner.getPrivatePath(0).c_str();
     share1.setOwnerAppId(owner.getAppId());
     share2.setOwnerAppId(owner.getAppId());
     share1.setTargetAppId(target1.getAppId());
     share2.setTargetAppId(target2.getAppId());
-
-    const char *path[] = {sharedPath.c_str()};
-    share1.addPaths(path, 1);
-    share2.addPaths(path, 1);
+    const char *paths[] = {sharedPath.c_str()};
+    share1.addPaths(paths, 1);
+    share2.addPaths(paths, 1);
 
     Api::applySharing(share1);
-    TestSecurityManagerDatabase db;
-    std::string pathLabel = db.get_path_label(sharedPath.c_str());
-    RUNNER_ASSERT_MSG(!pathLabel.empty(), "Couldn't fetch path label from database for file " << sharedPath);
-
-    check_system_access(pathLabel);
-    check_owner_access(owner.generateAppLabel(), pathLabel);
-    check_target_access(owner.generatePkgLabel(), target1.generateAppLabel(), pathLabel);
-    check_path_label(sharedPath, pathLabel);
+    runAccessTest(owner, sharedPath, R_OK|W_OK|X_OK);
+    runAccessTest(target1, sharedPath, R_OK|X_OK);
+    runAccessTest(target2, sharedPath, 0);
+    runSystemAccessTest(geteuid(), getegid(), sharedPath, R_OK|W_OK|X_OK);
 
     Api::applySharing(share2);
-    check_system_access(pathLabel);
-    check_owner_access(owner.generateAppLabel(), pathLabel);
-    check_target_access(owner.generatePkgLabel(), target1.generateAppLabel(), pathLabel);
-    check_target_access(owner.generatePkgLabel(), target2.generateAppLabel(), pathLabel);
-    check_path_label(sharedPath, pathLabel);
+    runAccessTest(owner, sharedPath, R_OK|W_OK|X_OK);
+    runAccessTest(target2, sharedPath, R_OK|X_OK);
+    runAccessTest(target1, sharedPath, R_OK|X_OK);
+    runSystemAccessTest(geteuid(), getegid(), sharedPath, R_OK|W_OK|X_OK);
 
     Api::dropSharing(share1);
-    check_system_access(pathLabel);
-    check_owner_access(owner.generateAppLabel(), pathLabel);
-    check_target_access(owner.generatePkgLabel(), target1.generateAppLabel(), pathLabel, false, false);
-    check_target_access(owner.generatePkgLabel(), target2.generateAppLabel(), pathLabel);
-    check_path_label(sharedPath, pathLabel);
+    runAccessTest(owner, sharedPath, R_OK|W_OK|X_OK);
+    runAccessTest(target1, sharedPath, 0);
+    runAccessTest(target2, sharedPath, R_OK|X_OK);
+    runSystemAccessTest(geteuid(), getegid(), sharedPath, R_OK|W_OK|X_OK);
 
     Api::dropSharing(share2);
-    check_system_access(pathLabel, false);
-    check_owner_access(owner.generateAppLabel(), pathLabel, false);
-    check_target_access(owner.generatePkgLabel(), target1.generateAppLabel(), pathLabel, false, false);
-    check_target_access(owner.generatePkgLabel(), target2.generateAppLabel(), pathLabel, false, false);
-    check_path_label(sharedPath, owner.generatePkgLabel());
-
-    Api::uninstall(ownerReq);
-    for (size_t i = 1; i < helper.size(); i++) {
-        InstallRequest targetReq = createInstallReq(helper[i]);
-        Api::uninstall(targetReq);
-    }
+    runAccessTest(owner, sharedPath, R_OK|W_OK|X_OK);
+    runAccessTest(target1, sharedPath, 0);
+    runAccessTest(target2, sharedPath, 0);
+    runSystemAccessTest(geteuid(), getegid(), sharedPath, R_OK|W_OK|X_OK);
 }
 
-RUNNER_TEST(security_manager_35_share_two_with_two)
+/*
+ * Check access when sharing two separate private paths with two separate applications.
+ */
+RUNNER_CHILD_TEST(security_manager_35_share_two_with_two)
 {
-    std::vector<AppInstallHelper> helper {{"app35a"}, {"app35b"}, {"app35c"}};
-    auto &owner = helper[0];
-    auto &target1 = helper[1];
-    auto &target2 = helper[2];
-
-    // cleanup
-    for (auto &e : helper) {
-        e.revokeRules();
-    }
-    owner.createPrivateDir();
-    owner.createSharedFile(0);
-    owner.createSharedFile(1);
-    clearLabels(owner.getInstallDir());
-
-    InstallRequest ownerReq = createInstallReq(owner,
-           {PathInfo{owner.getSharedPath(0), SECURITY_MANAGER_PATH_RW},
-            PathInfo{owner.getSharedPath(1), SECURITY_MANAGER_PATH_RW}});
-
-    Api::install(ownerReq);
-
-    for (size_t i = 1; i < helper.size(); i++) {
-        InstallRequest targetReq = createInstallReq(helper[i]);
-        Api::install(targetReq);
-    }
+    AppInstallHelper owner("sm_test_35_owner");
+    owner.createPrivateFile(0);
+    owner.createPrivateFile(1);
+    ScopedInstaller ownerInstall(owner);
+
+    AppInstallHelper target1("sm_test_35_target1");
+    ScopedInstaller targetInstall1(target1);
+
+    AppInstallHelper target2("sm_test_35_target2");
+    ScopedInstaller targetInstall2(target2);
 
     SharingRequest share1, share2;
-    std::string sharedPath1 = owner.getSharedPath(0).c_str();
-    std::string sharedPath2 = owner.getSharedPath(1).c_str();
+    std::string sharedPath1 = owner.getPrivatePath(0).c_str();
+    std::string sharedPath2 = owner.getPrivatePath(1).c_str();
     share1.setOwnerAppId(owner.getAppId());
     share2.setOwnerAppId(owner.getAppId());
     share1.setTargetAppId(target1.getAppId());
     share2.setTargetAppId(target2.getAppId());
-
-    const char *path1[] = {sharedPath1.c_str()};
-    const char *path2[] = {sharedPath2.c_str()};
-    share1.addPaths(path1, 1);
-    share2.addPaths(path2, 1);
+    const char *paths1[] = {sharedPath1.c_str()};
+    share1.addPaths(paths1, 1);
+    const char *paths2[] = {sharedPath2.c_str()};
+    share2.addPaths(paths2, 1);
 
     Api::applySharing(share1);
-    TestSecurityManagerDatabase db;
-    std::string pathLabel1 = db.get_path_label(sharedPath1.c_str());
-    RUNNER_ASSERT_MSG(!pathLabel1.empty(), "Couldn't fetch path label from database for file " << sharedPath1);
-
-    check_system_access(pathLabel1);
-    check_owner_access(owner.generateAppLabel(), pathLabel1);
-    check_target_access(owner.generatePkgLabel(), target1.generateAppLabel(), pathLabel1);
-    check_path_label(sharedPath1, pathLabel1);
+    runAccessTest(owner, sharedPath1, R_OK|W_OK|X_OK);
+    runAccessTest(target1, sharedPath1, R_OK|X_OK);
+    runSystemAccessTest(geteuid(), getegid(), sharedPath1, R_OK|W_OK|X_OK);
 
     Api::applySharing(share2);
-    std::string pathLabel2 = db.get_path_label(sharedPath2.c_str());
-    RUNNER_ASSERT_MSG(!pathLabel2.empty(), "Couldn't fetch path label from database for file " << sharedPath2);
-    RUNNER_ASSERT_MSG(pathLabel1 != pathLabel2, "Labels for shared files should be unique!");
-
-    check_system_access(pathLabel1);
-    check_system_access(pathLabel2);
-    check_owner_access(owner.generateAppLabel(), pathLabel1);
-    check_owner_access(owner.generateAppLabel(), pathLabel2);
-    check_target_access(owner.generatePkgLabel(), target1.generateAppLabel(), pathLabel1);
-    check_target_access(owner.generatePkgLabel(), target2.generateAppLabel(), pathLabel2);
-    check_path_label(sharedPath1, pathLabel1);
-    check_path_label(sharedPath2, pathLabel2);
+    runAccessTest(owner, sharedPath2, R_OK|W_OK|X_OK);
+    runAccessTest(target1, sharedPath1, R_OK|X_OK);
+    runAccessTest(target1, sharedPath2, 0);
+    runAccessTest(target2, sharedPath2, R_OK|X_OK);
+    runAccessTest(target2, sharedPath1, 0);
+    runSystemAccessTest(geteuid(), getegid(), sharedPath2, R_OK|W_OK|X_OK);
 
     Api::dropSharing(share2);
-    check_system_access(pathLabel1);
-    check_system_access(pathLabel2, false);
-    check_owner_access(owner.generateAppLabel(), pathLabel1);
-    check_owner_access(owner.generateAppLabel(), pathLabel2, false);
-    check_target_access(owner.generatePkgLabel(), target1.generateAppLabel(), pathLabel1);
-    check_target_access(owner.generatePkgLabel(), target2.generateAppLabel(), pathLabel2, false, false);
-    check_path_label(sharedPath1, pathLabel1);
-    check_path_label(sharedPath2, owner.generatePkgLabel());
+    runAccessTest(owner, sharedPath1, R_OK|W_OK|X_OK);
+    runAccessTest(owner, sharedPath2, R_OK|W_OK|X_OK);
+    runAccessTest(target1, sharedPath1, R_OK|X_OK);
+    runAccessTest(target2, sharedPath2, 0);
+    runSystemAccessTest(geteuid(), getegid(), sharedPath2, R_OK|W_OK|X_OK);
 
     Api::dropSharing(share1);
-    check_system_access(pathLabel1, false);
-    check_system_access(pathLabel2, false);
-    check_owner_access(owner.generateAppLabel(), pathLabel1, false);
-    check_owner_access(owner.generateAppLabel(), pathLabel2, false);
-    check_target_access(owner.generatePkgLabel(), target1.generateAppLabel(), pathLabel1, false, false);
-    check_target_access(owner.generatePkgLabel(), target2.generateAppLabel(), pathLabel2, false, false);
-    check_path_label(sharedPath1, owner.generatePkgLabel());
-    check_path_label(sharedPath2, owner.generatePkgLabel());
-    Api::uninstall(ownerReq);
-    for (size_t i = 1; i < helper.size(); i++) {
-        InstallRequest targetReq;
-        targetReq.setAppId(helper[i].getAppId());
-        targetReq.setPkgId(helper[i].getAppId());
-        Api::uninstall(targetReq);
-    }
+    runAccessTest(owner, sharedPath1, R_OK|W_OK|X_OK);
+    runAccessTest(owner, sharedPath2, R_OK|W_OK|X_OK);
+    runAccessTest(target1, sharedPath1, 0);
+    runAccessTest(target2, sharedPath2, 0);
+    runSystemAccessTest(geteuid(), getegid(), sharedPath1, R_OK|W_OK|X_OK);
+    runSystemAccessTest(geteuid(), getegid(), sharedPath2, R_OK|W_OK|X_OK);
 }
 
-RUNNER_TEST(security_manager_35_share_uninstall_target) {
-    std::vector<AppInstallHelper> helper {{"app35aa"}, {"app35bb"}};
-    auto &owner = helper[0];
-    auto &target = helper[1];
-
-    for (auto &e : helper) {
-        e.revokeRules();
-    }
-
-    owner.createPrivateDir();
-    owner.createSharedFile();
-    clearLabels(owner.getInstallDir());
-
-    InstallRequest ownerReq = createInstallReq(owner,
-                                   {PathInfo{owner.getSharedPath(), SECURITY_MANAGER_PATH_RW}});
-    Api::install(ownerReq);
-
-    InstallRequest targetReq = createInstallReq(target);
-    Api::install(targetReq);
-
-    SharingRequest share1;
-    std::string sharedPath = owner.getSharedPath();
-    share1.setOwnerAppId(owner.getAppId());
-    share1.setTargetAppId(target.getAppId());
-    const char *path[] = {sharedPath.c_str()};
-    share1.addPaths(path, 1);
-    Api::applySharing(share1);
-
-    TestSecurityManagerDatabase db;
-    std::string pathLabel1 = db.get_path_label(sharedPath.c_str());
-    RUNNER_ASSERT_MSG(!pathLabel1.empty(), "Couldn't fetch path label from database for file " << sharedPath);
-
-    check_system_access(pathLabel1);
-    check_owner_access(owner.generateAppLabel(), pathLabel1);
-    check_target_access(owner.generatePkgLabel(), target.generateAppLabel(), pathLabel1);
-    check_path_label(sharedPath, pathLabel1);
-
-    Api::uninstall(targetReq);
-
-    check_system_access(pathLabel1, false);
-    check_owner_access(owner.generateAppLabel(), pathLabel1, false);
-    check_target_access(owner.generatePkgLabel(), target.generateAppLabel(), pathLabel1, false, false);
-    check_path_label(sharedPath, owner.generatePkgLabel());
-
-    Api::dropSharing(share1, SECURITY_MANAGER_ERROR_APP_UNKNOWN);
-    Api::uninstall(ownerReq);
+/*
+ * Check access after sharing one private path with one application and after uninstalling target
+ * application.
+ */
+RUNNER_CHILD_TEST(security_manager_35_share_uninstall_target) {
+    AppInstallHelper owner("sm_test_35_owner");
+    owner.createPrivateFile();
+    ScopedInstaller ownerInstall(owner);
+
+    AppInstallHelper target("sm_test_35_target");
+    ScopedInstaller targetInstall(target);
+
+    SharingRequest share;
+    std::string sharedPath = owner.getPrivatePath();
+    share.setOwnerAppId(owner.getAppId());
+    share.setTargetAppId(target.getAppId());
+    const char *paths[] = {sharedPath.c_str()};
+    share.addPaths(paths, 1);
+    Api::applySharing(share);
+
+    runAccessTest(owner, sharedPath, R_OK|W_OK|X_OK);
+    runAccessTest(target, sharedPath, R_OK|X_OK);
+    runSystemAccessTest(geteuid(), getegid(), sharedPath, R_OK|W_OK|X_OK);
+
+    targetInstall.uninstallApp();
+    runAccessTest(owner, sharedPath, R_OK|W_OK|X_OK);
+    runSystemAccessTest(geteuid(), getegid(), sharedPath, R_OK|W_OK|X_OK);
+
+    // Reinstall, so we can change context to same app_id
+    ScopedInstaller targetInstall2(target);
+    runAccessTest(target, sharedPath, 0);
+
+    Api::dropSharing(share, SECURITY_MANAGER_ERROR_INPUT_PARAM);
 }
 
-RUNNER_TEST(security_manager_35_share_uninstall_owner) {
-    std::vector<AppInstallHelper> helper {{"app35aaa"}, {"app35bbb"}};
-    auto &owner = helper[0];
-    auto &target = helper[1];
-
-    for (auto &e : helper) {
-        e.revokeRules();
-    }
+/*
+ * Check access after sharing one private path with one application and after uninstalling owner
+ * application.
+ */
+RUNNER_CHILD_TEST(security_manager_35_share_uninstall_owner) {
+    AppInstallHelper owner("sm_test_35_owner");
+    owner.createPrivateFile();
+    ScopedInstaller ownerInstall(owner);
 
-    owner.createPrivateDir();
-    owner.createSharedFile();
+    AppInstallHelper target("sm_test_35_target");
+    ScopedInstaller targetInstall(target);
 
-    clearLabels(owner.getInstallDir());
+    SharingRequest share;
+    std::string sharedPath = owner.getPrivatePath();
+    share.setOwnerAppId(owner.getAppId());
+    share.setTargetAppId(target.getAppId());
+    const char *paths[] = {sharedPath.c_str()};
+    share.addPaths(paths, 1);
+    Api::applySharing(share);
 
-    InstallRequest ownerReq = createInstallReq(owner,
-                                   {PathInfo{owner.getSharedPath(), SECURITY_MANAGER_PATH_RW}});
-    Api::install(ownerReq);
+    runAccessTest(owner, sharedPath, R_OK|W_OK|X_OK);
+    runAccessTest(target, sharedPath, R_OK|X_OK);
+    runSystemAccessTest(geteuid(), getegid(), sharedPath, R_OK|W_OK|X_OK);
 
-    InstallRequest targetReq = createInstallReq(target);
-    Api::install(targetReq);
+    ownerInstall.uninstallApp();
 
-    SharingRequest share1;
-    std::string sharedPath = owner.getSharedPath();
-    share1.setOwnerAppId(owner.getAppId());
-    share1.setTargetAppId(target.getAppId());
-    const char *path[] = {sharedPath.c_str()};
-    share1.addPaths(path, 1);
-    Api::applySharing(share1);
+    runAccessTest(target, sharedPath, 0);
 
-    TestSecurityManagerDatabase db;
-    std::string pathLabel1 = db.get_path_label(sharedPath.c_str());
-    RUNNER_ASSERT_MSG(!pathLabel1.empty(), "Couldn't fetch path label from database for file " << sharedPath);
+    Api::dropSharing(share, SECURITY_MANAGER_ERROR_APP_UNKNOWN);
 
-    check_system_access(pathLabel1);
-    check_owner_access(owner.generateAppLabel(), pathLabel1);
-    check_target_access(owner.generatePkgLabel(), target.generateAppLabel(), pathLabel1);
-    check_path_label(sharedPath, pathLabel1);
-
-    owner.removePaths();
-    Api::uninstall(ownerReq);
-
-    check_system_access(pathLabel1, false);
-    check_owner_access(owner.generateAppLabel(), pathLabel1, false);
-    check_target_access(owner.generatePkgLabel(), target.generateAppLabel(), pathLabel1, false, false);
-
-    Api::dropSharing(share1, SECURITY_MANAGER_ERROR_APP_UNKNOWN);
-    Api::uninstall(targetReq);
 }
 
-RUNNER_TEST(security_manager_36_share_pkg_owner_uninstall) {
-    std::vector<AppInstallHelper> helper {{"app36a", "pkg1"}, {"app36b", "pkg1"}, {"app36c", "pkg2"}};
-    auto &owner = helper[0];
-    auto &pkgApp = helper[1];
-    auto &target = helper[2];
-
-    for (auto &e : helper) {
-        e.revokeRules();
-    }
-
-    owner.createPrivateDir();
-    owner.createSharedFile();
-    clearLabels(owner.getInstallDir());
+/*
+ * Check access after sharing one private path with one application and after uninstalling owner
+ * application from package with two applications.
+ */
+RUNNER_CHILD_TEST(security_manager_36_share_pkg_owner_uninstall) {
+    std::string pkgName = "sm_test_36";
+    AppInstallHelper owner("sm_test_36_owner", pkgName);
+    owner.createPrivateFile();
+    ScopedInstaller ownerInstall(owner);
 
-    InstallRequest ownerReq = createInstallReq(owner,
-                                   {PathInfo{owner.getSharedPath(), SECURITY_MANAGER_PATH_RW}});
-    Api::install(ownerReq);
+    AppInstallHelper samePkgAsOwnerApp("sm_test_36", pkgName);
+    ScopedInstaller samePkgAsOwnerInstall(samePkgAsOwnerApp);
 
-    InstallRequest pkgAppReq = createInstallReq(pkgApp);
-    Api::install(pkgAppReq);
-    InstallRequest targetReq = createInstallReq(target);
-    Api::install(targetReq);
+    AppInstallHelper target("sm_test_36_target");
+    ScopedInstaller targetInstall(target);
 
-    SharingRequest share1;
-    std::string sharedPath = owner.getSharedPath();
-    share1.setOwnerAppId(owner.getAppId());
-    share1.setTargetAppId(target.getAppId());
-    const char *path[] = {sharedPath.c_str()};
-    share1.addPaths(path, 1);
-    Api::applySharing(share1);
-
-    TestSecurityManagerDatabase db;
-    std::string pathLabel1 = db.get_path_label(sharedPath.c_str());
-    RUNNER_ASSERT_MSG(!pathLabel1.empty(), "Couldn't fetch path label from database for file " << sharedPath);
+    SharingRequest share;
+    std::string sharedPath = owner.getPrivatePath();
+    share.setOwnerAppId(owner.getAppId());
+    share.setTargetAppId(target.getAppId());
+    const char *paths[] = {sharedPath.c_str()};
+    share.addPaths(paths, 1);
+    Api::applySharing(share);
 
-    check_system_access(pathLabel1);
-    check_owner_access(owner.generateAppLabel(), pathLabel1);
-    check_owner_access(pkgApp.generateAppLabel(), pathLabel1);
-    check_target_access(owner.generatePkgLabel(), target.generateAppLabel(), pathLabel1);
-    check_path_label(sharedPath, pathLabel1);
+    runAccessTest(owner, sharedPath, R_OK|W_OK|X_OK);
+    runAccessTest(samePkgAsOwnerApp, sharedPath, R_OK|W_OK|X_OK);
+    runAccessTest(target, sharedPath, R_OK|X_OK);
+    runSystemAccessTest(geteuid(), getegid(), sharedPath, R_OK|W_OK|X_OK);
 
-    owner.removePaths();
-    Api::uninstall(ownerReq);
+    ownerInstall.uninstallApp();
 
-    check_system_access(pathLabel1, false);
-    check_owner_access(owner.generateAppLabel(), pathLabel1, false);
-    check_owner_access(pkgApp.generateAppLabel(), pathLabel1, false);
-    check_target_access(owner.generatePkgLabel(), target.generateAppLabel(), pathLabel1, false, false);
+    runAccessTest(target, sharedPath, 0);
 
-    Api::dropSharing(share1, SECURITY_MANAGER_ERROR_APP_UNKNOWN);
-    Api::uninstall(pkgAppReq);
-    Api::uninstall(targetReq);
+    Api::dropSharing(share, SECURITY_MANAGER_ERROR_APP_UNKNOWN);
 }
 
-RUNNER_TEST(security_manager_36_share_pkg_owner_drop) {
-    std::vector<AppInstallHelper> helper {{"app36aa", "pkg1"}, {"app36bb", "pkg1"}, {"app36cc", "pkg2"}};
-    auto &owner = helper[0];
-    auto &pkgApp = helper[1];
-    auto &target = helper[2];
-
-    for (auto &e : helper) {
-        e.revokeRules();
-    }
-
-    owner.createPrivateDir();
-    owner.createSharedFile();
-    clearLabels(owner.getInstallDir());
-
-    InstallRequest ownerReq = createInstallReq(owner,
-                                   {PathInfo{owner.getSharedPath(), SECURITY_MANAGER_PATH_RW}});
-    Api::install(ownerReq);
-
-    InstallRequest pkgAppReq = createInstallReq(pkgApp);
-    Api::install(pkgAppReq);
-    InstallRequest targetReq = createInstallReq(target);
-    Api::install(targetReq);
-
-    SharingRequest share1;
-    std::string sharedPath = owner.getSharedPath();
-    share1.setOwnerAppId(owner.getAppId());
-    share1.setTargetAppId(target.getAppId());
-    const char *path[] = {sharedPath.c_str()};
-    share1.addPaths(path, 1);
-    Api::applySharing(share1);
-
-    TestSecurityManagerDatabase db;
-    std::string pathLabel1 = db.get_path_label(sharedPath.c_str());
-    RUNNER_ASSERT_MSG(!pathLabel1.empty(), "Couldn't fetch path label from database for file " << sharedPath);
-
-    check_system_access(pathLabel1);
-    check_owner_access(owner.generateAppLabel(), pathLabel1);
-    check_owner_access(pkgApp.generateAppLabel(), pathLabel1);
-    check_target_access(owner.generatePkgLabel(), target.generateAppLabel(), pathLabel1);
-    check_path_label(sharedPath, pathLabel1);
-
-    Api::dropSharing(share1);
-
-    check_system_access(pathLabel1, false);
-    check_owner_access(owner.generateAppLabel(), pathLabel1, false);
-    check_owner_access(pkgApp.generateAppLabel(), pathLabel1, false);
-    check_target_access(owner.generatePkgLabel(), target.generateAppLabel(), pathLabel1, false, false);
-    check_path_label(sharedPath, owner.generatePkgLabel());
-
-    Api::uninstall(ownerReq);
-    Api::uninstall(pkgAppReq);
-    Api::uninstall(targetReq);
+/*
+ * Check access after sharing one private path with one application when owner application is from
+ * package with two applications.
+ */
+RUNNER_CHILD_TEST(security_manager_36_share_pkg_owner_drop) {
+    std::string pkgName = "sm_test_36";
+    AppInstallHelper owner("sm_test_36_owner", pkgName);
+    owner.createPrivateFile();
+    ScopedInstaller ownerInstall(owner);
+
+    AppInstallHelper samePkgAsOwnerApp("sm_test_36", pkgName);
+    ScopedInstaller samePkgAsOwnerInstall(samePkgAsOwnerApp);
+
+    AppInstallHelper target("sm_test_36_target");
+    ScopedInstaller targetInstall(target);
+
+    SharingRequest share;
+    std::string sharedPath = owner.getPrivatePath();
+    share.setOwnerAppId(owner.getAppId());
+    share.setTargetAppId(target.getAppId());
+    const char *paths[] = {sharedPath.c_str()};
+    share.addPaths(paths, 1);
+    Api::applySharing(share);
+
+    runAccessTest(owner, sharedPath, R_OK|W_OK|X_OK);
+    runAccessTest(samePkgAsOwnerApp, sharedPath, R_OK|W_OK|X_OK);
+    runAccessTest(target, sharedPath, R_OK|X_OK);
+    runSystemAccessTest(geteuid(), getegid(), sharedPath, R_OK|W_OK|X_OK);
+
+    Api::dropSharing(share);
+
+    runAccessTest(owner, sharedPath, R_OK|W_OK|X_OK);
+    runAccessTest(samePkgAsOwnerApp, sharedPath, R_OK|W_OK|X_OK);
+    runAccessTest(target, sharedPath, 0);
+    runSystemAccessTest(geteuid(), getegid(), sharedPath, R_OK|W_OK|X_OK);
 }
 
-RUNNER_TEST(security_manager_36_share_pkg_target_uninstall) {
-    std::vector<AppInstallHelper> helper {{"app36aaa", "pkg1"}, {"app36bbb", "pkg1"}, {"app36ccc", "pkg2"}};
-    auto &owner = helper[0];
-    auto &pkgApp = helper[1];
-    auto &target = helper[2];
-
-    for (auto &e : helper) {
-        e.revokeRules();
-    }
-
-    owner.createPrivateDir();
-    owner.createSharedFile();
-    clearLabels(owner.getInstallDir());
-
-    InstallRequest ownerReq = createInstallReq(owner,
-                                   {PathInfo{owner.getSharedPath(), SECURITY_MANAGER_PATH_RW}});
-    Api::install(ownerReq);
-
-    InstallRequest pkgAppReq = createInstallReq(pkgApp);
-    Api::install(pkgAppReq);
-    InstallRequest targetReq = createInstallReq(target);
-    Api::install(targetReq);
-
-    SharingRequest share1;
-    std::string sharedPath = owner.getSharedPath();
-    share1.setOwnerAppId(owner.getAppId());
-    share1.setTargetAppId(target.getAppId());
-    const char *path[] = {sharedPath.c_str()};
-    share1.addPaths(path, 1);
-    Api::applySharing(share1);
-
-    TestSecurityManagerDatabase db;
-    std::string pathLabel1 = db.get_path_label(sharedPath.c_str());
-    RUNNER_ASSERT_MSG(!pathLabel1.empty(), "Couldn't fetch path label from database for file " << sharedPath);
-
-    check_system_access(pathLabel1);
-    check_owner_access(owner.generateAppLabel(), pathLabel1);
-    check_owner_access(pkgApp.generateAppLabel(), pathLabel1);
-    check_target_access(owner.generatePkgLabel(), target.generateAppLabel(), pathLabel1);
-    check_path_label(sharedPath, pathLabel1);
-
-    Api::uninstall(targetReq);
-
-    check_system_access(pathLabel1, false);
-    check_owner_access(owner.generateAppLabel(), pathLabel1, false);
-    check_owner_access(pkgApp.generateAppLabel(), pathLabel1, false);
-    check_target_access(owner.generatePkgLabel(), target.generateAppLabel(), pathLabel1, false, false);
-    check_path_label(sharedPath, owner.generatePkgLabel());
-
-    Api::dropSharing(share1, SECURITY_MANAGER_ERROR_APP_UNKNOWN);
-
-    Api::uninstall(ownerReq);
-    Api::uninstall(pkgAppReq);
+/*
+ * Check access after sharing one private path with one application and after uninstalling target
+ * application when owner application is from package with two applications.
+ */
+RUNNER_CHILD_TEST(security_manager_36_share_pkg_target_uninstall) {
+    std::string pkgName = "sm_test_36";
+    AppInstallHelper owner("sm_test_36_owner", pkgName);
+    owner.createPrivateFile();
+    ScopedInstaller ownerInstall(owner);
+
+    AppInstallHelper samePkgAsOwnerApp("sm_test_36", pkgName);
+    ScopedInstaller samePkgAsOwnerInstall(samePkgAsOwnerApp);
+
+    AppInstallHelper target("sm_test_36_target");
+    ScopedInstaller targetInstall(target);
+
+    SharingRequest share;
+    std::string sharedPath = owner.getPrivatePath();
+    share.setOwnerAppId(owner.getAppId());
+    share.setTargetAppId(target.getAppId());
+    const char *paths[] = {sharedPath.c_str()};
+    share.addPaths(paths, 1);
+    Api::applySharing(share);
+
+    runAccessTest(owner, sharedPath, R_OK|W_OK|X_OK);
+    runAccessTest(samePkgAsOwnerApp, sharedPath, R_OK|W_OK|X_OK);
+    runAccessTest(target, sharedPath, R_OK|X_OK);
+    runSystemAccessTest(geteuid(), getegid(), sharedPath, R_OK|W_OK|X_OK);
+
+    targetInstall.uninstallApp();
+    runAccessTest(owner, sharedPath, R_OK|W_OK|X_OK);
+    runAccessTest(samePkgAsOwnerApp, sharedPath, R_OK|W_OK|X_OK);
+    runSystemAccessTest(geteuid(), getegid(), sharedPath, R_OK|W_OK|X_OK);
+
+    // Reinstall, so we can change context to same app_id
+    ScopedInstaller targetInstall2(target);
+    runAccessTest(target, sharedPath, 0);
+
+    Api::dropSharing(share, SECURITY_MANAGER_ERROR_INPUT_PARAM);
 }
 
-RUNNER_TEST(security_manager_37_pkg_double_share_target_uninstall) {
-    std::vector<AppInstallHelper> helper {{"app37a", "pkg1"}, {"app37b", "pkg1"}, {"app37c", "pkg2"}};
-    auto &owner = helper[0];
-    auto &pkgApp = helper[1];
-    auto &target = helper[2];
-
-    for (auto &e : helper) {
-        e.revokeRules();
-    }
-
-    owner.createPrivateDir();
-    owner.createSharedFile();
-    clearLabels(owner.getInstallDir());
-
-    InstallRequest ownerReq = createInstallReq(owner,
-                                   {PathInfo{owner.getSharedPath(), SECURITY_MANAGER_PATH_RW}});
-    Api::install(ownerReq);
-
-    InstallRequest pkgAppReq = createInstallReq(pkgApp);
-    Api::install(pkgAppReq);
-    InstallRequest targetReq = createInstallReq(target);
-    Api::install(targetReq);
-
-    SharingRequest share1;
-    std::string sharedPath = owner.getSharedPath();
-    share1.setOwnerAppId(owner.getAppId());
-    share1.setTargetAppId(target.getAppId());
-    const char *path[] = {sharedPath.c_str()};
-    share1.addPaths(path, 1);
-    Api::applySharing(share1);
-
-    TestSecurityManagerDatabase db;
-    std::string pathLabel1 = db.get_path_label(sharedPath.c_str());
-    RUNNER_ASSERT_MSG(!pathLabel1.empty(), "Couldn't fetch path label from database for file " << sharedPath);
-
-    check_system_access(pathLabel1);
-    check_owner_access(owner.generateAppLabel(), pathLabel1);
-    check_owner_access(pkgApp.generateAppLabel(), pathLabel1);
-    check_target_access(owner.generatePkgLabel(), target.generateAppLabel(), pathLabel1);
-    check_path_label(sharedPath, pathLabel1);
-
-    Api::applySharing(share1);
-
-    check_system_access(pathLabel1);
-    check_owner_access(owner.generateAppLabel(), pathLabel1);
-    check_owner_access(pkgApp.generateAppLabel(), pathLabel1);
-    check_target_access(owner.generatePkgLabel(), target.generateAppLabel(), pathLabel1);
-    check_path_label(sharedPath, pathLabel1);
-
-    Api::uninstall(targetReq);
-
-    check_system_access(pathLabel1, false);
-    check_owner_access(owner.generateAppLabel(), pathLabel1, false);
-    check_owner_access(pkgApp.generateAppLabel(), pathLabel1, false);
-    check_target_access(owner.generatePkgLabel(), target.generateAppLabel(), pathLabel1, false, false);
-    check_path_label(sharedPath, owner.generatePkgLabel());
-
-    Api::dropSharing(share1, SECURITY_MANAGER_ERROR_APP_UNKNOWN);
-
-    Api::uninstall(ownerReq);
-    Api::uninstall(pkgAppReq);
+/*
+ * Check access after double sharing one private path with one application and after uninstalling
+ * target application when owner application is from package with two applications.
+ */
+RUNNER_CHILD_TEST(security_manager_37_pkg_double_share_target_uninstall) {
+    std::string pkgName = "sm_test_37";
+    AppInstallHelper owner("sm_test_37_owner", pkgName);
+    owner.createPrivateFile();
+    ScopedInstaller ownerInstall(owner);
+
+    AppInstallHelper samePkgAsOwnerApp("sm_test_37", pkgName);
+    ScopedInstaller samePkgAsOwnerInstall(samePkgAsOwnerApp);
+
+    AppInstallHelper target("sm_test_37_target");
+    ScopedInstaller targetInstall(target);
+
+    SharingRequest share;
+    std::string sharedPath = owner.getPrivatePath();
+    share.setOwnerAppId(owner.getAppId());
+    share.setTargetAppId(target.getAppId());
+    const char *paths[] = {sharedPath.c_str()};
+    share.addPaths(paths, 1);
+    Api::applySharing(share);
+    Api::applySharing(share);
+
+    runAccessTest(owner, sharedPath, R_OK|W_OK|X_OK);
+    runAccessTest(samePkgAsOwnerApp, sharedPath, R_OK|W_OK|X_OK);
+    runAccessTest(target, sharedPath, R_OK|X_OK);
+    runSystemAccessTest(geteuid(), getegid(), sharedPath, R_OK|W_OK|X_OK);
+
+    targetInstall.uninstallApp();
+    runAccessTest(owner, sharedPath, R_OK|W_OK|X_OK);
+    runAccessTest(samePkgAsOwnerApp, sharedPath, R_OK|W_OK|X_OK);
+    runSystemAccessTest(geteuid(), getegid(), sharedPath, R_OK|W_OK|X_OK);
+
+    // Reinstall, so we can change context to same app_id
+    ScopedInstaller targetInstall2(target);
+    runAccessTest(target, sharedPath, 0);
+
+    Api::dropSharing(share, SECURITY_MANAGER_ERROR_INPUT_PARAM);
 }
 
-RUNNER_TEST(security_manager_37_pkg_double_share_owner_uninstall) {
-    std::vector<AppInstallHelper> helper {{"app37aa", "pkg1"}, {"app37bb", "pkg1"}, {"app37cc", "pkg2"}};
-    auto &owner = helper[0];
-    auto &pkgApp = helper[1];
-    auto &target = helper[2];
-
-    for (auto &e : helper) {
-        e.revokeRules();
-    }
-
-    owner.createPrivateDir();
-    owner.createSharedFile();
-    clearLabels(owner.getInstallDir());
-
-    InstallRequest ownerReq = createInstallReq(owner,
-                                   {PathInfo{owner.getSharedPath(), SECURITY_MANAGER_PATH_RW}});
-    Api::install(ownerReq);
-
-    InstallRequest pkgAppReq = createInstallReq(pkgApp);
-    Api::install(pkgAppReq);
-    InstallRequest targetReq = createInstallReq(target);
-    Api::install(targetReq);
-
-    SharingRequest share1;
-    std::string sharedPath = owner.getSharedPath();
-    share1.setOwnerAppId(owner.getAppId());
-    share1.setTargetAppId(target.getAppId());
-    const char *path[] = {sharedPath.c_str()};
-    share1.addPaths(path, 1);
-    Api::applySharing(share1);
+/*
+ * Check access after double sharing one private path with one application and after uninstalling
+ * owner application from package with two applications.
+ */
+RUNNER_CHILD_TEST(security_manager_37_pkg_double_share_owner_uninstall) {
+    std::string pkgName = "sm_test_37";
+    AppInstallHelper owner("sm_test_37_owner", pkgName);
+    owner.createPrivateFile();
+    ScopedInstaller ownerInstall(owner);
 
-    TestSecurityManagerDatabase db;
-    std::string pathLabel1 = db.get_path_label(sharedPath.c_str());
-    RUNNER_ASSERT_MSG(!pathLabel1.empty(), "Couldn't fetch path label from database for file " << sharedPath);
+    AppInstallHelper samePkgAsOwnerApp("sm_test_37", pkgName);
+    ScopedInstaller samePkgAsOwnerInstall(samePkgAsOwnerApp);
 
-    check_system_access(pathLabel1);
-    check_owner_access(owner.generateAppLabel(), pathLabel1);
-    check_owner_access(pkgApp.generateAppLabel(), pathLabel1);
-    check_target_access(owner.generatePkgLabel(), target.generateAppLabel(), pathLabel1);
-    check_path_label(sharedPath, pathLabel1);
+    AppInstallHelper target("sm_test_37_target");
+    ScopedInstaller targetInstall(target);
 
-    Api::applySharing(share1);
+    SharingRequest share;
+    std::string sharedPath = owner.getPrivatePath();
+    share.setOwnerAppId(owner.getAppId());
+    share.setTargetAppId(target.getAppId());
+    const char *paths[] = {sharedPath.c_str()};
+    share.addPaths(paths, 1);
+    Api::applySharing(share);
+    Api::applySharing(share);
 
-    check_system_access(pathLabel1);
-    check_owner_access(owner.generateAppLabel(), pathLabel1);
-    check_owner_access(pkgApp.generateAppLabel(), pathLabel1);
-    check_target_access(owner.generatePkgLabel(), target.generateAppLabel(), pathLabel1);
-    check_path_label(sharedPath, pathLabel1);
+    runAccessTest(owner, sharedPath, R_OK|W_OK|X_OK);
+    runAccessTest(samePkgAsOwnerApp, sharedPath, R_OK|W_OK|X_OK);
+    runAccessTest(target, sharedPath, R_OK|X_OK);
+    runSystemAccessTest(geteuid(), getegid(), sharedPath, R_OK|W_OK|X_OK);
 
-    owner.removePaths();
-    Api::uninstall(ownerReq);
+    ownerInstall.uninstallApp();
 
-    check_system_access(pathLabel1, false);
-    check_owner_access(owner.generateAppLabel(), pathLabel1, false);
-    check_owner_access(pkgApp.generateAppLabel(), pathLabel1, false);
-    check_target_access(owner.generatePkgLabel(), target.generateAppLabel(), pathLabel1, false, false);
+    runAccessTest(target, sharedPath, 0);
 
-    Api::dropSharing(share1, SECURITY_MANAGER_ERROR_APP_UNKNOWN);
-
-    Api::uninstall(targetReq);
-    Api::uninstall(pkgAppReq);
+    Api::dropSharing(share, SECURITY_MANAGER_ERROR_APP_UNKNOWN);
 }
 
-RUNNER_TEST(security_manager_38_share_one_with_two_uninstall_target)
+/*
+ * Check access after sharing one private path with two applications from different packages and
+ * after uninstalling one of them and dropping second sharing.
+ */
+RUNNER_CHILD_TEST(security_manager_38_share_one_with_two_uninstall_target)
 {
-    std::vector<AppInstallHelper> helper {{"app38a"}, {"app38b"}, {"app38c"}};
-    auto &owner = helper[0];
-    auto &target1 = helper[1];
-    auto &target2 = helper[2];
+    AppInstallHelper owner("sm_test_34_owner");
+    owner.createPrivateFile();
+    ScopedInstaller ownerInstall(owner);
 
-    // cleanup
-    for (auto &e : helper) {
-        e.revokeRules();
-    }
-    owner.createPrivateDir();
-    owner.createSharedFile();
-    clearLabels(owner.getInstallDir());
+    AppInstallHelper target1("sm_test_34_target1");
+    ScopedInstaller targetInstall1(target1);
 
-    InstallRequest ownerReq = createInstallReq(owner,
-                               {PathInfo{owner.getSharedPath(), SECURITY_MANAGER_PATH_RW}});
-    Api::install(ownerReq);
-
-
-    InstallRequest targetReq1 = createInstallReq(target1);
-    Api::install(targetReq1);
-    InstallRequest targetReq2 = createInstallReq(target2);
-    Api::install(targetReq2);
+    AppInstallHelper target2("sm_test_34_target2");
+    ScopedInstaller targetInstall2(target2);
 
     SharingRequest share1, share2;
-    std::string sharedPath = owner.getSharedPath(0).c_str();
+    std::string sharedPath = owner.getPrivatePath(0).c_str();
     share1.setOwnerAppId(owner.getAppId());
     share2.setOwnerAppId(owner.getAppId());
     share1.setTargetAppId(target1.getAppId());
     share2.setTargetAppId(target2.getAppId());
-
-    const char *path[] = {sharedPath.c_str()};
-    share1.addPaths(path, 1);
-    share2.addPaths(path, 1);
+    const char *paths[] = {sharedPath.c_str()};
+    share1.addPaths(paths, 1);
+    share2.addPaths(paths, 1);
 
     Api::applySharing(share1);
-    TestSecurityManagerDatabase db;
-    std::string pathLabel = db.get_path_label(sharedPath.c_str());
-    RUNNER_ASSERT_MSG(!pathLabel.empty(), "Couldn't fetch path label from database for file " << sharedPath);
-
-    check_system_access(pathLabel);
-    check_owner_access(owner.generateAppLabel(), pathLabel);
-    check_target_access(owner.generatePkgLabel(), target1.generateAppLabel(), pathLabel);
-    check_path_label(sharedPath, pathLabel);
+    runAccessTest(owner, sharedPath, R_OK|W_OK|X_OK);
+    runAccessTest(target1, sharedPath, R_OK|X_OK);
+    runSystemAccessTest(geteuid(), getegid(), sharedPath, R_OK|W_OK|X_OK);
 
     Api::applySharing(share2);
-    check_system_access(pathLabel);
-    check_owner_access(owner.generateAppLabel(), pathLabel);
-    check_target_access(owner.generatePkgLabel(), target1.generateAppLabel(), pathLabel);
-    check_target_access(owner.generatePkgLabel(), target2.generateAppLabel(), pathLabel);
-    check_path_label(sharedPath, pathLabel);
-
-    Api::uninstall(targetReq1);
-    check_system_access(pathLabel);
-    check_owner_access(owner.generateAppLabel(), pathLabel);
-    check_target_access(owner.generatePkgLabel(), target1.generateAppLabel(), pathLabel, false, false);
-    check_target_access(owner.generatePkgLabel(), target2.generateAppLabel(), pathLabel);
-    check_path_label(sharedPath, pathLabel);
+    runAccessTest(owner, sharedPath, R_OK|W_OK|X_OK);
+    runAccessTest(target2, sharedPath, R_OK|X_OK);
+    runSystemAccessTest(geteuid(), getegid(), sharedPath, R_OK|W_OK|X_OK);
+
+    targetInstall1.uninstallApp();
+    runAccessTest(owner, sharedPath, R_OK|W_OK|X_OK);
+    runAccessTest(target2, sharedPath, R_OK|X_OK);
+    runSystemAccessTest(geteuid(), getegid(), sharedPath, R_OK|W_OK|X_OK);
+
+    // Reinstall, so we can change context to same app_id
+    ScopedInstaller targetInstall1_2(target1);
+    runAccessTest(target1, sharedPath, 0);
 
     Api::dropSharing(share2);
-    check_system_access(pathLabel, false);
-    check_owner_access(owner.generateAppLabel(), pathLabel, false);
-    check_target_access(owner.generatePkgLabel(), target1.generateAppLabel(), pathLabel, false, false);
-    check_target_access(owner.generatePkgLabel(), target2.generateAppLabel(), pathLabel, false, false);
-    check_path_label(sharedPath, owner.generatePkgLabel());
 
-    Api::dropSharing(share1, SECURITY_MANAGER_ERROR_APP_UNKNOWN);
-    Api::uninstall(ownerReq);
-    Api::uninstall(targetReq2);
+    runAccessTest(owner, sharedPath, R_OK|W_OK|X_OK);
+    runAccessTest(target2, sharedPath, 0);
+    runSystemAccessTest(geteuid(), getegid(), sharedPath, R_OK|W_OK|X_OK);
+
+    Api::dropSharing(share1, SECURITY_MANAGER_ERROR_INPUT_PARAM);
 }
 
-RUNNER_TEST(security_manager_38_share_one_with_two_uninstall_owner)
+/*
+ * Check access after sharing one private path with two applications from different packages and
+ * after uninstalling owner application.
+ */
+RUNNER_CHILD_TEST(security_manager_38_share_one_with_two_uninstall_owner)
 {
-    std::vector<AppInstallHelper> helper {{"app38aa"}, {"app38bb"}, {"app38cc"}};
-    auto &owner = helper[0];
-    auto &target1 = helper[1];
-    auto &target2 = helper[2];
+    AppInstallHelper owner("sm_test_34_owner");
+    owner.createPrivateFile();
+    ScopedInstaller ownerInstall(owner);
 
-    // cleanup
-    for (auto &e : helper) {
-        e.revokeRules();
-    }
-    owner.createPrivateDir();
-    owner.createSharedFile();
-    clearLabels(owner.getInstallDir());
+    AppInstallHelper target1("sm_test_34_target1");
+    ScopedInstaller targetInstall1(target1);
 
-    InstallRequest ownerReq = createInstallReq(owner,
-                               {PathInfo{owner.getSharedPath(), SECURITY_MANAGER_PATH_RW}});
-    Api::install(ownerReq);
-
-
-    InstallRequest targetReq1 = createInstallReq(target1);
-    Api::install(targetReq1);
-    InstallRequest targetReq2 = createInstallReq(target2);
-    Api::install(targetReq2);
+    AppInstallHelper target2("sm_test_34_target2");
+    ScopedInstaller targetInstall2(target2);
 
     SharingRequest share1, share2;
-    std::string sharedPath = owner.getSharedPath(0).c_str();
+    std::string sharedPath = owner.getPrivatePath(0).c_str();
     share1.setOwnerAppId(owner.getAppId());
     share2.setOwnerAppId(owner.getAppId());
     share1.setTargetAppId(target1.getAppId());
     share2.setTargetAppId(target2.getAppId());
-
-    const char *path[] = {sharedPath.c_str()};
-    share1.addPaths(path, 1);
-    share2.addPaths(path, 1);
+    const char *paths[] = {sharedPath.c_str()};
+    share1.addPaths(paths, 1);
+    share2.addPaths(paths, 1);
 
     Api::applySharing(share1);
-    TestSecurityManagerDatabase db;
-    std::string pathLabel = db.get_path_label(sharedPath.c_str());
-    RUNNER_ASSERT_MSG(!pathLabel.empty(), "Couldn't fetch path label from database for file " << sharedPath);
-
-    check_system_access(pathLabel);
-    check_owner_access(owner.generateAppLabel(), pathLabel);
-    check_target_access(owner.generatePkgLabel(), target1.generateAppLabel(), pathLabel);
-    check_path_label(sharedPath, pathLabel);
+    runAccessTest(owner, sharedPath, R_OK|W_OK|X_OK);
+    runAccessTest(target1, sharedPath, R_OK|X_OK);
+    runSystemAccessTest(geteuid(), getegid(), sharedPath, R_OK|W_OK|X_OK);
 
     Api::applySharing(share2);
-    check_system_access(pathLabel);
-    check_owner_access(owner.generateAppLabel(), pathLabel);
-    check_target_access(owner.generatePkgLabel(), target1.generateAppLabel(), pathLabel);
-    check_target_access(owner.generatePkgLabel(), target2.generateAppLabel(), pathLabel);
-    check_path_label(sharedPath, pathLabel);
-
-    owner.removePaths();
-    Api::uninstall(ownerReq);
-    check_system_access(pathLabel, false);
-    check_owner_access(owner.generateAppLabel(), pathLabel,false);
-    check_target_access(owner.generatePkgLabel(), target1.generateAppLabel(), pathLabel, false, false);
-    check_target_access(owner.generatePkgLabel(), target2.generateAppLabel(), pathLabel, false, false);
+    runAccessTest(owner, sharedPath, R_OK|W_OK|X_OK);
+    runAccessTest(target2, sharedPath, R_OK|X_OK);
+    runSystemAccessTest(geteuid(), getegid(), sharedPath, R_OK|W_OK|X_OK);
+
+    ownerInstall.uninstallApp();
+
+    runAccessTest(target2, sharedPath, 0);
 
     Api::dropSharing(share1, SECURITY_MANAGER_ERROR_APP_UNKNOWN);
     Api::dropSharing(share2, SECURITY_MANAGER_ERROR_APP_UNKNOWN);
-    Api::uninstall(targetReq1);
-    Api::uninstall(targetReq2);
 }

diff --git a/src/security-manager-tests/test_cases_public_sharing.cpp b/src/security-manager-tests/test_cases_public_sharing.cpp
index 3dcaf51eacf3e5d223fe24091d7fbf97fbb5e927..05d9e82c36a0190ee7249d986bb81c466ec89f2a 100644 (file)
--- a/src/security-manager-tests/test_cases_public_sharing.cpp
+++ b/src/security-manager-tests/test_cases_public_sharing.cpp
@@ -50,48 +50,6 @@ VersionCombinations makeVersionCombinations(const std::vector<std::string> &vers
 
 const VersionCombinations versionCombinations = makeVersionCombinations(versions);
 
-const std::unordered_map<int, const char* const> accessTypeToString {
-    std::make_pair(0, "F_OK"),
-    std::make_pair(1, "X_OK"),
-    std::make_pair(2, "W_OK"),
-    std::make_pair(3, "W_OK|X_OK"),
-    std::make_pair(4, "R_OK"),
-    std::make_pair(5, "R_OK|X_OK"),
-    std::make_pair(6, "R_OK|W_OK"),
-    std::make_pair(7, "R_OK|W_OK|X_OK")
-};
-
-int oppositeAccess(int accessType) {
-    return accessType ^ (R_OK | W_OK | X_OK);
-}
-
-void accessCheck(const std::string &appId, const std::string &path, int accessType, int expected) {
-    RUNNER_ASSERT_MSG(::access(path.c_str(), accessType) == expected,
-                      "access from app " << appId << " to path " << path
-                       << (expected == 0 ? "not granted" : "unnecessarily granted")
-                       << " (" << accessTypeToString.at(accessType) << ")");
-}
-
-void runAccessTest(const AppInstallHelper &appFrom, const std::string &testPath,
-                   int accessType) {
-    auto fun = [&](){
-        int oppositeAccessType = oppositeAccess(accessType);
-        Api::setProcessLabel(appFrom.getAppId());
-        RUNNER_ASSERT_ERRNO_MSG(0 == drop_root_privileges(appFrom.getUID(), appFrom.getGID()),
-                                "drop_root_privileges failed.");
-        if (accessType != 0)
-            accessCheck(appFrom.getAppId(), testPath, accessType, 0);
-        if (oppositeAccessType != 0) {
-            std::vector<int> singleAccessTypes = {R_OK, W_OK, X_OK};
-            for (auto singleAccessType : singleAccessTypes)
-                if (oppositeAccessType & singleAccessType)
-                    accessCheck(appFrom.getAppId(), testPath, singleAccessType, -1);
-        }
-    };
-
-    runInChildParentWait(fun);
-}
-
 } //anonymous namespace
 
 RUNNER_TEST_GROUP_INIT(SECURITY_MANAGER_SHARED_RO)