* Add dependency to libacl.
* Modify access checks to verify ownership and ACLs in no-smack mode.
* Add AGID getter.
* Add ACL helper.
* Rename test app dir to work with AppInstallHelper.
* Make runAccessTest() prepare and cleanup the app.
* Add system_access supplementary group for tests in no-smack mode.
* Update the tests.
* Skip access checks expecting rule removal in no-smack (paths will be
removed by the installer anyway).
* Make AppInstallHelper use global user id when installing as root (the
app is installed as a global user in such case).
* Fix AppInstallHelper::createFile().
* Make AppInstallHelper::create*() methods chown files for global
installations too.
* Update no-smack tests script.
* Minor refactoring.
Change-Id: I7c6b302767ef1122439ea79b3eb2bb4785316120
BuildRequires: pkgconfig(security-privilege-manager)
BuildRequires: pkgconfig(libsystemd)
BuildRequires: openssl1.1
+BuildRequires: pkgconfig(libacl)
Requires: gdb
Requires: diffutils
Requires: iproute2
${PROJECT_SOURCE_DIR}/src/common/privilege_manager.cpp
${PROJECT_SOURCE_DIR}/src/common/scoped_process_label.cpp
${PROJECT_SOURCE_DIR}/src/common/ckm_helpers.cpp
+ ${PROJECT_SOURCE_DIR}/src/common/dac.cpp
)
#system and local includes
* limitations under the License.
*/
-#include <fcntl.h>
-#include <map>
-#include <string>
#include <sys/mman.h>
#include <sys/stat.h>
-#include <sys/types.h>
#include <sys/smack.h>
-#include <unistd.h>
-#include <utility>
-
-#include <security-manager-types.h>
+#include <sstream>
#include <dpl/test/test_runner.h>
#include <sm_api.h>
const gid_t FILE_GROUP = 100;
- std::string genSkelPath() {
- static std::string skelPkgDir;
- if (!skelPkgDir.empty())
- return skelPkgDir;
- std::string app = TzPlatformConfig::getEnv(TZ_USER_APP);
+std::string genSkelPath() {
+ static std::string skelPkgDir = []{
+ std::string ret = TzPlatformConfig::getEnv(TZ_USER_APP);
std::string home = TzPlatformConfig::getEnv(TZ_USER_HOME);
std::string skelDir = "/etc/skel";
- skelPkgDir.assign(app);
- skelPkgDir.replace(0, home.length(), skelDir);
-
- return skelPkgDir;
- }
-
- const AppInstallHelper::TypePathMap typeToPath = {
- {SECURITY_MANAGER_PATH_RW, "app_rw"},
- {SECURITY_MANAGER_PATH_RO, "app_ro"},
- {SECURITY_MANAGER_PATH_PUBLIC_RO, "public_ro"},
- {SECURITY_MANAGER_PATH_TRUSTED_RW, "trusted_rw"},
- {SECURITY_MANAGER_PATH_OWNER_RW_OTHER_RO, "shared_ro"}
- };
+ ret.replace(0, home.length(), skelDir);
+ return ret;
+ }();
+
+ return skelPkgDir;
+}
+
+const AppInstallHelper::TypePathMap typeToPath = {
+ {SECURITY_MANAGER_PATH_RW, "app_rw"},
+ {SECURITY_MANAGER_PATH_RO, "app_ro"},
+ {SECURITY_MANAGER_PATH_PUBLIC_RO, "public_ro"},
+ {SECURITY_MANAGER_PATH_TRUSTED_RW, "trusted_rw"},
+ {SECURITY_MANAGER_PATH_OWNER_RW_OTHER_RO, "shared_ro"}
+};
+
+} // namespace
+
+AppInstallHelper::AppInstallHelper(const std::string &appNamePrefix,
+ const std::string &pkgNamePrefix,
+ bool isLocal,
+ uid_t uid,
+ std::string version) :
+ m_appName(appNamePrefix + "_app_id"),
+ m_pkgName(pkgNamePrefix + "_pkg_id"),
+ m_isLocal(isLocal),
+ m_uidGid(uid),
+ m_version(version),
+ m_installType(SM_APP_INSTALL_NONE),
+ m_isHybrid(false),
+ m_creatorPid(getpid())
+{
+ // When app is installed with UID=0 it becomes a global user app (see setRequestDefaultValues())
+ if (m_installType == SM_APP_INSTALL_NONE && m_uidGid == 0)
+ setUidGid(TzPlatformConfig::getGlobalUserId());
}
AppInstallHelper::AppInstallHelper(AppInstallHelper &&other)
return m_version;
}
-void AppInstallHelper::setUidGid(int uidGid) {
+void AppInstallHelper::setUidGid(unsigned uidGid) {
m_uidGid = uidGid;
}
-int AppInstallHelper::getUID() const {
+unsigned AppInstallHelper::getUID() const {
return m_uidGid;
}
-int AppInstallHelper::getGID() const {
+unsigned AppInstallHelper::getGID() const {
return m_uidGid;
}
bool AppInstallHelper::createFile(app_install_path_type smType, const std::string &path) {
- if (creat(path.c_str(), 0751) == 0) {
- // Local paths need user change
- m_fileTypeMap[smType].push_back(path);
- if (!m_isLocal || chown(path.c_str(), m_uidGid, FILE_GROUP) == 0)
- return true;
- }
- return false;
+ auto fd = creat(path.c_str(), 0751);
+ if (fd == -1)
+ return false;
+
+ auto ret = fchown(fd, m_uidGid, FILE_GROUP);
+ close(fd);
+ m_fileTypeMap[smType].push_back(path);
+ return ret == 0;
}
bool AppInstallHelper::createDir(app_install_path_type smType, const std::string &path, bool isBasePath) {
// Dont pass base pkg dirs to SM, because transmute will be forced on RO subdirs
if (!isBasePath)
m_dirTypeMap[smType].push_back(path);
- if (!m_isLocal || chown(path.c_str(), m_uidGid, FILE_GROUP) == 0)
+ if (chown(path.c_str(), m_uidGid, FILE_GROUP) == 0)
return true;
return false;
std::string linkPath = getPath(smType, PathType::DIR, i, rType);
if (symlink(dest.c_str(), linkPath.c_str()) == 0) {
m_fileTypeMap[smType].push_back(linkPath);
- if (m_isLocal) {
- chown(linkPath.c_str(), m_uidGid, FILE_GROUP);
- }
+ chown(linkPath.c_str(), m_uidGid, FILE_GROUP);
}
}
}
#ifndef SMACK_ENABLED
-uid_t AppInstallHelper::getPUID() const {
+
+void AppInstallHelper::getPUIDAndAGID() const {
+ static constexpr gid_t MIN_AUTHOR_GID = 20000;
if (m_puid)
- return *m_puid;
+ return;
+
+ struct {
+ uid_t uid = 0;
+ gid_t gid = 0;
+ } id;
- static constexpr auto MMAP_SIZE = sizeof(uid_t);
+ static constexpr auto MMAP_SIZE = sizeof(id);
auto deleter = [&](void* addr) {
RUNNER_ASSERT_ERRNO_MSG(munmap(addr, MMAP_SIZE) == 0, "munmap() failed");
};
- auto shmem = std::unique_ptr<void, decltype(deleter)>{mmap(nullptr, sizeof(uid_t),
+ auto shmem = std::unique_ptr<void, decltype(deleter)>{mmap(nullptr, MMAP_SIZE,
PROT_READ | PROT_WRITE,
MAP_SHARED | MAP_ANONYMOUS, -1, 0),
std::move(deleter)};
RUNNER_ASSERT_MSG(pid >= 0, "Fork failed");
if (pid == 0) {
SecurityManagerTest::Api::setAppProcessIdentity(m_appName);
- uid_t uid = getuid();
- std::memcpy(shmem.get(), &uid, sizeof(uid));
+ id.uid = getuid();
+
+ // get current process groups
+ int ret = getgroups(0, nullptr);
+ RUNNER_ASSERT_MSG(ret != -1, "Unable to get supplementary groups");
+
+ std::vector<gid_t> actualGids(ret);
+ ret = getgroups(ret, actualGids.data());
+ RUNNER_ASSERT_MSG(ret != -1, "Unable to get supplementary groups");
+
+ for (const auto& gid : actualGids) {
+ if (gid >= MIN_AUTHOR_GID) {
+ RUNNER_ASSERT(id.gid == 0);
+ id.gid = gid;
+ }
+ }
+
+ std::memcpy(shmem.get(), &id, sizeof(id));
_exit(0);
}
waitPid(pid);
- uid_t uid;
- std::memcpy(&uid, shmem.get(), sizeof(uid));
- m_puid = uid;
- return uid;
+ std::memcpy(&id, shmem.get(), sizeof(id));
+ m_puid = id.uid;
+ if (id.gid != 0)
+ m_agid = id.gid;
+}
+
+uid_t AppInstallHelper::getPUID() const {
+ getPUIDAndAGID();
+ return *m_puid;
}
+
+std::optional<gid_t> AppInstallHelper::getAGID() const {
+ getPUIDAndAGID();
+ return m_agid;
+}
+#endif
+
+Access AppInstallHelper::pathOwnerRWAccess() const
+{
+ Access ret;
+ ret.label = generateOwnerRWPathLabel(getPkgId());
+#ifndef SMACK_ENABLED
+ std::ostringstream os;
+ os << "u::rwx,g::rwx,o::-,m::rwx,u:" << getPUID() << ":rwx";
+ ret.dac = Dac{os.str(), getUID(), checkedGetSystemAccessGid()};
+#endif
+ return ret;
+}
+
+Access AppInstallHelper::pathOwnerROAccess() const
+{
+ Access ret;
+ ret.label = generateOwnerROPathLabel(getPkgId());
+#ifndef SMACK_ENABLED
+ std::ostringstream os;
+ os << "u::rwx,g::rwx,o::-,m::rwx,u:" << getPUID() << ":rx";
+ ret.dac = Dac{os.str(), getUID(), checkedGetSystemAccessGid()};
#endif
+ return ret;
+}
+
+Access AppInstallHelper::pathOwnerROOtherROAccess() const
+{
+ Access ret;
+ ret.label = getOwnerROOtherROPathLabel();
+#ifndef SMACK_ENABLED
+ std::ostringstream os;
+ os << "u::rwx,g::rwx,o::rx,m::rwx,u:" << getPUID() << ":rx";
+ ret.dac = Dac{os.str(), getUID(), checkedGetSystemAccessGid()};
+#endif
+ return ret;
+}
+
+Access AppInstallHelper::pathOwnerRWOtherROAccess() const
+{
+ Access ret;
+ ret.label = getOwnerRWOtherROPathLabel();
+#ifndef SMACK_ENABLED
+ std::ostringstream os;
+ os << "u::rwx,g::rwx,o::rx,m::rwx,u:" << getPUID() << ":rwx";
+ ret.dac = Dac{os.str(), getUID(), checkedGetSystemAccessGid()};
+#endif
+ return ret;
+}
std::string AppInstallHelper::generateAppLabel() const {
return generateProcessLabel(getAppId(), getPkgId(), getIsHybrid());
}
std::string AppInstallHelper::generatePkgLabel() const {
- return generatePathRWLabel(getPkgId());
+ return generateOwnerRWPathLabel(getPkgId());
}
const AppInstallHelper::TypePathsMap& AppInstallHelper::getDirsMap() const {
#include <security-manager-types.h>
#include <app_def_privilege.h>
+#include "dac.h"
+
+struct Access {
+ std::optional<Dac> dac;
+ std::string label;
+};
struct AppInstallHelper {
const std::string &pkgNamePrefix,
bool isLocal,
uid_t uid,
- std::string version = std::string())
- : m_appName(appNamePrefix + "_app_id"), m_pkgName(pkgNamePrefix + "_pkg_id"), m_isLocal(isLocal), m_uidGid(uid), m_version(version),
- m_installType(SM_APP_INSTALL_NONE), m_isHybrid(false), m_creatorPid(getpid())
- {}
+ std::string version = std::string());
AppInstallHelper(const std::string &appNamePrefix,
const std::string &pkgNamePrefix,
// App info getters and setters
const std::string& getAppId() const;
const std::string& getPkgId() const;
- void setUidGid(int uidGid);
- int getUID() const;
- int getGID() const;
+ void setUidGid(unsigned uidGid);
+ unsigned getUID() const;
+ unsigned getGID() const;
void setVersion(const std::string &version);
std::string getVersion() const;
void setAuthor(const std::string &author);
#ifndef SMACK_ENABLED
private:
mutable std::optional<uid_t> m_puid;
+ mutable std::optional<gid_t> m_agid;
+ void getPUIDAndAGID() const;
public:
uid_t getPUID() const;
+ std::optional<gid_t> getAGID() const;
#endif
+ Access pathOwnerRWAccess() const;
+ Access pathOwnerROAccess() const;
+ Access pathOwnerROOtherROAccess() const;
+ Access pathOwnerRWOtherROAccess() const;
+
protected:
struct RootInfo {
RootInfo() : isCreated(false) {}
const std::string m_appName;
const std::string m_pkgName;
bool m_isLocal;
- int m_uidGid;
+ unsigned m_uidGid;
std::string m_version;
app_install_type m_installType;
bool m_isHybrid;
--- /dev/null
+/*
+ * Copyright (c) 2025 Samsung Electronics Co., Ltd All Rights Reserved
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <sys/stat.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <cstdint>
+#include <sstream>
+#include <iostream>
+#include <unordered_set>
+#include <optional>
+#include <acl/libacl.h>
+
+#include "dac.h"
+#include "dpl/test/test_runner.h"
+
+namespace {
+
+template<size_t N>
+inline constexpr uint8_t bitsNeeded = [] {
+ uint8_t res = 0;
+ auto n = N;
+ while (n > 0) {
+ ++res;
+ n >>= 1;
+ }
+ return res;
+}();
+
+template<auto... N>
+inline constexpr auto max = [] {
+ auto vals = {N...};
+ auto res = *vals.begin();
+ for (auto x : vals)
+ if (x > res)
+ res = x;
+ return res;
+}();
+
+inline constexpr size_t MAX_TAG =
+ max<ACL_USER_OBJ, ACL_USER, ACL_GROUP_OBJ, ACL_GROUP, ACL_MASK, ACL_OTHER>;
+inline constexpr size_t MAX_PERM = ACL_READ | ACL_WRITE | ACL_EXECUTE;
+
+class AclHelper
+{
+public:
+ struct AclEntry
+ {
+ acl_tag_t tag = ACL_UNDEFINED_TAG;
+ std::optional<unsigned int> qualifier = std::nullopt;
+ acl_perm_t perms = 0;
+ };
+
+ struct Hash
+ {
+ size_t operator()(const AclEntry &entry) const;
+ };
+
+ explicit AclHelper(acl_t&& acl);
+
+ friend bool operator==(const AclHelper &first, const AclHelper &second) noexcept;
+
+ friend bool operator!=(const AclHelper &first, const AclHelper &second) noexcept
+ {
+ return !(first == second);
+ }
+
+ friend std::ostream& operator<<(std::ostream &os, const AclHelper &acl);
+
+private:
+ std::unordered_set<AclEntry, Hash> m_entries;
+};
+
+constexpr bool operator==(const AclHelper::AclEntry &first, const AclHelper::AclEntry &second) noexcept
+{
+ return first.tag == second.tag && first.perms == second.perms &&
+ first.qualifier == second.qualifier;
+}
+
+bool operator==(const AclHelper &first, const AclHelper &second) noexcept
+{
+ return first.m_entries == second.m_entries;
+}
+
+std::ostream& operator<<(std::ostream &os, const AclHelper::AclEntry &entry);
+
+size_t AclHelper::Hash::operator()(const AclEntry &entry) const
+{
+ static constexpr auto TAG_BITS = bitsNeeded<MAX_TAG>;
+ static constexpr auto PERM_BITS = bitsNeeded<MAX_PERM>;
+ size_t hash = 0;
+ RUNNER_ASSERT(entry.tag >= 0);
+ RUNNER_ASSERT(static_cast<size_t>(entry.tag) <= MAX_TAG);
+ hash |= static_cast<size_t>(entry.tag);
+ RUNNER_ASSERT(entry.perms <= MAX_PERM);
+ hash |= static_cast<size_t>(entry.perms << TAG_BITS);
+ if (entry.qualifier.has_value()) {
+ RUNNER_ASSERT(*entry.qualifier <= std::numeric_limits<decltype(hash)>::max() >> (TAG_BITS + PERM_BITS));
+ hash |= *entry.qualifier << (TAG_BITS + PERM_BITS);
+ }
+ return hash;
+}
+
+AclHelper::AclHelper(acl_t&& acl)
+{
+ RUNNER_ASSERT(acl != nullptr);
+
+ acl_entry_t entry;
+ int ret = acl_get_entry(acl, ACL_FIRST_ENTRY, &entry);
+ RUNNER_ASSERT(ret >= 0);
+ while (ret == 1) {
+ AclEntry aclEntry;
+ RUNNER_ASSERT(0 == acl_get_tag_type(entry, &aclEntry.tag));
+ if (aclEntry.tag == ACL_USER || aclEntry.tag == ACL_GROUP) {
+ auto q = acl_get_qualifier(entry);
+ RUNNER_ASSERT(q != nullptr);
+ static_assert(std::is_same_v<uid_t, unsigned int>);
+ static_assert(std::is_same_v<gid_t, unsigned int>);
+ aclEntry.qualifier = *static_cast<unsigned int*>(q);
+ }
+ acl_permset_t permset;
+ RUNNER_ASSERT(0 == acl_get_permset(entry, &permset));
+
+ for (auto perm : { ACL_READ, ACL_WRITE, ACL_EXECUTE }) {
+ ret = acl_get_perm(permset, perm);
+ RUNNER_ASSERT(ret >= 0);
+
+ if (ret == 1)
+ aclEntry.perms |= perm;
+ }
+ m_entries.emplace(std::move(aclEntry));
+
+ ret = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry);
+ RUNNER_ASSERT(ret >= 0);
+ }
+ acl_free(acl);
+}
+
+std::ostream& operator<<(std::ostream &os, const AclHelper::AclEntry &entry)
+{
+ switch (entry.tag) {
+ case ACL_UNDEFINED_TAG:
+ os << "UNDEFINED_TAG|";
+ break;
+ case ACL_USER_OBJ:
+ os << "USER_OBJ|";
+ break;
+ case ACL_USER:
+ os << "USER|";
+ break;
+ case ACL_GROUP_OBJ:
+ os << "GROUP_OBJ|";
+ break;
+ case ACL_GROUP:
+ os << "GROUP|";
+ break;
+ case ACL_MASK:
+ os << "MASK|";
+ break;
+ case ACL_OTHER:
+ os << "OTHER|";
+ break;
+ default:
+ RUNNER_FAIL_MSG("Unknown tag");
+ }
+
+ if (entry.qualifier.has_value())
+ os << *entry.qualifier << "|";
+
+ if (entry.perms & ACL_READ)
+ os << "r";
+ else
+ os << "-";
+ if (entry.perms & ACL_WRITE)
+ os << "w";
+ else
+ os << "-";
+ if (entry.perms & ACL_EXECUTE)
+ os << "x";
+ else
+ os << "-";
+ return os;
+}
+
+std::ostream& operator<<(std::ostream &os, const AclHelper &acl)
+{
+ os << "{\n";
+ for (const auto &entry : acl.m_entries)
+ os << " " << entry << "\n";
+ return os << "}";
+}
+
+template<typename T>
+void RUNNER_ASSERT_EQUAL_MSG(const T& expected, const T& actual, const std::string& msg)
+{
+ std::ostringstream os;
+ os << msg << " expected: " << expected << " != actual: " << actual;
+ RUNNER_ASSERT_MSG(expected == actual, os.str());
+}
+
+void CheckAcl(const std::string &path, const std::string &aclText, acl_type_t type)
+{
+ AclHelper actual(acl_get_file(path.c_str(), type));
+ AclHelper expected(acl_from_text(aclText.c_str()));
+ RUNNER_ASSERT_EQUAL_MSG(expected, actual,
+ std::string("Checking ") + (type == ACL_TYPE_ACCESS ? "access" : "default") +
+ " ACL for: " + path);
+}
+
+} // namespace
+
+void CheckDac(const std::string &path, const Dac &dac)
+{
+ CheckAcl(path, dac.acl, ACL_TYPE_ACCESS);
+
+ struct stat statbuf;
+ RUNNER_ASSERT(0 == stat(path.c_str(), &statbuf));
+
+ RUNNER_ASSERT(statbuf.st_uid == dac.owner);
+ RUNNER_ASSERT(statbuf.st_gid == dac.group);
+}
--- /dev/null
+/*
+ * Copyright (c) 2025 Samsung Electronics Co., Ltd. All rights reserved.
+ *
+ * This file is licensed under the terms of MIT License or the Apache License
+ * Version 2.0 of your choice. See the LICENSE.MIT file for MIT license details.
+ * See the LICENSE file or the notice below for Apache License Version 2.0
+ * details.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <string>
+#include <sys/types.h>
+
+struct Dac {
+ std::string acl;
+ uid_t owner;
+ gid_t group;
+};
+
+void CheckDac(const std::string &path, const Dac &dac);
return label;
}
-std::string generatePathRWLabel(const std::string &pkgId)
+std::string generateOwnerRWPathLabel(const std::string &pkgId)
{
if (!smack_check())
return NO_SMACK_LABEL;
return "User::Pkg::" + pkgId;
}
-std::string generatePathROLabel(const std::string &pkgId)
+std::string generateOwnerROPathLabel(const std::string &pkgId)
{
if (!smack_check())
return NO_SMACK_LABEL;
- return generatePathRWLabel(pkgId) + "::RO";
+ return generateOwnerRWPathLabel(pkgId) + "::RO";
}
-std::string generatePathTrustedLabel(int64_t authorId)
+std::string generateTrustedPathLabel(int64_t authorId)
{
if (!smack_check())
return NO_SMACK_LABEL;
return "User::Author::" + std::to_string(authorId);
}
-std::string getPublicPathLabel()
+std::string getOwnerROOtherROPathLabel()
{
if (!smack_check())
return NO_SMACK_LABEL;
return "User::Home";
}
-std::string getSharedROPathLabel()
+std::string getOwnerRWOtherROPathLabel()
{
if (!smack_check())
return NO_SMACK_LABEL;
constexpr inline char NO_SMACK_LABEL[] = "User::Pkg::default_app_no_Smack_mode";
std::string generateProcessLabel(const std::string &appId, const std::string &pkgId, bool isHybrid = false);
-std::string generatePathRWLabel(const std::string &pkgId);
-std::string generatePathROLabel(const std::string &pkgId);
-std::string generatePathTrustedLabel(int64_t authorId);
-std::string getPublicPathLabel();
-std::string getSharedROPathLabel();
+std::string generateOwnerRWPathLabel(const std::string &pkgId);
+std::string generateOwnerROPathLabel(const std::string &pkgId);
+std::string generateTrustedPathLabel(int64_t authorId);
+std::string getOwnerROOtherROPathLabel();
+std::string getOwnerRWOtherROPathLabel();
*/
#include "tests_common.h"
+
+#include <cassert>
+#include <cerrno>
+
+#include <grp.h>
#include <sys/mman.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>
-#include <errno.h>
bool smack_check(void)
{
return pid;
}
-void runInChildParentWait(const std::function<void(void)> &process) {
+pid_t runInChildParentWait(const std::function<void(void)> &process) {
pid_t pid = fork();
RUNNER_ASSERT_ERRNO_MSG(pid >= 0, "fork failed");
if (pid == 0) {
process();
exit(EXIT_SUCCESS);
- } else {
- waitPid(pid);
}
+ waitPid(pid);
+ return pid;
+}
+
+std::optional<gid_t> nameToGid(const char *name) noexcept {
+ struct group entry, *gresult;
+ char buffer[1024];
+ if (0 != getgrnam_r(name, &entry, buffer, sizeof(buffer), &gresult) && (gresult != NULL))
+ return std::nullopt;
+
+ return entry.gr_gid;
+}
+
+gid_t checkedNameToGid(const char *name) {
+ auto gid = nameToGid(name);
+ RUNNER_ASSERT_MSG(gid.has_value(), "Error in getgrnam. Group name: " << name);
+ return *gid;
+}
+
+std::optional<gid_t> getSystemAccessGid() noexcept {
+ if (smack_check())
+ return std::nullopt;
+
+ static const std::optional<gid_t> SYSTEM_ACCESS_GID = nameToGid("system_access");
+ return SYSTEM_ACCESS_GID;
}
+gid_t checkedGetSystemAccessGid() {
+ auto gid = getSystemAccessGid();
+ RUNNER_ASSERT_MSG(gid.has_value(), "Failed to get system_access gid");
+ return *gid;
+};
#include <dpl/test/test_runner_multiprocess.h>
#include <algorithm>
+#include <optional>
#include <sys/types.h>
#include <string>
#include <tuple>
void waitPid(pid_t pid);
pid_t runInChild(const std::function<void(void)> &process);
-void runInChildParentWait(const std::function<void(void)> &process);
+pid_t runInChildParentWait(const std::function<void(void)> &process);
+
+[[nodiscard]] std::optional<gid_t> nameToGid(const char *name) noexcept;
+[[nodiscard]] gid_t checkedNameToGid(const char *name);
+[[nodiscard]] std::optional<gid_t> getSystemAccessGid() noexcept;
+[[nodiscard]] gid_t checkedGetSystemAccessGid();
#define RUNNER_TEST_SMACK(Proc, ...) \
void Proc(std::tuple<__VA_ARGS__> &optionalArgsTuple); \
${PROJECT_SOURCE_DIR}/src/common/sm_user_request.cpp
${PROJECT_SOURCE_DIR}/src/common/sm_policy_request.cpp
${PROJECT_SOURCE_DIR}/src/common/app_install_helper.cpp
+ ${PROJECT_SOURCE_DIR}/src/common/dac.cpp
${PROJECT_SOURCE_DIR}/src/security-manager-tests/common/sm_commons.cpp
${PROJECT_SOURCE_DIR}/src/security-manager-tests/common/policy_configuration.cpp
${PROJECT_SOURCE_DIR}/src/security-manager-tests/common/template_parser.cpp
libcap
dbus-1
libgum
- boost)
+ boost
+ libacl)
SET(TARGET_SEC_MGR_TESTS "security-manager-tests")
+++ /dev/null
-../../non_app_dir/exec
\ No newline at end of file
+++ /dev/null
-../../non_app_dir/normal
\ No newline at end of file
+++ /dev/null
-exec
\ No newline at end of file
+++ /dev/null
-normal
\ No newline at end of file
+++ /dev/null
-exec
\ No newline at end of file
+++ /dev/null
-normal
\ No newline at end of file
+++ /dev/null
-exec
\ No newline at end of file
+++ /dev/null
-../../non_app_dir
\ No newline at end of file
+++ /dev/null
-../../non_app_dir/exec
\ No newline at end of file
+++ /dev/null
-../../non_app_dir/normal
\ No newline at end of file
+++ /dev/null
-normal
\ No newline at end of file
+++ /dev/null
-exec
\ No newline at end of file
+++ /dev/null
-normal
\ No newline at end of file
+++ /dev/null
-exec
\ No newline at end of file
+++ /dev/null
-normal
\ No newline at end of file
+++ /dev/null
-exec
\ No newline at end of file
+++ /dev/null
-../../non_app_dir
\ No newline at end of file
+++ /dev/null
-../../non_app_dir/exec
\ No newline at end of file
+++ /dev/null
-../../non_app_dir/normal
\ No newline at end of file
+++ /dev/null
-normal
\ No newline at end of file
+++ /dev/null
-../../non_app_dir/exec
\ No newline at end of file
+++ /dev/null
-../../non_app_dir/normal
\ No newline at end of file
+++ /dev/null
-exec
\ No newline at end of file
+++ /dev/null
-normal
\ No newline at end of file
+++ /dev/null
-exec
\ No newline at end of file
+++ /dev/null
-normal
\ No newline at end of file
+++ /dev/null
-exec
\ No newline at end of file
+++ /dev/null
-../../non_app_dir
\ No newline at end of file
+++ /dev/null
-../../non_app_dir/exec
\ No newline at end of file
+++ /dev/null
-../../non_app_dir/normal
\ No newline at end of file
+++ /dev/null
-normal
\ No newline at end of file
{
#ifdef SMACK_ENABLED
const std::pair<std::string, std::string> switchAliases[] = {
- {"~PATH_RW~", generatePathRWLabel(m_pkgName)},
- {"~PATH_RO~", generatePathROLabel(m_pkgName)},
+ {"~PATH_RW~", generateOwnerRWPathLabel(m_pkgName)},
+ {"~PATH_RO~", generateOwnerROPathLabel(m_pkgName)},
{"~PROCESS~", generateProcessLabel(m_appName, m_pkgName, m_isHybrid)}
};
void AppInstallHelperExt::checkPkgSmackRulesAfterUninstall() const
{
const std::vector<AccessRequest> rules(parseSmackRulesFile(SMACK_RULES_PATH));
- const std::string labels[] = {generatePathRWLabel(m_pkgName),
- generatePathROLabel(m_pkgName),
+ const std::string labels[] = {generateOwnerRWPathLabel(m_pkgName),
+ generateOwnerROPathLabel(m_pkgName),
generateProcessLabel(m_appName, m_pkgName, true),
generateProcessLabel(m_appName, m_pkgName)};
#include <vector>
#include <stdexcept>
-#include <grp.h>
#include <sys/types.h>
#include <unistd.h>
#include <dpl/test/test_runner.h>
#include <dpl/test/test_runner_child.h>
#include <policy_configuration.h>
+#include "tests_common.h"
#define CONF_DIR "/usr/share/security-manager/policy/"
#define CONF_GROUP_FILE "privilege-group.list"
} // namespace anonymous
-gid_t nameToGid(const char *name) {
- struct group entry, *gresult;
- char buffer[1024];
- RUNNER_ASSERT_MSG(
- 0 == getgrnam_r(name, &entry, buffer, 1024, &gresult) && (gresult != NULL),
- "Error in getgrnam. Group name: " << name);
- return entry.gr_gid;
-}
-
-
std::string PolicyConfiguration::getConfigFilePath(UserType userType) {
const char *user = NULL;
switch(userType) {
gid_t PolicyConfiguration::groupToGid(const std::string &gname) {
auto it = m_groupGidMap.find(gname);
if (it == m_groupGidMap.end())
- m_groupGidMap[gname] = nameToGid(gname.c_str());
+ m_groupGidMap[gname] = checkedNameToGid(gname.c_str());
return m_groupGidMap[gname];
}
namespace SecurityManagerTest {
-gid_t nameToGid(const char *name);
-
class PolicyConfiguration {
public:
typedef std::vector<gid_t> GidVector;
#include <template_parser.h>
#include <temp_test_user.h>
+#include "dac.h"
+
using namespace SecurityManagerTest;
-#define ALLOW 0
-#define DENY -1
+namespace {
+inline constexpr int ALLOW = 0;
+inline constexpr int DENY = -1;
+
+const std::vector<std::string> SM_SYSTEM_LABELS = {"System", "System::Privileged", "User"};
+
+int getOppositeAccessType(int accessType) noexcept {
+ return accessType ^ (R_OK | W_OK | X_OK);
+}
+
+const std::unordered_map<int, const char* const> accessTypeToString {
+ std::make_pair(0, "F_OK"),
+ std::make_pair(1, "X_OK"),
+ std::make_pair(2, "W_OK"),
+ std::make_pair(3, "W_OK|X_OK"),
+ std::make_pair(4, "R_OK"),
+ std::make_pair(5, "R_OK|X_OK"),
+ std::make_pair(6, "R_OK|W_OK"),
+ std::make_pair(7, "R_OK|W_OK|X_OK")
+};
// Common DB/nftw checks
// nftw doesn't allow passing user data to functions. Work around by using global variable
-static std::string nftw_expected_label;
+Access nftw_expected_access;
bool nftw_expected_transmute;
bool nftw_expected_exec;
-static int nftw_check_sm_labels_app_dir(const char *fpath, const struct stat *sb,
- const char* correctLabel, bool transmute_test, bool exec_test)
+int nftw_check_sm_access(const char *fpath,
+ const struct stat *sb,
+ int /*typeflag*/,
+ struct FTW* /*ftwbuf*/)
{
-#if SMACK_ENABLED
- int result;
- CStringPtr labelPtr;
- char* label = nullptr;
-
- /* ACCESS */
- result = smack_lgetlabel(fpath, &label, SMACK_LABEL_ACCESS);
- RUNNER_ASSERT_MSG(result == 0, "Could not get label for the path");
- labelPtr.reset(label);
- RUNNER_ASSERT_MSG(label != nullptr, "ACCESS label on " << fpath << " is not set");
- result = strcmp(correctLabel, label);
- RUNNER_ASSERT_MSG(result == 0, "ACCESS label on " << fpath << " is incorrect"
- " (should be '" << correctLabel << "' and is '" << label << "')");
-
-
- /* EXEC */
- result = smack_lgetlabel(fpath, &label, SMACK_LABEL_EXEC);
- RUNNER_ASSERT_MSG(result == 0, "Could not get label for the path");
- labelPtr.reset(label);
-
- if (S_ISREG(sb->st_mode) && (sb->st_mode & S_IXUSR) && exec_test) {
- RUNNER_ASSERT_MSG(label != nullptr, "EXEC label on " << fpath << " is not set");
- result = strcmp(correctLabel, label);
- RUNNER_ASSERT_MSG(result == 0, "Incorrect EXEC label on executable file " << fpath);
- } else
- RUNNER_ASSERT_MSG(label == nullptr, "EXEC label on " << fpath << " is set");
-
-
- /* TRANSMUTE */
- result = smack_lgetlabel(fpath, &label, SMACK_LABEL_TRANSMUTE);
- RUNNER_ASSERT_MSG(result == 0, "Could not get label for the path");
- labelPtr.reset(label);
-
- if (S_ISDIR(sb->st_mode) && transmute_test == true) {
- RUNNER_ASSERT_MSG(label != nullptr, "TRANSMUTE label on " << fpath << " is not set at all");
- RUNNER_ASSERT_MSG(strcmp(label,"TRUE") == 0,
- "TRANSMUTE label on " << fpath << " is not set properly: '"<<label<<"'");
- } else {
- RUNNER_ASSERT_MSG(label == nullptr, "TRANSMUTE label on " << fpath << " is set");
+ if (smack_check()) {
+ int result;
+ CStringPtr labelPtr;
+ char* label = nullptr;
+
+ /* ACCESS */
+ result = smack_lgetlabel(fpath, &label, SMACK_LABEL_ACCESS);
+ RUNNER_ASSERT_MSG(result == 0, "Could not get label for the path");
+ labelPtr.reset(label);
+ RUNNER_ASSERT_MSG(label != nullptr, "ACCESS label on " << fpath << " is not set");
+ RUNNER_ASSERT_MSG(nftw_expected_access.label == label, "ACCESS label on " << fpath << " is incorrect"
+ " (should be '" << nftw_expected_access.label << "' and is '" << label << "')");
+
+ /* EXEC */
+ result = smack_lgetlabel(fpath, &label, SMACK_LABEL_EXEC);
+ RUNNER_ASSERT_MSG(result == 0, "Could not get label for the path");
+ labelPtr.reset(label);
+
+ if (S_ISREG(sb->st_mode) && (sb->st_mode & S_IXUSR) && nftw_expected_exec) {
+ RUNNER_ASSERT_MSG(label != nullptr, "EXEC label on " << fpath << " is not set");
+ RUNNER_ASSERT_MSG(nftw_expected_access.label == label, "Incorrect EXEC label on executable file " << fpath);
+ } else
+ RUNNER_ASSERT_MSG(label == nullptr, "EXEC label on " << fpath << " is set");
+
+
+ /* TRANSMUTE */
+ result = smack_lgetlabel(fpath, &label, SMACK_LABEL_TRANSMUTE);
+ RUNNER_ASSERT_MSG(result == 0, "Could not get label for the path");
+ labelPtr.reset(label);
+
+ if (S_ISDIR(sb->st_mode) && nftw_expected_transmute) {
+ RUNNER_ASSERT_MSG(label != nullptr, "TRANSMUTE label on " << fpath << " is not set at all");
+ RUNNER_ASSERT_MSG(strcmp(label, "TRUE") == 0,
+ "TRANSMUTE label on " << fpath << " is not set properly: '" << label << "'");
+ } else {
+ RUNNER_ASSERT_MSG(label == nullptr, "TRANSMUTE label on " << fpath << " is set");
+ }
}
-#else
- (void)fpath;
- (void)sb;
- (void)correctLabel;
- (void)transmute_test;
- (void)exec_test;
-#endif
+
+ if (nftw_expected_access.dac.has_value())
+ CheckDac(fpath, *nftw_expected_access.dac);
+
return 0;
}
-static int nftw_check_sm_labels(const char *fpath, const struct stat *sb,
- int /*typeflag*/, struct FTW* /*ftwbuf*/)
-{
- return nftw_check_sm_labels_app_dir(fpath, sb,
- nftw_expected_label.c_str(), nftw_expected_transmute, nftw_expected_exec);
-}
+} // namespace
int nftw_remove_labels(const char *fpath, const struct stat* /*sb*/,
int /*typeflag*/, struct FTW* /*ftwbuf*/)
return 0;
}
-void check_path(const std::string &path, const std::string &label, bool transmute, bool execute) {
- nftw_expected_label = label;
+void check_path(const std::string &path, const Access &access, bool transmute, bool execute) {
+ nftw_expected_access = access;
nftw_expected_transmute = transmute;
nftw_expected_exec = execute;
// check labels
- int result = nftw(path.c_str(), &nftw_check_sm_labels, FTW_MAX_FDS, FTW_PHYS);
+ int result = nftw(path.c_str(), &nftw_check_sm_access, FTW_MAX_FDS, FTW_PHYS);
RUNNER_ASSERT_MSG(result == 0, "Unable to check Smack labels for " << path);
}
return caps;
}
-static int getOppositeAccessType(int accessType) {
- return accessType ^ (R_OK | W_OK | X_OK);
-}
-
-static const std::unordered_map<int, const char* const> accessTypeToString {
- std::make_pair(0, "F_OK"),
- std::make_pair(1, "X_OK"),
- std::make_pair(2, "W_OK"),
- std::make_pair(3, "W_OK|X_OK"),
- std::make_pair(4, "R_OK"),
- std::make_pair(5, "R_OK|X_OK"),
- std::make_pair(6, "R_OK|W_OK"),
- std::make_pair(7, "R_OK|W_OK|X_OK")
-};
-
void accessCheck(const std::string &id, const std::string &path, int accessType,
int expected)
{
void runAccessTest(const AppInstallHelper &app, const std::string &testPath, int accessType) {
auto fun = [&](){
- Api::setAppProcessIdentity(app.getAppId());
- RUNNER_ASSERT_ERRNO_MSG(0 == drop_root_privileges(app.getUID(), app.getGID()),
- "drop_root_privileges failed.");
+ RUNNER_ASSERT_ERRNO_MSG(setLauncherSecurityAttributes(app.getUID(), app.getGID()) == 0,
+ "launcher failed");
+ Api::prepareAppCandidate();
+ Api::prepareApp(app.getAppId());
accessTest(app.getAppId(), testPath, accessType);
};
- runInChildParentWait(fun);
+ auto pid = runInChildParentWait(fun);
+ Api::cleanupApp(app.getAppId(), app.getUID(), pid);
}
-static const std::vector<std::string> SM_SYSTEM_LABELS = {"System", "System::Privileged", "User"};
-
void runSystemAccessTest(uid_t uid, gid_t gid, const std::string &testPath, int accessType) {
for (const auto &label : SM_SYSTEM_LABELS)
runAccessTest(label, uid, gid, testPath, accessType);
{
return setLauncherSecurityAttributes(user.getUid(), user.getGid());
}
-
int nftw_remove_labels(const char *fpath, const struct stat* /*sb*/,
int /*typeflag*/, struct FTW* /*ftwbuf*/);
-void check_path(const std::string &path, const std::string &label,
+void check_path(const std::string &path, const Access &access,
bool transmute = true, bool execute = false);
CapsSetsUniquePtr setCaps(const char *cap_string);
security_manager_11a_set_identity_system
security_manager_11b_set_identity_privileged
security_manager_11c_set_identity_app_no_author
+ app_defined_06_get_provider
+ app_defined_07_get_provider_license
+ app_defined_08_add_get_license_with_untrusted_priv
+ app_defined_09_add_get_client_license
app_defined_10_check_system_privileges
+ app_defined_11_invalid_license
+ app_defined_12_invalid_common_name
security_manager_22_security_manager_cmd_install
security_manager_23_security_manager_cmd_users
security_manager_51b_get_id_by_socket_bad_fd
security_manager_66_path_req_check_labels
security_manager_67_path_req_shared_ro_3_0
security_manager_68_path_req_shared_ro_2_X
+ security_manager_69_path_req_trusted_rw_no_author
security_manager_70_path_req_trusted_rw_positive
+ security_manager_76_owner_access
+ security_manager_7x_test
+ security_manager_77_owner_other_access_version_combinations
+ security_manager_78_another_pkg_shared_ro_have_ro_access_to_shared_ro
+ security_manager_79a_same_pkg_shared_ro_have_ro_access_to_shared_ro
+ security_manager_79b_same_pkg_shared_ro_have_ro_access_to_shared_ro
+ security_manager_80_same_pkg_shared_ro_have_no_access_to_shared_ro_app_ro_dir
+ security_manager_81_add_path_to_app_and_check_all
security_manager_82_add_invalid_path_to_app_and_check_all
+ security_manager_83_install_uninstall_shared_ro_app_and_check_cleaning
+ security_manager_84_install_uninstall_shared_ro_two_apps_in_one_pkg
smack_privileges_10_no_privileges
smack_privileges_20_internet_privilege
smack_privileges_30_one_after_another
smack_privileges_400_malformed
security_manager_40_set_wrong_author_id
security_manager_41_set_author_id_multiple_times
+ security_manager_43_app_install_with_trusted_path
+ security_manager_44_app_install_with_trusted_path_no_author_id
+ security_manager_45_test_authorId_identificator_creation
+ security_manager_46a_pkgId_deinstalation_test_hybrid
+ security_manager_46b_pkgId_deinstalation_test_nonhybrid
+ security_manager_46c_pkgId_deinstalation_test_hybrid_only_provider
+ security_manager_46d_pkgId_deinstalation_test_hybrid_only_trusted
)
function run_tests_and_exit {
* limitations under the License.
*/
-#include <dpl/test/test_runner.h>
+#include "dpl/test/test_runner.h"
+#include "tests_common.h"
+
+#include <grp.h>
+#include <sys/types.h>
+#include <unistd.h>
+
+namespace {
+
+int addSystemAccessGroupForCurrentProcess()
+{
+ static constexpr size_t MAX_GROUPS = 100;
+ gid_t gids[MAX_GROUPS + 1];
+ int cnt = getgroups(MAX_GROUPS, gids);
+ if (cnt == -1) {
+ std::cerr << "getgroups() failed\n";
+ return -1;
+ }
+
+ auto gid = getSystemAccessGid();
+ if (!gid.has_value()) {
+ std::cerr << "Failed to get system_access gid\n";
+ return -1;
+ }
+
+ gids[cnt] = *gid;
+ cnt++;
+
+ if (setgroups(cnt, gids) < 0) {
+ std::cerr << "setgroups failed\n";
+ return -1;
+ }
+ return 0;
+}
+
+} // namespace
int main(int argc, char *argv[])
{
+ if (!smack_check()) {
+ int ret = addSystemAccessGroupForCurrentProcess();
+ if (ret != 0)
+ return ret;
+ }
+
return DPL::Test::TestRunnerSingleton::Instance().ExecTestRunner(argc, argv);
}
*/
RUNNER_TEST(security_manager_01d_app_install_complicated_dir_tree)
{
- const std::string appId = "sm_test_01d_app_id_full";
- const std::string pkgId = "sm_test_01d_pkg_id_full";
+ AppInstallHelper app("sm_test_01d");
- const std::string rootDir = TzPlatformConfig::globalAppDir() + "/" + pkgId + "/";
+ const std::string rootDir = TzPlatformConfig::globalAppDir() + "/" + app.getPkgId() + "/";
const std::string privateDir = rootDir + "app_dir/";
const std::string privateRODir = rootDir + "app_dir_ro/";
const std::string publicRODir = rootDir + "app_dir_public_ro/";
RUNNER_ASSERT_MSG(result == 0, "Unable to clean Smack labels in " << rootDir);
InstallRequest requestInst;
- requestInst.setAppId(appId);
- requestInst.setPkgId(pkgId);
+ requestInst.setAppId(app.getAppId());
+ requestInst.setPkgId(app.getPkgId());
requestInst.addPath(privateDir, SECURITY_MANAGER_PATH_RW);
requestInst.addPath(privateRODir, SECURITY_MANAGER_PATH_RO);
requestInst.addPath(publicRODir, SECURITY_MANAGER_PATH_PUBLIC_RO);
Api::uninstall(*req);
});
- check_path(privateDir, generatePathRWLabel(pkgId));
- check_path(privateRODir, generatePathROLabel(pkgId), false);
- check_path(publicRODir, getPublicPathLabel());
- check_path(sharedRODir, getSharedROPathLabel());
+ check_path(privateDir, app.pathOwnerRWAccess());
+ check_path(privateRODir, app.pathOwnerROAccess(), false);
+ check_path(publicRODir, app.pathOwnerROOtherROAccess());
+ check_path(sharedRODir, app.pathOwnerRWOtherROAccess());
}
-RUNNER_CHILD_TEST(security_manager_02_app_install_uninstall_full)
+RUNNER_TEST(security_manager_02_app_install_uninstall_full)
{
const PrivilegeVector defaultPrivs = {
PRIV_INTERNAL_AUDIO,
ScopedAppLauncher launcher(app, [&]{ app.checkGroupPrivileges(defaultAllowedPrivs); });
}
- check_path(app.getPrivateDir(), generatePathRWLabel(app.getPkgId()));
- check_path(app.getPrivateRODir(), generatePathROLabel(app.getPkgId()), false);
- check_path(app.getPublicDir(), getPublicPathLabel());
- check_path(app.getSharedRODir(), getSharedROPathLabel());
+ check_path(app.getPrivateDir(), app.pathOwnerRWAccess());
+ check_path(app.getPrivateRODir(), app.pathOwnerROAccess(), false);
+ check_path(app.getPublicDir(), app.pathOwnerROOtherROAccess());
+ check_path(app.getSharedRODir(), app.pathOwnerRWOtherROAccess());
}
app.checkAfterUninstall();
RUNNER_TEST_GROUP_INIT(SECURITY_MANAGER_PATHS)
static void checkPaths(const AppInstallHelper &app, AppInstallHelper::RootType type) {
- check_path(app.getPrivateDir(0, type), generatePathRWLabel(app.getPkgId()));
- check_path(app.getPrivateRODir(0, type), generatePathROLabel(app.getPkgId()), false);
- check_path(app.getPublicDir(type), getPublicPathLabel());
+ check_path(app.getPrivateDir(0, type), app.pathOwnerRWAccess());
+ check_path(app.getPrivateRODir(0, type), app.pathOwnerROAccess(), false);
+ check_path(app.getPublicDir(type), app.pathOwnerROOtherROAccess());
}
RUNNER_TEST(security_manager_101_paths_global_extended)
ScopedInstaller install(app);
- check_path(app.getPrivateDir(0, AppInstallHelper::RootType::SKEL), generatePathRWLabel(app.getPkgId()));
+ check_path(app.getPrivateDir(0, AppInstallHelper::RootType::SKEL), app.pathOwnerRWAccess());
// Below doesn't work, because /etc/skel/apps_rw has transmute and label "User::Home", to which "System::Privileged" has a 't' access
//check_path(app.getPrivateRODir(0, AppInstallHelper::RootType::SKEL), generatePathROLabel(app.getPkgId()), false);
- check_path(app.getPublicDir(AppInstallHelper::RootType::SKEL), getPublicPathLabel());
+ check_path(app.getPublicDir(AppInstallHelper::RootType::SKEL), app.pathOwnerROOtherROAccess());
}
RUNNER_TEST(security_manager_104_paths_local_skel)
preq.addPath(app.getSharedRODir(), SECURITY_MANAGER_PATH_OWNER_RW_OTHER_RO);
Api::registerPaths(preq);
- check_path(app.getPrivateDir(), generatePathRWLabel(app.getPkgId()));
- check_path(app.getPrivateRODir(), generatePathROLabel(app.getPkgId()), false);
- check_path(app.getPublicDir(), getPublicPathLabel());
- check_path(app.getSharedRODir(), getSharedROPathLabel());
+ check_path(app.getPrivateDir(), app.pathOwnerRWAccess());
+ check_path(app.getPrivateRODir(), app.pathOwnerROAccess(), false);
+ check_path(app.getPublicDir(), app.pathOwnerROOtherROAccess());
+ check_path(app.getSharedRODir(), app.pathOwnerRWOtherROAccess());
}
RUNNER_TEST(security_manager_67_path_req_shared_ro_3_0)
preq.addPath(app.getSharedRODir(), SECURITY_MANAGER_PATH_OWNER_RW_OTHER_RO);
Api::registerPaths(preq);
- check_path(app.getSharedRODir(), getSharedROPathLabel());
+ check_path(app.getSharedRODir(), app.pathOwnerRWOtherROAccess());
}
RUNNER_TEST(security_manager_68_path_req_shared_ro_2_X)
preq.addPath(app.getSharedRODir(), SECURITY_MANAGER_PATH_OWNER_RW_OTHER_RO);
Api::registerPaths(preq);
- check_path(app.getSharedRODir(), getSharedROPathLabel());
+ check_path(app.getSharedRODir(), app.pathOwnerRWOtherROAccess());
}
RUNNER_TEST(security_manager_69_path_req_trusted_rw_no_author)
userInstall.uninstallApp();
- // no more apps with author id
- runSystemAccessTest(user.getUid(), user.getGid(), trustedPath, 0);
+ // on no-smack the acl rule will disappear after directory removal
+ if (smack_check()) {
+ // no more apps with author id
+ runSystemAccessTest(user.getUid(), user.getGid(), trustedPath, 0);
+ }
}
providerInstaller.uninstallApp();
- runSystemAccessTest(user.getUid(), user.getGid(), trustedPath, 0);
+ // on no-smack the acl rule will disappear after directory removal
+ if (smack_check())
+ runSystemAccessTest(user.getUid(), user.getGid(), trustedPath, 0);
}
RUNNER_CHILD_TEST(security_manager_46a_pkgId_deinstalation_test_hybrid)
projects / platform / core / test / security-tests.git / commitdiff