security-manager-tests: prepare for security-manager integration with cynara

Security-manager will soon requires the caller to hold appropriate privilege.
Tests must always call security-manager APIs with Smack label which has
privilege.

This change makes sure that privileged operations from security-tests
are always called with proper Smack label.

It also adapts for the only part of security-manager that already checks
permission of the caller - privacy-manager APIs. The permissions
required for calling privacy-manager APIs have changed, so security-tests
must change them too.

Change-Id: Ib5e046dbf7fef8e8187b2f7f5700f236ef73bbda

diff --git a/packaging/security-tests.manifest b/packaging/security-tests.manifest
index c3df657..5829dad 100644 (file)
--- a/packaging/security-tests.manifest
+++ b/packaging/security-tests.manifest
@@ -7,7 +7,7 @@
         <filesystem path="/usr/bin/test-performance-check.sh" exec_label="_" />
 
         <filesystem path="/usr/bin/libsmack-test" exec_label="_" />
-        <filesystem path="/usr/bin/security-manager-tests" exec_label="_" />
+        <filesystem path="/usr/bin/security-manager-tests" exec_label="User" />
         <filesystem path="/usr/bin/cynara-tests" exec_label="_" />
         <filesystem path="/usr/bin/ckm-tests" exec_label="User" />
         <filesystem path="/usr/bin/ckm-tests" exec_label="System" />

diff --git a/src/security-manager-tests/security_manager_tests.cpp b/src/security-manager-tests/security_manager_tests.cpp
index a878baf..ea82655 100644 (file)
--- a/src/security-manager-tests/security_manager_tests.cpp
+++ b/src/security-manager-tests/security_manager_tests.cpp
@@ -105,8 +105,8 @@ static const std::string LINK_PREFIX("link_to_");
 
 static const std::string PRIVILEGE_MANAGER_APP = "privilege_manager";
 static const std::string PRIVILEGE_MANAGER_PKG = "privilege_manager";
-static const std::string PRIVILEGE_MANAGER_SELF_PRIVILEGE = "http://tizen.org/privilege/systemsettings";
-static const std::string PRIVILEGE_MANAGER_ADMIN_PRIVILEGE = "http://tizen.org/privilege/systemsettings.admin";
+static const std::string PRIVILEGE_MANAGER_SELF_PRIVILEGE = "http://tizen.org/privilege/notexist";
+static const std::string PRIVILEGE_MANAGER_ADMIN_PRIVILEGE = "http://tizen.org/privilege/internal/usermanagement";
 
 static const std::vector<std::string> MANY_APPS = {
     "security_manager_10_app_1",
@@ -157,6 +157,21 @@ static const std::vector<privileges_t> MANY_APPS_PRIVILEGES = {
     }
 };
 
+class ScopedProcessLabel {
+public:
+    ScopedProcessLabel() {
+        smack_new_label_from_self(&label);
+    }
+
+    ~ScopedProcessLabel() {
+        smack_set_label_for_self(label);
+        free(label);
+    }
+
+private:
+    char *label;
+};
+
 static std::string generateAppLabel(const std::string &appId)
 {
     return "User::App::" + appId;
@@ -724,33 +739,36 @@ RUNNER_CHILD_TEST_SMACK(security_manager_03_set_label_from_appid)
     RUNNER_ASSERT_ERRNO_MSG(result == 0,
         "Can't set socket label. Result: " << result);
 
-    Api::setProcessLabel(app_id);
-
-    result = smack_new_label_from_file(*sockPtr, XATTR_NAME_SMACKIPIN, &label);
-    RUNNER_ASSERT_ERRNO_MSG(result != -1, "smack_new_label_from_file failed: " << label);
-    labelPtr.reset(label);
-    result = expected_label.compare(label);
-    RUNNER_ASSERT_MSG(result == 0, "Socket label is incorrect. Expected: " <<
-        expected_label << " Actual: " << label);
-
-    result = smack_new_label_from_file(*sockPtr, XATTR_NAME_SMACKIPOUT, &label);
-    RUNNER_ASSERT_ERRNO_MSG(result != -1, "smack_new_label_from_file failed: " << label);
-    labelPtr.reset(label);
-    result = expected_label.compare(label);
-    RUNNER_ASSERT_MSG(result == 0, "Socket label is incorrect. Expected: " <<
-        expected_label << " Actual: " << label);
-
-    result = smack_new_label_from_self(&label);
-    RUNNER_ASSERT_MSG(result >= 0,
-            " Error getting current process label");
-    RUNNER_ASSERT_MSG(label != nullptr,
-            " Process label is not set");
-    labelPtr.reset(label);
-
-    result = expected_label.compare(label);
-    RUNNER_ASSERT_MSG(result == 0,
-            " Process label is incorrect. Expected: \"" << expected_label <<
-            "\" Actual: \"" << label << "\"");
+    {
+        ScopedProcessLabel keepLabel;
+        Api::setProcessLabel(app_id);
+
+        result = smack_new_label_from_file(*sockPtr, XATTR_NAME_SMACKIPIN, &label);
+        RUNNER_ASSERT_ERRNO_MSG(result != -1, "smack_new_label_from_file failed: " << label);
+        labelPtr.reset(label);
+        result = expected_label.compare(label);
+        RUNNER_ASSERT_MSG(result == 0, "Socket label is incorrect. Expected: " <<
+            expected_label << " Actual: " << label);
+
+        result = smack_new_label_from_file(*sockPtr, XATTR_NAME_SMACKIPOUT, &label);
+        RUNNER_ASSERT_ERRNO_MSG(result != -1, "smack_new_label_from_file failed: " << label);
+        labelPtr.reset(label);
+        result = expected_label.compare(label);
+        RUNNER_ASSERT_MSG(result == 0, "Socket label is incorrect. Expected: " <<
+            expected_label << " Actual: " << label);
+
+        result = smack_new_label_from_self(&label);
+        RUNNER_ASSERT_MSG(result >= 0,
+                " Error getting current process label");
+        RUNNER_ASSERT_MSG(label != nullptr,
+                " Process label is not set");
+        labelPtr.reset(label);
+
+        result = expected_label.compare(label);
+        RUNNER_ASSERT_MSG(result == 0,
+                " Process label is incorrect. Expected: \"" << expected_label <<
+                "\" Actual: \"" << label << "\"");
+    }
 
     uninstall_app(app_id, pkg_id, true);
 }
@@ -763,7 +781,10 @@ RUNNER_CHILD_TEST_NOSMACK(security_manager_03_set_label_from_appid_nosmack)
     uninstall_app(app_id, pkg_id, true);
     install_app(app_id, pkg_id);
 
-    Api::setProcessLabel(app_id);
+    {
+        ScopedProcessLabel keepLabel;
+        Api::setProcessLabel(app_id);
+    }
 
     uninstall_app(app_id, pkg_id, true);
 }
@@ -1742,6 +1763,7 @@ RUNNER_MULTIPROCESS_TEST(security_manager_15_privacy_manager_send_policy_update_
     const std::string username("sm_test_15_username");
     PolicyRequest addPolicyRequest;
     CynaraTestAdmin::Admin admin;
+    ScopedProcessLabel keepLabel;
 
     struct message {
         uid_t uid;
@@ -1810,6 +1832,7 @@ RUNNER_MULTIPROCESS_TEST(security_manager_15_privacy_manager_send_policy_update_
     const std::string username("sm_test_15_username");
     PolicyRequest addPolicyRequest;
     CynaraTestAdmin::Admin admin;
+    ScopedProcessLabel keepLabel;
 
     struct message {
         uid_t uid;
@@ -1879,6 +1902,7 @@ RUNNER_MULTIPROCESS_TEST(security_manager_15_privacy_manager_send_policy_update_
     const std::string username("sm_test_15_username");
     PolicyRequest addPolicyRequest;
     CynaraTestAdmin::Admin admin;
+    ScopedProcessLabel keepLabel;
 
     struct message {
         uid_t uid;
@@ -2031,6 +2055,7 @@ RUNNER_MULTIPROCESS_TEST(security_manager_17_privacy_manager_delete_policy_for_s
     int pipefd2[2];
     pid_t pid;
     int result = 0;
+    ScopedProcessLabel keepLabel;
 
     RUNNER_ASSERT_MSG((pipe(pipefd) != -1),"pipe failed");
     RUNNER_ASSERT_MSG((pipe(pipefd2) != -1),"second pipe failed");
@@ -2140,6 +2165,7 @@ RUNNER_MULTIPROCESS_TEST(security_manager_17_privacy_manager_fetch_whole_policy_
     int pipefd[2];
     pid_t pid;
     int result = 0;
+    ScopedProcessLabel keepLabel;
 
     RUNNER_ASSERT_MSG((pipe(pipefd) != -1),"pipe failed");
 
@@ -2155,10 +2181,6 @@ RUNNER_MULTIPROCESS_TEST(security_manager_17_privacy_manager_fetch_whole_policy_
 
         unsigned int privileges_count = 0;
 
-        register_current_process_as_privilege_manager(user.getUid(), false);
-        //the above call, registers 1 new privilege for the given user, hence the incrementation of below variable
-        ++privileges_count;
-
         for(unsigned int i = 0; i < MANY_APPS.size(); ++i) {
             InstallRequest requestInst;
             requestInst.setAppId(MANY_APPS[i].c_str());
@@ -2173,6 +2195,10 @@ RUNNER_MULTIPROCESS_TEST(security_manager_17_privacy_manager_fetch_whole_policy_
             privileges_count += MANY_APPS_PRIVILEGES.at(i).size();
         };
 
+        register_current_process_as_privilege_manager(user.getUid(), false);
+        //the above call, registers 1 new privilege for the given user, hence the incrementation of below variable
+        ++privileges_count;
+
         //send info to child
         msg.uid = user.getUid();
         msg.gid = user.getGid();
@@ -2351,8 +2377,8 @@ RUNNER_MULTIPROCESS_TEST(security_manager_21_security_manager_admin_deny_user_pr
     } msg;
 
     privileges_t admin_required_privs = {
-            "http://tizen.org/privilege/systemsettings.admin",
-            "http://tizen.org/privilege/systemsettings"};
+            PRIVILEGE_MANAGER_SELF_PRIVILEGE,
+            PRIVILEGE_MANAGER_ADMIN_PRIVILEGE};
     privileges_t manifest_privs = {
             "http://tizen.org/privilege/internet",
             "http://tizen.org/privilege/camera"};