Adjust some of security-manager tests for no-smack environment

Change-Id: If031bb68e36ee8ad2df0eb00e32637fc78d11f01

diff --git a/src/common/app_context.cpp b/src/common/app_context.cpp
index 0a42fe7590446fe87c9f8168823497f9ea6e25c1..c002a46c578b18ccafb351af2053b97727f49ebe 100644 (file)
--- a/src/common/app_context.cpp
+++ b/src/common/app_context.cpp
@@ -81,8 +81,10 @@ void AppContext::applyUserSwitchEffective(uid_t user, gid_t group)
 
 void AppContext::revokeAccessToAll()
 {
+#if SMACK_ENABLED
     RUNNER_ASSERT_MSG(0 == smack_revoke_subject(m_label.c_str()),
         "Error in smack_revoke_subject(" << m_label << ")");
+#endif
 }
 
 void AppContext::revokeRules()

diff --git a/src/common/app_install_helper.cpp b/src/common/app_install_helper.cpp
index cbc6a8d2d892583d9150877ce12e96e0b483399f..2b8761470528c00d012c3eacec45cac6b2bb1051 100644 (file)
--- a/src/common/app_install_helper.cpp
+++ b/src/common/app_install_helper.cpp
@@ -17,6 +17,7 @@
 #include <fcntl.h>
 #include <map>
 #include <string>
+#include <sys/mman.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <sys/smack.h>
@@ -26,6 +27,7 @@
 #include <security-manager-types.h>
 
 #include <dpl/test/test_runner.h>
+#include <sm_api.h>
 #include <tzplatform.h>
 #include <label_generator.h>
 #include <tests_common.h>
@@ -304,11 +306,45 @@ const PrivilegeVector& AppInstallHelper::getAppDefinedPrivileges() const {
 }
 
 void AppInstallHelper::revokeRules() const {
+#if SMACK_ENABLED
     RUNNER_ASSERT_MSG(
         0 == smack_revoke_subject(generateAppLabel().c_str()),
         "Revoking smack subject failed");
+#endif
 }
 
+#ifndef SMACK_ENABLED
+uid_t AppInstallHelper::getPUID() const {
+    if (m_puid)
+        return *m_puid;
+
+    static constexpr auto MMAP_SIZE = sizeof(uid_t);
+    auto deleter = [&](void* addr) {
+        RUNNER_ASSERT_ERRNO_MSG(munmap(addr, MMAP_SIZE) == 0, "munmap() failed");
+    };
+    auto shmem = std::unique_ptr<void, decltype(deleter)>{mmap(nullptr, sizeof(uid_t),
+                                                               PROT_READ | PROT_WRITE,
+                                                               MAP_SHARED | MAP_ANONYMOUS, -1, 0),
+                                                          std::move(deleter)};
+    RUNNER_ASSERT_ERRNO_MSG(shmem.get(), "mmap() failed");
+    pid_t pid = fork();
+    RUNNER_ASSERT_MSG(pid >= 0, "Fork failed");
+    if (pid == 0) {
+        SecurityManagerTest::Api::prepareAppCandidate();
+        SecurityManagerTest::Api::prepareApp(m_appName);
+        uid_t uid = getuid();
+        std::memcpy(shmem.get(), &uid, sizeof(uid));
+        _exit(0);
+    }
+    waitPid(pid);
+    SecurityManagerTest::Api::cleanupApp(m_appName, geteuid(), pid);
+    uid_t uid;
+    std::memcpy(&uid, shmem.get(), sizeof(uid));
+    m_puid = uid;
+    return uid;
+}
+#endif
+
 std::string AppInstallHelper::generateAppLabel() const {
     return generateProcessLabel(getAppId(), getPkgId(), getIsHybrid());
 }

diff --git a/src/common/app_install_helper.h b/src/common/app_install_helper.h
index cc59bc9ab818a094b7d07202c78944d0bb889213..4293523c37d57c5970ca3d5149b1d9788b7ef48f 100644 (file)
--- a/src/common/app_install_helper.h
+++ b/src/common/app_install_helper.h
@@ -21,6 +21,7 @@
 #include <unistd.h>
 
 #include <map>
+#include <optional>
 #include <string>
 #include <utility>
 #include <vector>
@@ -146,6 +147,14 @@ struct AppInstallHelper {
             removePaths();
     }
 
+#ifndef SMACK_ENABLED
+private:
+    mutable std::optional<uid_t> m_puid;
+
+public:
+    uid_t getPUID() const;
+#endif
+
 protected:
     struct RootInfo {
         RootInfo() : isCreated(false) {}

diff --git a/src/common/fs_label_manager.cpp b/src/common/fs_label_manager.cpp
index 9a4cda5f9762f0e798208cb6ae8de373ab47e028..aee1a14e837db9f0974c2396e204d37a547a9e10 100644 (file)
--- a/src/common/fs_label_manager.cpp
+++ b/src/common/fs_label_manager.cpp
@@ -15,6 +15,7 @@
 
 namespace
 {
+#if SMACK_ENABLED
 static const char* get_xattr_name(enum smack_label_type type)
 {
     switch (type) {
@@ -35,6 +36,7 @@ static const char* get_xattr_name(enum smack_label_type type)
             return nullptr;
     }
 }
+#endif
 }
 
 FsLabelManager::FsLabelManager(const std::string &path, const std::string &label)
@@ -96,18 +98,25 @@ void FsLabelManager::testSmackSetLabel(const std::string &relativePath,
                                        const char *label,
                                        enum smack_label_type labelType)
 {
+#if SMACK_ENABLED
     std::string path = m_path + relativePath;
 
     int ret = smack_setlabel(path.c_str(), label, labelType);
     RUNNER_ASSERT_MSG(ret == 0, "Error in normal setting label " << label);
 
     checkLabel(path, label, labelType);
+#else
+    (void)relativePath;
+    (void)label;
+    (void)labelType;
+#endif
 }
 
 void FsLabelManager::testSmackGetLabel(const std::string &relativePath,
                                        const char *label,
                                        enum smack_label_type labelType)
 {
+#if SMACK_ENABLED
     std::string path = m_path + relativePath;
 
     char *tmpLabel;
@@ -124,6 +133,11 @@ void FsLabelManager::testSmackGetLabel(const std::string &relativePath,
     RUNNER_ASSERT_MSG(ret == 0, "Wrong label. " << tmpLabel << " != " << label);
 
     checkLabel(path, tmpLabel, labelType);
+#else
+    (void)relativePath;
+    (void)label;
+    (void)labelType;
+#endif
 }
 
 void FsLabelManager::testSmackClearLabels(const std::string &relativePath)
@@ -138,6 +152,7 @@ void FsLabelManager::checkLabel(const std::string &path,
                                 const char *label,
                                 enum smack_label_type labelType)
 {
+#if SMACK_ENABLED
     char buf[SMACK_LABEL_LEN+2] = { 0, };
     int ret = getxattr(path.c_str(), get_xattr_name(labelType), buf, SMACK_LABEL_LEN+1);
     RUNNER_ASSERT_ERRNO_MSG(ret > 0, "Error in getting xattr");
@@ -150,12 +165,18 @@ void FsLabelManager::checkLabel(const std::string &path,
 
     ret = strncmp(tmpLabel, buf, SMACK_LABEL_LEN+1);
     RUNNER_ASSERT_MSG(ret == 0, "Wrong label. " << tmpLabel << " != " << buf);
+#else
+    (void)path;
+    (void)label;
+    (void)labelType;
+#endif
 }
 
 void FsLabelManager::checkLinkLabel(const std::string &path,
                                     const char *label,
                                     enum smack_label_type labelType)
 {
+#if SMACK_ENABLED
     char buf[SMACK_LABEL_LEN+2] = { 0, };
     int ret = lgetxattr(path.c_str(), get_xattr_name(labelType), buf, SMACK_LABEL_LEN+1);
     RUNNER_ASSERT_ERRNO_MSG(ret > 0, "Error in getting xattr");
@@ -168,4 +189,9 @@ void FsLabelManager::checkLinkLabel(const std::string &path,
 
     ret = strncmp(tmpLabel, buf, SMACK_LABEL_LEN+1);
     RUNNER_ASSERT_MSG(ret == 0, "Wrong label. " << tmpLabel << " != " << buf);
+#else
+    (void)path;
+    (void)label;
+    (void)labelType;
+#endif
 }

diff --git a/src/common/label_generator.cpp b/src/common/label_generator.cpp
index adf1eddb1544de3a7753314451325dceded4b7f2..fe492f1891a66be6dedb3bfd42a20e448b545a8f 100644 (file)
--- a/src/common/label_generator.cpp
+++ b/src/common/label_generator.cpp
@@ -17,8 +17,6 @@
 #include <tests_common.h>
 #include <label_generator.h>
 
-constexpr inline char NO_SMACK_LABEL[] = "User::Pkg::default_app_no_Smack_mode";
-
 // Common implementation details
 std::string generateProcessLabel(const std::string &appId, const std::string &pkgId, bool isHybrid)
 {

diff --git a/src/common/label_generator.h b/src/common/label_generator.h
index b4af2913af50cd455849b78efbd592dfb1913b8a..6274a235a13be699902ce53a04077807f084f574 100644 (file)
--- a/src/common/label_generator.h
+++ b/src/common/label_generator.h
@@ -17,6 +17,8 @@
 #include <string>
 #include <sys/types.h>
 
+constexpr inline char NO_SMACK_LABEL[] = "User::Pkg::default_app_no_Smack_mode";
+
 std::string generateProcessLabel(const std::string &appId, const std::string &pkgId, bool isHybrid = false);
 std::string generatePathRWLabel(const std::string &pkgId);
 std::string generatePathROLabel(const std::string &pkgId);

diff --git a/src/common/scoped_process_label.cpp b/src/common/scoped_process_label.cpp
index b7e450ca413af3aba4bda6f0c5a4bf42748924ae..81c69d551ee63826e587ceed04d82ac5467cbdaa 100644 (file)
--- a/src/common/scoped_process_label.cpp
+++ b/src/common/scoped_process_label.cpp
@@ -33,10 +33,10 @@
 
 namespace {
 
+#if SMACK_ENABLED
 const std::string& getOnlycapPath()
 {
        static std::string onlycapPath;
-
        if (onlycapPath.empty()) {
                const char* smackfs = smack_smackfs_path();
                if (smackfs != nullptr) {
@@ -47,10 +47,10 @@ const std::string& getOnlycapPath()
        return onlycapPath;
 }
 
-const char* SEPARATORS = " ";
 
 OnlycapSet smackGetOnlycap()
 {
+       static constexpr char SEPARATORS[] = " ";
        std::ifstream ifs(getOnlycapPath());
 
        RUNNER_ASSERT_MSG(ifs, "Opening " << getOnlycapPath() << " failed.");
@@ -75,9 +75,11 @@ OnlycapSet smackGetOnlycap()
        }
        return onlycapSet;
 }
+#endif
 
 void smackSetOnlycap(const OnlycapSet& onlycapSet)
 {
+#if SMACK_ENABLED
        if (onlycapSet.empty()) {
                int ret = smack_set_onlycap(NULL, 0);
                RUNNER_ASSERT_MSG(ret == 0, "Error in smack_set_onlycap():" << ret);
@@ -93,12 +95,19 @@ void smackSetOnlycap(const OnlycapSet& onlycapSet)
 
        int ret = smack_set_onlycap(labels, i);
        RUNNER_ASSERT_MSG(ret == 0, "Error in smack_set_onlycap():" << ret);
+#else
+       (void)onlycapSet;
+#endif
 }
 
 void smackSetLabelForSelf(const std::string& label)
 {
+#if SMACK_ENABLED
        int ret = smack_set_label_for_self(label.c_str());
        RUNNER_ASSERT_MSG(ret == 0, "Error in smack_set_label_for_self('" << label << "'): " << ret);
+#else
+       (void)label;
+#endif
 }
 
 } // namespace anonymous
@@ -106,6 +115,7 @@ void smackSetLabelForSelf(const std::string& label)
 ScopedProcessLabel::ScopedProcessLabel(std::string label, bool restore) :
                m_label(std::move(label))
 {
+#if SMACK_ENABLED
        if (restore) {
                // store the current process label
                char* originalLabel = NULL;
@@ -129,6 +139,9 @@ ScopedProcessLabel::ScopedProcessLabel(std::string label, bool restore) :
                }
        }
        smackSetLabelForSelf(m_label);
+#else
+       (void)restore;
+#endif
 }
 
 ScopedProcessLabel::ScopedProcessLabel(ScopedProcessLabel&& other)

diff --git a/src/common/smack_access.cpp b/src/common/smack_access.cpp
index e461a312745a0361c16bec2a0721d11cbe04c4ed..98123576c1c068e01b6b37c7c4345fc5eb26f58f 100644 (file)
--- a/src/common/smack_access.cpp
+++ b/src/common/smack_access.cpp
@@ -29,8 +29,10 @@
 SmackAccess::SmackAccess()
   : m_handle(nullptr)
 {
+#if SMACK_ENABLED
     RUNNER_ASSERT_MSG(0 == smack_accesses_new(&m_handle),
         "Error in smack_accesses_new");
+#endif
 }
 
 void SmackAccess::add(
@@ -38,25 +40,37 @@ void SmackAccess::add(
     const std::string &object,
     const std::string &rights)
 {
+#if SMACK_ENABLED
     RUNNER_ASSERT_MSG(0 == smack_accesses_add(m_handle,
             subject.c_str(),
             object.c_str(),
             rights.c_str()),
         "Error in smack_accesses_add.");
+#else
+    (void)subject;
+    (void)object;
+    (void)rights;
+#endif
 }
 
 void SmackAccess::apply() {
+#if SMACK_ENABLED
     RUNNER_ASSERT_MSG(0 == smack_accesses_apply(m_handle),
         "Error in smack_accessses_apply.");
+#endif
 }
 
 void SmackAccess::clear() {
+#if SMACK_ENABLED
     RUNNER_ASSERT_MSG(0 == smack_accesses_clear(m_handle),
         "Error in smack_accesses_clear.");
+#endif
 }
 
 SmackAccess::~SmackAccess() {
+#if SMACK_ENABLED
     if (m_handle)
         smack_accesses_free(m_handle);
+#endif
 }
 

diff --git a/src/security-manager-tests/common/app_install_helper_ext.cpp b/src/security-manager-tests/common/app_install_helper_ext.cpp
index 36c3e738b04c84d6c0fec33f89dbe9853b4d7822..c6e2c4ba93703dba857ab8ccee2088ff62f293c4 100644 (file)
--- a/src/security-manager-tests/common/app_install_helper_ext.cpp
+++ b/src/security-manager-tests/common/app_install_helper_ext.cpp
@@ -45,6 +45,7 @@ void assertNoLabelInRule(const AccessRequest &rule, const std::string &label)
                       " access: " << rule.access);
 }
 
+
 #ifdef SMACK_ENABLED
 std::string accessOpposite(std::string &access)
 {
@@ -95,7 +96,11 @@ void AppInstallHelperExt::checkPrivileges(const PrivilegeVector &allowedPrivs,
                                           const PrivilegeVector &deniedPrivs) const
 {
     /* Privileges should be granted to all users if root installs app */
+#if SMACK_ENABLED
     auto user = (m_uidGid == 0 ? ANY_USER_REPRESENTATION : std::to_string(m_uidGid));
+#else
+    auto user = std::to_string(getPUID());
+#endif
 
     std::string smackLabel = generateProcessLabel(m_appName, m_pkgName, m_isHybrid);
 

diff --git a/src/security-manager-tests/common/sm_commons.cpp b/src/security-manager-tests/common/sm_commons.cpp
index 1a636e4615ca0c279914122fa87195d49278db60..af5ffae4be78188105f762a6f14d8da88727078b 100644 (file)
--- a/src/security-manager-tests/common/sm_commons.cpp
+++ b/src/security-manager-tests/common/sm_commons.cpp
@@ -58,6 +58,7 @@ bool nftw_expected_exec;
 static int nftw_check_sm_labels_app_dir(const char *fpath, const struct stat *sb,
                               const char* correctLabel, bool transmute_test, bool exec_test)
 {
+#if SMACK_ENABLED
     int result;
     CStringPtr labelPtr;
     char* label = nullptr;
@@ -97,7 +98,13 @@ static int nftw_check_sm_labels_app_dir(const char *fpath, const struct stat *sb
     } else {
         RUNNER_ASSERT_MSG(label == nullptr, "TRANSMUTE label on " << fpath << " is set");
     }
-
+#else
+    (void)fpath;
+    (void)sb;
+    (void)correctLabel;
+    (void)transmute_test;
+    (void)exec_test;
+#endif
     return 0;
 }
 
@@ -111,9 +118,13 @@ static int nftw_check_sm_labels(const char *fpath, const struct stat *sb,
 int nftw_remove_labels(const char *fpath, const struct stat* /*sb*/,
                        int /*typeflag*/, struct FTW* /*ftwbuf*/)
 {
+#if SMACK_ENABLED
     smack_lsetlabel(fpath, nullptr, SMACK_LABEL_ACCESS);
     smack_lsetlabel(fpath, nullptr, SMACK_LABEL_EXEC);
     smack_lsetlabel(fpath, nullptr, SMACK_LABEL_TRANSMUTE);
+#else
+    (void)fpath;
+#endif
 
     return 0;
 }

diff --git a/src/security-manager-tests/test_cases.cpp b/src/security-manager-tests/test_cases.cpp
index 2cac54932edc5cf8e20dbe4d0b64a274082088d0..8e47434eabec0ae85ec70dd24fb57b58e9138678 100644 (file)
--- a/src/security-manager-tests/test_cases.cpp
+++ b/src/security-manager-tests/test_cases.cpp
@@ -203,6 +203,7 @@ RUNNER_CHILD_TEST(security_manager_02a_set_process_groups)
     app.checkAfterUninstall();
 }
 
+#if SMACK_ENABLED
 RUNNER_CHILD_TEST_SMACK(security_manager_03_set_label_from_appid)
 {
     std::string expectedSockLabel = "labelExpectedOnlyFromSocket";
@@ -260,6 +261,7 @@ RUNNER_CHILD_TEST_SMACK(security_manager_03_set_label_from_appid)
         waitPid(pid);
     }
 }
+#endif
 
 RUNNER_CHILD_TEST(security_manager_04a_app_install_uninstall_by_app_user_for_self)
 {
@@ -615,6 +617,8 @@ RUNNER_TEST(security_manager_09d_uninstall_app_from_hybrid_package)
 
     {
         ScopedInstaller appsInstall(appIds, apps[0].getPkgId());
+        for (const auto& app : apps)
+            app.checkAfterInstall();
 
         InstallRequest updateRequest;
         updateRequest.setPkgId(apps[0].getPkgId());

diff --git a/src/security-manager-tests/test_cases_dyntransition.cpp b/src/security-manager-tests/test_cases_dyntransition.cpp
index 3c8c607b9b5e9073f51eb26738aa6dc9b95d7834..81f8c4c1b1846882717dd4898ed0f6be380bc404 100644 (file)
--- a/src/security-manager-tests/test_cases_dyntransition.cpp
+++ b/src/security-manager-tests/test_cases_dyntransition.cpp
@@ -44,6 +44,7 @@ struct UidGidMsg {
 static void testSetLabelForSelf(const std::string &appName, const std::string &pkgName,
                                 bool expected_success)
 {
+#if SMACK_ENABLED
     //FIXME : replace this with SM API
     std::string label =  generateProcessLabel(appName, pkgName);
     int result = smack_set_label_for_self(label.c_str());
@@ -53,6 +54,11 @@ static void testSetLabelForSelf(const std::string &appName, const std::string &p
     else
         RUNNER_ASSERT_MSG(result != 0, "smack_set_label_for_self(" << label <<
                 ") wrongly succeeded");
+#else
+    (void)appName;
+    (void)pkgName;
+    (void)expected_success;
+#endif
 }
 
 RUNNER_TEST_GROUP_INIT(SECURITY_MANAGER_LABEL_MONITOR_API)

diff --git a/src/security-manager-tests/test_cases_shm.cpp b/src/security-manager-tests/test_cases_shm.cpp
index 003508572743ab22888ec428980f7c5305c6904f..fb747b873c35c869a93496bd4c387045b2dbf8d8 100644 (file)
--- a/src/security-manager-tests/test_cases_shm.cpp
+++ b/src/security-manager-tests/test_cases_shm.cpp
@@ -43,7 +43,6 @@ RUNNER_TEST(shm01_create_file)
     const char *shmName = "shm01_testName";
     auto exLabel = app.generateAppLabel();
     ScopedInstaller req(app);
-    char *label = NULL;
 
     // clean up environment
     shm_unlink(shmName);
@@ -52,6 +51,8 @@ RUNNER_TEST(shm01_create_file)
     RUNNER_ASSERT_ERRNO_MSG(fd >= 0, "security_manager_shm_open failed");
     FdUniquePtr file(&fd);
 
+#if SMACK_ENABLED
+    char *label = NULL;
     ssize_t len = smack_new_label_from_file(fd, XATTR_NAME_SMACK, &label);
     RUNNER_ASSERT_MSG(len > 0, "");
 
@@ -59,6 +60,7 @@ RUNNER_TEST(shm01_create_file)
 
     RUNNER_ASSERT_MSG(exLabel == label, "Wrong label. Expected: " << exLabel
         << " Found: " << label);
+#endif
 
     int ret = shm_unlink(shmName);
     RUNNER_ASSERT_ERRNO_MSG(0 == ret, "shm_unlink failed");
@@ -71,7 +73,6 @@ RUNNER_TEST(shm02_double_open)
     const char *shmName = "shm02_testName";
     auto exLabel = app.generateAppLabel();
     ScopedInstaller req(app);
-    char *label = NULL;
 
     // clean up environment
     shm_unlink(shmName);
@@ -80,6 +81,8 @@ RUNNER_TEST(shm02_double_open)
     RUNNER_ASSERT_ERRNO_MSG(fd1 >= 0, "security_manager_shm_open failed");
     FdUniquePtr file1(&fd1);
 
+#if SMACK_ENABLED
+    char *label = NULL;
     ssize_t len = smack_new_label_from_file(fd1, XATTR_NAME_SMACK, &label);
     RUNNER_ASSERT_MSG(len > 0, "");
 
@@ -87,6 +90,7 @@ RUNNER_TEST(shm02_double_open)
 
     RUNNER_ASSERT_MSG(exLabel == label, "Wrong label. Expected: " << exLabel
         << " Found: " << label);
+#endif
 
     int fd2 = security_manager_shm_open(shmName, O_CREAT | O_RDWR, 0666, app.getAppId().c_str());
     RUNNER_ASSERT_ERRNO_MSG(fd2 >= 0, "security_manager_shm_open failed");
@@ -111,12 +115,13 @@ RUNNER_TEST(shm03_double_share)
     // clean up environment
     shm_unlink(shmName);
 
-    char *label = NULL;
 
     int fd1 = security_manager_shm_open(shmName, O_CREAT | O_RDWR, 0666, appa.getAppId().c_str());
     RUNNER_ASSERT_ERRNO_MSG(fd1 >= 0, "security_manager_shm_open failed");
     FdUniquePtr file1(&fd1);
 
+#if SMACK_ENABLED
+    char *label = NULL;
     ssize_t len = smack_new_label_from_file(fd1, XATTR_NAME_SMACK, &label);
     RUNNER_ASSERT_MSG(len > 0, "");
 
@@ -124,6 +129,7 @@ RUNNER_TEST(shm03_double_share)
 
     RUNNER_ASSERT_MSG(exLabel == label, "Wrong label. Expected: " << exLabel
         << " Found: " << label);
+#endif
 
     int fd2 = security_manager_shm_open(shmName, O_CREAT | O_RDWR, 0666, appb.getAppId().c_str());
     int err = errno;