Add tests for security_manager_get_app_full_credentials_from_pid

Also fix security_manager_get_app_owner_uid

Change-Id: I2d55c7240fc8eeed73018a8b173df0e2ea555499

diff --git a/src/security-manager-tests/run-security-manager-no-smack-tests.sh b/src/security-manager-tests/run-security-manager-no-smack-tests.sh
index 2a65231816040fec7a83bb0b83c9d065b2d2e3a5..39a1b3c4c5f44ce44d25b6b007045b03afa36048 100755 (executable)
--- a/src/security-manager-tests/run-security-manager-no-smack-tests.sh
+++ b/src/security-manager-tests/run-security-manager-no-smack-tests.sh
@@ -100,6 +100,8 @@ required=(
        security_manager_26_1b_security_manager_get_app_owner_uid
        security_manager_26_2_security_manager_self_is_app
        security_manager_26_3_security_manager_is_app_from_pid
+       security_manager_26_4a_security_manager_get_app_full_credentials_from_pid
+       security_manager_26_4b_security_manager_get_app_full_credentials_from_pid
        nss_01_normal_user_without_inter_daemon_groups
        nss_02_guest_user_without_inter_daemon_groups
        nss_03_guest_user_without_inter_daemon_groups_unaffected_by_cynara

diff --git a/src/security-manager-tests/test_cases.cpp b/src/security-manager-tests/test_cases.cpp
index 68ce61bc46b4d7c18583ed9e40c6b30d2b402f84..f27fbc929c107b782d76807094d669dd56454426 100644 (file)
--- a/src/security-manager-tests/test_cases.cpp
+++ b/src/security-manager-tests/test_cases.cpp
@@ -1266,27 +1266,16 @@ RUNNER_CHILD_TEST(security_manager_26_1a_security_manager_get_app_owner_uid)
     } else {
         // child - the actual application
         RUNNER_ASSERT_MSG(setLauncherSecurityAttributes(testUser) == 0, "launcher failed");
+        auto expected = getuid();
         Api::prepareAppCandidate();
         Api::prepareApp(app.getAppId());
         uid_t owner_uid = 0;
         RUNNER_ASSERT_MSG(
             security_manager_get_app_owner_uid(getpid(), &owner_uid) == SECURITY_MANAGER_SUCCESS,
             "Invalid return from security_manager_get_app_owner_uid()");
-        // TODO - on smack-enabled image prepareApp call doesn't change UID as its inherited
-        // normally from launchpad. Calling setuid() will drop caps, that can be mitigated by
-        // prctl & libcap, but namespace setup fails in that case. Hence, for now, the test on
-        // smack-enabled image expects to return UID of the calling process that tests were executed
-        // with.
-        //
-        // This will be changed once we'll do completely black-box security tests that will actually
-        // install a real app.
-        if (smack_check()) {
-            RUNNER_ASSERT_MSG(owner_uid == getuid(), "Invalid uid returned - expected: "
-                              << getuid() << " returned: " << owner_uid);
-        } else {
-            RUNNER_ASSERT_MSG(owner_uid == testUser.getUid(), "Invalid uid returned - expected: "
-                              << testUser.getUid() << " returned: " << owner_uid);
-        }
+
+        RUNNER_ASSERT_MSG(owner_uid == expected, "Invalid uid returned - expected: "
+                          << expected << " returned: " << owner_uid);
         exit(0);
     }
 }
@@ -1400,3 +1389,62 @@ RUNNER_CHILD_TEST(security_manager_26_3_security_manager_is_app_from_pid)
     }
     app.checkAfterUninstall();
 }
+
+
+RUNNER_CHILD_TEST(security_manager_26_4a_security_manager_get_app_full_credentials_from_pid)
+{
+    TemporaryTestUser testUser("sm_test_26_4_user_name", GUM_USERTYPE_NORMAL);
+    testUser.create();
+    AppInstallHelperExt app("sm_test_26_4", "sm_test_26_4", testUser.getUid());
+    ScopedInstaller appInstall(app);
+    auto pid = runInChildParentWait([&]{
+        // child - the actual application
+        RUNNER_ASSERT_MSG(setLauncherSecurityAttributes(testUser) == 0, "launcher failed");
+        auto expected = getuid();
+        Api::prepareAppCandidate();
+        Api::prepareApp(app.getAppId());
+        uid_t owner_uid = 0;
+        char* pkgId = nullptr;
+        char* appId = nullptr;
+        RUNNER_ASSERT_MSG(
+            security_manager_get_app_full_credentials_from_pid(getpid(), &owner_uid, &pkgId, &appId) == SECURITY_MANAGER_SUCCESS,
+            "Invalid return from ecurity_manager_get_app_full_credentials_from_pid()");
+
+        RUNNER_ASSERT_MSG(owner_uid == expected, "Invalid uid returned - expected: "
+                          << expected << " returned: " << owner_uid);
+
+        RUNNER_ASSERT_MSG(app.getPkgId() == pkgId,  "Invalid pkgId returned from security_manager_get_app_full_credentials_from_pid");
+        RUNNER_ASSERT_MSG(appId == nullptr, "Invalid appId returned from security_manager_get_app_full_credentials_from_pid"); // non-hybrid app
+    });
+    Api::cleanupApp(app.getAppId(), testUser.getUid(), pid);
+}
+
+
+RUNNER_CHILD_TEST(security_manager_26_4b_security_manager_get_app_full_credentials_from_pid)
+{
+    TemporaryTestUser testUser("sm_test_26_4_user_name", GUM_USERTYPE_NORMAL);
+    testUser.create();
+    AppInstallHelperExt app("sm_test_26_4", "sm_test_26_4", testUser.getUid());
+    app.setHybrid();
+    ScopedInstaller appInstall(app);
+    auto pid = runInChildParentWait([&]{
+        // child - the actual application
+        RUNNER_ASSERT_MSG(setLauncherSecurityAttributes(testUser) == 0, "launcher failed");
+        auto expected = getuid();
+        Api::prepareAppCandidate();
+        Api::prepareApp(app.getAppId());
+        uid_t owner_uid = 0;
+        char* pkgId = nullptr;
+        char* appId = nullptr;
+        RUNNER_ASSERT_MSG(
+            security_manager_get_app_full_credentials_from_pid(getpid(), &owner_uid, &pkgId, &appId) == SECURITY_MANAGER_SUCCESS,
+            "Invalid return from ecurity_manager_get_app_full_credentials_from_pid()");
+
+        RUNNER_ASSERT_MSG(owner_uid == expected, "Invalid uid returned - expected: "
+                          << expected << " returned: " << owner_uid);
+
+        RUNNER_ASSERT_MSG(app.getPkgId() == pkgId,  "Invalid pkgId returned from security_manager_get_app_full_credentials_from_pid");
+        RUNNER_ASSERT_MSG(app.getAppId() == appId, "Invalid appId returned from security_manager_get_app_full_credentials_from_pid"); // hybrid app
+    });
+    Api::cleanupApp(app.getAppId(), testUser.getUid(), pid);
+}