Add privileged tests for REMOVE only permission

Check if ckmc_get_data_alias_info_list and
ckmc_get_data_alias_list return info for READ only
and REMOVE only permission

Change-Id: Iac50c1e0c23560c88eb3d5c74ec4c450a52d3a50

diff --git a/src/ckm/ckm-common.cpp b/src/ckm/ckm-common.cpp
index 213ea286fa6093d75fc705b2763b6af2fbf17c08..3380e9f6849eb682a45b5107f5a06f1e241f2a72 100644 (file)
--- a/src/ckm/ckm-common.cpp
+++ b/src/ckm/ckm-common.cpp
@@ -483,38 +483,55 @@ void check_alias_info_list(const InfoVector& expected)
 size_t count_aliases(alias_type_ type, size_t minimum_initial_element_count)
 {
     ckmc_alias_list_s *aliasList = NULL;
-    int ec;
+    ckmc_alias_info_list_s *aliasInfoList = NULL;
+
+    int errorCodeAliasList, errorCodeAliasInfoList;
+
     switch(type)
     {
         case ALIAS_KEY:
-            ec = ckmc_get_key_alias_list(&aliasList);
+            errorCodeAliasList = ckmc_get_key_alias_list(&aliasList);
+            errorCodeAliasInfoList = ckmc_get_key_alias_info_list(&aliasInfoList);
             break;
 
         case ALIAS_CERT:
-            ec = ckmc_get_cert_alias_list(&aliasList);
+            errorCodeAliasList = ckmc_get_cert_alias_list(&aliasList);
+            errorCodeAliasInfoList = ckmc_get_cert_alias_info_list(&aliasInfoList);
             break;
 
         case ALIAS_DATA:
-            ec = ckmc_get_data_alias_list(&aliasList);
+            errorCodeAliasList = ckmc_get_data_alias_list(&aliasList);
+            errorCodeAliasInfoList = ckmc_get_data_alias_info_list(&aliasInfoList);
             break;
         default:
             RUNNER_ASSERT_MSG(false, "Unsupported value ALIAS_KEY == " << (int)type);
     }
 
-    if(ec == CKMC_ERROR_DB_ALIAS_UNKNOWN)
+    RUNNER_ASSERT_MSG(errorCodeAliasList == errorCodeAliasInfoList,
+                      "Error codes are not equal: " << CKMCErrorToString(errorCodeAliasList)
+                      << " != " << CKMCErrorToString(errorCodeAliasInfoList));
+
+    if(errorCodeAliasList == CKMC_ERROR_DB_ALIAS_UNKNOWN)
         return 0;
 
-    RUNNER_ASSERT_MSG(ec == CKMC_ERROR_NONE,
-                      "Error: alias list failed, ec: " << CKMCErrorToString(ec));
+    RUNNER_ASSERT_MSG(errorCodeAliasList == CKMC_ERROR_NONE,
+                      "Error: alias list failed, ec: " << CKMCErrorToString(errorCodeAliasList));
 
-    ckmc_alias_list_s *plist = aliasList;
+    ckmc_alias_list_s *paliasList = aliasList;
+    ckmc_alias_info_list_s *paliasInfoList = aliasInfoList;
     size_t return_count = 0;
-    while(plist)
+    while(paliasList && paliasInfoList)
     {
-        plist = plist->next;
-        return_count ++;
+        paliasList = paliasList->next;
+        paliasInfoList = paliasInfoList->next;
+        ++return_count;
     }
+
+    RUNNER_ASSERT_MSG(!paliasList && !paliasInfoList,
+                      "Size of alias list is not equal to size of alias info list");
+
     ckmc_alias_list_all_free(aliasList);
+    ckmc_alias_info_list_all_free(aliasInfoList);
 
     RUNNER_ASSERT_MSG(
       return_count >= minimum_initial_element_count,

diff --git a/src/ckm/privileged/capi-access_control.cpp b/src/ckm/privileged/capi-access_control.cpp
index 351c0b255f6070479085246430b2b15d410bdb28..c6bf9660e0d7f8c9cbb8f1d62016ceb3025bcae0 100644 (file)
--- a/src/ckm/privileged/capi-access_control.cpp
+++ b/src/ckm/privileged/capi-access_control.cpp
@@ -80,6 +80,12 @@ void check_alias_count(size_t expected)
     RUNNER_ASSERT_MSG(count == expected, "Expected " << expected << " aliases, got " << count);
 }
 
+void remove_alias(const char *alias)
+{
+    int ret = ckmc_remove_alias(alias);
+    RUNNER_ASSERT_MSG(CKMC_ERROR_NONE == ret, "Removing alias failed. " << CKMCErrorToString(ret));
+}
+
 } // namespace anonymous
 
 RUNNER_TEST_GROUP_INIT (T300_CKMC_ACCESS_CONTROL_USER_C_API);
@@ -525,6 +531,32 @@ RUNNER_TEST(T3034_manager_deprecated_remove_allowed, RemoveDataEnv<APP_1>)
     }
 }
 
+// tries to get alias list and alias info list of other application data
+// with permission for read or remove
+RUNNER_TEST(T3035_manager_gets_alias_info_list_with_read_or_remove, RemoveDataEnv<APP_1>)
+{
+    // prepare: add data
+    {
+        ScopedAppContext ctx(APP_LABEL_1, APP_1, GROUP_1);
+        save_data(TEST_ALIAS, TEST_DATA);
+        allow_access(TEST_ALIAS, APP_LABEL_2, CKMC_PERMISSION_READ);
+        allow_access(TEST_ALIAS, APP_LABEL_3, CKMC_PERMISSION_REMOVE);
+    }
+
+    // test getting alias from another label with read permission
+    {
+        ScopedAppContext ctx(APP_LABEL_2, APP_1, GROUP_1);
+        check_alias_count(1);
+    }
+
+    // test getting and removing alias from another label with remove permission
+    {
+        ScopedAppContext ctx(APP_LABEL_3, APP_1, GROUP_1);
+        check_alias_count(0);
+        remove_alias(aliasWithLabel(APP_LABEL_1, TEST_ALIAS).c_str());
+    }
+}
+
 /////////////////////////////////////////////////////////////////////////////
 // Control