CKM: Prevent running tests as wrong user

Abort if ckm-tests are launched as user != owner
Abort if ckm-privileged-tests are launched as user != root
Update security-tests-all.sh to use proper user
Add ckm-privileged-tests to security-tests.sh
Add missing license boilerplate

Change-Id: Id4929d3c4266e4abe7e8ea89238fe72195b73081

diff --git a/src/ckm/CMakeLists.txt b/src/ckm/CMakeLists.txt
index 924e811..515e0be 100644 (file)
--- a/src/ckm/CMakeLists.txt
+++ b/src/ckm/CMakeLists.txt
@@ -1,4 +1,4 @@
-# Copyright (c) 2013-2015 Samsung Electronics Co., Ltd All Rights Reserved
+# Copyright (c) 2013-2018 Samsung Electronics Co., Ltd All Rights Reserved
 #
 #   Licensed under the Apache License, Version 2.0 (the "License");
 #   you may not use this file except in compliance with the License.
@@ -33,6 +33,7 @@ ADD_DEFINITIONS("-DCKM_RW_DATA_DIR=\"${CKM_RW_DATA_DIR}\"")
 PKG_CHECK_MODULES(CKM_TEST_COMMON_DEP
     REQUIRED
     key-manager
+    libtzplatform-config
 )
 
 SET(CKM_TEST_COMMON_SRCS

diff --git a/src/ckm/privileged/main.cpp b/src/ckm/privileged/main.cpp
index df5d5dd..b652a23 100644 (file)
--- a/src/ckm/privileged/main.cpp
+++ b/src/ckm/privileged/main.cpp
@@ -1,5 +1,5 @@
 /*
- *  Copyright (c) 2016 Samsung Electronics Co., Ltd All Rights Reserved
+ *  Copyright (c) 2016-2018 Samsung Electronics Co., Ltd All Rights Reserved
  *
  *  Licensed under the Apache License, Version 2.0 (the "License");
  *  you may not use this file except in compliance with the License.
@@ -13,6 +13,12 @@
  *  See the License for the specific language governing permissions and
  *  limitations under the License
  */
+#include <unistd.h>
+#include <sys/types.h>
+
+#include <fstream>
+#include <iostream>
+
 #include <netdb.h>
 
 #include <dpl/test/test_runner.h>
@@ -30,8 +36,6 @@
 #include <ckm/ckm-type.h>
 #include <ckm/ckm-pkcs12.h>
 
-#include <fstream>
-
 #include <openssl/x509.h>
 #include <openssl/x509v3.h>
 
@@ -379,5 +383,10 @@ RUNNER_TEST(T17112_deinit)
 
 int main(int argc, char *argv[])
 {
+    if (geteuid() != 0)
+    {
+        std::cerr << argv[0] << " should be executed as root. Aborting" << std::endl;
+        return -1;
+    }
     return DPL::Test::TestRunnerSingleton::Instance().ExecTestRunner(argc, argv);
 }

diff --git a/src/ckm/unprivileged/main.cpp b/src/ckm/unprivileged/main.cpp
index f0adfe1..6c2fe63 100644 (file)
--- a/src/ckm/unprivileged/main.cpp
+++ b/src/ckm/unprivileged/main.cpp
@@ -1,3 +1,25 @@
+/*
+ *  Copyright (c) 2016-2018 Samsung Electronics Co., Ltd All Rights Reserved
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License
+ */
+#include <unistd.h>
+#include <sys/types.h>
+
+#include <fstream>
+#include <iostream>
+#include <string>
+
 #include <netdb.h>
 
 #include <dpl/test/test_runner.h>
@@ -12,11 +34,11 @@
 #include <ckm/ckm-type.h>
 #include <ckm/ckm-pkcs12.h>
 
-#include <fstream>
-
 #include <openssl/x509.h>
 #include <openssl/x509v3.h>
 
+#include <tzplatform_config.h>
+
 namespace {
 const int USER_APP = 5001;
 
@@ -2799,5 +2821,16 @@ RUNNER_TEST(T1905_deinit)
 
 int main(int argc, char *argv[])
 {
+    uid_t expected_uid = tzplatform_getuid(TZ_SYS_DEFAULT_USER);
+    if (expected_uid != geteuid()) {
+        std::string userStr("owner");
+        const char* user = tzplatform_getenv(TZ_SYS_DEFAULT_USER);
+        if (user)
+            userStr = user;
+
+        std::cerr << argv[0] << " should be executed as " << userStr << ". Aborting" << std::endl;
+        return -1;
+    }
+
     return DPL::Test::TestRunnerSingleton::Instance().ExecTestRunner(argc, argv);
 }

diff --git a/src/security-tests.sh b/src/security-tests.sh
index 3956258..89be46f 100644 (file)
--- a/src/security-tests.sh
+++ b/src/security-tests.sh
@@ -1,7 +1,7 @@
 #!/bin/sh
 
 #####################################################################
-# Copyright (c) 2012-2014 Samsung Electronics Co., Ltd All Rights Reserved
+# Copyright (c) 2012-2018 Samsung Electronics Co., Ltd All Rights Reserved
 #
 #    Licensed under the Apache License, Version 2.0 (the "License");
 #    you may not use this file except in compliance with the License.
@@ -42,9 +42,14 @@ case $1 in
     ;;
 "ckm")
     echo "========================================================================="
-    echo "KEY MANAGER TESTS"
+    echo "KEY MANAGER UNPRIVILEGED TESTS"
     echo
-    ckm-tests "${@:2}"
+    ARGS="${@:2}"
+    su - owner -c "ckm-tests $ARGS"
+    echo "========================================================================="
+    echo "KEY MANAGER PRIVILEGED TESTS"
+    echo
+    ckm-tests-on-onlycap.sh $ARGS
     ;;
 "yaca")
     echo "========================================================================="