#include <sm_api.h>
#include <sm_db.h>
#include <sm_request.h>
+#include <sm_sharing_request.h>
#include <sm_user_request.h>
#include <app_install_helper.h>
#include <temp_test_user.h>
#include <cynara_test_admin.h>
#include <service_manager.h>
#include <cynara_test_admin.h>
+#include "memory.h"
using namespace SecurityManagerTest;
}
}
+std::string access_opposite(std::string &access) {
+ static const std::map<char, int> access_mapping = {{'r', 0}, {'w', 1}, {'x', 2}, {'a', 3},
+ {'t', 4}, {'l', 5}};
+ //May write implies may lock
+ if (access.find('w') != std::string::npos && access.find('l') == std::string::npos) {
+ access.append("l");
+ }
+ std::string access_opposite = "rwxatl";
+ for (char c : access) {
+ access_opposite[access_mapping.at(c)] = '-';
+ }
+ auto it = std::remove_if(access_opposite.begin(), access_opposite.end(), [](char c) {return c == '-';});
+ access_opposite.erase(it, access_opposite.end());
+ return access_opposite;
+}
+
+void check_exact_smack_accesses(const std::string &subject, const std::string &object, const std::string &access) {
+ std::string access_str(access);
+ auto no_access = access_opposite(access_str);
+ for (char c : access_str) {
+ int ret = smack_have_access(subject.c_str(), object.c_str(), std::string(1, c).c_str());
+ RUNNER_ASSERT_MSG(ret >= 0, "smack_have_access failed: <" << subject << ">, <" << object << ">, <" << c << "> errno=" << strerror(errno));
+ RUNNER_ASSERT_MSG(ret == 1, "Access " << c << " from " << subject << " to "
+ << object << " not given");
+ }
+
+ for (char c : no_access) {
+ int ret = smack_have_access(subject.c_str(), object.c_str(), std::string(1, c).c_str());
+ RUNNER_ASSERT_MSG(ret >= 0, "smack_have_access failed: <" << subject << ">, <" << object << ">, <" << c << "> errno=" << strerror(errno));
+ RUNNER_ASSERT_MSG(ret == 0, "Access " << c << " from " << subject << " to "
+ << object << " unnecessarily given");
+ }
+}
+
+
RUNNER_TEST_GROUP_INIT(SECURITY_MANAGER)
};
}
+namespace {
+const char *const owner_access = "rwxat";
+const char *const target_path_access = "rxl";
+const char *const target_dir_access = "x";
+const char *const no_access = "";
+
+void check_system_access(const std::string pathLabel, bool apply = true) {
+ check_exact_smack_accesses("User", pathLabel, (apply ? owner_access : no_access));
+ check_exact_smack_accesses("System", pathLabel, (apply ? owner_access : no_access));
+}
+
+void check_owner_access(const std::string &ownerLabel, const std::string &pathLabel, bool apply = true) {
+ check_exact_smack_accesses(ownerLabel, pathLabel, (apply ? owner_access : no_access));
+}
+
+void check_target_access(const std::string &ownerPkgLabel, const std::string &targetLabel,
+ const std::string &pathLabel, bool pathShared = true, bool anyPathShared = true) {
+ check_exact_smack_accesses(targetLabel, pathLabel, (pathShared ? target_path_access : no_access));
+ check_exact_smack_accesses(targetLabel, ownerPkgLabel, (anyPathShared ? target_dir_access : no_access));
+}
+
+void check_path_label(const std::string &path, const std::string &expectedLabel) {
+ char *label = nullptr;
+ int ret = smack_new_label_from_path(path.c_str(), XATTR_NAME_SMACK, 0, &label);
+ RUNNER_ASSERT_MSG(ret > 0, "smack_new_label_from_path failed for " << path);
+ SmackLabelPtr realLabel(label);
+ RUNNER_ASSERT_MSG(realLabel.get() == expectedLabel, "Fetched label from " << path << " different"
+ " than expected, is : " << realLabel.get() << " should be " << expectedLabel);
+}
+
+void createFile(const std::string &filePath)
+{
+ //create temporary file and set label for it
+ mode_t systemMask;
+
+ unlink(filePath.c_str());
+ //allow to create file with 777 rights
+ systemMask = umask(0000);
+ int fd = open(filePath.c_str(), O_RDWR | O_CREAT, S_IRWXU | S_IRWXG | S_IRWXO);
+ //restore system mask
+ umask(systemMask);
+ RUNNER_ASSERT_ERRNO_MSG(fd > -1, "Unable to create file for tests");
+
+ //for descriptor protection
+ FdUniquePtr fd_ptr(&fd);
+
+ //change owner and group to user APP
+ int ret = chown(filePath.c_str(), APP_UID, APP_GID);
+ RUNNER_ASSERT_ERRNO_MSG(ret == 0, "Unable to change file owner");
+}
+
+}
+
+RUNNER_TEST(security_manager_30a_send_incomplete_req1)
+{
+ SharingRequest request;
+ Api::applySharing(request, SECURITY_MANAGER_ERROR_REQ_NOT_COMPLETE);
+ request.setOwnerAppId("someOwner");
+ Api::applySharing(request, SECURITY_MANAGER_ERROR_REQ_NOT_COMPLETE);
+ request.setTargetAppId("someTarget");
+ Api::applySharing(request, SECURITY_MANAGER_ERROR_REQ_NOT_COMPLETE);
+}
+
+RUNNER_TEST(security_manager_30b_send_incomplete_req2)
+{
+ SharingRequest request;
+ request.setTargetAppId("someTarget");
+ Api::applySharing(request, SECURITY_MANAGER_ERROR_REQ_NOT_COMPLETE);
+ request.setOwnerAppId("someOwner");
+ Api::applySharing(request, SECURITY_MANAGER_ERROR_REQ_NOT_COMPLETE);
+}
+
+RUNNER_TEST(security_manager_30c_send_incomplete_req3)
+{
+ SharingRequest request;
+ const char *somePaths[] = {"path1", "path2"};
+ request.addPaths(somePaths, sizeof(somePaths)/sizeof(somePaths[0]));
+ Api::applySharing(request, SECURITY_MANAGER_ERROR_REQ_NOT_COMPLETE);
+ request.setOwnerAppId("someOwner");
+ Api::applySharing(request, SECURITY_MANAGER_ERROR_REQ_NOT_COMPLETE);
+}
+
+RUNNER_TEST(security_manager_30d_unknown_owner)
+{
+ // This test depends on order of checks in security-manager service implementation
+ SharingRequest request;
+ request.setOwnerAppId("ImPrettySureIDontExist");
+ request.setTargetAppId("IDontMatter");
+ const char *somePaths[] = {"path1", "path2"};
+ request.addPaths(somePaths, sizeof(somePaths)/sizeof(somePaths[0]));
+ Api::applySharing(request, SECURITY_MANAGER_ERROR_APP_UNKNOWN);
+}
+
+RUNNER_TEST(security_manager_30e_unknown_target)
+{
+ // This test depends on order of checks in security-manager service implementation
+ AppInstallHelper owner("installedApp");
+ owner.revokeRules();
+ owner.createInstallDir();
+ InstallRequest ownerInst;
+ ownerInst.setAppId(owner.getAppId().c_str());
+ ownerInst.setPkgId(owner.getPkgId().c_str());
+ Api::install(ownerInst);
+
+ SharingRequest request;
+ request.setOwnerAppId(owner.getAppId());
+ request.setTargetAppId("NowImPrettySureIDontExist");
+ const char *somePaths[] = {"path1", "path2"};
+ request.addPaths(somePaths, sizeof(somePaths)/sizeof(somePaths[0]));
+ Api::applySharing(request, SECURITY_MANAGER_ERROR_APP_UNKNOWN);
+
+ Api::uninstall(ownerInst);
+}
+
+RUNNER_TEST(security_manager_30f_bad_paths)
+{
+ // This test depends on order of checks in security-manager service implementation
+ AppInstallHelper owner("installedApp");
+ owner.revokeRules();
+ owner.createInstallDir();
+ InstallRequest ownerInst;
+ ownerInst.setAppId(owner.getAppId().c_str());
+ ownerInst.setPkgId(owner.getPkgId().c_str());
+ Api::install(ownerInst);
+
+ AppInstallHelper target("secondInstalledApp");
+ target.revokeRules();
+ target.createInstallDir();
+ InstallRequest targetInst;
+ targetInst.setAppId(target.getAppId().c_str());
+ targetInst.setPkgId(target.getPkgId().c_str());
+ Api::install(targetInst);
+
+ SharingRequest request;
+ request.setOwnerAppId(owner.getAppId());
+ request.setTargetAppId(target.getAppId());
+
+ const char *somePath = "/tmp/somePath";
+ createFile(somePath);
+ const char *somePaths[] = {somePath};
+ request.addPaths(somePaths, sizeof(somePaths)/sizeof(somePaths[0]));
+ Api::applySharing(request, SECURITY_MANAGER_ERROR_APP_NOT_PATH_OWNER);
+
+ Api::uninstall(ownerInst);
+}
+
+RUNNER_TEST(security_manager_31_simple_share)
+{
+ std::vector<AppInstallHelper> helper {{"app30a"}, {"app30b"}};
+ auto &owner = helper[0];
+ auto &target = helper[1];
+
+ for (auto &e : helper) {
+ e.revokeRules();
+ e.createInstallDir();
+ }
+
+ owner.createPrivateDir();
+ owner.createSharedFile();
+
+ InstallRequest ownerReq;
+ ownerReq.setAppId(owner.getAppId().c_str());
+ ownerReq.setPkgId(owner.getPkgId().c_str());
+ ownerReq.addPath(owner.getSharedPath().c_str(), SECURITY_MANAGER_PATH_RW);
+ int result = nftw(owner.getInstallDir().c_str(), &nftw_remove_labels, FTW_MAX_FDS, FTW_PHYS);
+ RUNNER_ASSERT_MSG(result == 0, "Unable to remove Smack labels in " << owner.getInstallDir());
+ Api::install(ownerReq);
+
+ InstallRequest targetReq;
+ targetReq.setAppId(target.getAppId().c_str());
+ targetReq.setPkgId(target.getAppId().c_str());
+ Api::install(targetReq);
+
+ SharingRequest share1;
+ std::string sharedPath = owner.getSharedPath().c_str();
+ share1.setOwnerAppId(owner.getAppId());
+ share1.setTargetAppId(target.getAppId());
+ const char *path[] = {sharedPath.c_str()};
+ share1.addPaths(path, 1);
+ Api::applySharing(share1);
+
+ TestSecurityManagerDatabase db;
+ std::string pathLabel1 = db.get_path_label(sharedPath.c_str());
+ RUNNER_ASSERT_MSG(!pathLabel1.empty(), "Couldn't fetch path label from database for file " << sharedPath);
+
+ check_system_access(pathLabel1);
+ check_owner_access(owner.generateAppLabel(), pathLabel1);
+ check_target_access(owner.generatePkgLabel(), target.generateAppLabel(), pathLabel1);
+ check_path_label(sharedPath, pathLabel1);
+
+ Api::dropSharing(share1);
+ check_system_access(pathLabel1, false);
+ check_owner_access(owner.generateAppLabel(), pathLabel1, false);
+ check_target_access(owner.generatePkgLabel(), target.generateAppLabel(), pathLabel1, false, false);
+ check_path_label(sharedPath, owner.generatePkgLabel());
+
+ Api::uninstall(ownerReq);
+ Api::uninstall(targetReq);
+}
+
+RUNNER_TEST(security_manager_32_double_share)
+{
+ std::vector<AppInstallHelper> helper {{"app31a"}, {"app31b"}};
+ auto &owner = helper[0];
+ auto &target = helper[1];
+
+ // cleanup
+ for (auto &e : helper) {
+ e.revokeRules();
+ e.createInstallDir();
+ }
+ owner.createPrivateDir();
+ owner.createSharedFile();
+
+ InstallRequest ownerReq;
+ ownerReq.setAppId(owner.getAppId().c_str());
+ ownerReq.setPkgId(owner.getPkgId().c_str());
+ ownerReq.addPath(owner.getSharedPath().c_str(), SECURITY_MANAGER_PATH_RW);
+
+ int result = nftw(owner.getInstallDir().c_str(), &nftw_remove_labels, FTW_MAX_FDS, FTW_PHYS);
+ RUNNER_ASSERT_MSG(result == 0, "Unable to remove Smack labels in " << owner.getInstallDir());
+ Api::install(ownerReq);
+
+ InstallRequest targetReq;
+ targetReq.setAppId(target.getAppId().c_str());
+ targetReq.setPkgId(target.getAppId().c_str());
+ Api::install(targetReq);
+
+ SharingRequest share1;
+ std::string sharedPath = owner.getSharedPath(0).c_str();
+ share1.setOwnerAppId(owner.getAppId());
+ share1.setTargetAppId(target.getAppId());
+ const char *path[] = {sharedPath.c_str()};
+ share1.addPaths(path, 1);
+ Api::applySharing(share1);
+
+ TestSecurityManagerDatabase db;
+ std::string pathLabel = db.get_path_label(sharedPath.c_str());
+ RUNNER_ASSERT_MSG(!pathLabel.empty(), "Couldn't fetch path label from database for file " << sharedPath);
+
+ check_system_access(pathLabel);
+ check_owner_access(owner.generateAppLabel(), pathLabel);
+ check_target_access(owner.generatePkgLabel(), target.generateAppLabel(), pathLabel);
+ check_path_label(sharedPath, pathLabel);
+
+ Api::applySharing(share1);
+ check_system_access(pathLabel);
+ check_owner_access(owner.generateAppLabel(), pathLabel);
+ check_target_access(owner.generatePkgLabel(), target.generateAppLabel(), pathLabel);
+ check_path_label(sharedPath, pathLabel);
+
+ Api::dropSharing(share1);
+ check_system_access(pathLabel);
+ check_owner_access(owner.generateAppLabel(), pathLabel);
+ check_target_access(owner.generatePkgLabel(), target.generateAppLabel(), pathLabel);
+ check_path_label(sharedPath, pathLabel);
+
+ Api::dropSharing(share1);
+ check_system_access(pathLabel, false);
+ check_owner_access(owner.generateAppLabel(), pathLabel, false);
+ check_target_access(owner.generatePkgLabel(), target.generateAppLabel(), pathLabel, false, false);
+ check_path_label(sharedPath, owner.generatePkgLabel());
+
+ Api::uninstall(ownerReq);
+ Api::uninstall(targetReq);
+}
+RUNNER_TEST(security_manager_33_share_two_with_one)
+{
+ std::vector<AppInstallHelper> helper {{"app32a"}, {"app32b"}};
+ auto &owner = helper[0];
+ auto &target = helper[1];
+
+ // cleanup
+ for (auto &e : helper) {
+ e.revokeRules();
+ e.createInstallDir();
+ }
+ owner.createPrivateDir();
+ owner.createSharedFile(0);
+ owner.createSharedFile(1);
+
+ InstallRequest ownerReq;
+ ownerReq.setAppId(owner.getAppId().c_str());
+ ownerReq.setPkgId(owner.getPkgId().c_str());
+ ownerReq.addPath(owner.getSharedPath(0).c_str(), SECURITY_MANAGER_PATH_RW);
+ ownerReq.addPath(owner.getSharedPath(1).c_str(), SECURITY_MANAGER_PATH_RW);
+
+ int result = nftw(owner.getInstallDir().c_str(), &nftw_remove_labels, FTW_MAX_FDS, FTW_PHYS);
+ RUNNER_ASSERT_MSG(result == 0, "Unable to remove Smack labels in " << owner.getInstallDir());
+ Api::install(ownerReq);
+
+ InstallRequest targetReq;
+ targetReq.setAppId(target.getAppId().c_str());
+ targetReq.setPkgId(target.getAppId().c_str());
+ Api::install(targetReq);
+
+ SharingRequest share1, share2;
+ std::string sharedPath1 = owner.getSharedPath(0).c_str();
+ std::string sharedPath2 = owner.getSharedPath(1).c_str();
+ share1.setOwnerAppId(owner.getAppId());
+ share2.setOwnerAppId(owner.getAppId());
+ share1.setTargetAppId(target.getAppId());
+ share2.setTargetAppId(target.getAppId());
+ const char *path1[] = {sharedPath1.c_str()};
+ const char *path2[] = {sharedPath2.c_str()};
+ share1.addPaths(path1, 1);
+ share2.addPaths(path2, 1);
+
+ Api::applySharing(share1);
+ TestSecurityManagerDatabase db;
+ std::string pathLabel1 = db.get_path_label(sharedPath1.c_str());
+ RUNNER_ASSERT_MSG(!pathLabel1.empty(), "Couldn't fetch path label from database for file " << sharedPath1);
+
+ check_system_access(pathLabel1);
+ check_owner_access(owner.generateAppLabel(), pathLabel1);
+ check_target_access(owner.generatePkgLabel(), target.generateAppLabel(), pathLabel1);
+ check_path_label(sharedPath1, pathLabel1);
+
+ Api::applySharing(share2);
+ std::string pathLabel2 = db.get_path_label(sharedPath2.c_str());
+ RUNNER_ASSERT_MSG(!pathLabel2.empty(), "Couldn't fetch path label from database for file " << sharedPath2);
+ RUNNER_ASSERT_MSG(pathLabel1 != pathLabel2, "Labels for private shared paths should be unique!");
+
+ check_system_access(pathLabel1);
+ check_system_access(pathLabel2);
+ check_owner_access(owner.generateAppLabel(), pathLabel1);
+ check_owner_access(owner.generateAppLabel(), pathLabel2);
+ check_target_access(owner.generatePkgLabel(), target.generateAppLabel(), pathLabel1);
+ check_target_access(owner.generatePkgLabel(), target.generateAppLabel(), pathLabel2);
+ check_path_label(sharedPath1, pathLabel1);
+ check_path_label(sharedPath2, pathLabel2);
+
+ Api::dropSharing(share1);
+ check_system_access(pathLabel1, false);
+ check_system_access(pathLabel2);
+ check_owner_access(owner.generateAppLabel(), pathLabel1, false);
+ check_target_access(owner.generatePkgLabel(), target.generateAppLabel(), pathLabel1, false);
+ check_target_access(owner.generatePkgLabel(), target.generateAppLabel(), pathLabel2);
+ check_path_label(sharedPath1, owner.generatePkgLabel());
+ check_path_label(sharedPath2, pathLabel2);
+
+ Api::dropSharing(share2);
+ check_system_access(pathLabel1, false);
+ check_system_access(pathLabel2, false);
+ check_owner_access(owner.generateAppLabel(), pathLabel1, false);
+ check_owner_access(owner.generateAppLabel(), pathLabel2, false);
+ check_target_access(owner.generatePkgLabel(), target.generateAppLabel(), pathLabel1, false, false);
+ check_target_access(owner.generatePkgLabel(), target.generateAppLabel(), pathLabel2, false, false);
+ check_path_label(sharedPath1, owner.generatePkgLabel());
+ check_path_label(sharedPath2, owner.generatePkgLabel());
+
+ Api::uninstall(ownerReq);
+ Api::uninstall(targetReq);
+}
+
+RUNNER_TEST(security_manager_34_share_one_with_two)
+{
+ std::vector<AppInstallHelper> helper {{"app33a"}, {"app33b"}, {"app33c"}};
+ auto &owner = helper[0];
+ auto &target1 = helper[1];
+ auto &target2 = helper[2];
+
+ // cleanup
+ for (auto &e : helper) {
+ e.revokeRules();
+ e.createInstallDir();
+ }
+ owner.createPrivateDir();
+ owner.createSharedFile();
+
+ InstallRequest ownerReq;
+ ownerReq.setAppId(owner.getAppId().c_str());
+ ownerReq.setPkgId(owner.getPkgId().c_str());
+ ownerReq.addPath(owner.getSharedPath().c_str(), SECURITY_MANAGER_PATH_RW);
+ int result = nftw(owner.getInstallDir().c_str(), &nftw_remove_labels, FTW_MAX_FDS, FTW_PHYS);
+ RUNNER_ASSERT_MSG(result == 0, "Unable to remove Smack labels in " << owner.getInstallDir());
+ Api::install(ownerReq);
+
+ for (size_t i = 1; i < helper.size(); i++) {
+ InstallRequest targetReq;
+ targetReq.setAppId(helper[i].getAppId().c_str());
+ targetReq.setPkgId(helper[i].getAppId().c_str());
+ Api::install(targetReq);
+ }
+
+ SharingRequest share1, share2;
+ std::string sharedPath = owner.getSharedPath(0).c_str();
+ share1.setOwnerAppId(owner.getAppId());
+ share2.setOwnerAppId(owner.getAppId());
+ share1.setTargetAppId(target1.getAppId());
+ share2.setTargetAppId(target2.getAppId());
+
+ const char *path[] = {sharedPath.c_str()};
+ share1.addPaths(path, 1);
+ share2.addPaths(path, 1);
+
+ Api::applySharing(share1);
+ TestSecurityManagerDatabase db;
+ std::string pathLabel = db.get_path_label(sharedPath.c_str());
+ RUNNER_ASSERT_MSG(!pathLabel.empty(), "Couldn't fetch path label from database for file " << sharedPath);
+
+ check_system_access(pathLabel);
+ check_owner_access(owner.generateAppLabel(), pathLabel);
+ check_target_access(owner.generatePkgLabel(), target1.generateAppLabel(), pathLabel);
+ check_path_label(sharedPath, pathLabel);
+
+ Api::applySharing(share2);
+ check_system_access(pathLabel);
+ check_owner_access(owner.generateAppLabel(), pathLabel);
+ check_target_access(owner.generatePkgLabel(), target1.generateAppLabel(), pathLabel);
+ check_target_access(owner.generatePkgLabel(), target2.generateAppLabel(), pathLabel);
+ check_path_label(sharedPath, pathLabel);
+
+ Api::dropSharing(share1);
+ check_system_access(pathLabel);
+ check_owner_access(owner.generateAppLabel(), pathLabel);
+ check_target_access(owner.generatePkgLabel(), target1.generateAppLabel(), pathLabel, false, false);
+ check_target_access(owner.generatePkgLabel(), target2.generateAppLabel(), pathLabel);
+ check_path_label(sharedPath, pathLabel);
+
+ Api::dropSharing(share2);
+ check_system_access(pathLabel, false);
+ check_owner_access(owner.generateAppLabel(), pathLabel, false);
+ check_target_access(owner.generatePkgLabel(), target1.generateAppLabel(), pathLabel, false, false);
+ check_target_access(owner.generatePkgLabel(), target2.generateAppLabel(), pathLabel, false, false);
+ check_path_label(sharedPath, owner.generatePkgLabel());
+
+ Api::uninstall(ownerReq);
+ for (size_t i = 1; i < helper.size(); i++) {
+ InstallRequest targetReq;
+ targetReq.setAppId(helper[i].getAppId().c_str());
+ targetReq.setPkgId(helper[i].getAppId().c_str());
+ Api::uninstall(targetReq);
+ }
+}
+
+RUNNER_TEST(security_manager_35_share_two_with_two)
+{
+ std::vector<AppInstallHelper> helper {{"app34a"}, {"app34b"}, {"app34c"}};
+ auto &owner = helper[0];
+ auto &target1 = helper[1];
+ auto &target2 = helper[2];
+
+ // cleanup
+ for (auto &e : helper) {
+ e.revokeRules();
+ e.createInstallDir();
+ }
+ owner.createPrivateDir();
+ owner.createSharedFile(0);
+ owner.createSharedFile(1);
+
+ InstallRequest ownerReq;
+ ownerReq.setAppId(owner.getAppId().c_str());
+ ownerReq.setPkgId(owner.getPkgId().c_str());
+ ownerReq.addPath(owner.getSharedPath(0).c_str(), SECURITY_MANAGER_PATH_RW);
+ ownerReq.addPath(owner.getSharedPath(1).c_str(), SECURITY_MANAGER_PATH_RW);
+
+ int result = nftw(owner.getInstallDir().c_str(), &nftw_remove_labels, FTW_MAX_FDS, FTW_PHYS);
+ RUNNER_ASSERT_MSG(result == 0, "Unable to remove Smack labels in " << owner.getInstallDir());
+ Api::install(ownerReq);
+
+ for (size_t i = 1; i < helper.size(); i++) {
+ InstallRequest targetReq;
+ targetReq.setAppId(helper[i].getAppId().c_str());
+ targetReq.setPkgId(helper[i].getAppId().c_str());
+ Api::install(targetReq);
+ }
+
+ SharingRequest share1, share2;
+ std::string sharedPath1 = owner.getSharedPath(0).c_str();
+ std::string sharedPath2 = owner.getSharedPath(1).c_str();
+ share1.setOwnerAppId(owner.getAppId());
+ share2.setOwnerAppId(owner.getAppId());
+ share1.setTargetAppId(target1.getAppId());
+ share2.setTargetAppId(target2.getAppId());
+
+ const char *path1[] = {sharedPath1.c_str()};
+ const char *path2[] = {sharedPath2.c_str()};
+ share1.addPaths(path1, 1);
+ share2.addPaths(path2, 1);
+
+ Api::applySharing(share1);
+ TestSecurityManagerDatabase db;
+ std::string pathLabel1 = db.get_path_label(sharedPath1.c_str());
+ RUNNER_ASSERT_MSG(!pathLabel1.empty(), "Couldn't fetch path label from database for file " << sharedPath1);
+
+ check_system_access(pathLabel1);
+ check_owner_access(owner.generateAppLabel(), pathLabel1);
+ check_target_access(owner.generatePkgLabel(), target1.generateAppLabel(), pathLabel1);
+ check_path_label(sharedPath1, pathLabel1);
+
+ Api::applySharing(share2);
+ std::string pathLabel2 = db.get_path_label(sharedPath2.c_str());
+ RUNNER_ASSERT_MSG(!pathLabel2.empty(), "Couldn't fetch path label from database for file " << sharedPath2);
+ RUNNER_ASSERT_MSG(pathLabel1 != pathLabel2, "Labels for shared files should be unique!");
+
+ check_system_access(pathLabel1);
+ check_system_access(pathLabel2);
+ check_owner_access(owner.generateAppLabel(), pathLabel1);
+ check_owner_access(owner.generateAppLabel(), pathLabel2);
+ check_target_access(owner.generatePkgLabel(), target1.generateAppLabel(), pathLabel1);
+ check_target_access(owner.generatePkgLabel(), target2.generateAppLabel(), pathLabel2);
+ check_path_label(sharedPath1, pathLabel1);
+ check_path_label(sharedPath2, pathLabel2);
+
+ Api::dropSharing(share2);
+ check_system_access(pathLabel1);
+ check_system_access(pathLabel2, false);
+ check_owner_access(owner.generateAppLabel(), pathLabel1);
+ check_owner_access(owner.generateAppLabel(), pathLabel2, false);
+ check_target_access(owner.generatePkgLabel(), target1.generateAppLabel(), pathLabel1);
+ check_target_access(owner.generatePkgLabel(), target2.generateAppLabel(), pathLabel2, false, false);
+ check_path_label(sharedPath1, pathLabel1);
+ check_path_label(sharedPath2, owner.generatePkgLabel());
+
+ Api::dropSharing(share1);
+ check_system_access(pathLabel1, false);
+ check_system_access(pathLabel2, false);
+ check_owner_access(owner.generateAppLabel(), pathLabel1, false);
+ check_owner_access(owner.generateAppLabel(), pathLabel2, false);
+ check_target_access(owner.generatePkgLabel(), target1.generateAppLabel(), pathLabel1, false, false);
+ check_target_access(owner.generatePkgLabel(), target2.generateAppLabel(), pathLabel2, false, false);
+ check_path_label(sharedPath1, owner.generatePkgLabel());
+ check_path_label(sharedPath2, owner.generatePkgLabel());
+ Api::uninstall(ownerReq);
+ for (size_t i = 1; i < helper.size(); i++) {
+ InstallRequest targetReq;
+ targetReq.setAppId(helper[i].getAppId().c_str());
+ targetReq.setPkgId(helper[i].getAppId().c_str());
+ Api::uninstall(targetReq);
+ }
+}
+
RUNNER_TEST(security_manager_40_set_wrong_author_id)
{
InstallRequest requestInst;