Adjust system db tests no-smack 11/323611/7
authorKrzysztof Jackiewicz <k.jackiewicz@samsung.com>
Wed, 30 Apr 2025 14:24:34 +0000 (16:24 +0200)
committerKrzysztof Jackiewicz <k.jackiewicz@samsung.com>
Wed, 14 May 2025 13:27:31 +0000 (15:27 +0200)
Verify with: ckm-privileged-tests --group=T50_SYSTEM_DB

All should pass on both smack and no-smack

Change-Id: I38e11de3e3fd6a2688f0bc4fb6fe34af843869a6

src/ckm/ckm-common.cpp
src/ckm/ckm-common.h
src/ckm/privileged/system-db.cpp

index 01536420b842e0a898592743a86a06651ea62918..bd2adba4afd4fd4407c20dd39df24571f9b16984 100644 (file)
@@ -221,6 +221,17 @@ ScopedRemoveData::~ScopedRemoveData()
     check_remove_allowed(m_alias);
 }
 
+ScopedSaveData::ScopedSaveData(const std::string& alias,
+                               const char *data,
+                               size_t len,
+                               const char *password,
+                               int expected_err,
+                               bool exportable) :
+    ScopedRemoveData(alias)
+{
+    save_data(alias, data, len, password, expected_err, exportable);
+}
+
 ScopedSaveData::ScopedSaveData(const std::string& alias, const char *data, int expected_err) :
     ScopedRemoveData(alias)
 {
index 207b0497e3c6a1881cd54c14e1c9fa704b7d0992..56b8120072a9b5a99e24ef1ef308d521259291aa 100644 (file)
@@ -199,6 +199,12 @@ class ScopedSaveData : public ScopedRemoveData
 {
 public:
     ScopedSaveData(const std::string& alias, const char *data, int expected_err = CKMC_ERROR_NONE);
+    ScopedSaveData(const std::string& alias,
+                   const char *data,
+                   size_t len,
+                   const char *password,
+                   int expected_err = CKMC_ERROR_NONE,
+                   bool exportable = true);
 };
 
 class ScopedDBUnlock : public PidBound
index fbaf5dbf337b51a31d2457ba613324057193a101..0a605d48ff67cb4bd72981424d42645d6e1820a2 100644 (file)
@@ -25,6 +25,9 @@
 #include <ckmc/ckmc-manager.h>
 #include <ckmc/ckmc-type.h>
 #include <scoped-app-context.h>
+#include <scoped_app_launcher.h>
+#include <scoped_installer.h>
+#include <test_user.h>
 #include <unistd.h>
 #include <sys/types.h>
 
@@ -37,8 +40,8 @@ const uid_t SERVICE_USER_ID_MAX   = 4999;
 const gid_t SERVICE_GROUP_ID_MAX  = 4999;
 const uid_t SERVICE_USER_ID_FAIL  = 5000;
 const gid_t SERVICE_GROUP_ID_FAIL = 5000;
-const uid_t USER_ID               = 5050;
-const gid_t GROUP_ID              = 5050;
+uid_t USER_ID;
+std::string PKG_ID;
 const char* APP_PASS              = "user-pass";
 
 const char* TEST_ALIAS            = "test-alias";
@@ -55,10 +58,38 @@ const char* TEST_DATA =
         "laborum et dolorum fuga. ";
 }
 
+std::unique_ptr<AppInstallHelper> APP;
 
-RUNNER_TEST_GROUP_INIT(T50_SYSTEM_DB);
+class AppInstallationFixture: public DPL::Test::TestGroup
+{
+public:
+    void Init() override
+    {
+        m_user = std::make_unique<TestUser>(
+                TestUser::createTemporary("ckm_test_user", GUM_USERTYPE_NORMAL, false));
+
+        APP = std::make_unique<AppInstallHelper>("ckm_test_app", m_user->getUid());
+        m_installer = std::make_unique<ScopedInstaller>(*APP);
+        USER_ID = m_user->getUid();
+        PKG_ID = APP->getPkgId();
+        // clean system db just in case
+        remove_user_data(SERVICE_USER_ID);
+    }
+    void Finish() override
+    {
+        m_installer.reset();
+        APP.reset();
+        m_user.reset();
+    }
+
+private:
+    std::unique_ptr<ScopedInstaller> m_installer;
+    std::unique_ptr<TestUser> m_user;
+};
+
+RUNNER_TEST_GROUP_INIT_ENV(T50_SYSTEM_DB, AppInstallationFixture);
 
-RUNNER_TEST(T5010_ACCESS_SYSTEM_DB, RemoveDataEnv<0, USER_ID>)
+RUNNER_CHILD_TEST(T5010_ACCESS_SYSTEM_DB)
 {
     // [prepare]
     // start as system service
@@ -69,20 +100,18 @@ RUNNER_TEST(T5010_ACCESS_SYSTEM_DB, RemoveDataEnv<0, USER_ID>)
     // try to access the item - expect fail (db is locked)
 
     // [prepare]
-    save_data(TEST_SYSTEM_ALIAS, TEST_DATA);
-    allow_access(TEST_SYSTEM_ALIAS, TEST_LABEL, CKMC_PERMISSION_READ);
+    ScopedSaveData ssd(TEST_SYSTEM_ALIAS, TEST_DATA);
+    allow_access(TEST_SYSTEM_ALIAS, PKG_ID, CKMC_PERMISSION_READ);
 
     // [test]
-    {
-        ScopedDBUnlock unlock(USER_ID, APP_PASS);
-    }
-
-    ScopedAppContext ctx(TEST_LABEL, USER_ID, GROUP_ID);
+    ScopedDBUnlock(USER_ID, APP_PASS);
 
-    check_read(TEST_ALIAS, SYSTEM_LABEL, TEST_DATA, CKMC_ERROR_DB_LOCKED);
+    ScopedAppLauncher(*APP, []{
+        check_read(TEST_ALIAS, SYSTEM_LABEL, TEST_DATA, CKMC_ERROR_DB_LOCKED);
+    });
 }
 
-RUNNER_TEST(T5020_CLIENT_APP_ADD_TO_PRIVATE_DB, RemoveDataEnv<USER_ID>)
+RUNNER_CHILD_TEST(T5020_CLIENT_APP_ADD_TO_PRIVATE_DB)
 {
     // [test]
     // switch to user app, unlock DB
@@ -92,13 +121,14 @@ RUNNER_TEST(T5020_CLIENT_APP_ADD_TO_PRIVATE_DB, RemoveDataEnv<USER_ID>)
 
     // [test]
     ScopedDBUnlock unlock(USER_ID, APP_PASS);
-    ScopedAppContext ctx(TEST_LABEL, USER_ID, GROUP_ID);
 
-    ScopedSaveData ssd(TEST_ALIAS, TEST_DATA);
-    check_read(TEST_ALIAS, TEST_LABEL, TEST_DATA);
+    ScopedAppLauncher(*APP, []{
+        ScopedSaveData ssd(TEST_ALIAS, TEST_DATA);
+        check_read(TEST_ALIAS, PKG_ID, TEST_DATA);
+    });
 }
 
-RUNNER_TEST(T5030_CLIENT_APP_TRY_ADDING_SYSTEM_ITEM, RemoveDataEnv<0, USER_ID>)
+RUNNER_CHILD_TEST(T5030_CLIENT_APP_TRY_ADDING_SYSTEM_ITEM)
 {
     // [test]
     // switch to user app, unlock DB
@@ -106,13 +136,13 @@ RUNNER_TEST(T5030_CLIENT_APP_TRY_ADDING_SYSTEM_ITEM, RemoveDataEnv<0, USER_ID>)
 
     // [test]
     ScopedDBUnlock unlock(USER_ID, APP_PASS);
-    ScopedAppContext ctx(TEST_LABEL, USER_ID, GROUP_ID);
-
-    save_data(aliasWithLabel(SYSTEM_LABEL, TEST_ALIAS), TEST_DATA, CKMC_ERROR_PERMISSION_DENIED);
-    check_read(TEST_ALIAS, SYSTEM_LABEL, TEST_DATA, CKMC_ERROR_DB_ALIAS_UNKNOWN);
+    ScopedAppLauncher(*APP, []{
+        save_data(aliasWithLabel(SYSTEM_LABEL, TEST_ALIAS), TEST_DATA, CKMC_ERROR_PERMISSION_DENIED);
+        check_read(TEST_ALIAS, SYSTEM_LABEL, TEST_DATA, CKMC_ERROR_DB_ALIAS_UNKNOWN);
+    });
 }
 
-RUNNER_TEST(T5031_CLIENT_APP_ACCESS_WITH_PERMISSION, RemoveDataEnv<0, USER_ID>)
+RUNNER_CHILD_TEST(T5031_CLIENT_APP_ACCESS_WITH_PERMISSION)
 {
     // [prepare]
     // start as system service
@@ -122,17 +152,17 @@ RUNNER_TEST(T5031_CLIENT_APP_ACCESS_WITH_PERMISSION, RemoveDataEnv<0, USER_ID>)
     // switch to user app, unlock DB
     // try to access the system item - expect success
 
-    save_data(TEST_SYSTEM_ALIAS, TEST_DATA);
-    allow_access(TEST_SYSTEM_ALIAS, TEST_LABEL, CKMC_PERMISSION_READ);
+    ScopedSaveData ssd(TEST_SYSTEM_ALIAS, TEST_DATA);
+    allow_access(TEST_SYSTEM_ALIAS, PKG_ID, CKMC_PERMISSION_READ);
 
     // [test]
     ScopedDBUnlock unlock(USER_ID, APP_PASS);
-    ScopedAppContext ctx(TEST_LABEL, USER_ID, GROUP_ID);
-
-    check_read(TEST_ALIAS, SYSTEM_LABEL, TEST_DATA);
+    ScopedAppLauncher(*APP, []{
+        check_read(TEST_ALIAS, SYSTEM_LABEL, TEST_DATA);
+    });
 }
 
-RUNNER_TEST(T5032_CLIENT_APP_ACCESS_NO_PERMISSION, RemoveDataEnv<0, USER_ID>)
+RUNNER_CHILD_TEST(T5032_CLIENT_APP_ACCESS_NO_PERMISSION)
 {
     // [prepare]
     // start as system service
@@ -142,16 +172,16 @@ RUNNER_TEST(T5032_CLIENT_APP_ACCESS_NO_PERMISSION, RemoveDataEnv<0, USER_ID>)
     // try to access the system item - expect fail
 
     // [prepare]
-    save_data(TEST_SYSTEM_ALIAS, TEST_DATA);
+    ScopedSaveData ssd(TEST_SYSTEM_ALIAS, TEST_DATA);
 
     // [test]
     ScopedDBUnlock unlock(USER_ID, APP_PASS);
-    ScopedAppContext ctx(TEST_LABEL, USER_ID, GROUP_ID);
-
-    check_read(TEST_ALIAS, SYSTEM_LABEL, TEST_DATA, CKMC_ERROR_DB_ALIAS_UNKNOWN);
+    ScopedAppLauncher(*APP, []{
+        check_read(TEST_ALIAS, SYSTEM_LABEL, TEST_DATA, CKMC_ERROR_DB_ALIAS_UNKNOWN);
+    });
 }
 
-RUNNER_TEST(T5033_CLIENT_APP_PERMISSION_REMOVAL, RemoveDataEnv<0, USER_ID>)
+RUNNER_CHILD_TEST(T5033_CLIENT_APP_PERMISSION_REMOVAL)
 {
     // [prepare]
     // start as system service
@@ -168,30 +198,26 @@ RUNNER_TEST(T5033_CLIENT_APP_PERMISSION_REMOVAL, RemoveDataEnv<0, USER_ID>)
     // try to access the system item - expect fail
 
     // [prepare]
-    save_data(TEST_SYSTEM_ALIAS, TEST_DATA);
-    allow_access(TEST_SYSTEM_ALIAS, TEST_LABEL, CKMC_PERMISSION_READ);
+    ScopedSaveData ssd(TEST_SYSTEM_ALIAS, TEST_DATA);
+    allow_access(TEST_SYSTEM_ALIAS, PKG_ID, CKMC_PERMISSION_READ);
 
     ScopedDBUnlock unlock(USER_ID, APP_PASS);
 
     // [test]
-    {
-        ScopedAppContext ctx(TEST_LABEL, USER_ID, GROUP_ID);
-
+    ScopedAppLauncher(*APP, []{
         check_read(TEST_ALIAS, SYSTEM_LABEL, TEST_DATA);
-    }
+    });
 
     // [prepare2]
     check_remove_allowed(TEST_SYSTEM_ALIAS);
 
     // [test2]
-    {
-        ScopedAppContext ctx(TEST_LABEL, USER_ID, GROUP_ID);
-
+    ScopedAppLauncher(*APP, []{
         check_read(TEST_ALIAS, SYSTEM_LABEL, TEST_DATA, CKMC_ERROR_DB_ALIAS_UNKNOWN);
-    }
+    });
 }
 
-RUNNER_TEST(T5034_CLIENT_APP_SET_READ_ACCESS, RemoveDataEnv<0, USER_ID>)
+RUNNER_CHILD_TEST(T5034_CLIENT_APP_SET_READ_ACCESS)
 {
     // [test]
     // switch to user app, unlock DB
@@ -200,14 +226,15 @@ RUNNER_TEST(T5034_CLIENT_APP_SET_READ_ACCESS, RemoveDataEnv<0, USER_ID>)
 
     // [test]
     ScopedDBUnlock unlock(USER_ID, APP_PASS);
-    ScopedAppContext ctx(TEST_LABEL, USER_ID, GROUP_ID);
 
-    ScopedSaveData ssdsystem_user(TEST_ALIAS, TEST_DATA);
-    ScopedSaveData ssdsystem_system(TEST_SYSTEM_ALIAS, TEST_DATA, CKMC_ERROR_PERMISSION_DENIED);
-    check_read(TEST_ALIAS, SYSTEM_LABEL, TEST_DATA, CKMC_ERROR_DB_ALIAS_UNKNOWN);
+    ScopedAppLauncher(*APP, []{
+        ScopedSaveData ssd_user(TEST_ALIAS, TEST_DATA);
+        ScopedSaveData ssd_system(TEST_SYSTEM_ALIAS, TEST_DATA, CKMC_ERROR_PERMISSION_DENIED);
+        check_read(TEST_ALIAS, SYSTEM_LABEL, TEST_DATA, CKMC_ERROR_DB_ALIAS_UNKNOWN);
+    });
 }
 
-RUNNER_TEST(T5035_CLIENT_APP_TRY_REMOVING_SYSTEM_ITEM, RemoveDataEnv<0, USER_ID>)
+RUNNER_CHILD_TEST(T5035_CLIENT_APP_TRY_REMOVING_SYSTEM_ITEM)
 {
     // [prepare]
     // start as system service
@@ -218,17 +245,17 @@ RUNNER_TEST(T5035_CLIENT_APP_TRY_REMOVING_SYSTEM_ITEM, RemoveDataEnv<0, USER_ID>
     // try to remove item from system DB  - expect fail
 
     // [prepare]
-    save_data(TEST_SYSTEM_ALIAS, TEST_DATA);
-    allow_access(TEST_SYSTEM_ALIAS, TEST_LABEL, CKMC_PERMISSION_READ);
+    ScopedSaveData ssd(TEST_SYSTEM_ALIAS, TEST_DATA);
+    allow_access(TEST_SYSTEM_ALIAS, PKG_ID, CKMC_PERMISSION_READ);
 
     // [test]
     ScopedDBUnlock unlock(USER_ID, APP_PASS);
-    ScopedAppContext ctx(TEST_LABEL, USER_ID, GROUP_ID);
-
-    check_remove_denied(TEST_SYSTEM_ALIAS);
+    ScopedAppLauncher(*APP, []{
+        check_remove_denied(TEST_SYSTEM_ALIAS);
+    });
 }
 
-RUNNER_TEST(T5036_CLIENT_LIST_ACCESSIBLE_ITEMS, RemoveDataEnv<0, USER_ID>)
+RUNNER_CHILD_TEST(T5036_CLIENT_LIST_ACCESSIBLE_ITEMS)
 {
     // [prepare]
     // start as system service
@@ -243,23 +270,23 @@ RUNNER_TEST(T5036_CLIENT_LIST_ACCESSIBLE_ITEMS, RemoveDataEnv<0, USER_ID>)
     // user lists items - expect system item A and private item
 
     // [prepare]
-    save_data(TEST_SYSTEM_ALIAS, TEST_DATA);
-    save_data(TEST_SYSTEM_ALIAS_2, TEST_DATA);
-    allow_access(TEST_SYSTEM_ALIAS, TEST_LABEL, CKMC_PERMISSION_READ);
+    ScopedSaveData ssd1(TEST_SYSTEM_ALIAS, TEST_DATA);
+    ScopedSaveData ssd2(TEST_SYSTEM_ALIAS_2, TEST_DATA);
+    allow_access(TEST_SYSTEM_ALIAS, PKG_ID, CKMC_PERMISSION_READ);
 
     // [test]
     check_alias_list({TEST_SYSTEM_ALIAS, TEST_SYSTEM_ALIAS_2});
 
     // [test2]
     ScopedDBUnlock unlock(USER_ID, APP_PASS);
-    ScopedAppContext ctx(TEST_LABEL, USER_ID, GROUP_ID);
-    ScopedSaveData user_data(TEST_ALIAS, TEST_DATA);
+    ScopedAppLauncher(*APP, []{
+        ScopedSaveData user_data(TEST_ALIAS, TEST_DATA);
 
-    check_alias_list({TEST_SYSTEM_ALIAS,
-                        aliasWithLabel(TEST_LABEL, TEST_ALIAS)});
+        check_alias_list({TEST_SYSTEM_ALIAS, aliasWithLabel(PKG_ID, TEST_ALIAS)});
+    });
 }
 
-RUNNER_TEST(T5037_CLIENT_APP_TRY_GENERATE_KEY_IN_SYSTEM_DB, RemoveDataEnv<USER_ID>)
+RUNNER_CHILD_TEST(T5037_CLIENT_APP_TRY_GENERATE_KEY_IN_SYSTEM_DB)
 {
     // [test]
     // switch to user app, unlock DB
@@ -267,28 +294,27 @@ RUNNER_TEST(T5037_CLIENT_APP_TRY_GENERATE_KEY_IN_SYSTEM_DB, RemoveDataEnv<USER_I
 
     // [test]
     ScopedDBUnlock unlock(USER_ID, APP_PASS);
-    ScopedAppContext ctx(TEST_LABEL, USER_ID, GROUP_ID);
-
-    std::string private_key_alias = aliasWithLabel(SYSTEM_LABEL, "sys-db-priv");
-    std::string public_key_alias = aliasWithLabel(SYSTEM_LABEL, "sys-db-pub");
-    ckmc_policy_s policy_private_key;
-    ckmc_policy_s policy_public_key;
-    policy_private_key.password = NULL;
-    policy_private_key.extractable = 1;
-    policy_public_key.password = NULL;
-    policy_public_key.extractable = 1;
-    int temp;
-    RUNNER_ASSERT_MSG(
-                CKMC_ERROR_PERMISSION_DENIED ==
-                    (temp = ckmc_create_key_pair_rsa(1024,
-                                                        private_key_alias.c_str(),
-                                                        public_key_alias.c_str(),
-                                                        policy_private_key,
-                                                        policy_public_key)),
-                CKMCReadableError(temp));
+    ScopedAppLauncher(*APP, []{
+        std::string private_key_alias = aliasWithLabel(SYSTEM_LABEL, "sys-db-priv");
+        std::string public_key_alias = aliasWithLabel(SYSTEM_LABEL, "sys-db-pub");
+        ckmc_policy_s policy_private_key;
+        ckmc_policy_s policy_public_key;
+        policy_private_key.password = NULL;
+        policy_private_key.extractable = 1;
+        policy_public_key.password = NULL;
+        policy_public_key.extractable = 1;
+        int temp = ckmc_create_key_pair_rsa(1024,
+                                            private_key_alias.c_str(),
+                                            public_key_alias.c_str(),
+                                            policy_private_key,
+                                            policy_public_key);
+        ScopedRemoveData srd1(private_key_alias);
+        ScopedRemoveData srd2(public_key_alias);
+        RUNNER_ASSERT_MSG(CKMC_ERROR_PERMISSION_DENIED == temp, CKMCReadableError(temp));
+    });
 }
 
-RUNNER_TEST(T5038_CLIENT_SERVER_CREATE_VERIFY_SYSTEM_DB, RemoveDataEnv<0, USER_ID>)
+RUNNER_CHILD_TEST(T5038_CLIENT_SERVER_CREATE_VERIFY_SYSTEM_DB)
 {
     // [prepare]
     // start as system service
@@ -308,15 +334,14 @@ RUNNER_TEST(T5038_CLIENT_SERVER_CREATE_VERIFY_SYSTEM_DB, RemoveDataEnv<0, USER_I
     policy_private_key.extractable = 1;
     policy_public_key.password = NULL;
     policy_public_key.extractable = 1;
-    int temp;
-    RUNNER_ASSERT_MSG(
-            CKMC_ERROR_NONE ==
-                    (temp = ckmc_create_key_pair_rsa(1024,
-                                                     private_key_alias.c_str(),
-                                                     public_key_alias.c_str(),
-                                                     policy_private_key,
-                                                     policy_public_key)),
-             CKMCReadableError(temp));
+    int temp = ckmc_create_key_pair_rsa(1024,
+                                        private_key_alias.c_str(),
+                                        public_key_alias.c_str(),
+                                        policy_private_key,
+                                        policy_public_key);
+    ScopedRemoveData srd1(private_key_alias);
+    ScopedRemoveData srd2(public_key_alias);
+    RUNNER_ASSERT_MSG(CKMC_ERROR_NONE == temp, CKMCReadableError(temp));
 
     // [test]
     {
@@ -348,25 +373,23 @@ RUNNER_TEST(T5038_CLIENT_SERVER_CREATE_VERIFY_SYSTEM_DB, RemoveDataEnv<0, USER_I
 
     // [test2]
     ScopedDBUnlock unlock(USER_ID, APP_PASS);
-    ScopedAppContext ctx(TEST_LABEL, USER_ID, GROUP_ID);
-
-    ckmc_hash_algo_e hash_algo = CKMC_HASH_SHA256;
-    ckmc_rsa_padding_algo_e pad_algo = CKMC_PKCS1_PADDING;
-    ckmc_raw_buffer_s *signature;
-    ckmc_raw_buffer_s msg_buff = prepare_message_buffer("message test");
-
-    RUNNER_ASSERT_MSG(
-            CKMC_ERROR_DB_ALIAS_UNKNOWN == (temp = ckmc_create_signature(
-                    private_key_alias.c_str(),
-                    NULL,
-                    msg_buff,
-                    hash_algo,
-                    pad_algo,
-                    &signature)),
-            CKMCReadableError(temp));
+    ScopedAppLauncher(*APP, [&]{
+        ckmc_hash_algo_e hash_algo = CKMC_HASH_SHA256;
+        ckmc_rsa_padding_algo_e pad_algo = CKMC_PKCS1_PADDING;
+        ckmc_raw_buffer_s *signature;
+        ckmc_raw_buffer_s msg_buff = prepare_message_buffer("message test");
+
+        int ret = ckmc_create_signature(private_key_alias.c_str(),
+                                        NULL,
+                                        msg_buff,
+                                        hash_algo,
+                                        pad_algo,
+                                        &signature);
+        RUNNER_ASSERT_MSG(CKMC_ERROR_DB_ALIAS_UNKNOWN == ret, CKMCReadableError(ret));
+    });
 }
 
-RUNNER_TEST(T5039_SYSTEM_APP_SET_REMOVE_ACCESS, RemoveDataEnv<0>)
+RUNNER_TEST(T5039_SYSTEM_APP_SET_REMOVE_ACCESS)
 {
     // [prepare]
     // start as system service
@@ -375,13 +398,16 @@ RUNNER_TEST(T5039_SYSTEM_APP_SET_REMOVE_ACCESS, RemoveDataEnv<0>)
     // add remove permission to a user app - expect fail
 
     // [prepare]
-    save_data(TEST_SYSTEM_ALIAS, TEST_DATA);
+    ScopedSaveData ssd(TEST_SYSTEM_ALIAS, TEST_DATA);
 
     // [test]
-    allow_access_negative(TEST_SYSTEM_ALIAS, TEST_LABEL, CKMC_PERMISSION_REMOVE, CKMC_ERROR_INVALID_PARAMETER);
+    allow_access_negative(TEST_SYSTEM_ALIAS,
+                          PKG_ID,
+                          CKMC_PERMISSION_REMOVE,
+                          CKMC_ERROR_INVALID_PARAMETER);
 }
 
-RUNNER_TEST(T5040_SYSTEM_SVC_ACCESS_DB, RemoveDataEnv<0>)
+RUNNER_TEST(T5040_SYSTEM_SVC_ACCESS_DB)
 {
     // [prepare]
     // start as system service
@@ -390,13 +416,13 @@ RUNNER_TEST(T5040_SYSTEM_SVC_ACCESS_DB, RemoveDataEnv<0>)
     // try to access the item - expect success
 
     // [prepare]
-    save_data(TEST_SYSTEM_ALIAS, TEST_DATA);
+    ScopedSaveData ssd(TEST_SYSTEM_ALIAS, TEST_DATA);
 
     // [test]
     check_read(TEST_ALIAS, SYSTEM_LABEL, TEST_DATA);
 }
 
-RUNNER_TEST(T5041_SYSTEM_SVC_1234_ACCESS_DB, RemoveDataEnv<0, SERVICE_USER_ID_2>)
+RUNNER_CHILD_TEST(T5041_SYSTEM_SVC_1234_ACCESS_DB)
 {
     // [prepare]
     // start as system service
@@ -406,7 +432,7 @@ RUNNER_TEST(T5041_SYSTEM_SVC_1234_ACCESS_DB, RemoveDataEnv<0, SERVICE_USER_ID_2>
     // try to access the item - expect success
 
     // [prepare]
-    save_data(TEST_SYSTEM_ALIAS, TEST_DATA);
+    ScopedSaveData ssd(TEST_SYSTEM_ALIAS, TEST_DATA);
 
     // [test]
     ScopedAppContext ctx(TEST_LABEL_2, SERVICE_USER_ID_2, SERVICE_GROUP_ID_2);
@@ -414,7 +440,7 @@ RUNNER_TEST(T5041_SYSTEM_SVC_1234_ACCESS_DB, RemoveDataEnv<0, SERVICE_USER_ID_2>
     check_read(TEST_ALIAS, SYSTEM_LABEL, TEST_DATA);
 }
 
-RUNNER_TEST(T5042_SYSTEM_SVC_1234_ADD_ITEM_TO_DB, RemoveDataEnv<0, SERVICE_USER_ID_2>)
+RUNNER_CHILD_TEST(T5042_SYSTEM_SVC_1234_ADD_ITEM_TO_DB)
 {
     // [prepare]
     // start as system service 1234
@@ -431,7 +457,7 @@ RUNNER_TEST(T5042_SYSTEM_SVC_1234_ADD_ITEM_TO_DB, RemoveDataEnv<0, SERVICE_USER_
     check_read(TEST_ALIAS, SYSTEM_LABEL, TEST_DATA);
 }
 
-RUNNER_TEST(T5043_SYSTEM_SVC_4999_ACCESS_DB, RemoveDataEnv<0, SERVICE_USER_ID_MAX>)
+RUNNER_CHILD_TEST(T5043_SYSTEM_SVC_4999_ACCESS_DB)
 {
     // [prepare]
     // start as system service
@@ -441,7 +467,7 @@ RUNNER_TEST(T5043_SYSTEM_SVC_4999_ACCESS_DB, RemoveDataEnv<0, SERVICE_USER_ID_MA
     // try to access the item - expect success
 
     // [prepare]
-    save_data(TEST_SYSTEM_ALIAS, TEST_DATA);
+    ScopedSaveData ssd(TEST_SYSTEM_ALIAS, TEST_DATA);
 
     // [test]
     ScopedAppContext ctx(TEST_LABEL_2, SERVICE_USER_ID_MAX, SERVICE_GROUP_ID_MAX);
@@ -449,7 +475,7 @@ RUNNER_TEST(T5043_SYSTEM_SVC_4999_ACCESS_DB, RemoveDataEnv<0, SERVICE_USER_ID_MA
     check_read(TEST_ALIAS, SYSTEM_LABEL, TEST_DATA);
 }
 
-RUNNER_TEST(T5044_SYSTEM_SVC_5000_ACCESS_DB, RemoveDataEnv<0, SERVICE_USER_ID_FAIL>)
+RUNNER_CHILD_TEST(T5044_SYSTEM_SVC_5000_ACCESS_DB, RemoveDataEnv<SERVICE_USER_ID_FAIL>)
 {
     // [prepare]
     // start as system service
@@ -459,7 +485,8 @@ RUNNER_TEST(T5044_SYSTEM_SVC_5000_ACCESS_DB, RemoveDataEnv<0, SERVICE_USER_ID_FA
     // try to access the item - expect fail (no system service)
 
     // [prepare]
-    save_data(TEST_SYSTEM_ALIAS, TEST_DATA);
+    ScopedSaveData ssd(TEST_SYSTEM_ALIAS, TEST_DATA);
+    ScopedDBUnlock unlock(SERVICE_USER_ID_FAIL, APP_PASS);
 
     // [test]
     ScopedAppContext ctx(TEST_LABEL_2, SERVICE_USER_ID_FAIL, SERVICE_GROUP_ID_FAIL);
@@ -467,7 +494,7 @@ RUNNER_TEST(T5044_SYSTEM_SVC_5000_ACCESS_DB, RemoveDataEnv<0, SERVICE_USER_ID_FA
     check_read(TEST_ALIAS, SYSTEM_LABEL, TEST_DATA, CKMC_ERROR_DB_ALIAS_UNKNOWN);
 }
 
-RUNNER_TEST(T5045_SYSTEM_DB_ADD_WITH_INVALID_LABEL, RemoveDataEnv<0>)
+RUNNER_TEST(T5045_SYSTEM_DB_ADD_WITH_INVALID_LABEL)
 {
     // [prepare]
     // start as system service
@@ -476,14 +503,16 @@ RUNNER_TEST(T5045_SYSTEM_DB_ADD_WITH_INVALID_LABEL, RemoveDataEnv<0>)
     // try to add item using explicit system label - expect success
 
     // [test]
-    save_data(aliasWithLabel(INVALID_LABEL, TEST_ALIAS), TEST_DATA, CKMC_ERROR_INVALID_PARAMETER);
+    ScopedSaveData ssd1(aliasWithLabel(INVALID_LABEL, TEST_ALIAS),
+                        TEST_DATA,
+                        CKMC_ERROR_INVALID_PARAMETER);
     check_read(TEST_ALIAS, INVALID_LABEL, TEST_DATA, CKMC_ERROR_DB_ALIAS_UNKNOWN);
 
-    save_data(aliasWithLabel(SYSTEM_LABEL, TEST_ALIAS), TEST_DATA);
+    ScopedSaveData ssd2(aliasWithLabel(SYSTEM_LABEL, TEST_ALIAS), TEST_DATA);
     check_read(TEST_ALIAS, SYSTEM_LABEL, TEST_DATA);
 }
 
-RUNNER_TEST(T5046_CLIENT_GET_ALIAS_STATUS_NO_PASSWORD, RemoveDataEnv<0>)
+RUNNER_TEST(T5046_CLIENT_GET_ALIAS_STATUS_NO_PASSWORD)
 {
     // [prepare]
     // start as system service
@@ -493,8 +522,8 @@ RUNNER_TEST(T5046_CLIENT_GET_ALIAS_STATUS_NO_PASSWORD, RemoveDataEnv<0>)
     // system service list alias status - expect both items to have no password protection
 
     // [prepare]
-    save_data(TEST_SYSTEM_ALIAS, TEST_DATA);
-    save_data(TEST_SYSTEM_ALIAS_2, TEST_DATA);
+    ScopedSaveData ssd1(TEST_SYSTEM_ALIAS, TEST_DATA);
+    ScopedSaveData ssd2(TEST_SYSTEM_ALIAS_2, TEST_DATA);
 
     // [test]
     InfoVector expected;
@@ -504,7 +533,7 @@ RUNNER_TEST(T5046_CLIENT_GET_ALIAS_STATUS_NO_PASSWORD, RemoveDataEnv<0>)
     check_alias_info_list(ckmc_get_data_alias_info_list, expected);
 }
 
-RUNNER_TEST(T5047_CLIENT_GET_ALIAS_STATUS_PASSWORD_PROTECTED, RemoveDataEnv<0>)
+RUNNER_TEST(T5047_CLIENT_GET_ALIAS_STATUS_PASSWORD_PROTECTED)
 {
     // [prepare]
     // start as system service
@@ -516,9 +545,12 @@ RUNNER_TEST(T5047_CLIENT_GET_ALIAS_STATUS_PASSWORD_PROTECTED, RemoveDataEnv<0>)
     // protected with password
 
     // [prepare]
-    save_data(TEST_SYSTEM_ALIAS, TEST_DATA);
-    save_data(TEST_SYSTEM_ALIAS_2, TEST_DATA, strlen(TEST_DATA), TEST_PASSWORD);
-    save_data(TEST_SYSTEM_ALIAS_2 + "1", TEST_DATA, strlen(TEST_DATA), TEST_PASSWORD);
+    ScopedSaveData ssd1(TEST_SYSTEM_ALIAS, TEST_DATA);
+    ScopedSaveData ssd2(TEST_SYSTEM_ALIAS_2, TEST_DATA, strlen(TEST_DATA), TEST_PASSWORD);
+    ScopedSaveData ssd3(TEST_SYSTEM_ALIAS_2 + "1",
+                        TEST_DATA,
+                        strlen(TEST_DATA),
+                        TEST_PASSWORD);
 
     // [test]
     InfoVector expected;