src/security-manager-tests/test_cases_privacy_manager.cpp

   1 /*
   2  * Copyright (c) 2016 Samsung Electronics Co., Ltd All Rights Reserved
   3  *
   4  *    Licensed under the Apache License, Version 2.0 (the "License");
   5  *    you may not use this file except in compliance with the License.
   6  *    You may obtain a copy of the License at
   7  *
   8  *        http://www.apache.org/licenses/LICENSE-2.0
   9  *
  10  *    Unless required by applicable law or agreed to in writing, software
  11  *    distributed under the License is distributed on an "AS IS" BASIS,
  12  *    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13  *    See the License for the specific language governing permissions and
  14  *    limitations under the License.
  15  */
  16
  17 #include <cstdlib>
  18 #include <map>
  19 #include <set>
  20 #include <string>
  21 #include <sys/types.h>
  22 #include <unistd.h>
  23 #include <unordered_set>
  24 #include <utility>
  25 #include <vector>
  26
  27 #include <app_install_helper.h>
  28 #include <cynara_test_admin.h>
  29 #include <dpl/test/test_runner.h>
  30 #include <memory.h>
  31 #include <passwd_access.h>
  32 #include <policy_configuration.h>
  33 #include <privilege_info.h>
  34 #include <scoped_label.h>
  35 #include <scoped_installer.h>
  36 #include <sm_api.h>
  37 #include <sm_commons.h>
  38 #include <sm_policy_request.h>
  39 #include <sm_request.h>
  40 #include <synchronization_pipe.h>
  41 #include <temp_test_user.h>
  42 #include <tests_common.h>
  43
  44 using namespace SecurityManagerTest;
  45
  46 static const std::vector<std::string> PM_MANY_APPS = {
  47     "security_manager_pm_app_1",
  48     "security_manager_pm_app_2",
  49     "security_manager_pm_app_3",
  50     "security_manager_pm_app_4",
  51     "security_manager_pm_app_5"
  52 };
  53
  54 const std::string PRIVILEGE_MANAGER_APP = "privilege_manager";
  55 const std::string PRIVILEGE_MANAGER_PKG = "privilege_manager";
  56 const std::string PRIVILEGE_MANAGER_SELF_PRIVILEGE = "http://tizen.org/privilege/notexist";
  57 const std::string PRIVILEGE_MANAGER_ADMIN_PRIVILEGE = "http://tizen.org/privilege/internal/usermanagement";
  58
  59 static const std::map<std::string, struct app_attributes> PM_MANY_APPS_PKGS = {
  60     {"security_manager_pm_app_1", {"security_manager_pm_pkg_1", "2.1"}},
  61     {"security_manager_pm_app_2", {"security_manager_pm_pkg_2", "3.0"}},
  62     {"security_manager_pm_app_3", {"security_manager_pm_pkg_3", "2.1.1"}},
  63     {"security_manager_pm_app_4", {"security_manager_pm_pkg_4", "3.1"}},
  64     {"security_manager_pm_app_5", {"security_manager_pm_pkg_5", "2.2"}},
  65     {PRIVILEGE_MANAGER_APP, {PRIVILEGE_MANAGER_PKG, "3.0"}}
  66 };
  67
  68 static const std::vector<privileges_t> PM_MANY_APPS_PRIVILEGES = {
  69     {
  70         "http://tizen.org/privilege/internet",
  71         "http://tizen.org/privilege/display"
  72     },
  73     {
  74         "http://tizen.org/privilege/telephony",
  75         "http://tizen.org/privilege/datasharing"
  76     },
  77     {
  78         "http://tizen.org/privilege/content.write",
  79         "http://tizen.org/privilege/led",
  80         "http://tizen.org/privilege/email"
  81     },
  82     {
  83         "http://tizen.org/privilege/led",
  84         "http://tizen.org/privilege/email",
  85         "http://tizen.org/privilege/telephony",
  86         "http://tizen.org/privilege/datasharing"
  87     },
  88     {
  89         "http://tizen.org/privilege/internet",
  90         "http://tizen.org/privilege/display",
  91         "http://tizen.org/privilege/led",
  92         "http://tizen.org/privilege/email"
  93     }
  94 };
  95
  96 RUNNER_TEST_GROUP_INIT(SECURITY_MANAGER_PRIVACY_MANAGER)
  97
  98 static inline void register_current_process_as_privilege_manager(uid_t uid, bool forAdmin = false)
  99 {
 100     InstallRequest request;
 101     request.setAppId(PRIVILEGE_MANAGER_APP.c_str());
 102     request.setPkgId(PRIVILEGE_MANAGER_PKG.c_str());
 103     request.setUid(uid);
 104     request.addPrivilege(PRIVILEGE_MANAGER_SELF_PRIVILEGE.c_str());
 105     if (forAdmin)
 106         request.addPrivilege(PRIVILEGE_MANAGER_ADMIN_PRIVILEGE.c_str());
 107     Api::install(request);
 108     Api::setProcessLabel(PRIVILEGE_MANAGER_APP.c_str());
 109 };
 110
 111 RUNNER_CHILD_TEST(security_manager_10_privacy_manager_fetch_whole_policy_for_self)
 112 {
 113     //TEST DATA
 114     const std::string username("sm_test_10_user_name");
 115     unsigned int privileges_count = 0;
 116
 117     std::map<std::string, std::map<std::string, std::set<std::string>>> users2AppsMap;
 118     std::map<std::string, std::set<std::string>> apps2PrivsMap;
 119
 120     for (unsigned int i = 0; i < PM_MANY_APPS.size(); ++i) {
 121         apps2PrivsMap.insert(std::pair<std::string, std::set<std::string>>(
 122             PM_MANY_APPS.at(i), std::set<std::string>(
 123                 PM_MANY_APPS_PRIVILEGES.at(i).begin(),
 124                 PM_MANY_APPS_PRIVILEGES.at(i).end())));
 125         privileges_count += PM_MANY_APPS_PRIVILEGES.at(i).size();
 126     };
 127
 128     apps2PrivsMap.insert(std::pair<std::string, std::set<std::string>>(
 129         PRIVILEGE_MANAGER_APP, std::set<std::string>{PRIVILEGE_MANAGER_SELF_PRIVILEGE}));
 130     ++privileges_count;
 131     users2AppsMap.insert(std::pair<std::string, std::map<std::string, std::set<std::string>>>(username, apps2PrivsMap));
 132     //TEST DATA END
 133
 134     SynchronizationPipe pipe;
 135     pid_t pid = fork();
 136
 137     if (pid != 0) { //parent process
 138         pipe.claimParentEp();
 139         TemporaryTestUser tmpUser(username, GUM_USERTYPE_NORMAL, false);
 140         tmpUser.create();
 141
 142         for(const auto &user : users2AppsMap) {
 143             for(const auto &app : user.second) {
 144                 InstallRequest requestInst;
 145                 requestInst.setAppId(app.first.c_str());
 146                 try {
 147                     requestInst.setPkgId(PM_MANY_APPS_PKGS.at(app.first).package.c_str());
 148                 } catch (const std::out_of_range &e) {
 149                     RUNNER_FAIL_MSG("Couldn't find package for app: " << app.first);
 150                 };
 151                 requestInst.setUid(tmpUser.getUid());
 152
 153                 for (const auto &privilege : app.second) {
 154                     requestInst.addPrivilege(privilege.c_str());
 155                 };
 156
 157                 Api::install(requestInst);
 158             };
 159
 160             //check_app_after_install(PM_MANY_APPS[i].c_str(), PM_MANY_APPS_PKGS[i].c_str());
 161         };
 162
 163         //Start child process
 164         pipe.post();
 165         waitPid(pid);
 166
 167         tmpUser.remove();
 168     } else { //child process
 169         pipe.claimChildEp();
 170         pipe.wait();
 171
 172         uid_t uid; gid_t gid;
 173         PasswdAccess::allUser(username, uid, gid);
 174         std::string uidStr = std::to_string(uid);
 175         register_current_process_as_privilege_manager(uid);
 176         int result = drop_root_privileges(uid, gid);
 177         RUNNER_ASSERT_MSG(result == 0, "drop_root_privileges failed");
 178
 179         std::vector<PolicyEntry> policyEntries;
 180         PolicyEntry filter;
 181         Api::getPolicy(filter, policyEntries);
 182
 183         RUNNER_ASSERT_MSG(policyEntries.size() != 0, "Policy is empty");
 184         RUNNER_ASSERT_MSG(policyEntries.size() == privileges_count, "Number of policies doesn't match - should be: " << privileges_count << " and is " << policyEntries.size());
 185
 186         for (const auto &policyEntry : policyEntries) {
 187             std::string user = policyEntry.getUser();
 188             std::string app = policyEntry.getAppId();
 189             std::string privilege = policyEntry.getPrivilege();
 190
 191             RUNNER_ASSERT_MSG(user == uidStr, "Unexpected user: " << user);
 192
 193             try {
 194                 std::set<std::string>::iterator tmp = users2AppsMap.at(username).at(app).find(privilege);
 195                 if (tmp == users2AppsMap.at(username).at(app).end())
 196                     RUNNER_FAIL_MSG("Unexpected policy entry: unexpected privilege: " << policyEntry);
 197             } catch (const std::out_of_range &e) {
 198                 RUNNER_FAIL_MSG("Unexpected policy entry: unexpected app: " << policyEntry << ". Exception: " << e.what());
 199             };
 200         };
 201         exit(0);
 202     };
 203 }
 204
 205 RUNNER_CHILD_TEST(security_manager_11_privacy_manager_fetch_whole_policy_for_admin_unprivileged)
 206 {
 207     //TEST DATA
 208     const std::vector<std::string> usernames = {"sm_test_11_user_name_1", "sm_test_11_user_name_2"};
 209     unsigned int privileges_count = 0;
 210
 211     std::map<std::string, std::map<std::string, std::set<std::string>>> users2AppsMap;
 212     std::map<std::string, std::set<std::string>> apps2PrivsMap;
 213
 214     for (const auto &username : usernames) {
 215         //Only entries for one of the users will be listed
 216         privileges_count = 0;
 217
 218         for(unsigned int i = 0; i < PM_MANY_APPS.size(); ++i) {
 219             apps2PrivsMap.insert(std::pair<std::string, std::set<std::string>>(
 220                 PM_MANY_APPS.at(i), std::set<std::string>(
 221                     PM_MANY_APPS_PRIVILEGES.at(i).begin(),
 222                     PM_MANY_APPS_PRIVILEGES.at(i).end())));
 223             privileges_count+=PM_MANY_APPS_PRIVILEGES.at(i).size();
 224         };
 225
 226         users2AppsMap.insert(std::pair<std::string, std::map<std::string, std::set<std::string>>>(username, apps2PrivsMap));
 227     };
 228
 229     users2AppsMap.at(usernames.at(0)).insert(std::pair<std::string, std::set<std::string>>(
 230         PRIVILEGE_MANAGER_APP, std::set<std::string>{PRIVILEGE_MANAGER_SELF_PRIVILEGE}));
 231
 232     ++privileges_count;
 233     //TEST DATA END
 234
 235     SynchronizationPipe pipe;
 236     pid_t pid = fork();
 237
 238     if (pid != 0) { //parent process
 239         pipe.claimParentEp();
 240         std::vector<TemporaryTestUser> users = {
 241             TemporaryTestUser(usernames.at(0), GUM_USERTYPE_NORMAL, false),
 242             TemporaryTestUser(usernames.at(1), GUM_USERTYPE_ADMIN, false)
 243             };
 244
 245         users.at(0).create();
 246         users.at(1).create();
 247
 248         //Install apps for both users
 249         for(const auto &user : users) {
 250             for(const auto &app : users2AppsMap.at(user.getUserName())) {
 251                 InstallRequest requestInst;
 252                 requestInst.setAppId(app.first.c_str());
 253                 try {
 254                     requestInst.setPkgId(PM_MANY_APPS_PKGS.at(app.first).package.c_str());
 255                 } catch (const std::out_of_range &e) {
 256                     RUNNER_FAIL_MSG("Couldn't find package for app: " << app.first);
 257                 };
 258                 requestInst.setUid(user.getUid());
 259
 260                 for (const auto &privilege : app.second) {
 261                     requestInst.addPrivilege(privilege.c_str());
 262                 };
 263
 264                 Api::install(requestInst);
 265             };
 266
 267             //check_app_after_install(PM_MANY_APPS[i].c_str(), PM_MANY_APPS_PKGS[i].c_str());
 268         };
 269
 270         //Start child
 271         pipe.post();
 272         waitPid(pid);
 273
 274         for (auto &user : users)
 275             user.remove();
 276
 277     } else { //child process
 278         pipe.claimChildEp();
 279         pipe.wait();
 280
 281         uid_t uid; gid_t gid;
 282         PasswdAccess::allUser(usernames.at(0), uid, gid);
 283         std::string uidStr = std::to_string(uid);
 284         register_current_process_as_privilege_manager(uid);
 285
 286         //change uid to normal user
 287         errno = 0;
 288         int result = drop_root_privileges(uid, gid);
 289         RUNNER_ASSERT_MSG(result == 0, "drop_root_privileges failed");
 290
 291         std::vector<PolicyEntry> policyEntries;
 292         PolicyEntry filter;
 293
 294         //this call should only return privileges belonging to the current uid
 295         Api::getPolicy(filter, policyEntries);
 296
 297         RUNNER_ASSERT_MSG(policyEntries.size() != 0, "Policy is empty");
 298         RUNNER_ASSERT_MSG(policyEntries.size() == privileges_count, "Number of policies doesn't match - should be: " << privileges_count << " and is " << policyEntries.size());
 299
 300         for (const auto &policyEntry : policyEntries) {
 301             std::string user = policyEntry.getUser();
 302             std::string app = policyEntry.getAppId();
 303             std::string privilege = policyEntry.getPrivilege();
 304
 305             RUNNER_ASSERT_MSG(uidStr == user, "Unexpected user: " << user);
 306
 307             try {
 308                 std::set<std::string>::iterator tmp = users2AppsMap.at(usernames.at(0)).at(app).find(privilege);
 309                 if (tmp == users2AppsMap.at(usernames.at(0)).at(app).end())
 310                     RUNNER_FAIL_MSG("Unexpected policy entry: unexpected privilege: " << policyEntry);
 311             } catch (const std::out_of_range &e) {
 312                 RUNNER_FAIL_MSG("Unexpected policy entry: app: " << policyEntry << ". Exception: " << e.what());
 313             };
 314         };
 315         exit(0);
 316     };
 317 }
 318
 319 RUNNER_CHILD_TEST(security_manager_12_privacy_manager_fetch_whole_policy_for_admin_privileged)
 320 {
 321     std::vector<PolicyEntry> oldPolicyVec;
 322     Api::getPolicy(PolicyEntry(), oldPolicyVec);
 323     std::unordered_set<PolicyEntry> oldPolicySet(oldPolicyVec.begin(), oldPolicyVec.end());
 324
 325     //TEST DATA
 326     const std::vector<std::string> usernames = {"sm_test_12_user_name_1", "sm_test_12_user_name_2"};
 327     unsigned int privileges_count = oldPolicyVec.size();
 328
 329     std::map<std::string, std::map<std::string, std::set<std::string>>> users2AppsMap;
 330     std::map<std::string, std::set<std::string>> apps2PrivsMap;
 331
 332     for (const auto &username : usernames) {
 333         for(unsigned int i = 0; i < PM_MANY_APPS.size(); ++i) {
 334             apps2PrivsMap.insert(std::pair<std::string, std::set<std::string>>(
 335                 PM_MANY_APPS.at(i), std::set<std::string>(
 336                     PM_MANY_APPS_PRIVILEGES.at(i).begin(),
 337                     PM_MANY_APPS_PRIVILEGES.at(i).end())));
 338             privileges_count+=PM_MANY_APPS_PRIVILEGES.at(i).size();
 339         };
 340
 341         users2AppsMap.insert(std::make_pair(username, apps2PrivsMap));
 342     };
 343
 344     users2AppsMap.at(usernames.at(1)).insert(std::make_pair(PRIVILEGE_MANAGER_APP,
 345         std::set<std::string>{PRIVILEGE_MANAGER_SELF_PRIVILEGE, PRIVILEGE_MANAGER_ADMIN_PRIVILEGE}));
 346
 347     privileges_count += 2;
 348     //TEST DATA END
 349
 350     SynchronizationPipe pipe;
 351     pid_t pid = fork();
 352
 353     if (pid != 0) { //parent process
 354         pipe.claimParentEp();
 355         std::vector<TemporaryTestUser> users = {
 356             TemporaryTestUser(usernames.at(0), GUM_USERTYPE_NORMAL, false),
 357             TemporaryTestUser(usernames.at(1), GUM_USERTYPE_ADMIN, false)
 358             };
 359
 360         users.at(0).create();
 361         users.at(1).create();
 362         //Install apps for both users
 363         for(const auto &user : users) {
 364             for(const auto &app : users2AppsMap.at(user.getUserName())) {
 365                 InstallRequest requestInst;
 366                 requestInst.setAppId(app.first.c_str());
 367                 try {
 368                     requestInst.setPkgId(PM_MANY_APPS_PKGS.at(app.first).package.c_str());
 369                 } catch (const std::out_of_range &e) {
 370                     RUNNER_FAIL_MSG("Couldn't find package for app: " << app.first);
 371                 };
 372                 requestInst.setUid(user.getUid());
 373
 374                 for (const auto &privilege : app.second) {
 375                     requestInst.addPrivilege(privilege.c_str());
 376                 };
 377
 378                 Api::install(requestInst);
 379             };
 380
 381             //check_app_after_install(PM_MANY_APPS[i].c_str(), PM_MANY_APPS_PKGS[i].c_str());
 382         };
 383
 384         //Start child process
 385         pipe.post();
 386         waitPid(pid);
 387
 388         for (auto &user : users)
 389             user.remove();
 390
 391     } else { //child process
 392         pipe.claimChildEp();
 393         pipe.wait();
 394
 395         uid_t adminUid;
 396         gid_t adminGid;
 397         PasswdAccess::allUser(usernames.at(1), adminUid, adminGid);
 398         std::string adminUidStr = std::to_string(adminUid);
 399         uid_t normalUid = PasswdAccess::uid(usernames.at(0));
 400         std::string normalUidStr = std::to_string(normalUid);
 401         register_current_process_as_privilege_manager(adminUid, true);
 402
 403         //change uid to normal user
 404         int result = drop_root_privileges(adminUid, adminGid);
 405         RUNNER_ASSERT_MSG(result == 0, "drop_root_privileges failed");
 406
 407
 408         std::vector<PolicyEntry> policyEntries;
 409         //this call should succeed as the calling user is privileged
 410         Api::getPolicy(PolicyEntry(), policyEntries);
 411
 412         RUNNER_ASSERT_MSG(policyEntries.size() != 0, "Policy is empty");
 413         RUNNER_ASSERT_MSG(policyEntries.size() == privileges_count, "Number of policies doesn't match - should be: " << privileges_count << " and is " << policyEntries.size());
 414
 415         for (const auto &policyEntry : policyEntries) {
 416             if (oldPolicySet.count(policyEntry))
 417                 continue;
 418
 419             std::string user = policyEntry.getUser();
 420             std::string app = policyEntry.getAppId();
 421             std::string privilege = policyEntry.getPrivilege();
 422
 423             RUNNER_ASSERT_MSG(user == normalUidStr || user == adminUidStr, "Unexpected user: " << user);
 424
 425             std::string uidStrToLook = user == normalUidStr ? usernames.at(0) : usernames.at(1);
 426
 427             try {
 428                 std::set<std::string>::iterator tmp = users2AppsMap.at(uidStrToLook).at(app).find(privilege);
 429                 if (tmp == users2AppsMap.at(uidStrToLook).at(app).end())
 430                     RUNNER_FAIL_MSG("Unexpected policy entry: unexpected privilege: " << policyEntry);
 431             } catch (const std::out_of_range &e) {
 432                 RUNNER_FAIL_MSG("Unexpected policy entry: unexpected app: " << policyEntry << ". Exception: " << e.what());
 433             } catch (const std::invalid_argument& e) {
 434                 RUNNER_FAIL_MSG("Incorrect UID: " << user << ". Exception: " << e.what());
 435             };
 436         };
 437
 438         exit(0);
 439     };
 440 }
 441
 442 RUNNER_CHILD_TEST(security_manager_13_privacy_manager_fetch_policy_after_update_unprivileged)
 443 {
 444     //TEST DATA
 445     const std::vector<std::string> usernames = {"sm_test_13_user_name_1", "sm_test_13_user_name_2"};
 446
 447     std::map<std::string, std::map<std::string, std::set<std::string>>> users2AppsMap;
 448     std::map<std::string, std::set<std::string>> apps2PrivsMap;
 449
 450     for (const auto &username : usernames) {
 451
 452         for(unsigned int i = 0; i < PM_MANY_APPS.size(); ++i) {
 453             apps2PrivsMap.insert(std::pair<std::string, std::set<std::string>>(
 454                 PM_MANY_APPS.at(i), std::set<std::string>(
 455                     PM_MANY_APPS_PRIVILEGES.at(i).begin(),
 456                     PM_MANY_APPS_PRIVILEGES.at(i).end())));
 457         };
 458
 459         users2AppsMap.insert(std::pair<std::string, std::map<std::string, std::set<std::string>>>(username, apps2PrivsMap));
 460     };
 461
 462     users2AppsMap.at(usernames.at(1)).insert(std::pair<std::string, std::set<std::string>>(
 463         PRIVILEGE_MANAGER_APP, std::set<std::string>{PRIVILEGE_MANAGER_SELF_PRIVILEGE}));
 464
 465     //TEST DATA END
 466
 467     pid_t pid[2];
 468     SynchronizationPipe sync[2];
 469     std::vector<PolicyEntry> policyEntries;
 470
 471     pid[0] = fork();
 472
 473     if (pid[0] == 0) { //child #1 process
 474         sync[0].claimChildEp();
 475         sync[0].wait();
 476
 477         uid_t uid; gid_t gid;
 478         PasswdAccess::allUser(usernames.at(0), uid, gid);
 479         register_current_process_as_privilege_manager(uid);
 480
 481         //change uid to normal user
 482         int result = drop_root_privileges(uid, gid);
 483         RUNNER_ASSERT_MSG(result == 0, "drop_root_privileges failed");
 484
 485         PolicyEntry filter;
 486         PolicyRequest policyRequest;
 487
 488         PolicyEntry policyEntry(
 489                 PM_MANY_APPS[0],
 490                 std::to_string(uid),
 491                 "http://tizen.org/privilege/internet"
 492                 );
 493         policyEntry.setLevel("Deny");
 494
 495         policyRequest.addEntry(policyEntry);
 496         policyEntry = PolicyEntry(
 497                 PM_MANY_APPS[1],
 498                 std::to_string(uid),
 499                 "http://tizen.org/privilege/display"
 500                 );
 501         policyEntry.setLevel("Deny");
 502
 503         policyRequest.addEntry(policyEntry);
 504         Api::sendPolicy(policyRequest);
 505
 506         exit(0);
 507     } else { //parent process
 508         sync[0].claimParentEp();
 509         pid[1] = fork();
 510
 511         if (pid[1] == 0) { //child #2 process
 512             sync[1].claimChildEp();
 513             sync[1].wait();
 514
 515             uid_t target_uid = PasswdAccess::uid(usernames.at(0));
 516             uid_t my_uid;
 517             gid_t my_gid;
 518             PasswdAccess::allUser(usernames.at(1), my_uid, my_gid);
 519
 520             register_current_process_as_privilege_manager(my_uid);
 521
 522             //change uid to normal user
 523             int result = drop_root_privileges(my_uid, my_gid);
 524             RUNNER_ASSERT_MSG(result == 0, "drop_root_privileges failed");
 525
 526             PolicyEntry filter = PolicyEntry(
 527                         SECURITY_MANAGER_ANY,
 528                         std::to_string(target_uid),
 529                         SECURITY_MANAGER_ANY
 530                         );
 531
 532             //U2 requests contents of U1 privacy manager - should fail
 533             Api::getPolicyForSelf(filter, policyEntries, SECURITY_MANAGER_ERROR_ACCESS_DENIED);
 534             RUNNER_ASSERT_MSG(policyEntries.size() == 0, "Policy is not empty, but is " << policyEntries.size());
 535
 536             filter = PolicyEntry(
 537                         SECURITY_MANAGER_ANY,
 538                         SECURITY_MANAGER_ANY,
 539                         SECURITY_MANAGER_ANY
 540                         );
 541
 542             policyEntries.clear();
 543
 544             //U2 requests contents of ADMIN bucket - should fail
 545             Api::getPolicyForAdmin(filter, policyEntries, SECURITY_MANAGER_ERROR_ACCESS_DENIED);
 546             RUNNER_ASSERT_MSG(policyEntries.size() == 0, "Policy is not empty, but is " << policyEntries.size());
 547             exit(0);
 548         } else { //parent
 549             sync[1].claimParentEp();
 550             std::vector<TemporaryTestUser> users = {
 551                 TemporaryTestUser(usernames.at(0), GUM_USERTYPE_NORMAL, false),
 552                 TemporaryTestUser(usernames.at(1), GUM_USERTYPE_NORMAL, false)
 553                 };
 554
 555             users.at(0).create();
 556             users.at(1).create();
 557
 558             //Install apps for both users
 559             for(const auto &user : users2AppsMap) {
 560
 561                 for(const auto &app : user.second) {
 562                     InstallRequest requestInst;
 563                     requestInst.setAppId(app.first.c_str());
 564                     try {
 565                         requestInst.setPkgId(PM_MANY_APPS_PKGS.at(app.first).package.c_str());
 566                     } catch (const std::out_of_range &e) {
 567                         RUNNER_FAIL_MSG("Couldn't find package for app: " << app.first);
 568                     };
 569                     requestInst.setUid(users.at(0).getUid());
 570
 571                     for (const auto &privilege : app.second) {
 572                         requestInst.addPrivilege(privilege.c_str());
 573                     };
 574
 575                     Api::install(requestInst);
 576                 };
 577
 578                 //check_app_after_install(PM_MANY_APPS[i].c_str(), PM_MANY_APPS_PKGS[i].c_str());
 579             };
 580
 581             //Start child #1
 582             sync[0].post();
 583             waitPid(pid[0]);
 584
 585             //Start child #2
 586             sync[1].post();
 587             waitPid(pid[1]);
 588
 589             for (auto &user : users)
 590                 user.remove();
 591         };
 592     };
 593 }
 594
 595 RUNNER_CHILD_TEST(security_manager_14_privacy_manager_fetch_and_update_policy_for_admin)
 596 {
 597     //TEST DATA
 598     const std::vector<std::string> usernames = {"sm_test_14_user_name_1", "sm_test_14_user_name_2"};
 599     unsigned int privileges_count = 0;
 600
 601     std::map<std::string, std::map<std::string, std::set<std::string>>> users2AppsMap;
 602     std::map<std::string, std::set<std::string>> apps2PrivsMap;
 603
 604     for (const auto &username : usernames) {
 605
 606         for(unsigned int i = 0; i < PM_MANY_APPS.size(); ++i) {
 607             apps2PrivsMap.insert(std::pair<std::string, std::set<std::string>>(
 608                 PM_MANY_APPS.at(i), std::set<std::string>(
 609                     PM_MANY_APPS_PRIVILEGES.at(i).begin(),
 610                     PM_MANY_APPS_PRIVILEGES.at(i).end())));
 611             privileges_count+=PM_MANY_APPS_PRIVILEGES.at(i).size();
 612         };
 613
 614         users2AppsMap.insert(std::pair<std::string, std::map<std::string, std::set<std::string>>>(username, apps2PrivsMap));
 615     };
 616
 617     users2AppsMap.at(usernames.at(1)).insert(std::pair<std::string, std::set<std::string>>(
 618         PRIVILEGE_MANAGER_APP, std::set<std::string>{PRIVILEGE_MANAGER_SELF_PRIVILEGE}));
 619
 620     privileges_count += 2;
 621     //TEST DATA END
 622     SynchronizationPipe pipe;
 623
 624     pid_t pid = fork();
 625     if (pid != 0) {
 626         pipe.claimParentEp();
 627         std::vector<TemporaryTestUser> users = {
 628             TemporaryTestUser(usernames.at(0), GUM_USERTYPE_NORMAL, false),
 629             TemporaryTestUser(usernames.at(1), GUM_USERTYPE_ADMIN, false)
 630             };
 631
 632         users.at(0).create();
 633         users.at(1).create();
 634
 635         //Install apps for both users
 636         for(const auto &user : users) {
 637
 638             for(const auto &app : users2AppsMap.at(user.getUserName())) {
 639                 InstallRequest requestInst;
 640                 requestInst.setAppId(app.first.c_str());
 641                 try {
 642                     requestInst.setPkgId(PM_MANY_APPS_PKGS.at(app.first).package.c_str());
 643                 } catch (const std::out_of_range &e) {
 644                     RUNNER_FAIL_MSG("Couldn't find package for app: " << app.first);
 645                 };
 646                 requestInst.setUid(user.getUid());
 647
 648                 for (const auto &privilege : app.second) {
 649                     requestInst.addPrivilege(privilege.c_str());
 650                 };
 651
 652                 Api::install(requestInst);
 653             };
 654         };
 655
 656         //Start child process
 657         pipe.post();
 658         waitPid(pid);
 659
 660         //switch back to root
 661         for (auto &user : users)
 662             user.remove();
 663
 664     } else { //child process
 665         pipe.claimChildEp();
 666         pipe.wait();
 667
 668         uid_t uid; gid_t gid;
 669         PasswdAccess::allUser(usernames.at(1), uid, gid);
 670         register_current_process_as_privilege_manager(uid, true);
 671
 672         //change uid to normal user
 673         int result = drop_root_privileges(uid, gid);
 674         RUNNER_ASSERT_MSG(result == 0, "drop_root_privileges failed");
 675
 676         PolicyRequest *policyRequest = new PolicyRequest();
 677         PolicyEntry filter;
 678         std::vector<PolicyEntry> policyEntries;
 679         //this call should succeed as the calling user is privileged
 680         Api::getPolicyForSelf(filter, policyEntries);
 681
 682         unsigned int policyNum = policyEntries.size();
 683
 684         PolicyEntry policyEntry(
 685                 SECURITY_MANAGER_ANY,
 686                 SECURITY_MANAGER_ANY,
 687                 "http://tizen.org/privilege/internet"
 688                 );
 689         policyEntry.setMaxLevel("Deny");
 690
 691         policyRequest->addEntry(policyEntry);
 692         policyEntry = PolicyEntry(
 693                 SECURITY_MANAGER_ANY,
 694                 SECURITY_MANAGER_ANY,
 695                 "http://tizen.org/privilege/display"
 696                 );
 697         policyEntry.setMaxLevel("Deny");
 698
 699         policyRequest->addEntry(policyEntry);
 700         Api::sendPolicy(*policyRequest);
 701         Api::getPolicyForAdmin(filter, policyEntries);
 702
 703         RUNNER_ASSERT_MSG(policyEntries.size() == policyNum + 2, "Number of policies doesn't match - should be: "
 704                                     << policyNum + 2 << "  and is " << policyEntries.size());
 705
 706         delete policyRequest;
 707         policyRequest = new PolicyRequest();
 708         policyEntry = PolicyEntry(
 709                 SECURITY_MANAGER_ANY,
 710                 SECURITY_MANAGER_ANY,
 711                 "http://tizen.org/privilege/internet"
 712                 );
 713         policyEntry.setMaxLevel(SECURITY_MANAGER_DELETE);
 714         policyRequest->addEntry(policyEntry);
 715
 716         policyEntry = PolicyEntry(
 717                 SECURITY_MANAGER_ANY,
 718                 SECURITY_MANAGER_ANY,
 719                 "http://tizen.org/privilege/display"
 720                 );
 721         policyEntry.setMaxLevel(SECURITY_MANAGER_DELETE);
 722
 723         policyRequest->addEntry(policyEntry);
 724         Api::sendPolicy(*policyRequest);
 725
 726         policyEntries.clear();
 727         Api::getPolicyForAdmin(filter, policyEntries);
 728         RUNNER_ASSERT_MSG(policyEntries.size() == 0, "Number of policies doesn't match - should be: 0 and is " << policyEntries.size());
 729
 730         delete policyRequest;
 731
 732         exit(0);
 733     };
 734
 735 }
 736
 737 RUNNER_CHILD_TEST(security_manager_15_privacy_manager_send_policy_update_for_admin)
 738 {
 739     AppInstallHelper app("security_manager_15_update");
 740     const char *const update_privilege = "http://tizen.org/privilege/led";
 741     const char *const check_start_bucket = "ADMIN";
 742     const std::string username("sm_test_15_username");
 743     PolicyRequest addPolicyRequest;
 744     CynaraTestAdmin::Admin admin;
 745     ScopedProcessLabel keepLabel;
 746
 747     struct message {
 748         uid_t uid;
 749         gid_t gid;
 750     } msg;
 751
 752     int pipefd[2];
 753     pid_t pid;
 754     int result = 0;
 755
 756     RUNNER_ASSERT_MSG((pipe(pipefd) != -1),"pipe failed");
 757
 758     TemporaryTestUser user(username, GUM_USERTYPE_ADMIN, false);
 759     user.create();
 760
 761     app.createInstallDir();
 762     InstallRequest inst;
 763     inst.setAppId(app.getAppId());
 764     inst.setPkgId(app.getPkgId());
 765     Api::install(inst);
 766
 767     pid = fork();
 768     RUNNER_ASSERT_MSG(pid >= 0, "fork failed");
 769     if (pid != 0)//parent process
 770     {
 771         FdUniquePtr pipeptr(pipefd+1);
 772         close(pipefd[0]);
 773
 774         register_current_process_as_privilege_manager(user.getUid(), true);
 775
 776         //send info to child
 777         msg.uid = user.getUid();
 778         msg.gid = user.getGid();
 779
 780         ssize_t written = TEMP_FAILURE_RETRY(write(pipefd[1], &msg, sizeof(struct message)));
 781         RUNNER_ASSERT_MSG((written == sizeof(struct message)),"write failed");
 782
 783         waitPid(pid);
 784
 785         admin.adminCheck(check_start_bucket, false, app.generateAppLabel().c_str(),
 786                 std::to_string(static_cast<int>(msg.uid)).c_str(), update_privilege, CYNARA_ADMIN_ALLOW, nullptr);
 787     }
 788     if(pid == 0)
 789     {
 790         FdUniquePtr pipeptr(pipefd);
 791         close(pipefd[1]);
 792
 793         ssize_t fetched = TEMP_FAILURE_RETRY(read(pipefd[0], &msg, sizeof(struct message)));
 794         RUNNER_ASSERT_MSG(fetched == sizeof(struct message), "read failed");
 795
 796         //become admin privacy manager manager
 797         Api::setProcessLabel(PRIVILEGE_MANAGER_APP.c_str());
 798         result = drop_root_privileges(msg.uid, msg.gid);
 799         RUNNER_ASSERT_MSG(result == 0, "drop_root_privileges failed");
 800
 801         PolicyEntry entry(app.getAppId(), std::to_string(static_cast<int>(msg.uid)), update_privilege);
 802         entry.setMaxLevel("Allow");
 803
 804         addPolicyRequest.addEntry(entry);
 805         Api::sendPolicy(addPolicyRequest);
 806         exit(0);
 807     }
 808 }
 809
 810 RUNNER_CHILD_TEST(security_manager_15_privacy_manager_send_policy_update_for_admin_wildcard)
 811 {
 812     const char *const update_other_app_id = "security_manager_15_update_other_app_id";
 813     const char *const update_other_pkg_id = "security_manager_15_update_other_pkg_id";
 814     const char *const update_privilege = "http://tizen.org/privilege/led";
 815     const char *const check_start_bucket = "ADMIN";
 816     const std::string username("sm_test_15_username");
 817     PolicyRequest addPolicyRequest;
 818     CynaraTestAdmin::Admin admin;
 819     ScopedProcessLabel keepLabel;
 820
 821     struct message {
 822         uid_t uid;
 823         gid_t gid;
 824     } msg;
 825
 826     int pipefd[2];
 827     pid_t pid;
 828     int result = 0;
 829
 830     RUNNER_ASSERT_MSG((pipe(pipefd) != -1),"pipe failed");
 831
 832     TemporaryTestUser user(username, GUM_USERTYPE_ADMIN, false);
 833     user.create();
 834
 835     pid = fork();
 836     RUNNER_ASSERT_MSG(pid >= 0, "fork failed");
 837     if (pid != 0)//parent process
 838     {
 839         FdUniquePtr pipeptr(pipefd+1);
 840         close(pipefd[0]);
 841
 842         register_current_process_as_privilege_manager(user.getUid(), true);
 843
 844         //send info to child
 845         msg.uid = user.getUid();
 846         msg.gid = user.getGid();
 847
 848         ssize_t written = TEMP_FAILURE_RETRY(write(pipefd[1], &msg, sizeof(struct message)));
 849         RUNNER_ASSERT_MSG((written == sizeof(struct message)),"write failed");
 850
 851         waitPid(pid);
 852
 853         admin.adminCheck(check_start_bucket, false, generateProcessLabel(update_other_app_id, update_other_pkg_id).c_str(),
 854                 std::to_string(static_cast<int>(msg.uid)).c_str(), update_privilege, CYNARA_ADMIN_ALLOW, nullptr);
 855     }
 856     if(pid == 0)
 857     {
 858         FdUniquePtr pipeptr(pipefd);
 859         close(pipefd[1]);
 860
 861         ssize_t fetched = TEMP_FAILURE_RETRY(read(pipefd[0], &msg, sizeof(struct message)));
 862         RUNNER_ASSERT_MSG(fetched == sizeof(struct message), "read failed");
 863
 864         //become admin privacy manager manager
 865         Api::setProcessLabel(PRIVILEGE_MANAGER_APP.c_str());
 866         result = drop_root_privileges(msg.uid, msg.gid);
 867         RUNNER_ASSERT_MSG(result == 0, "drop_root_privileges failed");
 868
 869         // use wildcard as appId
 870         PolicyEntry entry(SECURITY_MANAGER_ANY, std::to_string(static_cast<int>(msg.uid)), update_privilege);
 871         entry.setMaxLevel("Allow");
 872
 873         addPolicyRequest.addEntry(entry);
 874         Api::sendPolicy(addPolicyRequest);
 875         exit(0);
 876     }
 877 }
 878
 879 RUNNER_CHILD_TEST(security_manager_15_privacy_manager_send_policy_update_for_self)
 880 {
 881     AppInstallHelper app("security_manager_15_update");
 882     const char *const update_privilege = "http://tizen.org/privilege/led";
 883     const char *const check_start_bucket = "";
 884     const std::string username("sm_test_15_username");
 885     PolicyRequest addPolicyRequest;
 886     CynaraTestAdmin::Admin admin;
 887     ScopedProcessLabel keepLabel;
 888
 889     struct message {
 890         uid_t uid;
 891         gid_t gid;
 892     } msg;
 893
 894     int pipefd[2];
 895     pid_t pid;
 896     int result = 0;
 897
 898     RUNNER_ASSERT_MSG((pipe(pipefd) != -1),"pipe failed");
 899
 900     TemporaryTestUser user(username, GUM_USERTYPE_NORMAL, false);
 901     user.create();
 902
 903     app.createInstallDir();
 904     InstallRequest inst;
 905     inst.setAppId(app.getAppId());
 906     inst.setPkgId(app.getPkgId());
 907     Api::install(inst);
 908
 909     pid = fork();
 910     RUNNER_ASSERT_MSG(pid >= 0, "fork failed");
 911     if (pid != 0)//parent process
 912     {
 913         FdUniquePtr pipeptr(pipefd+1);
 914         close(pipefd[0]);
 915
 916         register_current_process_as_privilege_manager(user.getUid(), false);
 917
 918         //send info to child
 919         msg.uid = user.getUid();
 920         msg.gid = user.getGid();
 921
 922         ssize_t written = TEMP_FAILURE_RETRY(write(pipefd[1], &msg, sizeof(struct message)));
 923         RUNNER_ASSERT_MSG((written == sizeof(struct message)),"write failed");
 924
 925         waitPid(pid);
 926
 927         admin.adminCheck(check_start_bucket, false, app.generateAppLabel().c_str(),
 928                 std::to_string(static_cast<int>(msg.uid)).c_str(), update_privilege, CYNARA_ADMIN_ALLOW, nullptr);
 929     }
 930     if(pid == 0)
 931     {
 932         FdUniquePtr pipeptr(pipefd);
 933         close(pipefd[1]);
 934
 935         ssize_t fetched = TEMP_FAILURE_RETRY(read(pipefd[0], &msg, sizeof(struct message)));
 936         RUNNER_ASSERT_MSG(fetched == sizeof(struct message), "read failed");
 937
 938         //become admin privacy manager manager
 939         Api::setProcessLabel(PRIVILEGE_MANAGER_APP.c_str());
 940         result = drop_root_privileges(msg.uid, msg.gid);
 941         RUNNER_ASSERT_MSG(result == 0, "drop_root_privileges failed");
 942
 943         PolicyEntry entry(app.getAppId(), std::to_string(static_cast<int>(msg.uid)), update_privilege);
 944         entry.setLevel("Allow");
 945
 946         addPolicyRequest.addEntry(entry);
 947         Api::sendPolicy(addPolicyRequest);
 948         exit(0);
 949     }
 950 }
 951
 952 RUNNER_CHILD_TEST(security_manager_16_policy_levels_get)
 953 {
 954     const std::string username("sm_test_16_user_cynara_policy");
 955     CynaraTestAdmin::Admin admin;
 956     int pipefd[2];
 957     pid_t pid;
 958     int result = 0;
 959
 960     struct message {
 961         uid_t uid;
 962         gid_t gid;
 963     } msg;
 964
 965     RUNNER_ASSERT_MSG((pipe(pipefd) != -1),"pipe failed");
 966
 967     TemporaryTestUser user(username, GUM_USERTYPE_NORMAL, false);
 968     user.create();
 969
 970     pid = fork();
 971     RUNNER_ASSERT_MSG(pid >= 0, "fork failed");
 972     if (pid != 0)//parent process
 973     {
 974         FdUniquePtr pipeptr(pipefd+1);
 975         close(pipefd[0]);
 976
 977         //send info to child
 978         msg.uid = user.getUid();
 979         msg.gid = user.getGid();
 980
 981         ssize_t written = TEMP_FAILURE_RETRY(write(pipefd[1], &msg, sizeof(struct message)));
 982         RUNNER_ASSERT_MSG((written == sizeof(struct message)),"write failed");
 983
 984         waitPid(pid);
 985     }
 986     if(pid == 0)
 987     {
 988         int ret;
 989         char** levels;
 990         std::string allow_policy, deny_policy;
 991         size_t count;
 992         FdUniquePtr pipeptr(pipefd);
 993         close(pipefd[1]);
 994
 995         ssize_t fetched = TEMP_FAILURE_RETRY(read(pipefd[0], &msg, sizeof(struct message)));
 996         RUNNER_ASSERT_MSG(fetched == sizeof(struct message), "read failed");
 997
 998         //become admin privacy manager manager
 999         result = drop_root_privileges(msg.uid, msg.gid);
1000         RUNNER_ASSERT_MSG(result == 0, "drop_root_privileges failed");
1001
1002         // 3 should be there when ask-user is installed
1003         ret = security_manager_policy_levels_get(&levels, &count);
1004
1005         RUNNER_ASSERT_MSG((lib_retcode)ret == SECURITY_MANAGER_SUCCESS,
1006                 "Invlid return code: " << ret);
1007
1008         RUNNER_ASSERT_MSG(count == 3, "Invalid number of policy levels. Should be 3, instead there is: " << static_cast<int>(count));
1009
1010         deny_policy = std::string(levels[0]);
1011         allow_policy = std::string(levels[count-1]);
1012
1013         // first should always be Deny
1014         RUNNER_ASSERT_MSG(deny_policy.compare("Deny") == 0,
1015                 "Invalid first policy level. Should be Deny, instead there is: " << levels[0]);
1016
1017         // last should always be Allow
1018         RUNNER_ASSERT_MSG(allow_policy.compare("Allow") == 0,
1019                 "Invalid last policy level. Should be Allow, instead there is: " << levels[count-1]);
1020
1021         security_manager_policy_levels_free(levels, count);
1022         exit(0);
1023     }
1024 }
1025
1026 RUNNER_CHILD_TEST(security_manager_17_privacy_manager_delete_policy_for_self)
1027 {
1028     AppInstallHelper app("security_manager_17_update");
1029     const char *const update_privilege = "http://tizen.org/privilege/led";
1030     const char *const check_start_bucket = "";
1031     const std::string username("sm_test_17_username");
1032     PolicyRequest addPolicyRequest;
1033     CynaraTestAdmin::Admin admin;
1034
1035     struct message {
1036         uid_t uid;
1037         gid_t gid;
1038     } msg;
1039
1040     int pipefd[2];
1041     int pipefd2[2];
1042     pid_t pid[2];
1043     int result = 0;
1044     ScopedProcessLabel keepLabel;
1045
1046     RUNNER_ASSERT_MSG((pipe(pipefd) != -1),"pipe failed");
1047     RUNNER_ASSERT_MSG((pipe(pipefd2) != -1),"second pipe failed");
1048
1049     TemporaryTestUser user(username, GUM_USERTYPE_NORMAL, false);
1050     user.create();
1051
1052     app.createInstallDir();
1053     InstallRequest inst;
1054     inst.setAppId(app.getAppId());
1055     inst.setPkgId(app.getPkgId());
1056     Api::install(inst);
1057
1058     pid[0] = fork();
1059     RUNNER_ASSERT_MSG(pid[0] >= 0, "fork failed");
1060     if (pid[0] != 0)//parent process
1061     {
1062         FdUniquePtr pipeptr(pipefd+1);
1063         close(pipefd[0]);
1064
1065         register_current_process_as_privilege_manager(user.getUid(), false);
1066
1067         //send info to child
1068         msg.uid = user.getUid();
1069         msg.gid = user.getGid();
1070
1071         ssize_t written = TEMP_FAILURE_RETRY(write(pipefd[1], &msg, sizeof(struct message)));
1072         RUNNER_ASSERT_MSG((written == sizeof(struct message)),"write failed");
1073
1074         waitPid(pid[0]);
1075
1076         admin.adminCheck(check_start_bucket, false, app.generateAppLabel().c_str(),
1077                 std::to_string(static_cast<int>(msg.uid)).c_str(), update_privilege, CYNARA_ADMIN_ALLOW, nullptr);
1078
1079         pid[1] = fork();
1080         if (pid[1] != 0)//parent process
1081         {
1082             FdUniquePtr pipeptr(pipefd2+1);
1083             close(pipefd2[0]);
1084
1085             //send info to child
1086             msg.uid = user.getUid();
1087             msg.gid = user.getGid();
1088
1089             ssize_t written = TEMP_FAILURE_RETRY(write(pipefd2[1], &msg, sizeof(struct message)));
1090             RUNNER_ASSERT_MSG((written == sizeof(struct message)),"write failed");
1091
1092             waitPid(pid[1]);
1093
1094             admin.adminCheck(check_start_bucket, false, app.generateAppLabel().c_str(),
1095                     std::to_string(static_cast<int>(msg.uid)).c_str(), update_privilege, CYNARA_ADMIN_DENY, nullptr);
1096         }
1097         if(pid[1] == 0)
1098         {
1099             FdUniquePtr pipeptr(pipefd2);
1100             close(pipefd2[1]);
1101
1102             ssize_t fetched = TEMP_FAILURE_RETRY(read(pipefd2[0], &msg, sizeof(struct message)));
1103             RUNNER_ASSERT_MSG(fetched == sizeof(struct message), "read failed");
1104
1105             result = drop_root_privileges(msg.uid, msg.gid);
1106             RUNNER_ASSERT_MSG(result == 0, "drop_root_privileges failed");
1107
1108             // delete this entry
1109             PolicyRequest deletePolicyRequest;
1110             PolicyEntry deleteEntry(app.getAppId(), std::to_string(static_cast<int>(msg.uid)), update_privilege);
1111             deleteEntry.setLevel(SECURITY_MANAGER_DELETE);
1112
1113             deletePolicyRequest.addEntry(deleteEntry);
1114             Api::sendPolicy(deletePolicyRequest);
1115             exit(0);
1116         }
1117     }
1118     if(pid[0] == 0)
1119     {
1120         FdUniquePtr pipeptr(pipefd);
1121         close(pipefd[1]);
1122
1123         ssize_t fetched = TEMP_FAILURE_RETRY(read(pipefd[0], &msg, sizeof(struct message)));
1124         RUNNER_ASSERT_MSG(fetched == sizeof(struct message), "read failed");
1125
1126         //become admin privacy manager manager
1127         Api::setProcessLabel(PRIVILEGE_MANAGER_APP.c_str());
1128         result = drop_root_privileges(msg.uid, msg.gid);
1129         RUNNER_ASSERT_MSG(result == 0, "drop_root_privileges failed");
1130
1131         PolicyEntry entry(app.getAppId(), std::to_string(static_cast<int>(msg.uid)), update_privilege);
1132         entry.setLevel("Allow");
1133
1134         addPolicyRequest.addEntry(entry);
1135         Api::sendPolicy(addPolicyRequest);
1136         exit(0);
1137     }
1138 }
1139
1140 RUNNER_CHILD_TEST(security_manager_17_privacy_manager_fetch_whole_policy_for_self_filtered)
1141 {
1142     const std::string username("sm_test_17_user_name");
1143
1144     struct message {
1145         uid_t uid;
1146         gid_t gid;
1147         unsigned int privileges_count;
1148     } msg;
1149
1150     int pipefd[2];
1151     pid_t pid;
1152     int result = 0;
1153     ScopedProcessLabel keepLabel;
1154
1155     RUNNER_ASSERT_MSG((pipe(pipefd) != -1),"pipe failed");
1156
1157     pid = fork();
1158     RUNNER_ASSERT_MSG(pid >= 0, "fork failed");
1159     if (pid != 0)//parent process
1160     {
1161         FdUniquePtr pipeptr(pipefd+1);
1162         close(pipefd[0]);
1163
1164         TemporaryTestUser user(username, static_cast<GumUserType>(GUM_USERTYPE_NORMAL), false);
1165         user.create();
1166
1167         unsigned int privileges_count = 0;
1168
1169         for(unsigned int i = 0; i < PM_MANY_APPS.size(); ++i) {
1170             InstallRequest requestInst;
1171             requestInst.setAppId(PM_MANY_APPS[i].c_str());
1172             requestInst.setPkgId(PM_MANY_APPS_PKGS.at(PM_MANY_APPS[i]).package.c_str());
1173             requestInst.setUid(user.getUid());
1174
1175             for (auto &priv : PM_MANY_APPS_PRIVILEGES.at(i)) {
1176                 requestInst.addPrivilege(priv.c_str());
1177             };
1178
1179             Api::install(requestInst);
1180             privileges_count += PM_MANY_APPS_PRIVILEGES.at(i).size();
1181         };
1182
1183         register_current_process_as_privilege_manager(user.getUid(), false);
1184         //the above call, registers 1 new privilege for the given user, hence the incrementation of below variable
1185         ++privileges_count;
1186
1187         //send info to child
1188         msg.uid = user.getUid();
1189         msg.gid = user.getGid();
1190         msg.privileges_count = privileges_count;
1191
1192         ssize_t written = TEMP_FAILURE_RETRY(write(pipefd[1], &msg, sizeof(struct message)));
1193         RUNNER_ASSERT_MSG((written == sizeof(struct message)),"write failed");
1194
1195         waitPid(pid);
1196     }
1197     if(pid == 0)
1198     {
1199         FdUniquePtr pipeptr(pipefd);
1200         close(pipefd[1]);
1201
1202         ssize_t fetched = TEMP_FAILURE_RETRY(read(pipefd[0], &msg, sizeof(struct message)));
1203         RUNNER_ASSERT_MSG(fetched == sizeof(struct message), "read failed");
1204
1205         //become admin privacy manager manager
1206         Api::setProcessLabel(PRIVILEGE_MANAGER_APP.c_str());
1207         result = drop_root_privileges(msg.uid, msg.gid);
1208         RUNNER_ASSERT_MSG(result == 0, "drop_root_privileges failed");
1209
1210         // filter by privilege
1211         std::vector<PolicyEntry> policyEntries;
1212         PolicyEntry filter(SECURITY_MANAGER_ANY, SECURITY_MANAGER_ANY, "http://tizen.org/privilege/internet");
1213         Api::getPolicy(filter, policyEntries);
1214
1215         RUNNER_ASSERT_MSG(policyEntries.size() != 0, "Policy is empty");
1216         RUNNER_ASSERT_MSG(policyEntries.size() == 2, "Number of policies doesn't match - should be: 2 and is " << policyEntries.size());
1217
1218         // filter by other privilege
1219         policyEntries.clear();
1220         PolicyEntry filter2(SECURITY_MANAGER_ANY, SECURITY_MANAGER_ANY, "http://tizen.org/privilege/email");
1221         Api::getPolicy(filter2, policyEntries);
1222
1223         RUNNER_ASSERT_MSG(policyEntries.size() != 0, "Policy is empty");
1224         RUNNER_ASSERT_MSG(policyEntries.size() == 3, "Number of policies doesn't match - should be: 3 and is " << policyEntries.size());
1225
1226         // filter by appId
1227         policyEntries.clear();
1228         PolicyEntry filter3(PM_MANY_APPS[4].c_str(), SECURITY_MANAGER_ANY, SECURITY_MANAGER_ANY);
1229         Api::getPolicy(filter3, policyEntries);
1230
1231         RUNNER_ASSERT_MSG(policyEntries.size() != 0, "Policy is empty");
1232         RUNNER_ASSERT_MSG(policyEntries.size() == 4, "Number of policies doesn't match - should be: 4 and is " << policyEntries.size());
1233     }
1234 }
1235
1236 RUNNER_CHILD_TEST(security_manager_18_privacy_manager_privacy_related_privileges_policy_install_remove)
1237 {
1238     TemporaryTestUser user("sm_test_18_username", GUM_USERTYPE_NORMAL);
1239     user.create();
1240
1241     AppInstallHelper helper("sm_test_18",
1242                             user.getUid());
1243     helper.addPrivileges({
1244                              "http://tizen.org/privilege/telephony",
1245                              "http://tizen.org/privilege/led",
1246                              "http://tizen.org/privilege/callhistory.read", // privacy-related privileges start here
1247                              "http://tizen.org/privilege/account.read",
1248                              "http://tizen.org/privilege/healthinfo"
1249                          });
1250
1251     PolicyEntry filter (helper.getAppId(), user.getUidString(), SECURITY_MANAGER_ANY);
1252     std::vector<PolicyEntry> policyEntries;
1253
1254     {
1255         ScopedInstaller installer(helper);
1256         unsigned int privacyNum = 0;
1257         for (auto &priv : helper.getPrivileges()) {
1258             if (1 == privilege_info_is_privacy(priv.c_str()))
1259                 ++privacyNum;
1260         };
1261
1262         Api::getPolicy(filter, policyEntries);
1263
1264         RUNNER_ASSERT_MSG(policyEntries.size() == helper.getPrivileges().size(),
1265         "Number of policy entries doesn't match; should be " << helper.getPrivileges().size() << " but is " << policyEntries.size());
1266
1267         if (PolicyConfiguration::getIsAskuserEnabled() ) {
1268             unsigned int privacyActNum = 0;
1269             for (auto &entry : policyEntries)
1270                 if (1 == privilege_info_is_privacy(entry.getPrivilege().c_str())) {
1271                     RUNNER_ASSERT_MSG(entry.getCurrentLevel() == "Ask user", "Invalid policy setup; policy should be \"Ask user\" but is " << entry.getCurrentLevel());
1272                     ++privacyActNum;
1273                 }
1274             RUNNER_ASSERT_MSG(privacyActNum == privacyNum, "Should be " << privacyNum << " privacy privileges, but is " << privacyActNum);
1275         }
1276     }
1277
1278     policyEntries.clear();
1279
1280     Api::getPolicy(filter, policyEntries);
1281
1282     RUNNER_ASSERT_MSG(policyEntries.size() == 0, "After deinstallation, policy entries size should be 0, but is: " << policyEntries.size());
1283 }
1284
1285 RUNNER_CHILD_TEST(security_manager_19_privacy_manager_privacy_related_privileges_policy_hybrid)
1286 {
1287     TemporaryTestUser user("sm_test_19_username", GUM_USERTYPE_NORMAL);
1288     user.create();
1289
1290     AppInstallHelper helper1("sm_test_19_app_id_1",
1291                             "sm_test_19_pkg_id",
1292                             true,
1293                             user.getUid(),
1294                             "3.0",
1295                             true);  // hybrid package
1296
1297     helper1.addPrivileges({
1298                               "http://tizen.org/privilege/telephony",
1299                               "http://tizen.org/privilege/led",
1300                               "http://tizen.org/privilege/callhistory.read", // privacy-related privileges start here
1301                               "http://tizen.org/privilege/account.read",
1302                               "http://tizen.org/privilege/healthinfo"
1303                          });
1304
1305     AppInstallHelper helper2("sm_test_19_app_id_2",
1306                             "sm_test_19_pkg_id",
1307                             true,
1308                             user.getUid(),
1309                             "3.0",
1310                             true);  // hybrid package
1311
1312     helper2.addPrivileges({
1313                               "http://tizen.org/privilege/telephony",
1314                               "http://tizen.org/privilege/led",
1315                               "http://tizen.org/privilege/callhistory.read", // privacy-related privileges start here
1316                           });
1317
1318     std::vector<PolicyEntry> policyEntries;
1319
1320     PolicyEntry filter(SECURITY_MANAGER_ANY, user.getUidString(), SECURITY_MANAGER_ANY);
1321     {
1322         ScopedInstaller installer1(helper1);
1323         ScopedInstaller installer2(helper2);
1324
1325         unsigned int privacyNum1 = 0, privacyNum2 = 0;
1326
1327         for (auto &priv : helper1.getPrivileges()) {
1328             if (1 == privilege_info_is_privacy(priv.c_str()))
1329                 ++privacyNum1;
1330         };
1331
1332         for (auto &priv : helper2.getPrivileges()) {
1333             if (1 == privilege_info_is_privacy(priv.c_str()))
1334                 ++privacyNum2;
1335         };
1336
1337         Api::getPolicy(filter, policyEntries);
1338
1339         if (PolicyConfiguration::getIsAskuserEnabled() ) {
1340             unsigned int privacyAct1 = 0, privacyAct2 = 0;
1341             for (auto &entry : policyEntries) {
1342                 RUNNER_ASSERT_MSG(entry.getAppId() == helper1.getAppId() || entry.getAppId() == helper2.getAppId(),
1343                                   "Invalid appId: should be either " << helper1.getAppId() << " or " << helper2.getAppId() << " but is " << entry.getAppId());
1344                 if (1 == privilege_info_is_privacy(entry.getPrivilege().c_str())) {
1345                     RUNNER_ASSERT_MSG(entry.getCurrentLevel() == "Ask user",
1346                                       "Invalid policy setup; policy should be \"Ask user\" but is " << entry.getCurrentLevel());
1347                     if (entry.getAppId() == helper1.getAppId())
1348                         ++privacyAct1;
1349                     else
1350                         ++privacyAct2;
1351                 }
1352             }
1353             RUNNER_ASSERT_MSG(privacyNum1 == privacyAct1, "Should be " << privacyNum1 << " privacy privileges, but is " << privacyAct1);
1354             RUNNER_ASSERT_MSG(privacyNum2 == privacyAct2, "Should be " << privacyNum2 << " privacy privileges, but is " << privacyAct2);
1355         }
1356     }
1357 }
1358
1359 RUNNER_CHILD_TEST(security_manager_20_privacy_manager_privacy_related_privielges_policy_admin_check)
1360 {
1361     TemporaryTestUser user("sm_test_20_username", GUM_USERTYPE_NORMAL);
1362     user.create();
1363
1364     AppInstallHelper helper("sm_test_20",
1365                             user.getUid());
1366
1367     helper.addPrivileges({
1368                              "http://tizen.org/privilege/telephony",
1369                              "http://tizen.org/privilege/led",
1370                              "http://tizen.org/privilege/callhistory.read", // privacy-related privileges start here
1371                              "http://tizen.org/privilege/account.read",
1372                              "http://tizen.org/privilege/healthinfo"
1373                          });
1374
1375     ScopedInstaller installer(helper);
1376
1377     if (PolicyConfiguration::getIsAskuserEnabled() ) {
1378         CynaraTestAdmin::Admin admin;
1379         int policyType = 0;
1380         admin.getPolicyTypeForDescription("Ask user", policyType);
1381         for (auto &priv : helper.getPrivileges()) {
1382             if (1 == privilege_info_is_privacy(priv.c_str())) {
1383                 admin.adminCheck("", true, helper.generateAppLabel().c_str(), user.getUidString().c_str(), priv.c_str(), policyType, nullptr);
1384             }
1385         }
1386     }
1387 }