CKM: Unlock journald logs

[Problem] Journald logging fails after dropping root privileges and changing
the label.
[Solution] Change execute label to User so that sockets created by ckm-tests
are allowed to wx to System. Add permissions for custom label to wx to System::Run.

[Verification] Run ckm-tests and check journald logs for smack messages. There
should be none.

Change-Id: I8ddca950755f3b7079ae42fba4416b506ea9e35e

diff --git a/packaging/security-tests.manifest b/packaging/security-tests.manifest
index e6064d1..9a62ddc 100644 (file)
--- a/packaging/security-tests.manifest
+++ b/packaging/security-tests.manifest
@@ -17,7 +17,7 @@
         <filesystem path="/usr/bin/security-server-tests-dbus" exec_label="_" />
         <filesystem path="/usr/bin/security-manager-tests" exec_label="_" />
         <filesystem path="/usr/bin/cynara-tests" exec_label="_" />
-        <filesystem path="/usr/bin/ckm-tests" exec_label="_" />
+        <filesystem path="/usr/bin/ckm-tests" exec_label="User" />
 
         <filesystem path="/usr/bin/test-app-wgt" exec_label="User" />
         <filesystem path="/usr/bin/test-app-efl" exec_label="User" />

diff --git a/src/ckm/access_provider2.cpp b/src/ckm/access_provider2.cpp
index 1d257cb..4e895d6 100644 (file)
--- a/src/ckm/access_provider2.cpp
+++ b/src/ckm/access_provider2.cpp
@@ -31,12 +31,14 @@ AccessProvider::AccessProvider(const std::string &mySubject)
   : m_mySubject(mySubject), m_inSwitchContext(false)
 {
     RUNNER_ASSERT_MSG(m_mySubject.size() > 0, "No smack label provided to AccessProvider!");
+    allowJournaldLogs();
 }
 
 AccessProvider::AccessProvider(const std::string &mySubject, int uid, int gid)
   : m_mySubject(mySubject), m_inSwitchContext(false)
 {
     RUNNER_ASSERT_MSG(m_mySubject.size() > 0, "No smack label provided to AccessProvider!");
+    allowJournaldLogs();
     applyAndSwithToUser(uid, gid);
 }
 
@@ -77,6 +79,10 @@ void AccessProvider::applyAndSwithToUser(int uid, int gid)
     m_inSwitchContext = true;
 }
 
+void AccessProvider::allowJournaldLogs() {
+    allowAPI("System::Run","wx"); // necessary for logging with journald
+}
+
 ScopedAccessProvider::~ScopedAccessProvider()
 {
     if(m_inSwitchContext == true)

diff --git a/src/ckm/access_provider2.h b/src/ckm/access_provider2.h
index bcf138b..b7c714b 100644 (file)
--- a/src/ckm/access_provider2.h
+++ b/src/ckm/access_provider2.h
@@ -40,6 +40,8 @@ public:
     void applyAndSwithToUser(int uid, int gid);
 
 private:
+    void allowJournaldLogs();
+
     SmackAccess m_smackAccess;
 protected:
     std::string m_mySubject;