Remove security-tests user and use libgum instead

Installing security-tests user in spec via gum-utils is not needed as it
can be added via libgum api. Due to that test directories for newly
created users are created in runtime.

Change-Id: I3446d2cb55a100422e9d963849dcc11f4894aa40

diff --git a/packaging/security-tests.spec b/packaging/security-tests.spec
index a5d79e7..b663366 100644 (file)
--- a/packaging/security-tests.spec
+++ b/packaging/security-tests.spec
@@ -25,10 +25,7 @@ BuildRequires: pkgconfig(sqlite3)
 BuildRequires: cynara-devel
 BuildRequires: pkgconfig(libtzplatform-config)
 BuildRequires: boost-devel
-BuildRequires: pkgconfig(libgum)
-Requires(post): gum-utils >= 1.0.5
-Requires(postun): gum-utils
-Requires(postun): %{_bindir}/id
+BuildRequires: pkgconfig(libgum) >= 1.0.5
 Requires: perf
 Requires: gdb
 
@@ -47,8 +44,7 @@ cmake . -DCMAKE_INSTALL_PREFIX=%{_prefix} \
         -DVERSION=%{version}              \
         -DCMAKE_BUILD_TYPE=%{?build_type:%build_type}%{!?build_type:DEBUG} \
         -DCMAKE_VERBOSE_MAKEFILE=ON       \
-        -DCYNARA_DB_DIR=%{_localstatedir}/cynara/db \
-        -DAPP_USER=security-tests-app
+        -DCYNARA_DB_DIR=%{_localstatedir}/cynara/db
 make %{?jobs:-j%jobs}
 
 %install
@@ -56,8 +52,6 @@ make %{?jobs:-j%jobs}
 ln -sf /etc/smack/test_smack_rules %{buildroot}/etc/smack/test_smack_rules_lnk
 
 %post
-%{_bindir}/gum-utils --add-user --username=security-tests-app --user_type=normal --offline
-
 find /etc/smack/test_privilege_control_DIR/ -type f -name exec -exec chmod 0755 {} +
 find /usr/apps/test_DIR/ -type f -name exec -exec chmod 0755 {} +
 
@@ -66,9 +60,6 @@ api_feature_loader --verbose
 
 echo "security-tests postinst done ..."
 
-%postun
-%{_bindir}/gum-utils --delete-user --uid=`%{_bindir}/id -u security-tests-app` --offline
-
 %files
 %manifest %{name}.manifest
 %defattr(-, root, root, -)
@@ -98,7 +89,6 @@ echo "security-tests postinst done ..."
 /usr/share/privilege-control/*
 /etc/smack/test_privilege_control_DIR/*
 /usr/apps/test_DIR/*
-/home/security-tests-app/test_DIR
 /usr/bin/test-app-efl
 /usr/bin/test-app-osp
 /usr/bin/test-app-wgt

diff --git a/tests/common/tests_common.cpp b/tests/common/tests_common.cpp
index 6808b57..8e60c2b 100644 (file)
--- a/tests/common/tests_common.cpp
+++ b/tests/common/tests_common.cpp
@@ -22,6 +22,7 @@
  */
 
 #include "tests_common.h"
+#include <fcntl.h>
 #include <sys/mman.h>
 #include <sys/stat.h>
 #include <sys/types.h>
@@ -183,3 +184,53 @@ int files_compare(int fd1, int fd2)
 
     return result;
 }
+
+void mkdirSafe(const std::string &path, mode_t mode)
+{
+    RUNNER_ASSERT_ERRNO_MSG(0 == mkdir(path.c_str(), mode),
+                            "mkdir for <" << path << "> with mode <" << mode << "> failed");
+}
+
+void creatSafe(const std::string &path, mode_t mode)
+{
+    RUNNER_ASSERT_ERRNO_MSG(-1 != creat(path.c_str(), mode),
+                            "creat for <" << path << "> with mode <" << mode << "> failed");
+}
+
+void symlinkSafe(const std::string &targetPath, const std::string &linkPath)
+{
+    RUNNER_ASSERT_ERRNO_MSG(0 == symlink(targetPath.c_str(), linkPath.c_str()),
+                            "symlink for <" << linkPath << "> to <" << targetPath << "> failed");
+}
+
+void removeDir(const std::string &path)
+{
+    DIR *d = opendir(path.c_str());
+
+    if (nullptr == d) {
+        RUNNER_ASSERT_ERRNO_MSG(errno == ENOENT, "opendir of <" << path << "> failed");
+        return;
+    }
+
+    struct dirent *dirEntry;
+    while (nullptr != (dirEntry = readdir(d))) {
+        std::string entryName(dirEntry->d_name);
+        if (entryName == "." || entryName == "..")
+            continue;
+
+        std::string entryPath(path + "/" + entryName);
+        struct stat st;
+
+        RUNNER_ASSERT_ERRNO_MSG(0 == lstat(entryPath.c_str(), &st),
+                                "stat for <" << entryPath << "> failed");
+        if (S_ISDIR(st.st_mode))
+            removeDir(entryPath);
+        else
+            RUNNER_ASSERT_ERRNO_MSG(0 == unlink(entryPath.c_str()),
+                                    "unlink for <" << entryPath << "> failed");
+    }
+
+    closedir(d);
+
+    RUNNER_ASSERT_ERRNO_MSG(0 == rmdir(path.c_str()), "rmdir for <" << path << "> failed");
+}

diff --git a/tests/common/tests_common.h b/tests/common/tests_common.h
index c03d37a..88c8205 100644 (file)
--- a/tests/common/tests_common.h
+++ b/tests/common/tests_common.h
@@ -48,6 +48,10 @@ void add_process_group(const char* group_name);
 void remove_process_group(const char* group_name);
 std::string formatCstr(const char *cstr);
 int files_compare(int fd1, int fd2);
+void mkdirSafe(const std::string &path, mode_t mode);
+void creatSafe(const std::string &path, mode_t mode);
+void symlinkSafe(const std::string &targetPath, const std::string &linkPath);
+void removeDir(const std::string &path);
 
 #define RUNNER_TEST_SMACK(Proc)                                                     \
     void Proc();                                                                    \

diff --git a/tests/security-manager-tests/CMakeLists.txt b/tests/security-manager-tests/CMakeLists.txt
index c185493..eb3ed39 100644 (file)
--- a/tests/security-manager-tests/CMakeLists.txt
+++ b/tests/security-manager-tests/CMakeLists.txt
@@ -75,8 +75,3 @@ INSTALL(DIRECTORY
     ${PROJECT_SOURCE_DIR}/tests/security-manager-tests/test_DIR
     DESTINATION /usr/apps/
 )
-
-INSTALL(DIRECTORY
-    ${PROJECT_SOURCE_DIR}/tests/security-manager-tests/test_DIR
-    DESTINATION /home/${APP_USER}/
-)

diff --git a/tests/security-manager-tests/security_manager_tests.cpp b/tests/security-manager-tests/security_manager_tests.cpp
index 0f58d93..7fb04cd 100644 (file)
--- a/tests/security-manager-tests/security_manager_tests.cpp
+++ b/tests/security-manager-tests/security_manager_tests.cpp
@@ -17,6 +17,7 @@
 #include <libprivilege-control_test_common.h>
 #include <tests_common.h>
 
+#include <tzplatform_config.h>
 #include <security-manager.h>
 #include <sm_api.h>
 #include <sm_db.h>
@@ -29,6 +30,7 @@
 using namespace SecurityManagerTest;
 
 DEFINE_SMARTPTR(cap_free, _cap_struct, CapsSetsUniquePtr);
+DEFINE_SMARTPTR(tzplatform_context_destroy, tzplatform_context, TzPlatformContextPtr);
 
 static const privileges_t SM_ALLOWED_PRIVILEGES = {
     "http://tizen.org/privilege/location",
@@ -48,8 +50,10 @@ static const std::vector<std::string> SM_ALLOWED_GROUPS = {"db_browser", "db_ala
 static const char *const SM_PRIVATE_PATH = "/usr/apps/test_DIR/app_dir";
 static const char *const SM_PUBLIC_RO_PATH = "/usr/apps/test_DIR/app_dir_public_ro";
 static const char *const SM_DENIED_PATH = "/usr/apps/test_DIR/non_app_dir";
-static const char *const SM_PRIVATE_PATH_FOR_USER = "/home/" APP_USER "/test_DIR";
 static const char *const ANY_USER_REPRESENTATION = "anyuser";/*this may be actually any string*/
+static const std::string EXEC_FILE("exec");
+static const std::string NORMAL_FILE("normal");
+static const std::string LINK_PREFIX("link_to_");
 
 static void generateAppLabel(const std::string &pkgId, std::string &label)
 {
@@ -473,8 +477,6 @@ RUNNER_CHILD_TEST_NOSMACK(security_manager_03_set_label_from_appid_nosmack)
     uninstall_app(app_id, pkg_id, true);
 }
 
-
-
 static void prepare_request(InstallRequest &request,
               const char *const app_id,
               const char *const pkg_id,
@@ -490,27 +492,52 @@ static void prepare_request(InstallRequest &request,
         request.setUid(uid);
 }
 
+static uid_t getGlobalUserId(void)
+{
+    return tzplatform_getuid(TZ_SYS_GLOBALAPP_USER);
+}
 
-static struct passwd* get_app_pw()
+static const std::string appDirPath(const TemporaryTestUser &user)
 {
-    struct passwd *pw = nullptr;
-    errno = 0;
-    while(!(pw = getpwnam(APP_USER))) {
-        RUNNER_ASSERT_ERRNO_MSG(errno == EINTR, "getpwnam() failed");
-    }
-    return pw;
+    struct tzplatform_context *tzCtxPtr = nullptr;
+
+    RUNNER_ASSERT(0 == tzplatform_context_create(&tzCtxPtr));
+    TzPlatformContextPtr tzCtxPtrSmart(tzCtxPtr);
+
+    RUNNER_ASSERT_MSG(0 == tzplatform_context_set_user(tzCtxPtr, user.getUid()),
+                      "Unable to set user <" << user.getUserName() << "> for tzplatform context");
+
+    const char *appDir = tzplatform_context_getenv(tzCtxPtr,
+                                getGlobalUserId() == user.getUid() ? TZ_SYS_RW_APP : TZ_USER_APP);
+    RUNNER_ASSERT_MSG(nullptr != appDir,
+                      "tzplatform_context_getenv failed"
+                          << "for getting sys rw app of user <" << user.getUserName() << ">");
+
+    return appDir;
+}
+
+static const std::string nonAppDirPath(const TemporaryTestUser &user)
+{
+    return TMP_DIR + "/" + user.getUserName();
 }
 
+static const std::string uidToStr(const uid_t uid)
+{
+    return std::to_string(static_cast<unsigned int>(uid));
+}
 
 static void install_and_check(const char *const sm_app_id,
                               const char *const sm_pkg_id,
-                              const std::string &user, uid_t uid,
-                              const std::string &user_path = SM_PRIVATE_PATH_FOR_USER)
+                              const TemporaryTestUser& user,
+                              const std::string &appDir,
+                              bool requestUid)
 {
     InstallRequest requestPublic;
 
     //install app for non-root user and try to register public path (should fail)
-    prepare_request(requestPublic, sm_app_id, sm_pkg_id, SECURITY_MANAGER_PATH_PUBLIC, user_path.c_str(), uid);
+    prepare_request(requestPublic, sm_app_id, sm_pkg_id,
+                    SECURITY_MANAGER_PATH_PUBLIC, appDir.c_str(),
+                    requestUid ? user.getUid() : 0);
 
     Api::install(requestPublic, SECURITY_MANAGER_ERROR_AUTHENTICATION_FAILED);
 
@@ -518,7 +545,9 @@ static void install_and_check(const char *const sm_app_id,
 
     //install app for non-root user
     //should fail (users may only register folders inside their home)
-    prepare_request(requestPrivate, sm_app_id, sm_pkg_id, SECURITY_MANAGER_PATH_PRIVATE, SM_PRIVATE_PATH, uid);
+    prepare_request(requestPrivate, sm_app_id, sm_pkg_id,
+                    SECURITY_MANAGER_PATH_PRIVATE, SM_PRIVATE_PATH,
+                    requestUid ? user.getUid() : 0);
 
     Api::install(requestPrivate, SECURITY_MANAGER_ERROR_AUTHENTICATION_FAILED);
 
@@ -526,14 +555,73 @@ static void install_and_check(const char *const sm_app_id,
 
     //install app for non-root user
     //should succeed - this time i register folder inside user's home dir
-    prepare_request(requestPrivateUser, sm_app_id, sm_pkg_id, SECURITY_MANAGER_PATH_PRIVATE, user_path.c_str(), uid);
+    prepare_request(requestPrivateUser, sm_app_id, sm_pkg_id,
+                    SECURITY_MANAGER_PATH_PRIVATE, appDir.c_str(),
+                    requestUid ? user.getUid() : 0);
 
     for (auto &privilege : SM_ALLOWED_PRIVILEGES)
         requestPrivateUser.addPrivilege(privilege.c_str());
 
     Api::install(requestPrivateUser);
 
-    check_app_permissions(sm_app_id, sm_pkg_id, user.c_str(), SM_ALLOWED_PRIVILEGES, SM_DENIED_PRIVILEGES);
+    check_app_permissions(sm_app_id, sm_pkg_id,
+                          uidToStr(user.getUid()).c_str(),
+                          SM_ALLOWED_PRIVILEGES, SM_DENIED_PRIVILEGES);
+}
+
+static void createTestDir(const std::string &dir)
+{
+    mode_t dirMode = S_IRWXU | S_IRWXG | S_IROTH | S_IXOTH;
+    mode_t execFileMode = S_IRWXU | S_IRWXG | S_IROTH | S_IXOTH;
+    mode_t normalFileMode = S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH;
+
+    mkdirSafe(dir, dirMode);
+    creatSafe(dir + "/" + EXEC_FILE, execFileMode);
+    creatSafe(dir + "/" + NORMAL_FILE, normalFileMode);
+    symlinkSafe(dir + "/" + EXEC_FILE, dir + "/" + LINK_PREFIX + EXEC_FILE);
+    symlinkSafe(dir + "/" + NORMAL_FILE, dir + "/" + LINK_PREFIX + NORMAL_FILE);
+}
+
+static void createInnerAppDir(const std::string &dir, const std::string &nonAppDir)
+{
+    createTestDir(dir);
+
+    symlinkSafe(nonAppDir, dir + "/" + LINK_PREFIX + "non_app_dir");
+    symlinkSafe(nonAppDir + "/" + EXEC_FILE,
+                dir + "/" + LINK_PREFIX + "non_app_" + EXEC_FILE);
+    symlinkSafe(nonAppDir + "/" + NORMAL_FILE,
+                dir + "/" + LINK_PREFIX + "non_app_" + NORMAL_FILE);
+}
+
+static void generateAppDir(const TemporaryTestUser &user)
+{
+    const std::string dir = appDirPath(user);
+    const std::string nonAppDir = nonAppDirPath(user);
+
+    createInnerAppDir(dir, nonAppDir);
+    createInnerAppDir(dir + "/.inner_dir", nonAppDir);
+    createInnerAppDir(dir + "/inner_dir", nonAppDir);
+}
+
+static void generateNonAppDir(const TemporaryTestUser &user)
+{
+    const std::string dir = nonAppDirPath(user);
+
+    createTestDir(dir);
+    createTestDir(dir + "/.inner_dir");
+    createTestDir(dir + "/inner_dir");
+}
+
+static void createTestDirs(const TemporaryTestUser &user)
+{
+    generateAppDir(user);
+    generateNonAppDir(user);
+}
+
+static void removeTestDirs(const TemporaryTestUser &user)
+{
+    removeDir(appDirPath(user));
+    removeDir(nonAppDirPath(user));
 }
 
 RUNNER_CHILD_TEST(security_manager_04a_app_install_uninstall_by_app_user_for_self)
@@ -541,15 +629,20 @@ RUNNER_CHILD_TEST(security_manager_04a_app_install_uninstall_by_app_user_for_sel
     int result;
     const char *const sm_app_id = "sm_test_04a_app_id_uid";
     const char *const sm_pkg_id = "sm_test_04a_pkg_id_uid";
+    const std::string new_user_name = "sm_test_04a_user_name";
+
+    TemporaryTestUser testUser(new_user_name, GUM_USERTYPE_NORMAL, false);
 
-    struct passwd *pw = get_app_pw();
-    const std::string user =  std::to_string(static_cast<unsigned int>(pw->pw_uid));
+    removeTestDirs(testUser);
+    createTestDirs(testUser);
+
+    const std::string userAppDirPath = appDirPath(testUser);
 
     //switch user to non-root
-    result = drop_root_privileges(pw->pw_uid, pw->pw_gid);
+    result = drop_root_privileges(testUser.getUid(), testUser.getGid());
     RUNNER_ASSERT_MSG(result == 0, "drop_root_privileges failed");
 
-    install_and_check(sm_app_id, sm_pkg_id, user, 0);
+    install_and_check(sm_app_id, sm_pkg_id, testUser, userAppDirPath, false);
 
     //uninstall app as non-root user
     InstallRequest request;
@@ -557,7 +650,9 @@ RUNNER_CHILD_TEST(security_manager_04a_app_install_uninstall_by_app_user_for_sel
 
     Api::uninstall(request);
 
-    check_app_permissions(sm_app_id, sm_pkg_id, user.c_str(), SM_NO_PRIVILEGES, SM_ALLOWED_PRIVILEGES);
+    check_app_permissions(sm_app_id, sm_pkg_id,
+                          uidToStr(testUser.getUid()).c_str(),
+                          SM_NO_PRIVILEGES, SM_ALLOWED_PRIVILEGES);
 }
 
 RUNNER_CHILD_TEST(security_manager_04b_app_install_by_root_for_app_user)
@@ -565,14 +660,17 @@ RUNNER_CHILD_TEST(security_manager_04b_app_install_by_root_for_app_user)
     int result;
     const char *const sm_app_id = "sm_test_04b_app_id_uid";
     const char *const sm_pkg_id = "sm_test_04b_pkg_id_uid";
+    const std::string new_user_name = "sm_test_04b_user_name";
+
+    TemporaryTestUser testUser(new_user_name, GUM_USERTYPE_NORMAL, false);
 
-    struct passwd *pw = get_app_pw();
-    const std::string user =  std::to_string(static_cast<unsigned int>(pw->pw_uid));
+    removeTestDirs(testUser);
+    createTestDirs(testUser);
 
-    install_and_check(sm_app_id, sm_pkg_id, user, pw->pw_uid);
+    install_and_check(sm_app_id, sm_pkg_id, testUser, appDirPath(testUser), true);
 
     //switch user to non-root - root may not uninstall apps for specified users
-    result = drop_root_privileges(pw->pw_uid, pw->pw_gid);
+    result = drop_root_privileges(testUser.getUid(), testUser.getGid());
     RUNNER_ASSERT_MSG(result == 0, "drop_root_privileges failed");
 
     //uninstall app as non-root user
@@ -581,7 +679,9 @@ RUNNER_CHILD_TEST(security_manager_04b_app_install_by_root_for_app_user)
 
     Api::uninstall(request);
 
-    check_app_permissions(sm_app_id, sm_pkg_id, user.c_str(), SM_NO_PRIVILEGES, SM_ALLOWED_PRIVILEGES);
+    check_app_permissions(sm_app_id, sm_pkg_id,
+                          uidToStr(testUser.getUid()).c_str(),
+                          SM_NO_PRIVILEGES, SM_ALLOWED_PRIVILEGES);
 }