Check smack leftovers after uninstallation

Not all smack rules are removed after user removal. It is due to improper
handling of hybridity update when apps are installed for different user than
the one passed in the update request.

Check it in security_manager_09_app. The check would fail. It has been marked
as "ignored" until proper fix lands in security-manager.

Change-Id: I7936d711e6a3f0dc14ecb405f35247b20f4cb37a

diff --git a/src/common/scoped_installer.h b/src/common/scoped_installer.h
index 82175ce..2eafe25 100644 (file)
--- a/src/common/scoped_installer.h
+++ b/src/common/scoped_installer.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2016-2019 Samsung Electronics Co., Ltd All Rights Reserved
+ * Copyright (c) 2016-2020 Samsung Electronics Co., Ltd All Rights Reserved
  *
  *    Licensed under the Apache License, Version 2.0 (the "License");
  *    you may not use this file except in compliance with the License.
@@ -35,11 +35,13 @@
 
 class ScopedInstaller {
 public:
-    ScopedInstaller(const AppInstallHelper &app, bool requestUid = true)
+    ScopedInstaller(const AppInstallHelper &app,
+                    bool requestUid = true,
+                    lib_retcode expectedResult = SECURITY_MANAGER_SUCCESS)
         : m_appIds({app.getAppId()}),
           m_uid(app.getUID()),
           m_installType(app.getInstallType()),
-          m_shouldUninstall(true),
+          m_shouldUninstall(expectedResult == SECURITY_MANAGER_SUCCESS),
           m_requestUid(requestUid),
           m_creatorPid(getpid())
     {
@@ -67,7 +69,7 @@ public:
         for (const auto &priv : app.getAppDefinedPrivileges())
             instReq.addAppDefinedPrivilege(priv);
 
-        SecurityManagerTest::Api::install(instReq);
+        SecurityManagerTest::Api::install(instReq, expectedResult);
     }
 
     ScopedInstaller(const std::vector<std::string> &appIds, const std::string &pkgId)

diff --git a/src/security-manager-tests/test_cases.cpp b/src/security-manager-tests/test_cases.cpp
index 72e17e4..b009a93 100644 (file)
--- a/src/security-manager-tests/test_cases.cpp
+++ b/src/security-manager-tests/test_cases.cpp
@@ -385,52 +385,26 @@ RUNNER_TEST(security_manager_08_user_double_add_double_remove)
 
 RUNNER_TEST(security_manager_09_app_install_constraint_check)
 {
-    auto install = [](const TemporaryTestUser& user,
-                      const char *pkgId,
-                      const char *appId,
-                      const char *version,
-                      const char *author,
-                      bool isHybrid,
-                      enum lib_retcode expected,
-                      bool uninstall = true)
+    auto install = [](const AppInstallHelperExt& app, bool success)
     {
-        InstallRequest request;
-        request.setAppId(appId);
-        request.setPkgId(pkgId);
-        request.setAppTizenVersion(version);
-        request.setAuthorId(author);
-        request.setUid(user.getUid());
-        if (isHybrid)
-            request.setHybrid();
-        Api::install(request, expected);
-
-        if(expected == SECURITY_MANAGER_SUCCESS && uninstall) {
-            Api::uninstall(request);
-        }
+        auto expected = success ? SECURITY_MANAGER_SUCCESS : SECURITY_MANAGER_ERROR_INPUT_PARAM;
+        ScopedInstaller appInstall(app, true, expected);
+        if (success)
+            app.checkAfterInstall();
+        return appInstall;
     };
 
-    auto update = [](const TemporaryTestUser& user,
-                     const char *pkgId,
-                     const char *appId,
-                     const char *version,
-                     const char *author,
-                     bool isHybrid,
-                     enum lib_retcode expected,
-                     bool uninstall = true)
+    auto update = [](const AppInstallHelperExt& app)
     {
         InstallRequest request;
-        request.setAppId(appId);
-        request.setPkgId(pkgId);
-        request.setAppTizenVersion(version);
-        request.setAuthorId(author);
-        request.setUid(user.getUid());
-        if (isHybrid)
+        request.setAppId(app.getAppId());
+        request.setPkgId(app.getPkgId());
+        request.setAppTizenVersion(app.getVersion());
+        request.setAuthorId(app.getAuthor());
+        request.setUid(app.getUID());
+        if (app.getIsHybrid())
             request.setHybrid();
-        Api::update(request, expected);
-
-        if(expected == SECURITY_MANAGER_SUCCESS && uninstall) {
-            Api::uninstall(request);
-        }
+        Api::update(request);
     };
 
     TemporaryTestUser users[] = {
@@ -441,36 +415,76 @@ RUNNER_TEST(security_manager_09_app_install_constraint_check)
     for (auto& gu : users)
         gu.create();
 
-    const char *const pkgId[] =   {"sm_test_09_pkg_id_0",  "sm_test_09_pkg_id_1"};
-    const char *const appId[] =   {"sm_test_09_app_id_0",  "sm_test_09_app_id_1"};
-    const char *const version[] = {"sm_test_09_version_0", "sm_test_09_version_1"};
-    const char *const author[] =  {"sm_test_09_author_0",  "sm_test_09_author_1"};
+    const char *const pkgIdPrefix[] =   {"sm_test_09_0",            "sm_test_09_1"};
+    const char *const appIdPrefix[] =   {"sm_test_09_0",            "sm_test_09_1"};
+    const char *const version[] =       {"sm_test_09_0_version",    "sm_test_09_1_version"};
+    const char *const author[] =        {"sm_test_09_0_author",     "sm_test_09_1_author"};
     bool hybrid[] = {false, true};
 
-    // uid_0, pkg_0, app_0, version_0, author_0, not hybrid
-    install(users[0], pkgId[0], appId[0], version[0], author[0], hybrid[0], SECURITY_MANAGER_SUCCESS, false);
+    std::list<AppInstallHelperExt> apps;
+
+    auto make_helper = [&](size_t userIdx,
+                           size_t pkgIdx,
+                           size_t appIdx,
+                           size_t verIdx,
+                           size_t authorIdx,
+                           size_t hybridIdx) -> AppInstallHelperExt&
+    {
+        apps.emplace_back(appIdPrefix[appIdx], pkgIdPrefix[pkgIdx], users[userIdx].getUid());
+        apps.back().setAuthor(author[authorIdx]);
+        apps.back().setVersion(version[verIdx]);
+        if (hybrid[hybridIdx])
+            apps.back().setHybrid();
+        return apps.back();
+    };
+
+    // uid_0, pkg_0, app_0, version_0, author_0, not hybrid -> ok
+    auto &app000000 = make_helper(0, 0, 0, 0, 0, 0);
+    auto i1 = install(app000000, true);
+
     // uid_1, pkg_0, app_0, version_0, author_0, not hybrid -> ok (different uid)
-    install(users[1], pkgId[0], appId[0], version[0], author[0], hybrid[0], SECURITY_MANAGER_SUCCESS);
-    // uid_0, pkg_0, app_0, version_0, author_0, hybrid -> ok for update (different hybrid setting)
-    install(users[0], pkgId[0], appId[0], version[0], author[0], hybrid[1], SECURITY_MANAGER_ERROR_INPUT_PARAM);
-    update(users[0], pkgId[0], appId[0], version[0], author[0], hybrid[1], SECURITY_MANAGER_SUCCESS, false);
+    auto& app100000 = make_helper(1, 0, 0, 0, 0, 0);
+    install(app100000, true);
+
+    // uid_0, pkg_0, app_0, version_0, author_0, hybrid -> conflicts with existing non hybrid app
+    auto& app000001 = make_helper(0, 0, 0, 0, 0, 1);
+    install(app000001, false);
+
+    // uid_0, pkg_0, app_0, version_0, author_0, hybrid -> ok (app updated to hybrid)
+    update(app000001);
+
+    // uid_0, pkg_0, app_0, version_0, author_0, hybrid -> ok (app installed again)
+    auto i2 = install(app000001, true);
+
+    // uid_0, pkg_0, app_0, version_0, author_0, not hybrid -> conflicts with existing hybrid app
+    install(app000000, false);
+
     // uid_0, pkg_0, app_1, version_0, author_0, hybrid -> ok (new app id)
-    install(users[0], pkgId[0], appId[1], version[0], author[0], hybrid[1], SECURITY_MANAGER_SUCCESS, false);
-    // uid_1, pkg_0, app_0, version_0, author_0, hybrid -> ok (different hybrid setting)
-    install(users[1], pkgId[0], appId[0], version[0], author[0], hybrid[1], SECURITY_MANAGER_SUCCESS, false);
-    // uid_1, pkg_0, app_0, version_0, author_1, not hybrid -> fail (author of app_0 must be the same)
-    install(users[1], pkgId[0], appId[0], version[0], author[1], hybrid[0], SECURITY_MANAGER_ERROR_INPUT_PARAM);
-    // uid_1, pkg_0, app_0, version_1, author_0, not hybrid -> ok (version upgrade and different hybrid setting)
-    install(users[1], pkgId[0], appId[0], version[1], author[0], hybrid[0], SECURITY_MANAGER_ERROR_INPUT_PARAM);
-    update(users[1], pkgId[0], appId[0], version[1], author[0], hybrid[0], SECURITY_MANAGER_SUCCESS);
-    // uid_1, pkg_1, app_0, version_0, author_0, not hybrid -> fail (pkg of app_0 must be the same)
-    install(users[1], pkgId[1], appId[0], version[0], author[0], hybrid[0], SECURITY_MANAGER_ERROR_INPUT_PARAM);
-    // uid_0, pkg_0, app_0, version_0, author_0, not hybrid -> ok (the same app again)
-    install(users[0], pkgId[0], appId[0], version[0], author[0], hybrid[0], SECURITY_MANAGER_SUCCESS, false);
-    // uid_0, pkg_1, app_0, version_0, author_0, not hybrid -> fail (app_name + uid must be unique)
-    install(users[0], pkgId[1], appId[0], version[0], author[0], hybrid[0], SECURITY_MANAGER_ERROR_INPUT_PARAM);
-    // uid_0, pkg_0, app_0, version_0, author_1, not hybrid -> fail (app_name + uid must be unique)
-    install(users[0], pkgId[0], appId[0], version[0], author[1], hybrid[0], SECURITY_MANAGER_ERROR_INPUT_PARAM);
+    auto& app001001 = make_helper(0, 0, 1, 0, 0, 1);
+    auto i3 = install(app001001, true);
+
+    // uid_1, pkg_0, app_0, version_0, author_0, hybrid -> ok (hybrid, different uid)
+    auto& app100001 = make_helper(1, 0, 0, 0, 0, 1);
+    auto i4 = install(app100001, true);
+
+    // uid_1, pkg_0, app_0, version_0, author_1, not hybrid -> author of app_0 must be the same
+    auto& app100010 = make_helper(1, 0, 0, 0, 1, 0);
+    install(app100010, false);
+
+    // uid_1, pkg_0, app_0, version_1, author_0, not hybrid -> ok (app version and hybridity changed)
+    auto& app100100 = make_helper(1, 0, 0, 1, 0, 0);
+    update(app100100);
+
+    // uid_1, pkg_1, app_0, version_1, author_0, not hybrid -> pkg of app_0 must be the same
+    auto& app110100 = make_helper(1, 1, 0, 1, 0, 0);
+    install(app110100, false);
+
+    for (auto& gu : users)
+        gu.remove();
+
+    RUNNER_IGNORED_MSG("Disabled until hybridity update works properly for all users");
+    for (auto& app : apps)
+        app.checkAfterUninstall();
 }
 
 RUNNER_TEST(security_manager_09a_install_many_apps_in_single_request)