|
 |
aba7ab1 |
#!/bin/bash
|
|
|
aba7ab1 |
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
|
|
aba7ab1 |
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
|
aba7ab1 |
#
|
|
|
aba7ab1 |
# runtest.sh of /CoreOS/libselinux/Sanity/selabel-functions
|
|
|
aba7ab1 |
# Description: Test selabel functions
|
|
|
aba7ab1 |
# Author: Jan Zarsky <jzarsky@redhat.com>
|
|
|
aba7ab1 |
#
|
|
|
aba7ab1 |
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
|
aba7ab1 |
#
|
|
|
aba7ab1 |
# Copyright (c) 2016 Red Hat, Inc.
|
|
|
aba7ab1 |
#
|
|
|
aba7ab1 |
# This program is free software: you can redistribute it and/or
|
|
|
aba7ab1 |
# modify it under the terms of the GNU General Public License as
|
|
|
aba7ab1 |
# published by the Free Software Foundation, either version 2 of
|
|
|
aba7ab1 |
# the License, or (at your option) any later version.
|
|
|
aba7ab1 |
#
|
|
|
aba7ab1 |
# This program is distributed in the hope that it will be
|
|
|
aba7ab1 |
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
|
|
aba7ab1 |
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
|
|
aba7ab1 |
# PURPOSE. See the GNU General Public License for more details.
|
|
|
aba7ab1 |
#
|
|
|
aba7ab1 |
# You should have received a copy of the GNU General Public License
|
|
|
aba7ab1 |
# along with this program. If not, see http://www.gnu.org/licenses/.
|
|
|
aba7ab1 |
#
|
|
|
aba7ab1 |
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
# Include Beaker environment
|
|
|
aba7ab1 |
. /usr/bin/rhts-environment.sh || exit 1
|
|
|
aba7ab1 |
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
PACKAGE="libselinux"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlJournalStart
|
|
|
aba7ab1 |
rlPhaseStartSetup
|
|
|
aba7ab1 |
rlAssertRpm ${PACKAGE}
|
|
|
aba7ab1 |
rlAssertRpm ${PACKAGE}-devel
|
|
|
aba7ab1 |
rlAssertRpm "glibc"
|
|
|
aba7ab1 |
rlAssertRpm "gcc"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
if rlIsRHEL 6; then
|
|
|
aba7ab1 |
rlRun -l "gcc test_open.c -o test_open -lselinux -Wall -Wextra -std=c99 -DRHEL6"
|
|
|
aba7ab1 |
rlRun -l "gcc test_lookup.c -o test_lookup -lselinux -Wall -Wextra -std=c99 -DRHEL6"
|
|
|
aba7ab1 |
rlRun -l "gcc test_stats.c -o test_stats -lselinux -Wall -Wextra -std=c99 -DRHEL6"
|
|
|
aba7ab1 |
else
|
|
|
aba7ab1 |
rlRun -l "gcc test_open.c -o test_open -lselinux -Wall -Wextra -std=c99"
|
|
|
aba7ab1 |
rlRun -l "gcc test_lookup.c -o test_lookup -lselinux -Wall -Wextra -std=c99"
|
|
|
aba7ab1 |
rlRun -l "gcc test_partial.c -o test_partial -lselinux -Wall -Wextra -std=c99"
|
|
|
aba7ab1 |
rlRun -l "gcc test_best.c -o test_best -lselinux -Wall -Wextra -std=c99"
|
|
|
aba7ab1 |
rlRun -l "gcc test_stats.c -o test_stats -lselinux -Wall -Wextra -std=c99"
|
|
|
aba7ab1 |
rlRun -l "gcc test_digest.c -o test_digest -lselinux -Wall -Wextra -std=c99"
|
|
|
aba7ab1 |
fi
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
|
|
|
aba7ab1 |
rlPhaseEnd
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlPhaseStartTest "selabel_open"
|
|
|
aba7ab1 |
# syntax: ./test_open BACKEND OPT_PATH OPT_SUBSET OPT_VALIDATE OPT_BASEONLY [nopt]
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "Normal run"
|
|
|
aba7ab1 |
rlRun "./test_open CTX_FILE NULL NULL 0 0"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "Backends"
|
|
|
aba7ab1 |
rlRun "./test_open CTX_MEDIA NULL NULL 0 0" 0
|
|
|
aba7ab1 |
rlRun "./test_open CTX_X NULL NULL 0 0" 0
|
|
|
aba7ab1 |
rlRun "./test_open CTX_DB NULL NULL 0 0" 0
|
|
|
aba7ab1 |
if rlIsRHEL "7" || rlIsFedora "<26"; then
|
|
|
aba7ab1 |
rlRun "./test_open CTX_ANDROID_PROP NULL NULL 0 0" 0
|
|
|
aba7ab1 |
rlRun "./test_open 5 NULL NULL 0 0" 22
|
|
|
aba7ab1 |
fi
|
|
|
aba7ab1 |
rlRun "./test_open 2147483647 NULL NULL 0 0" 22
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "Parameter nopt"
|
|
|
aba7ab1 |
rlRun "./test_open CTX_FILE NULL NULL 0 0 2147483647" 22,139
|
|
|
aba7ab1 |
rlRun "./test_open CTX_MEDIA NULL NULL 0 0 2147483647" 22,139
|
|
|
aba7ab1 |
rlRun "./test_open CTX_X NULL NULL 0 0 2147483647" 22,139
|
|
|
aba7ab1 |
rlRun "./test_open CTX_DB NULL NULL 0 0 2147483647" 22,139
|
|
|
aba7ab1 |
if rlIsRHEL "7" || rlIsFedora "<26"; then
|
|
|
aba7ab1 |
rlRun "./test_open CTX_ANDROID_PROP NULL NULL 0 0 2147483647" 22,139
|
|
|
aba7ab1 |
fi
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlRun "./test_open CTX_FILE NULL NULL 0 0 1"
|
|
|
aba7ab1 |
rlRun "./test_open CTX_MEDIA NULL NULL 0 0 1"
|
|
|
aba7ab1 |
rlRun "./test_open CTX_X NULL NULL 0 0 1"
|
|
|
aba7ab1 |
rlRun "./test_open CTX_DB NULL NULL 0 0 1"
|
|
|
aba7ab1 |
if rlIsRHEL "7" || rlIsFedora "<26"; then
|
|
|
aba7ab1 |
rlRun "./test_open CTX_ANDROID_PROP NULL NULL 0 0 1"
|
|
|
aba7ab1 |
fi
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlRun "./test_open CTX_FILE NULL NULL 0 0 0"
|
|
|
aba7ab1 |
rlRun "./test_open CTX_MEDIA NULL NULL 0 0 0"
|
|
|
aba7ab1 |
rlRun "./test_open CTX_X NULL NULL 0 0 0"
|
|
|
aba7ab1 |
rlRun "./test_open CTX_DB NULL NULL 0 0 0"
|
|
|
aba7ab1 |
if rlIsRHEL "7" || rlIsFedora "<26"; then
|
|
|
aba7ab1 |
rlRun "./test_open CTX_ANDROID_PROP NULL NULL 0 0 0"
|
|
|
aba7ab1 |
fi
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlRun "./test_open CTX_FILE NULL NULL 0 0 -1" 22,139
|
|
|
aba7ab1 |
rlRun "./test_open CTX_MEDIA NULL NULL 0 0 -1" 22,139
|
|
|
aba7ab1 |
rlRun "./test_open CTX_X NULL NULL 0 0 -1" 22,139
|
|
|
aba7ab1 |
rlRun "./test_open CTX_DB NULL NULL 0 0 -1" 22,139
|
|
|
aba7ab1 |
if rlIsRHEL "7" || rlIsFedora "<26"; then
|
|
|
aba7ab1 |
rlRun "./test_open CTX_ANDROID_PROP NULL NULL 0 0 -1" 22,139
|
|
|
aba7ab1 |
fi
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "Path option"
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlRun "./test_open CTX_FILE $TmpDir/my_contexts NULL 0 0"
|
|
|
aba7ab1 |
rlRun "./test_open CTX_MEDIA $TmpDir/my_contexts NULL 0 0"
|
|
|
aba7ab1 |
rlRun "./test_open CTX_X $TmpDir/my_contexts NULL 0 0"
|
|
|
aba7ab1 |
rlRun "./test_open CTX_DB $TmpDir/my_contexts NULL 0 0"
|
|
|
aba7ab1 |
if rlIsRHEL "7" || rlIsFedora "<26"; then
|
|
|
aba7ab1 |
rlRun "./test_open CTX_ANDROID_PROP $TmpDir/my_contexts NULL 0 0"
|
|
|
aba7ab1 |
fi
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlRun "./test_open CTX_FILE /nonexistent NULL 0 0" 2
|
|
|
aba7ab1 |
rlRun "./test_open CTX_MEDIA /nonexistent NULL 0 0" 2
|
|
|
aba7ab1 |
rlRun "./test_open CTX_X /nonexistent NULL 0 0" 2
|
|
|
aba7ab1 |
rlRun "./test_open CTX_DB /nonexistent NULL 0 0" 2
|
|
|
aba7ab1 |
if rlIsRHEL "7" || rlIsFedora "<26"; then
|
|
|
aba7ab1 |
rlRun "./test_open CTX_ANDROID_PROP /nonexistent NULL 0 0" 2
|
|
|
aba7ab1 |
fi
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "Subset option"
|
|
|
aba7ab1 |
rlRun "./test_open CTX_FILE NULL /etc 0 0"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "Baseonly option"
|
|
|
aba7ab1 |
rlRun "./test_open CTX_FILE NULL NULL 0 1"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "Validate option"
|
|
|
aba7ab1 |
rlRun "./test_open CTX_FILE NULL NULL 1 0"
|
|
|
aba7ab1 |
rlRun "./test_open CTX_MEDIA NULL NULL 1 0"
|
|
|
aba7ab1 |
rlRun "./test_open CTX_X NULL NULL 1 0"
|
|
|
aba7ab1 |
rlRun "./test_open CTX_DB NULL NULL 1 0"
|
|
|
aba7ab1 |
if rlIsRHEL "7" || rlIsFedora "<26"; then
|
|
|
aba7ab1 |
rlRun "./test_open CTX_ANDROID_PROP NULL NULL 1 0"
|
|
|
aba7ab1 |
fi
|
|
|
aba7ab1 |
rlPhaseEnd
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlPhaseStartTest "selabel_lookup and selabel_lookup_raw"
|
|
|
aba7ab1 |
rlLogInfo "Handle"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_FILE NULL NULL 0 0 some_input 0 nohandle" 139
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_MEDIA NULL NULL 0 0 some_input 0 nohandle" 139
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_X NULL NULL 0 0 some_input 0 nohandle" 139
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_DB NULL NULL 0 0 some_input 0 nohandle" 139
|
|
|
aba7ab1 |
if rlIsRHEL "7" || rlIsFedora "<26"; then
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_ANDROID_PROP NULL NULL 0 0 some_input 0 nohandle" 139
|
|
|
aba7ab1 |
fi
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "Path"
|
|
|
aba7ab1 |
if rlIsRHEL 6; then
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_FILE NULL NULL 0 0 NULL 0" 2,139
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_MEDIA NULL NULL 0 0 NULL 0" 2,139
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_X NULL NULL 0 0 NULL 0" 2,139
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_DB NULL NULL 0 0 NULL 0" 2,139
|
|
|
aba7ab1 |
else
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_FILE NULL NULL 0 0 NULL 0" 22
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_MEDIA NULL NULL 0 0 NULL 0" 22
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_X NULL NULL 0 0 NULL 0" 22
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_DB NULL NULL 0 0 NULL 0" 22
|
|
|
aba7ab1 |
# ANDROID_PROP backend does not set handle and returns NULL as handle
|
|
|
aba7ab1 |
# (see test_lookup.c for handling NULL handle)
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_ANDROID_PROP NULL NULL 0 0 NULL 0" 255
|
|
|
aba7ab1 |
fi
|
|
|
aba7ab1 |
rlPhaseEnd
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlPhaseStartTest "validate option"
|
|
|
aba7ab1 |
rlLogInfo "Invalid entries"
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "./test_open CTX_FILE $TmpDir/my_contexts NULL 1 0 2> >(tee output >&2)" 0
|
|
|
aba7ab1 |
rlRun "grep 'line' output" 1
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
one
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
if rlIsRHEL 6; then
|
|
|
aba7ab1 |
rlRun "./test_open CTX_FILE $TmpDir/my_contexts NULL 1 0 2> >(tee output >&2)" 0
|
|
|
aba7ab1 |
else
|
|
|
aba7ab1 |
rlRun "./test_open CTX_FILE $TmpDir/my_contexts NULL 1 0 2> >(tee output >&2)" 22
|
|
|
aba7ab1 |
fi
|
|
|
aba7ab1 |
rlRun "grep 'line 1 is missing fields' output"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
$TmpDir my_user_u:my_role_r:my_type_t:s0
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
if rlIsFedora ">27"; then
|
|
|
aba7ab1 |
rlRun "./test_open CTX_FILE $TmpDir/my_contexts NULL 1 0 2> >(tee output >&2)" 22
|
|
|
aba7ab1 |
else
|
|
|
aba7ab1 |
rlRun "./test_open CTX_FILE $TmpDir/my_contexts NULL 1 0 2> >(tee output >&2)" 0
|
|
|
aba7ab1 |
fi
|
|
|
aba7ab1 |
rlRun "grep 'line 1 has invalid context my_user_u:my_role_r:my_type_t:s0' output"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
$TmpDir invalid_file_type system_u:object_r:var_t:s0
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
if rlIsRHEL 6; then
|
|
|
aba7ab1 |
rlRun "./test_open CTX_FILE $TmpDir/my_contexts NULL 1 0 2> >(tee output >&2)" 0
|
|
|
aba7ab1 |
else
|
|
|
aba7ab1 |
rlRun "./test_open CTX_FILE $TmpDir/my_contexts NULL 1 0 2> >(tee output >&2)" 22
|
|
|
aba7ab1 |
fi
|
|
|
aba7ab1 |
rlRun "grep 'line 1 has invalid file type invalid_file_type' output"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
$TmpDir <<none>>
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "./test_open CTX_FILE $TmpDir/my_contexts NULL 1 0 2> >(tee output >&2)" 0
|
|
|
aba7ab1 |
rlRun "grep 'line 1' output" 1
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
#$TmpDir system_u:object_r:var_t:s0
|
|
|
aba7ab1 |
$TmpDir system_u:object_r:var_t:s0
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "./test_open CTX_FILE $TmpDir/my_contexts NULL 1 0 2> >(tee output >&2)" 0
|
|
|
aba7ab1 |
rlRun "grep 'Multiple same specifications' output" 1
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "Two same rules for the same path"
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
$TmpDir system_u:object_r:var_t:s0
|
|
|
aba7ab1 |
$TmpDir system_u:object_r:var_t:s0
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "./test_open CTX_FILE $TmpDir/my_contexts NULL 1 0 2> >(tee output >&2)" 22
|
|
|
aba7ab1 |
rlRun "grep 'Multiple same specifications' output"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "Two different rules for the same path"
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
$TmpDir system_u:object_r:bin_t:s0
|
|
|
aba7ab1 |
$TmpDir system_u:object_r:usr_t:s0
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "./test_open CTX_FILE $TmpDir/my_contexts NULL 1 0 2> >(tee output >&2)" 22
|
|
|
aba7ab1 |
rlRun "grep 'Multiple different specifications' output"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "Two different rules for same path but with different file type"
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
$TmpDir -- system_u:object_r:bin_t:s0
|
|
|
aba7ab1 |
$TmpDir -d system_u:object_r:usr_t:s0
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "./test_open CTX_FILE $TmpDir/my_contexts NULL 1 0 2> >(tee output >&2)" 0
|
|
|
aba7ab1 |
rlRun "grep 'Multiple different specifications' output" 1
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "Two different rules for same path one general and one with file type"
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
$TmpDir system_u:object_r:bin_t:s0
|
|
|
aba7ab1 |
$TmpDir -- system_u:object_r:usr_t:s0
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "./test_open CTX_FILE $TmpDir/my_contexts NULL 1 0 2> >(tee output >&2)" 22
|
|
|
aba7ab1 |
rlRun "grep 'Multiple different specifications' output"
|
|
|
aba7ab1 |
rlPhaseEnd
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
if rlIsRHEL ">=7" || rlIsFedora; then
|
|
|
aba7ab1 |
rlPhaseStartTest "file contexts files"
|
|
|
aba7ab1 |
rlLogInfo "subs file"
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
$TmpDir system_u:object_r:var_t:s0
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts.subs <
|
|
|
aba7ab1 |
/somepath $TmpDir
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_FILE $TmpDir/my_contexts NULL 0 0 /somepath 0 | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: system_u:object_r:var_t:s0' output" 0
|
|
|
aba7ab1 |
rlRun "rm -f $TmpDir/my_contexts.subs"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "subs_dist file"
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
$TmpDir system_u:object_r:var_t:s0
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts.subs_dist <
|
|
|
aba7ab1 |
/somepath $TmpDir
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_FILE $TmpDir/my_contexts NULL 0 0 /somepath 0 | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: system_u:object_r:var_t:s0' output" 0
|
|
|
aba7ab1 |
rlRun "rm -f $TmpDir/my_contexts.subs_dist"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "local file"
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts.local <
|
|
|
aba7ab1 |
$TmpDir system_u:object_r:var_t:s0
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_FILE $TmpDir/my_contexts NULL 0 0 $TmpDir 0 | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: system_u:object_r:var_t:s0' output" 0
|
|
|
aba7ab1 |
rlRun "rm -f $TmpDir/my_contexts.local"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "homedirs file"
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts.homedirs <
|
|
|
aba7ab1 |
$TmpDir system_u:object_r:var_t:s0
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_FILE $TmpDir/my_contexts NULL 0 0 $TmpDir 0 | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: system_u:object_r:var_t:s0' output" 0
|
|
|
aba7ab1 |
rlRun "rm -f $TmpDir/my_contexts.homedirs"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "Normal run"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_FILE NULL NULL 0 0 /nonexistent 0 | tee output" 0 \
|
|
|
aba7ab1 |
"Run selabel_lookup"
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: system_u:object_r:etc_runtime_t:s0' output" 0 \
|
|
|
aba7ab1 |
"Check context returned by selabel_lookup"
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup_raw context: system_u:object_r:etc_runtime_t:s0' output" 0 \
|
|
|
aba7ab1 |
"Check context returned by selabel_lookup_raw"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "Context is <<none>>"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_FILE NULL NULL 0 0 /tmp/somefile 0 2> >(tee output >&2)" 2 \
|
|
|
aba7ab1 |
"Run selabel_lookup on file with default context <<none>>"
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup - ERROR: No such file or directory' output" 0
|
|
|
aba7ab1 |
rlPhaseEnd
|
|
|
aba7ab1 |
fi
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlPhaseStartTest "media contexts files"
|
|
|
aba7ab1 |
rlLogInfo "Valid entries"
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
floppy system_u:object_r:tmp_t:s0
|
|
|
aba7ab1 |
cdrom system_u:object_r:var_t:s0
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_MEDIA $TmpDir/my_contexts NULL 1 0 floppy 0 | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: system_u:object_r:tmp_t:s0' output"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
floppy system_u:object_r:tmp_t:s0
|
|
|
aba7ab1 |
floppy system_u:object_r:var_t:s0
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_MEDIA $TmpDir/my_contexts NULL 1 0 floppy 0 | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: system_u:object_r:tmp_t:s0' output"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "No entries"
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_MEDIA $TmpDir/my_contexts NULL 1 0 floppy 0 2> >(tee output >&2)" 2
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup - ERROR: No such file or directory' output"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "Invalid entries"
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
floppy
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_MEDIA $TmpDir/my_contexts NULL 1 0 floppy 0 2> >(tee output >&2)" 2
|
|
|
aba7ab1 |
rlRun "grep 'line 1 is missing fields' output"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
floppy some_u:some_r:some_t:s0
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_MEDIA $TmpDir/my_contexts NULL 1 0 floppy 0 2> >(tee output >&2)" 22
|
|
|
aba7ab1 |
rlRun "grep 'has invalid context some_u:some_r:some_t:s0' output"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
# defaultContext=$(cat /etc/selinux/targeted/contexts/removable_context)
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
# rlLogInfo "empty contexts file"
|
|
|
aba7ab1 |
# rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
#EOF"
|
|
|
aba7ab1 |
# rlRun "./test_lookup CTX_MEDIA $TmpDir/my_contexts NULL 1 0 floppy 0 | tee output" 0
|
|
|
aba7ab1 |
# rlRun "grep 'selabel_lookup context: $defaultContext' output" 0
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
# rlLogInfo "invalid contexts file"
|
|
|
aba7ab1 |
# rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
#some_removable some_u:some_r:some_t:s0
|
|
|
aba7ab1 |
#EOF"
|
|
|
aba7ab1 |
# rlRun "./test_lookup CTX_MEDIA $TmpDir/my_contexts NULL 1 0 floppy 0 | tee output" 0
|
|
|
aba7ab1 |
# rlRun "grep 'selabel_lookup context: $defaultContext' output" 0
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "CTX_MEDIA backend"
|
|
|
aba7ab1 |
# syntax: ./test_lookup CTX_MEDIA OPT_PATH NULL OPT_VALIDATE 0 path 0
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "Normal run"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_MEDIA NULL NULL 0 0 floppy 0 | tee output" 0 \
|
|
|
aba7ab1 |
"Run selabel_lookup"
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: system_u:object_r:removable_device_t:s0' output" 0 \
|
|
|
aba7ab1 |
"Check context returned by selabel_lookup"
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup_raw context: system_u:object_r:removable_device_t:s0' output" 0 \
|
|
|
aba7ab1 |
"Check context returned by selabel_lookup_raw"
|
|
|
aba7ab1 |
rlPhaseEnd
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlPhaseStartTest "x contexts files"
|
|
|
aba7ab1 |
rlLogInfo "Valid entries"
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
client * system_u:object_r:tmp_t:s0
|
|
|
aba7ab1 |
selection PRIMARY system_u:object_r:var_t:s0
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_X $TmpDir/my_contexts NULL 1 0 PRIMARY X_SELN | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: system_u:object_r:var_t:s0' output"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "Comments and empty lines"
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
# some comment
|
|
|
aba7ab1 |
client * system_u:object_r:tmp_t:s0
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
selection PRIMARY system_u:object_r:var_t:s0
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_X $TmpDir/my_contexts NULL 1 0 PRIMARY X_SELN | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: system_u:object_r:var_t:s0' output"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "Object names"
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
property * system_u:object_r:tmp_t:s0
|
|
|
aba7ab1 |
selection * system_u:object_r:var_t:s0
|
|
|
aba7ab1 |
extension * system_u:object_r:usr_t:s0
|
|
|
aba7ab1 |
event * system_u:object_r:man_t:s0
|
|
|
aba7ab1 |
client * system_u:object_r:lib_t:s0
|
|
|
aba7ab1 |
poly_property * system_u:object_r:bin_t:s0
|
|
|
aba7ab1 |
poly_selection * system_u:object_r:remote_t:s0
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_X $TmpDir/my_contexts NULL 1 0 '*' X_PROP | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: system_u:object_r:tmp_t:s0' output"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_X $TmpDir/my_contexts NULL 1 0 '*' X_SELN | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: system_u:object_r:var_t:s0' output"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_X $TmpDir/my_contexts NULL 1 0 '*' X_EXT | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: system_u:object_r:usr_t:s0' output"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_X $TmpDir/my_contexts NULL 1 0 '*' X_EVENT | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: system_u:object_r:man_t:s0' output"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_X $TmpDir/my_contexts NULL 1 0 '*' X_CLIENT | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: system_u:object_r:lib_t:s0' output"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_X $TmpDir/my_contexts NULL 1 0 '*' X_POLYPROP | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: system_u:object_r:bin_t:s0' output"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_X $TmpDir/my_contexts NULL 1 0 '*' X_POLYSELN | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: system_u:object_r:remote_t:s0' output"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "Empty file"
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_X $TmpDir/my_contexts NULL 1 0 PRIMARY X_SELN" 2
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "Invalid entries"
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
property
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_X $TmpDir/my_contexts NULL 1 0 PRIMARY X_SELN 2> >(tee output >&2)" 2
|
|
|
aba7ab1 |
rlRun "grep 'line 1 is missing fields' output"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
property *
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_X $TmpDir/my_contexts NULL 1 0 PRIMARY X_SELN 2> >(tee output >&2)" 2
|
|
|
aba7ab1 |
rlRun "grep 'line 1 is missing fields' output"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
some_property * system_u:object_r:tmp_t:s0
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_X $TmpDir/my_contexts NULL 1 0 PRIMARY X_SELN 2> >(tee output >&2)" 2
|
|
|
aba7ab1 |
rlRun "grep 'line 1 has invalid object type some_property' output"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "Wildcard matching"
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
property * system_u:object_r:tmp_t:s0
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_X $TmpDir/my_contexts NULL 1 0 SOME_PROPERTY X_PROP | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: system_u:object_r:tmp_t:s0' output"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
property CUT_BUFFER0 system_u:object_r:tmp_t:s0
|
|
|
aba7ab1 |
property * system_u:object_r:usr_t:s0
|
|
|
aba7ab1 |
property CUT_BUFFER1 system_u:object_r:var_t:s0
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_X $TmpDir/my_contexts NULL 1 0 CUT_BUFFER0 X_PROP | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: system_u:object_r:tmp_t:s0' output"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_X $TmpDir/my_contexts NULL 1 0 CUT_BUFFER1 X_PROP | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: system_u:object_r:usr_t:s0' output"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_X $TmpDir/my_contexts NULL 1 0 CUT_BUFFER2 X_PROP | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: system_u:object_r:usr_t:s0' output"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "Substitution matching"
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
property CUT_BUFFER? system_u:object_r:tmp_t:s0
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_X $TmpDir/my_contexts NULL 1 0 CUT_BUFFER3 X_PROP | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: system_u:object_r:tmp_t:s0' output"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "Normal run"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_X NULL NULL 0 0 asdf X_CLIENT | tee output" 0 \
|
|
|
aba7ab1 |
"Run selabel_lookup"
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: system_u:object_r:remote_t:s0' output" 0 \
|
|
|
aba7ab1 |
"Check context returned by selabel_lookup"
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup_raw context: system_u:object_r:remote_t:s0' output" 0 \
|
|
|
aba7ab1 |
"Check context returned by selabel_lookup_raw"
|
|
|
aba7ab1 |
rlPhaseEnd
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlPhaseStartTest "db contexts files"
|
|
|
aba7ab1 |
rlLogInfo "Valid entries"
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
db_database my_database system_u:object_r:sepgsql_db_t:s0
|
|
|
aba7ab1 |
db_schema my_schema system_u:object_r:sepgsql_schema_t:s0
|
|
|
aba7ab1 |
db_view my_view system_u:object_r:sepgsql_view_t:s0
|
|
|
aba7ab1 |
db_table my_table system_u:object_r:sepgsql_table_t:s0
|
|
|
aba7ab1 |
db_column my_column system_u:object_r:var_t:s0
|
|
|
aba7ab1 |
db_tuple my_tuple system_u:object_r:tmp_t:s0
|
|
|
aba7ab1 |
db_procedure my_procedure system_u:object_r:sepgsql_proc_exec_t:s0
|
|
|
aba7ab1 |
db_sequence my_sequence system_u:object_r:sepgsql_seq_t:s0
|
|
|
aba7ab1 |
db_blob my_blob system_u:object_r:sepgsql_blob_t:s0
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
if rlIsRHEL ">=7" || rlIsFedora; then
|
|
|
aba7ab1 |
rlRun "cat >> $TmpDir/my_contexts <
|
|
|
aba7ab1 |
db_language my_language system_u:object_r:sepgsql_lang_t:s0
|
|
|
aba7ab1 |
db_exception my_exception system_u:object_r:usr_t:s0
|
|
|
aba7ab1 |
db_datatype my_datatype system_u:object_r:bin_t:s0
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
fi
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_DB $TmpDir/my_contexts NULL 1 0 my_database DB_DATABASE | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: system_u:object_r:sepgsql_db_t:s0' output"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_DB $TmpDir/my_contexts NULL 1 0 my_schema DB_SCHEMA | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: system_u:object_r:sepgsql_schema_t:s0' output"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_DB $TmpDir/my_contexts NULL 1 0 my_view DB_VIEW | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: system_u:object_r:sepgsql_view_t:s0' output"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_DB $TmpDir/my_contexts NULL 1 0 my_table DB_TABLE | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: system_u:object_r:sepgsql_table_t:s0' output"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_DB $TmpDir/my_contexts NULL 1 0 my_column DB_COLUMN | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: system_u:object_r:var_t:s0' output"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_DB $TmpDir/my_contexts NULL 1 0 my_tuple DB_TUPLE | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: system_u:object_r:tmp_t:s0' output"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_DB $TmpDir/my_contexts NULL 1 0 my_procedure DB_PROCEDURE | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: system_u:object_r:sepgsql_proc_exec_t:s0' output"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_DB $TmpDir/my_contexts NULL 1 0 my_sequence DB_SEQUENCE | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: system_u:object_r:sepgsql_seq_t:s0' output"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_DB $TmpDir/my_contexts NULL 1 0 my_blob DB_BLOB | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: system_u:object_r:sepgsql_blob_t:s0' output"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
if rlIsRHEL ">=7" || rlIsFedora; then
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_DB $TmpDir/my_contexts NULL 1 0 my_language DB_LANGUAGE | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: system_u:object_r:sepgsql_lang_t:s0' output"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_DB $TmpDir/my_contexts NULL 1 0 my_exception DB_EXCEPTION | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: system_u:object_r:usr_t:s0' output"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_DB $TmpDir/my_contexts NULL 1 0 my_datatype DB_DATATYPE | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: system_u:object_r:bin_t:s0' output"
|
|
|
aba7ab1 |
fi
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "Comments and empty lines"
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
# something
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
db_database my_database system_u:object_r:sepgsql_db_t:s0
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_DB $TmpDir/my_contexts NULL 1 0 my_database DB_DATABASE | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: system_u:object_r:sepgsql_db_t:s0' output"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "Wildcard matching"
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
db_database my_database system_u:object_r:var_t:s0
|
|
|
aba7ab1 |
db_database my_database* system_u:object_r:bin_t:s0
|
|
|
aba7ab1 |
db_database * system_u:object_r:usr_t:s0
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_DB $TmpDir/my_contexts NULL 1 0 my_database DB_DATABASE | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: system_u:object_r:var_t:s0' output"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_DB $TmpDir/my_contexts NULL 1 0 my_database_asdf DB_DATABASE | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: system_u:object_r:bin_t:s0' output"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_DB $TmpDir/my_contexts NULL 1 0 my_asdf DB_DATABASE | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: system_u:object_r:usr_t:s0' output"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
db_database * system_u:object_r:usr_t:s0
|
|
|
aba7ab1 |
db_database my_* system_u:object_r:bin_t:s0
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_DB $TmpDir/my_contexts NULL 1 0 my_database DB_DATABASE | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: system_u:object_r:usr_t:s0' output"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "Empty file"
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_DB $TmpDir/my_contexts NULL 1 0 my_database DB_DATABASE " 2
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "Invalid entries"
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
one
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_DB $TmpDir/my_contexts NULL 0 0 my_database DB_DATABASE 2> >(tee output >&2)" 2
|
|
|
aba7ab1 |
rlRun "grep 'line 1 has invalid format' output"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
one two
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_DB $TmpDir/my_contexts NULL 0 0 my_database DB_DATABASE 2> >(tee output >&2)" 2
|
|
|
aba7ab1 |
rlRun "grep 'line 1 has invalid format' output"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
one two three
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_DB $TmpDir/my_contexts NULL 0 0 my_database DB_DATABASE 2> >(tee output >&2)" 2
|
|
|
aba7ab1 |
rlRun "grep 'line 1 has invalid object type one' output"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
one two three four
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_DB $TmpDir/my_contexts NULL 0 0 my_database DB_DATABASE 2> >(tee output >&2)" 2
|
|
|
aba7ab1 |
rlRun "grep 'line 1 has invalid format' output"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "Normal run"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_DB NULL NULL 0 0 my_database DB_DATABASE | tee output"
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: system_u:object_r:sepgsql_db_t:s0' output"
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup_raw context: system_u:object_r:sepgsql_db_t:s0' output"
|
|
|
aba7ab1 |
rlPhaseEnd
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
if rlIsRHEL ">=7" || rlIsFedora; then
|
|
|
aba7ab1 |
rlPhaseStartTest "baseonly option"
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
$TmpDir.* system_u:object_r:var_t:s0
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts.subs <
|
|
|
aba7ab1 |
/somepath $TmpDir
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts.local <
|
|
|
aba7ab1 |
$TmpDir/local system_u:object_r:bin_t:s0
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts.homedirs <
|
|
|
aba7ab1 |
$TmpDir/homedirs system_u:object_r:usr_t:s0
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
# without baseonly option, the rule in my_contexts will be overridden
|
|
|
aba7ab1 |
# by a rule in my_contexts.local file
|
|
|
aba7ab1 |
# .subs file should work even with baseonly option
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_FILE $TmpDir/my_contexts NULL 0 0 /somepath/local 0 | tee output" 0 \
|
|
|
aba7ab1 |
"Running selabel_open without baseonly option"
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: system_u:object_r:bin_t:s0' output" 0
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_FILE $TmpDir/my_contexts NULL 0 1 /somepath/local 0 | tee output" 0 \
|
|
|
aba7ab1 |
"Running selabel_open with baseonly option"
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: system_u:object_r:var_t:s0' output" 0
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
# without baseonly option, the rule in my_contexts will be overridden
|
|
|
aba7ab1 |
# by a rule in my_contexts.homedirs file
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_FILE $TmpDir/my_contexts NULL 0 0 /somepath/homedirs 0 | tee output" 0 \
|
|
|
aba7ab1 |
"Running selabel_open without baseonly option"
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: system_u:object_r:usr_t:s0' output" 0
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_FILE $TmpDir/my_contexts NULL 0 1 /somepath/homedirs 0 | tee output" 0 \
|
|
|
aba7ab1 |
"Running selabel_open with baseonly option"
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: system_u:object_r:var_t:s0' output" 0
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlRun "rm -f $TmpDir/my_contexts.subs"
|
|
|
aba7ab1 |
rlRun "rm -f $TmpDir/my_contexts.local"
|
|
|
aba7ab1 |
rlRun "rm -f $TmpDir/my_contexts.homedirs"
|
|
|
aba7ab1 |
rlPhaseEnd
|
|
|
aba7ab1 |
fi
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlPhaseStartTest "selabel_lookup advanced tests"
|
|
|
aba7ab1 |
rlLogInfo "Custom file contexts file"
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
$TmpDir my_user_u:my_role_r:my_type_t:s0
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_FILE $TmpDir/my_contexts NULL 0 0 $TmpDir 0 | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: my_user_u:my_role_r:my_type_t:s0' output" 0
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "Rules for different file types"
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
$TmpDir -- user_u:role_r:regular_type_t:s0
|
|
|
aba7ab1 |
$TmpDir -b user_u:role_r:block_type_t:s0
|
|
|
aba7ab1 |
$TmpDir -c user_u:role_r:char_type_t:s0
|
|
|
aba7ab1 |
$TmpDir -d user_u:role_r:dir_type_t:s0
|
|
|
aba7ab1 |
$TmpDir -p user_u:role_r:pipe_type_t:s0
|
|
|
aba7ab1 |
$TmpDir -l user_u:role_r:symlink_type_t:s0
|
|
|
aba7ab1 |
$TmpDir -s user_u:role_r:socket_type_t:s0
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_FILE $TmpDir/my_contexts NULL 0 0 $TmpDir 0010000 | tee output"
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: user_u:role_r:pipe_type_t:s0' output"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_FILE $TmpDir/my_contexts NULL 0 0 $TmpDir 0020000 | tee output"
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: user_u:role_r:char_type_t:s0' output"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_FILE $TmpDir/my_contexts NULL 0 0 $TmpDir 0040000 | tee output"
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: user_u:role_r:dir_type_t:s0' output"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_FILE $TmpDir/my_contexts NULL 0 0 $TmpDir 0060000 | tee output"
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: user_u:role_r:block_type_t:s0' output"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_FILE $TmpDir/my_contexts NULL 0 0 $TmpDir 0100000 | tee output"
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: user_u:role_r:regular_type_t:s0' output"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_FILE $TmpDir/my_contexts NULL 0 0 $TmpDir 0120000 | tee output"
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: user_u:role_r:symlink_type_t:s0' output"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_FILE $TmpDir/my_contexts NULL 0 0 $TmpDir 0140000 | tee output"
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: user_u:role_r:socket_type_t:s0' output"
|
|
|
aba7ab1 |
rlPhaseEnd
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
if rlIsRHEL ">=7" || rlIsFedora; then
|
|
|
aba7ab1 |
rlPhaseStartTest "selabel_partial_match"
|
|
|
aba7ab1 |
# syntax: ./test_partial BACKEND OPT_PATH OPT_SUBSET OPT_VALIDATE OPT_BASEONLY path [nohandle]
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "nonsupporting backends"
|
|
|
aba7ab1 |
rlRun "./test_partial CTX_MEDIA NULL NULL 0 0 /somedir | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_partial_match: true' output" 0
|
|
|
aba7ab1 |
rlRun "./test_partial CTX_DB NULL NULL 0 0 /somedir | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_partial_match: true' output" 0
|
|
|
aba7ab1 |
rlRun "./test_partial CTX_X NULL NULL 0 0 /somedir | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_partial_match: true' output" 0
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "null as handle"
|
|
|
aba7ab1 |
rlRun "./test_partial CTX_FILE NULL NULL 0 0 /somedir nohandle" 22,139
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "nonexisting entry"
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_FILE $TmpDir/my_contexts NULL 0 0 /somedir 0" 2
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlRun "./test_partial CTX_FILE $TmpDir/my_contexts NULL 0 0 /somedir | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_partial_match: false' output" 0
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "full match"
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
/somedir user_u:role_r:type_t:s0
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_FILE $TmpDir/my_contexts NULL 0 0 /somedir 0 | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: user_u:role_r:type_t:s0' output"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlRun "./test_partial CTX_FILE $TmpDir/my_contexts NULL 0 0 /somedir | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_partial_match: true' output" 0
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "partial match"
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
/somedir42 user_u:role_r:type_t:s0
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_FILE $TmpDir/my_contexts NULL 0 0 /somedir 0" 2
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlRun "./test_partial CTX_FILE $TmpDir/my_contexts NULL 0 0 /somedir | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_partial_match: true' output" 0
|
|
|
aba7ab1 |
rlPhaseEnd
|
|
|
aba7ab1 |
fi
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
if rlIsRHEL ">=7" || rlIsFedora; then
|
|
|
aba7ab1 |
rlPhaseStartTest "selabel_best_match"
|
|
|
aba7ab1 |
# syntax: ./test_best BACKEND OPT_PATH OPT_SUBSET OPT_VALIDATE OPT_BASEONLY path mode [nohandle]
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "nonsupported backends"
|
|
|
aba7ab1 |
rlRun "./test_best CTX_MEDIA NULL NULL 0 0 /somedir 0" 95
|
|
|
aba7ab1 |
rlRun "./test_best CTX_DB NULL NULL 0 0 /somedir 0" 95
|
|
|
aba7ab1 |
rlRun "./test_best CTX_X NULL NULL 0 0 /somedir 0" 95
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "null as handle"
|
|
|
aba7ab1 |
rlRun "./test_best CTX_FILE NULL NULL 0 0 /somedir 0 nohandle" 22,139
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "null as key"
|
|
|
aba7ab1 |
rlRun "./test_best CTX_FILE NULL NULL 0 0 NULL 0" 22
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "nonexisting entry"
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_FILE $TmpDir/my_contexts NULL 0 0 /somedir 0" 2
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlRun "./test_best CTX_FILE $TmpDir/my_contexts NULL 0 0 /somedir 0" 2
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "exact match without aliases"
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
/somedir user_u:role_r:type_t:s0
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_FILE $TmpDir/my_contexts NULL 0 0 /somedir 0 | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: user_u:role_r:type_t:s0' output"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
# same as selabel_lookup
|
|
|
aba7ab1 |
rlRun "./test_best CTX_FILE $TmpDir/my_contexts NULL 0 0 /somedir 0 | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup_best_match context: user_u:role_r:type_t:s0' output"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "regex match without aliases"
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
/some.* user_u:role_r:type_t:s0
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_FILE $TmpDir/my_contexts NULL 0 0 /somedir 0 | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: user_u:role_r:type_t:s0' output"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
# same as selabel_lookup
|
|
|
aba7ab1 |
rlRun "./test_best CTX_FILE $TmpDir/my_contexts NULL 0 0 /somedir 0 | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup_best_match context: user_u:role_r:type_t:s0' output"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "exact match with exactly matching alias"
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
/somedir user_u:role_r:orig_t:s0
|
|
|
aba7ab1 |
/somesymlink user_u:role_r:link_t:s0
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_FILE $TmpDir/my_contexts NULL 0 0 /somedir 0 | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: user_u:role_r:orig_t:s0' output"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
# original context should be chosen when found
|
|
|
aba7ab1 |
rlRun "./test_best CTX_FILE $TmpDir/my_contexts NULL 0 0 /somedir 0 /somesymlink | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup_best_match context: user_u:role_r:orig_t:s0' output"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "no match with exactly matching alias"
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
/somesymlink user_u:role_r:type_t:s0
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_FILE $TmpDir/my_contexts NULL 0 0 /somedir 0" 2
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
# when there is no context for path, alias context should be chosen
|
|
|
aba7ab1 |
rlRun "./test_best CTX_FILE $TmpDir/my_contexts NULL 0 0 /somedir 0 /somesymlink | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup_best_match context: user_u:role_r:type_t:s0' output"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "no match with multiple exactly matching aliases"
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
/firstsymlink user_u:role_r:first_t:s0
|
|
|
aba7ab1 |
/secondsymlink user_u:role_r:second_t:s0
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_FILE $TmpDir/my_contexts NULL 0 0 /somedir 0" 2
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
# with no context for path and multiple aliases, first exact match should be chosen
|
|
|
aba7ab1 |
rlRun "./test_best CTX_FILE $TmpDir/my_contexts NULL 0 0 /somedir 0 /firstsymlink /secondsymlink | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup_best_match context: user_u:role_r:first_t:s0' output"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "no match with multiple regex matching aliases"
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
/short.* user_u:role_r:short_t:s0
|
|
|
aba7ab1 |
/verylong.* user_u:role_r:long_t:s0
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_FILE $TmpDir/my_contexts NULL 0 0 /somedir 0" 2
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
# with no context for path and multiple regex aliases, match with longest prefix should be chosen
|
|
|
aba7ab1 |
rlRun "./test_best CTX_FILE $TmpDir/my_contexts NULL 0 0 /somedir 0 /shortsymlink /verylongsymlink | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup_best_match context: user_u:role_r:long_t:s0' output"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "regex match with multiple regex matching aliases"
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
/some.* user_u:role_r:orig_t:s0
|
|
|
aba7ab1 |
/short.* user_u:role_r:short_t:s0
|
|
|
aba7ab1 |
/verylong.* user_u:role_r:long_t:s0
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "./test_lookup CTX_FILE $TmpDir/my_contexts NULL 0 0 /somedir 0 | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup context: user_u:role_r:orig_t:s0' output"
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
# with regex matching context for path and multiple regex aliases, match with longest prefix should be chosen
|
|
|
aba7ab1 |
# (among both original path and aliases)
|
|
|
aba7ab1 |
rlRun "./test_best CTX_FILE $TmpDir/my_contexts NULL 0 0 /somedir 0 /shortsymlink /verylongsymlink | tee output" 0
|
|
|
aba7ab1 |
rlRun "grep 'selabel_lookup_best_match context: user_u:role_r:long_t:s0' output"
|
|
|
aba7ab1 |
rlPhaseEnd
|
|
|
aba7ab1 |
fi
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlPhaseStartTest "selabel_stats"
|
|
|
aba7ab1 |
# syntax: ./test_stats BACKEND OPT_PATH OPT_VALIDATE [nohandle]
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlLogInfo "calling selabel_test - not checking output"
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
rlRun "./test_stats CTX_FILE $TmpDir/my_contexts 0" 0
|
|
|
aba7ab1 |
rlRun "./test_stats CTX_MEDIA $TmpDir/my_contexts 0" 0
|
|
|
aba7ab1 |
rlRun "./test_stats CTX_X $TmpDir/my_contexts 0" 0
|
|
|
aba7ab1 |
rlRun "./test_stats CTX_DB $TmpDir/my_contexts 0" 0
|
|
|
aba7ab1 |
if rlIsRHEL "7" || rlIsFedora "<26"; then
|
|
|
aba7ab1 |
rlRun "./test_stats CTX_ANDROID_PROP $TmpDir/my_contexts 0" 0
|
|
|
aba7ab1 |
fi
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlRun "./test_stats CTX_FILE $TmpDir/my_contexts 0 nohandle" 139
|
|
|
aba7ab1 |
rlPhaseEnd
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
if rlIsRHEL ">=7" || rlIsFedora; then
|
|
|
aba7ab1 |
rlPhaseStartTest "selabel_digest"
|
|
|
aba7ab1 |
# syntax: ./test_digest BACKEND OPT_PATH OPT_VALIDATE OPT_DIGEST [nohandle]
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlRun "./test_digest CTX_FILE NULL 0 0" 22
|
|
|
aba7ab1 |
rlRun "./test_digest CTX_FILE NULL 0 0 nohandle" 139
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlRun "./test_digest CTX_FILE NULL 0 1" 0
|
|
|
aba7ab1 |
rlRun "./test_digest CTX_MEDIA NULL 0 1" 0
|
|
|
aba7ab1 |
rlRun "./test_digest CTX_X NULL 0 1" 0
|
|
|
aba7ab1 |
rlRun "./test_digest CTX_DB NULL 0 1" 0
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlRun "cat > $TmpDir/my_contexts <
|
|
|
aba7ab1 |
EOF"
|
|
|
aba7ab1 |
if rlIsRHEL "7" || rlIsFedora "<26"; then
|
|
|
aba7ab1 |
rlRun "./test_digest CTX_ANDROID_PROP $TmpDir/my_contexts 0 1" 0
|
|
|
aba7ab1 |
fi
|
|
|
aba7ab1 |
rlPhaseEnd
|
|
|
aba7ab1 |
fi
|
|
|
aba7ab1 |
|
|
|
aba7ab1 |
rlPhaseStartCleanup
|
|
|
aba7ab1 |
rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
|
|
|
aba7ab1 |
rlRun "rm -f test_open test_lookup test_partial test_best test_stats test_digest output"
|
|
|
aba7ab1 |
rlPhaseEnd
|
|
|
aba7ab1 |
rlJournalPrintText
|
|
|
aba7ab1 |
rlJournalEnd
|