def test_write_manually(self): obj = ChangeProfileRule(None, '/foo', 'bar', allow_keyword=True) expected = ' allow change_profile /foo -> bar,' self.assertEqual(expected, obj.get_clean(2), 'unexpected clean rule') self.assertEqual(expected, obj.get_raw(2), 'unexpected raw rule')
def _check_invalid_rawrule(self, rawrule): obj = None self.assertFalse(ChangeProfileRule.match(rawrule)) with self.assertRaises(AppArmorException): obj = ChangeProfileRule(ChangeProfileRule.parse(rawrule)) self.assertIsNone(obj, 'ChangeProfileRule handed back an object unexpectedly')
def test_write_manually(self): obj = ChangeProfileRule('/foo', 'bar', allow_keyword=True) expected = ' allow change_profile /foo -> bar,' self.assertEqual(expected, obj.get_clean(2), 'unexpected clean rule') self.assertEqual(expected, obj.get_raw(2), 'unexpected raw rule')
def test_borked_obj_is_covered_2(self): obj = ChangeProfileRule.parse('change_profile /foo,') testobj = ChangeProfileRule(None, '/foo', '/bar') testobj.targetprofile = '' with self.assertRaises(AppArmorBug): obj.is_covered(testobj)
def test_borked_obj_is_covered_2(self): obj = ChangeProfileRule.parse('change_profile /foo,') testobj = ChangeProfileRule('/foo', '/bar') testobj.targetprofile = '' with self.assertRaises(AppArmorBug): obj.is_covered(testobj)
def _run_test(self, rawrule, expected): self.assertTrue(ChangeProfileRule.match(rawrule)) obj = ChangeProfileRule.parse(rawrule) clean = obj.get_clean() raw = obj.get_raw() self.assertEqual(expected.strip(), clean, 'unexpected clean rule') self.assertEqual(rawrule.strip(), raw, 'unexpected raw rule')
def test_borked_obj_is_covered_1(self): obj = ChangeProfileRule.parse('change_profile /foo,') testobj = ChangeProfileRule('/foo', '/bar') testobj.execcond = '' with self.assertRaises(AppArmorBug): obj.is_covered(testobj)
def _run_test(self, param, expected): obj = ChangeProfileRule.parse(self.rule) check_obj = ChangeProfileRule.parse(param) self.assertTrue(ChangeProfileRule.match(param)) self.assertEqual(obj.is_equal(check_obj), expected[0], 'Mismatch in is_equal, expected %s' % expected[0]) self.assertEqual(obj.is_equal(check_obj, True), expected[1], 'Mismatch in is_equal/strict, expected %s' % expected[1]) self.assertEqual(obj.is_covered(check_obj), expected[2], 'Mismatch in is_covered, expected %s' % expected[2]) self.assertEqual(obj.is_covered(check_obj, True, True), expected[3], 'Mismatch in is_covered/exact, expected %s' % expected[3])
def test_ruleset_2(self): ruleset = ChangeProfileRuleset() rules = [ 'change_profile /foo -> /bar,', 'allow change_profile /asdf,', 'deny change_profile -> xy, # example comment', ] expected_raw = [ ' change_profile /foo -> /bar,', ' allow change_profile /asdf,', ' deny change_profile -> xy, # example comment', '', ] expected_clean = [ ' deny change_profile -> xy, # example comment', '', ' allow change_profile /asdf,', ' change_profile /foo -> /bar,', '', ] for rule in rules: ruleset.add(ChangeProfileRule.parse(rule)) self.assertEqual(expected_raw, ruleset.get_raw(1)) self.assertEqual(expected_clean, ruleset.get_clean(1))
def test_invalid_is_covered(self): obj = ChangeProfileRule.parse('change_profile /foo,') testobj = BaseRule() # different type with self.assertRaises(AppArmorBug): obj.is_covered(testobj)
def test_invalid_is_equal(self): obj = ChangeProfileRule.parse('change_profile -> /bar,') testobj = BaseRule() # different type with self.assertRaises(AppArmorBug): obj.is_equal(testobj)
def test_change_profile_from_log(self): parser = ReadLog('', '', '', '') event = 'type=AVC msg=audit(1428699242.551:386): apparmor="DENIED" operation="change_profile" profile="/foo/changeprofile" pid=3459 comm="changeprofile" target="/foo/rename"' # libapparmor doesn't understand this log format (from JJ) # event = '[ 97.492562] audit: type=1400 audit(1431116353.523:77): apparmor="DENIED" operation="change_profile" profile="/foo/changeprofile" pid=3459 comm="changeprofile" target="/foo/rename"' parsed_event = parser.parse_event(event) self.assertEqual( parsed_event, { 'request_mask': None, 'denied_mask': None, 'error_code': 0, 'magic_token': 0, 'parent': 0, 'profile': '/foo/changeprofile', 'operation': 'change_profile', 'resource': None, 'info': None, 'aamode': 'REJECTING', 'time': 1428699242, 'active_hat': None, 'pid': 3459, 'task': 0, 'attr': None, 'name2': '/foo/rename', # target 'name': None, 'family': None, 'protocol': None, 'sock_type': None, }) obj = ChangeProfileRule(None, ChangeProfileRule.ALL, parsed_event['name2'], log_event=parsed_event) # audit allow deny comment execmode execcond all? targetprof all? expected = exp(False, False, False, '', None, None, True, '/foo/rename', False) self._compare_obj(obj, expected) self.assertEqual(obj.get_raw(1), ' change_profile -> /foo/rename,')
class ChangeProfileFromInit(ChangeProfileTest): tests = [ # ChangeProfileRule object audit allow deny comment execcond all? targetprof all? (ChangeProfileRule('/foo', '/bar', deny=True), exp(False, False, True, '', '/foo', False, '/bar', False)), (ChangeProfileRule('/foo', '/bar'), exp(False, False, False, '', '/foo', False, '/bar', False)), (ChangeProfileRule('/foo', ChangeProfileRule.ALL), exp(False, False, False, '', '/foo', False, None, True)), (ChangeProfileRule(ChangeProfileRule.ALL, '/bar'), exp(False, False, False, '', None, True, '/bar', False)), (ChangeProfileRule(ChangeProfileRule.ALL, ChangeProfileRule.ALL), exp(False, False, False, '', None, True, None, True)), ] def _run_test(self, obj, expected): self._compare_obj(obj, expected)
def test_net_from_log(self): parser = ReadLog('', '', '', '', '') event = 'type=AVC msg=audit(1428699242.551:386): apparmor="DENIED" operation="change_profile" profile="/foo/changeprofile" pid=3459 comm="changeprofile" target="/foo/rename"' # libapparmor doesn't understand this log format (from JJ) # event = '[ 97.492562] audit: type=1400 audit(1431116353.523:77): apparmor="DENIED" operation="change_profile" profile="/foo/changeprofile" pid=3459 comm="changeprofile" target="/foo/rename"' parsed_event = parser.parse_event(event) self.assertEqual(parsed_event, { 'request_mask': None, 'denied_mask': None, 'error_code': 0, #'family': 'inet', 'magic_token': 0, 'parent': 0, 'profile': '/foo/changeprofile', 'operation': 'change_profile', 'resource': None, 'info': None, 'aamode': 'REJECTING', 'time': 1428699242, 'active_hat': None, 'pid': 3459, 'task': 0, 'attr': None, 'name2': '/foo/rename', # target 'name': None, }) obj = ChangeProfileRule(ChangeProfileRule.ALL, parsed_event['name2'], log_event=parsed_event) # audit allow deny comment execcond all? targetprof all? expected = exp(False, False, False, '' , None, True, '/foo/rename', False) self._compare_obj(obj, expected) self.assertEqual(obj.get_raw(1), ' change_profile -> /foo/rename,')
def test_ruleset_1(self): ruleset = ChangeProfileRuleset() rules = [ 'change_profile -> /bar,', 'change_profile /foo,', ] expected_raw = [ 'change_profile -> /bar,', 'change_profile /foo,', '', ] expected_clean = [ 'change_profile -> /bar,', 'change_profile /foo,', '', ] for rule in rules: ruleset.add(ChangeProfileRule.parse(rule)) self.assertEqual(expected_raw, ruleset.get_raw()) self.assertEqual(expected_clean, ruleset.get_clean())
def _run_test(self, rawrule, expected): self.assertFalse(ChangeProfileRule.match(rawrule)) with self.assertRaises(expected): ChangeProfileRule.parse(rawrule)
def _run_test(self, rawrule, expected): self.assertTrue(ChangeProfileRule.match(rawrule)) obj = ChangeProfileRule.parse(rawrule) self.assertEqual(rawrule.strip(), obj.raw_rule) self._compare_obj(obj, expected)
def test_empty_net_data_1(self): obj = ChangeProfileRule('/foo', '/bar') obj.execcond = '' # no execcond set, and ALL not set with self.assertRaises(AppArmorBug): obj.get_clean(1)
def _run_test(self, params, expected): obj = ChangeProfileRule._parse(params) self.assertEqual(obj.logprof_header(), expected)
def test_empty_net_data_2(self): obj = ChangeProfileRule('/foo', '/bar') obj.targetprofile = '' # no targetprofile set, and ALL not set with self.assertRaises(AppArmorBug): obj.get_clean(1)
def test_empty_net_data_2(self): obj = ChangeProfileRule(None, '/foo', '/bar') obj.targetprofile = '' # no targetprofile set, and ALL not set with self.assertRaises(AppArmorBug): obj.get_clean(1)
def test_empty_net_data_1(self): obj = ChangeProfileRule(None, '/foo', '/bar') obj.execcond = '' # no execcond set, and ALL not set with self.assertRaises(AppArmorBug): obj.get_clean(1)
def _run_test(self, params, expected): with self.assertRaises(expected): ChangeProfileRule(params[0], params[1], params[2])
def test_missing_params_2(self): with self.assertRaises(TypeError): ChangeProfileRule('inet')