selinux/python/sepolgen/tests/test_interfaces.py
Stephen Smalley 48dc232627 Move policycoreutils/{sepolicy,audit2allow,semanage,scripts/chcat*} and sepolgen to python.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2016-11-16 11:19:50 -05:00

284 lines
8.3 KiB
Python

# Authors: Karl MacMillan <kmacmillan@mentalrootkit.com>
#
# Copyright (C) 2006 Red Hat
# see file 'COPYING' for use and warranty information
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License as
# published by the Free Software Foundation; version 2 only
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
#
import unittest
import sepolgen.access as access
import sepolgen.interfaces as interfaces
import sepolgen.policygen as policygen
import sepolgen.refparser as refparser
import sepolgen.refpolicy as refpolicy
class TestParam(unittest.TestCase):
def test(self):
p = interfaces.Param()
p.name = "$1"
self.assertEqual(p.name, "$1")
self.assertRaises(ValueError, p.set_name, "$N")
self.assertEqual(p.num, 1)
self.assertEqual(p.type, refpolicy.SRC_TYPE)
class TestAVExtractPerms(unittest.TestCase):
def test(self):
av = access.AccessVector(['foo', 'bar', 'file', 'read'])
params = { }
ret = interfaces.av_extract_params(av, params)
self.assertEqual(ret, 0)
self.assertEqual(params, { })
av.src_type = "$1"
ret = interfaces.av_extract_params(av, params)
self.assertEqual(ret, 0)
p = params["$1"]
self.assertEqual(p.name, "$1")
self.assertEqual(p.type, refpolicy.SRC_TYPE)
self.assertEqual(p.obj_classes, refpolicy.IdSet(["file"]))
params = { }
av.tgt_type = "$1"
av.obj_class = "process"
ret = interfaces.av_extract_params(av, params)
self.assertEqual(ret, 0)
p = params["$1"]
self.assertEqual(p.name, "$1")
self.assertEqual(p.type, refpolicy.SRC_TYPE)
self.assertEqual(p.obj_classes, refpolicy.IdSet(["process"]))
params = { }
av.tgt_type = "$1"
av.obj_class = "dir"
ret = interfaces.av_extract_params(av, params)
self.assertEqual(ret, 1)
p = params["$1"]
self.assertEqual(p.name, "$1")
self.assertEqual(p.type, refpolicy.SRC_TYPE)
self.assertEqual(p.obj_classes, refpolicy.IdSet(["dir"]))
av.src_type = "bar"
av.tgt_type = "$2"
av.obj_class = "dir"
ret = interfaces.av_extract_params(av, params)
self.assertEqual(ret, 0)
p = params["$2"]
self.assertEqual(p.name, "$2")
self.assertEqual(p.type, refpolicy.TGT_TYPE)
self.assertEqual(p.obj_classes, refpolicy.IdSet(["dir"]))
interface_example = """
interface(`files_search_usr',`
gen_require(`
type usr_t;
')
allow $1 usr_t:dir search;
allow { domain $1 } { usr_t usr_home_t }:{ file dir } { read write getattr };
typeattribute $1 file_type;
if (foo) {
allow $1 foo:bar baz;
}
if (bar) {
allow $1 foo:bar baz;
} else {
allow $1 foo:bar baz;
}
')
interface(`files_list_usr',`
gen_require(`
type usr_t;
')
allow $1 usr_t:dir { read getattr };
optional_policy(`
search_usr($1)
')
tunable_policy(`foo',`
whatever($1)
')
')
interface(`files_exec_usr_files',`
gen_require(`
type usr_t;
')
allow $1 usr_t:dir read;
allow $1 usr_t:lnk_file { read getattr };
can_exec($1,usr_t)
can_foo($1)
')
"""
simple_interface = """
interface(`foo',`
gen_require(`
type usr_t;
')
allow $1 usr_t:dir { create add_name };
allow $1 usr_t:file { read write };
')
"""
test_expansion = """
interface(`foo',`
gen_require(`
type usr_t;
')
allow $1 usr_t:dir { create add_name };
allow $1 usr_t:file { read write };
')
interface(`map', `
gen_require(`
type bar_t;
')
allow $1 bar_t:file read;
allow $2 bar_t:file write;
foo($2)
')
interface(`hard_map', `
gen_require(`
type baz_t;
')
allow $1 baz_t:file getattr;
allow $2 baz_t:file read;
allow $3 baz_t:file write;
map($1, $2)
map($2, $3)
# This should have no effect
foo($2)
')
"""
def compare_avsets(l, avs_b):
avs_a = access.AccessVectorSet()
avs_a.from_list(l)
a = list(avs_a)
b = list(avs_b)
a.sort()
b.sort()
if len(a) != len(b):
return False
for av_a, av_b in zip(a, b):
if av_a != av_b:
return False
return True
class TestInterfaceSet(unittest.TestCase):
def test_simple(self):
h = refparser.parse(simple_interface)
i = interfaces.InterfaceSet()
i.add_headers(h)
self.assertEqual(len(i.interfaces), 1)
for key, interface in i.interfaces.items():
self.assertEqual(key, interface.name)
self.assertEqual(key, "foo")
self.assertEqual(len(interface.access), 2)
# Check the access vectors
comp_avs = [["$1", "usr_t", "dir", "create", "add_name"],
["$1", "usr_t", "file", "read", "write"]]
ret = compare_avsets(comp_avs, interface.access)
self.assertTrue(ret)
# Check the params
self.assertEqual(len(interface.params), 1)
for param in interface.params.values():
self.assertEqual(param.type, refpolicy.SRC_TYPE)
self.assertEqual(param.name, "$1")
self.assertEqual(param.num, 1)
self.assertEqual(param.required, True)
def test_expansion(self):
h = refparser.parse(test_expansion)
i = interfaces.InterfaceSet()
i.add_headers(h)
self.assertEqual(len(i.interfaces), 3)
for key, interface in i.interfaces.items():
self.assertEqual(key, interface.name)
if key == "foo":
comp_avs = [["$1", "usr_t", "dir", "create", "add_name"],
["$1", "usr_t", "file", "read", "write"]]
self.assertTrue(compare_avsets(comp_avs, interface.access))
elif key == "map":
comp_avs = [["$2", "usr_t", "dir", "create", "add_name"],
["$2", "usr_t", "file", "read", "write"],
["$1", "bar_t", "file", "read"],
["$2", "bar_t", "file", "write"]]
self.assertTrue(compare_avsets(comp_avs, interface.access))
elif key == "hard_map":
comp_avs = [["$1", "baz_t", "file", "getattr"],
["$2", "baz_t", "file", "read"],
["$3", "baz_t", "file", "write"],
["$2", "usr_t", "dir", "create", "add_name"],
["$2", "usr_t", "file", "read", "write"],
["$1", "bar_t", "file", "read"],
["$2", "bar_t", "file", "write"],
["$3", "usr_t", "dir", "create", "add_name"],
["$3", "usr_t", "file", "read", "write"],
["$2", "bar_t", "file", "read"],
["$3", "bar_t", "file", "write"]]
self.assertTrue(compare_avsets(comp_avs, interface.access))
def test_export(self):
h = refparser.parse(interface_example)
i = interfaces.InterfaceSet()
i.add_headers(h)
f = open("output", "w")
i.to_file(f)
f.close()
i2 = interfaces.InterfaceSet()
f = open("output")
i2.from_file(f)
f.close()
if_status = [False, False, False]
for ifv in i2.interfaces.values():
if ifv.name == "files_search_usr":
if_status[0] = True
if ifv.name == "files_list_usr":
if_status[1] = True
if ifv.name == "files_exec_usr_files":
if_status[2] = True
self.assertEqual(if_status[0], True)
self.assertEqual(if_status[1], True)
self.assertEqual(if_status[2], True)