mirror of
https://github.com/SELinuxProject/selinux
synced 2025-04-21 23:05:28 +00:00
42b4a44b74
Add support for extended permissions to audit2allow. Extend AuditParser
to parse the 'ioctlcmd' field in AVC message. Extend PolicyGenerator to
generate allowxperm rules. Add the '-x'/'--xperms' option to audit2allow
to turn on generating of extended permission AV rules.
AVCMessage parses the ioctlcmd field in AVC messages. AuditParser
converts the ioctlcmd values into generic representation of extended
permissions that is stored in access vectors.
Extended permissions are represented by operations (currently only
'ioctl') and values associated to the operations. Values (for example
'~{ 0x42 1234 23-34 }') are stored in the XpermSet class.
PolicyGenerator contains new method to turn on generating of xperms.
When turned on, for each access vector, standard AV rule and possibly
several xperm AV rules are generated. Xperm AV rules are represented by
the AVExtRule class.
With xperm generating turned off, PolicyGenerator provides comments
about extended permissions in certain situations. When the AVC message
contains the ioctlcmd field and the access would be allowed according to
the policy, PolicyGenerator warns about xperm rules being the possible
cause of the denial.
Signed-off-by: Jan Zarsky <jzarsky@redhat.com>
61 lines
1.9 KiB
Python
61 lines
1.9 KiB
Python
import unittest
|
|
import os
|
|
import shutil
|
|
from tempfile import mkdtemp
|
|
from subprocess import Popen, PIPE
|
|
|
|
|
|
class Audit2allowTests(unittest.TestCase):
|
|
|
|
def assertDenied(self, err):
|
|
self.assertTrue('Permission denied' in err,
|
|
'"Permission denied" not found in %r' % err)
|
|
|
|
def assertNotFound(self, err):
|
|
self.assertTrue('not found' in err,
|
|
'"not found" not found in %r' % err)
|
|
|
|
def assertFailure(self, status):
|
|
self.assertTrue(status != 0,
|
|
'"Succeeded when it should have failed')
|
|
|
|
def assertSuccess(self, cmd, status, err):
|
|
self.assertTrue(status == 0,
|
|
'"%s should have succeeded for this test %r' % (cmd, err))
|
|
|
|
def test_sepolgen_ifgen(self):
|
|
"Verify sepolgen-ifgen works"
|
|
p = Popen(['sudo', 'sepolgen-ifgen'], stdout=PIPE)
|
|
out, err = p.communicate()
|
|
if err:
|
|
print(out, err)
|
|
self.assertSuccess("sepolgen-ifgen", p.returncode, err)
|
|
|
|
def test_audit2allow(self):
|
|
"Verify audit2allow works"
|
|
p = Popen(['python', './audit2allow', "-i", "test.log"], stdout=PIPE)
|
|
out, err = p.communicate()
|
|
if err:
|
|
print(out, err)
|
|
self.assertSuccess("audit2allow", p.returncode, err)
|
|
|
|
def test_audit2why(self):
|
|
"Verify audit2why works"
|
|
p = Popen(['python', './audit2why', "-i", "test.log"], stdout=PIPE)
|
|
out, err = p.communicate()
|
|
if err:
|
|
print(out, err)
|
|
self.assertSuccess("audit2why", p.returncode, err)
|
|
|
|
def test_xperms(self):
|
|
"Verify that xperms generation works"
|
|
p = Popen(['python', './audit2allow', "-x", "-i", "test.log"], stdout=PIPE)
|
|
out, err = p.communicate()
|
|
if err:
|
|
print(out, err)
|
|
self.assertTrue(b"allowxperm" in out)
|
|
self.assertSuccess("xperms", p.returncode, err)
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|