Skip to content

Commit 5ff7343

Browse files
cgzonescgzones
committed
libsepol/tests: add test for segregate attributes
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
1 parent aa43363 commit 5ff7343

File tree

8 files changed

+394
-0
lines changed

8 files changed

+394
-0
lines changed

‎libsepol/tests/libsepol-tests.c‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323
#include "test-expander.h"
2424
#include "test-deps.h"
2525
#include "test-downgrade.h"
26+
#include "test-segregateattributes.h"
2627

2728
#include <CUnit/Basic.h>
2829
#include <CUnit/Console.h>
@@ -69,6 +70,7 @@ static bool do_tests(int interactive, int verbose)
6970
DECLARE_SUITE(expander);
7071
DECLARE_SUITE(deps);
7172
DECLARE_SUITE(downgrade);
73+
DECLARE_SUITE(sattrs);
7274

7375
if (verbose)
7476
CU_basic_set_mode(CU_BRM_VERBOSE);

‎libsepol/tests/policies/test-sattrs/single.conf‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
class process
2+
class blk_file
3+
class chr_file
4+
class dir
5+
class fifo_file
6+
class file
7+
class lnk_file
8+
class sock_file
9+
10+
sid kernel
11+
sid security
12+
sid unlabeled
13+
sid file
14+
sid port
15+
sid netif
16+
sid netmsg
17+
sid node
18+
sid devnull
19+
20+
class process { dyntransition transition }
21+
class file { write }
22+
23+
ifdef(`enable_mls',`
24+
sensitivity s0;
25+
dominance { s0 }
26+
category c0; category c1; category c2; category c3;
27+
category c4; category c5; category c6; category c7;
28+
category c8; category c9; category c10; category c11;
29+
category c12; category c13; category c14; category c15;
30+
category c16; category c17; category c18; category c19;
31+
category c20; category c21; category c22; category c23;
32+
33+
level s0:c0.c23;
34+
35+
mlsconstrain file { write } ( h1 dom h2 );
36+
')
37+
38+
#
39+
# Test start
40+
#
41+
42+
attribute test1_attr1;
43+
attribute test1_attr2;
44+
type test1_type;
45+
typeattribute test1_type test1_attr1;
46+
typeattribute test1_type test1_attr2;
47+
segregate_attributes test1_attr1, test1_attr2;
48+
49+
50+
attribute test2_attr1;
51+
attribute test2_attr2;
52+
attribute test2_attr3;
53+
type test2_type1;
54+
type test2_type2;
55+
type test2_type3;
56+
type test2_type4;
57+
typeattribute test2_type1 test2_attr1;
58+
typeattribute test2_type1 test2_attr2;
59+
typeattribute test2_type2 test2_attr1;
60+
typeattribute test2_type2 test2_attr3;
61+
typeattribute test2_type3 test2_attr2;
62+
typeattribute test2_type3 test2_attr3;
63+
typeattribute test2_type4 test2_attr1;
64+
typeattribute test2_type4 test2_attr2;
65+
typeattribute test2_type4 test2_attr3;
66+
segregate_attributes test2_attr1, test2_attr2, test2_attr3;
67+
68+
#
69+
# Test End
70+
#
71+
72+
type sys_isid;
73+
allow sys_isid self : process { dyntransition transition };
74+
role sys_role;
75+
role sys_role types sys_isid;
76+
gen_user(sys_user,, sys_role, s0, s0 - s0:c0.c23)
77+
sid kernel gen_context(sys_user:sys_role:sys_isid, s0)
78+
sid security gen_context(sys_user:sys_role:sys_isid, s0)
79+
sid unlabeled gen_context(sys_user:sys_role:sys_isid, s0)
80+
sid file gen_context(sys_user:sys_role:sys_isid, s0)
81+
sid port gen_context(sys_user:sys_role:sys_isid, s0)
82+
sid netif gen_context(sys_user:sys_role:sys_isid, s0)
83+
sid netmsg gen_context(sys_user:sys_role:sys_isid, s0)
84+
sid node gen_context(sys_user:sys_role:sys_isid, s0)
85+
sid devnull gen_context(sys_user:sys_role:sys_isid, s0)
86+
fs_use_trans devpts gen_context(sys_user:sys_role:sys_isid, s0);
87+
fs_use_trans devtmpfs gen_context(sys_user:sys_role:sys_isid, s0);

‎libsepol/tests/policies/test-sattrs/split_base.conf‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
class process
2+
class blk_file
3+
class chr_file
4+
class dir
5+
class fifo_file
6+
class file
7+
class lnk_file
8+
class sock_file
9+
10+
sid kernel
11+
sid security
12+
sid unlabeled
13+
sid file
14+
sid port
15+
sid netif
16+
sid netmsg
17+
sid node
18+
sid devnull
19+
20+
class process { dyntransition transition }
21+
class file { write }
22+
23+
ifdef(`enable_mls',`
24+
sensitivity s0;
25+
dominance { s0 }
26+
category c0; category c1; category c2; category c3;
27+
category c4; category c5; category c6; category c7;
28+
category c8; category c9; category c10; category c11;
29+
category c12; category c13; category c14; category c15;
30+
category c16; category c17; category c18; category c19;
31+
category c20; category c21; category c22; category c23;
32+
33+
level s0:c0.c23;
34+
35+
mlsconstrain file { write } ( h1 dom h2 );
36+
')
37+
38+
type sys_isid;
39+
allow sys_isid self : process { dyntransition transition };
40+
role sys_role;
41+
role sys_role types sys_isid;
42+
gen_user(sys_user,, sys_role, s0, s0 - s0:c0.c23)
43+
sid kernel gen_context(sys_user:sys_role:sys_isid, s0)
44+
sid security gen_context(sys_user:sys_role:sys_isid, s0)
45+
sid unlabeled gen_context(sys_user:sys_role:sys_isid, s0)
46+
sid file gen_context(sys_user:sys_role:sys_isid, s0)
47+
sid port gen_context(sys_user:sys_role:sys_isid, s0)
48+
sid netif gen_context(sys_user:sys_role:sys_isid, s0)
49+
sid netmsg gen_context(sys_user:sys_role:sys_isid, s0)
50+
sid node gen_context(sys_user:sys_role:sys_isid, s0)
51+
sid devnull gen_context(sys_user:sys_role:sys_isid, s0)
52+
fs_use_trans devpts gen_context(sys_user:sys_role:sys_isid, s0);
53+
fs_use_trans devtmpfs gen_context(sys_user:sys_role:sys_isid, s0);

‎libsepol/tests/policies/test-sattrs/split_module1.conf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
module sattrs_test_1 1.0;
2+
3+
require {
4+
type test_type_t;
5+
}
6+
7+
attribute attr1;
8+
9+
typeattribute test_type_t attr1;

‎libsepol/tests/policies/test-sattrs/split_module2.conf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
module sattrs_test_2 1.0;
2+
3+
require {
4+
type test_type_t;
5+
}
6+
7+
attribute attr2;
8+
9+
typeattribute test_type_t attr2;

‎libsepol/tests/policies/test-sattrs/split_module3.conf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
module sattrs_test_3 1.0;
2+
3+
require {
4+
attribute attr1, attr2;
5+
}
6+
7+
type test_type_t;
8+
9+
segregate_attributes attr1, attr2;

0 commit comments

Comments
 (0)