Make test_matches.sh into a series of TAP testcases
Use temporary filesystems / memory disks instead of a hardcoded path which doesn't exist on test systems MFC after: 2 weeks Sponsored by: EMC / Isilon Storage Division
This commit is contained in:
parent
7b98ae5ad2
commit
5f249cb8c9
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=292531
@ -10,158 +10,185 @@ uidoutrange="daemon"
|
|||||||
gidinrange="nobody" # We expect $uidinrange in this group
|
gidinrange="nobody" # We expect $uidinrange in this group
|
||||||
gidoutrange="daemon" # We expect $uidinrange in this group
|
gidoutrange="daemon" # We expect $uidinrange in this group
|
||||||
|
|
||||||
playground="/stuff/nobody/" # Must not be on root fs
|
|
||||||
|
|
||||||
#
|
#
|
||||||
# Setup
|
# Setup
|
||||||
#
|
#
|
||||||
rm -f $playground/test*
|
|
||||||
|
: ${TMPDIR=/tmp}
|
||||||
|
if [ $(id -u) -ne 0 ]; then
|
||||||
|
echo "1..0 # SKIP test must be run as root"
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
if ! playground=$(mktemp -d $TMPDIR/tmp.XXXXXXX); then
|
||||||
|
echo "1..0 # SKIP failed to create temporary directory"
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
trap "rmdir $playground" EXIT INT TERM
|
||||||
|
if ! mdmfs -s 25m md $playground; then
|
||||||
|
echo "1..0 # SKIP failed to mount md device"
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
chmod a+rwx $playground
|
||||||
|
md_device=$(mount -p | grep "$playground" | awk '{ gsub(/^\/dev\//, "", $1); print $1 }')
|
||||||
|
trap "umount -f $playground; mdconfig -d -u $md_device; rmdir $playground" EXIT INT TERM
|
||||||
|
if [ -z "$md_device" ]; then
|
||||||
|
mount -p | grep $playground
|
||||||
|
echo "1..0 # md device not properly attached to the system"
|
||||||
|
fi
|
||||||
|
|
||||||
ugidfw remove 1
|
ugidfw remove 1
|
||||||
|
|
||||||
file1=$playground/test-$uidinrange
|
file1=$playground/test-$uidinrange
|
||||||
file2=$playground/test-$uidoutrange
|
file2=$playground/test-$uidoutrange
|
||||||
cat <<EOF> $playground/test-script.pl
|
cat > $playground/test-script.sh <<'EOF'
|
||||||
if (open(F, ">" . shift)) { exit 0; } else { exit 1; }
|
#!/bin/sh
|
||||||
|
: > $1
|
||||||
EOF
|
EOF
|
||||||
command1="perl $playground/test-script.pl $file1"
|
if [ $? -ne 0 ]; then
|
||||||
command2="perl $playground/test-script.pl $file2"
|
echo "1..0 # SKIP failed to create test script"
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
echo "1..30"
|
||||||
|
|
||||||
echo -n "$uidinrange file: "
|
command1="sh $playground/test-script.sh $file1"
|
||||||
su -m $uidinrange -c "$command1 && echo good"
|
command2="sh $playground/test-script.sh $file2"
|
||||||
|
|
||||||
|
echo "# $uidinrange file:"
|
||||||
|
su -m $uidinrange -c "if $command1; then echo ok; else echo not ok; fi"
|
||||||
chown "$uidinrange":"$gidinrange" $file1
|
chown "$uidinrange":"$gidinrange" $file1
|
||||||
chmod a+w $file1
|
chmod a+w $file1
|
||||||
|
|
||||||
echo -n "$uidoutrange file: "
|
echo "# $uidoutrange file:"
|
||||||
$command2 && echo good
|
if $command2; then echo ok; else echo not ok; fi
|
||||||
chown "$uidoutrange":"$gidoutrange" $file2
|
chown "$uidoutrange":"$gidoutrange" $file2
|
||||||
chmod a+w $file2
|
chmod a+w $file2
|
||||||
|
|
||||||
#
|
#
|
||||||
# No rules
|
# No rules
|
||||||
#
|
#
|
||||||
echo -n "no rules $uidinrange: "
|
echo "# no rules $uidinrange:"
|
||||||
su -fm $uidinrange -c "$command1 && echo good"
|
su -fm $uidinrange -c "if $command1; then echo ok; else echo not ok; fi"
|
||||||
echo -n "no rules $uidoutrange: "
|
echo "# no rules $uidoutrange:"
|
||||||
su -fm $uidoutrange -c "$command1 && echo good"
|
su -fm $uidoutrange -c "if $command1; then echo ok; else echo not ok; fi"
|
||||||
|
|
||||||
#
|
#
|
||||||
# Subject Match on uid
|
# Subject Match on uid
|
||||||
#
|
#
|
||||||
ugidfw set 1 subject uid $uidrange object mode rasx
|
ugidfw set 1 subject uid $uidrange object mode rasx
|
||||||
echo -n "subject uid in range: "
|
echo "# subject uid in range:"
|
||||||
su -fm $uidinrange -c "$command1 || echo good"
|
su -fm $uidinrange -c "if $command1; then echo not ok; else echo ok; fi"
|
||||||
echo -n "subject uid out range: "
|
echo "# subject uid out range:"
|
||||||
su -fm $uidoutrange -c "$command1 && echo good"
|
su -fm $uidoutrange -c "if $command1; then echo ok; else echo not ok; fi"
|
||||||
|
|
||||||
#
|
#
|
||||||
# Subject Match on gid
|
# Subject Match on gid
|
||||||
#
|
#
|
||||||
ugidfw set 1 subject gid $gidrange object mode rasx
|
ugidfw set 1 subject gid $gidrange object mode rasx
|
||||||
echo -n "subject gid in range: "
|
echo "# subject gid in range:"
|
||||||
su -fm $uidinrange -c "$command1 || echo good"
|
su -fm $uidinrange -c "if $command1; then echo not ok; else echo ok; fi"
|
||||||
echo -n "subject gid out range: "
|
echo "# subject gid out range:"
|
||||||
su -fm $uidoutrange -c "$command1 && echo good"
|
su -fm $uidoutrange -c "if $command1; then echo ok; else echo not ok; fi"
|
||||||
|
|
||||||
#
|
#
|
||||||
# Subject Match on jail
|
# Subject Match on jail
|
||||||
#
|
#
|
||||||
echo -n "subject matching jailid: "
|
|
||||||
rm -f $playground/test-jail
|
rm -f $playground/test-jail
|
||||||
jailid=`jail -i / localhost 127.0.0.1 /usr/sbin/daemon -f /bin/sh -c "(sleep 3; touch $playground/test-jail) &"`
|
echo "# subject matching jailid:"
|
||||||
|
jailid=`jail -i / localhost 127.0.0.1 /usr/sbin/daemon -f /bin/sh -c "(sleep 5; touch $playground/test-jail) &"`
|
||||||
ugidfw set 1 subject jailid $jailid object mode rasx
|
ugidfw set 1 subject jailid $jailid object mode rasx
|
||||||
sleep 6
|
sleep 10
|
||||||
if [ ! -f $playground/test-jail ] ; then echo good ; fi
|
if [ -f $playground/test-jail ]; then echo not ok; else echo ok; fi
|
||||||
|
|
||||||
echo -n "subject nonmatching jailid: "
|
|
||||||
rm -f $playground/test-jail
|
rm -f $playground/test-jail
|
||||||
jailid=`jail -i / localhost 127.0.0.1 /usr/sbin/daemon -f /bin/sh -c "(sleep 3; touch $playground/test-jail) &"`
|
echo "# subject nonmatching jailid:"
|
||||||
sleep 6
|
jailid=`jail -i / localhost 127.0.0.1 /usr/sbin/daemon -f /bin/sh -c "(sleep 5; touch $playground/test-jail) &"`
|
||||||
if [ -f $playground/test-jail ] ; then echo good ; fi
|
sleep 10
|
||||||
|
if [ -f $playground/test-jail ]; then echo ok; else echo not ok; fi
|
||||||
|
|
||||||
#
|
#
|
||||||
# Object uid
|
# Object uid
|
||||||
#
|
#
|
||||||
ugidfw set 1 subject object uid $uidrange mode rasx
|
ugidfw set 1 subject object uid $uidrange mode rasx
|
||||||
echo -n "object uid in range: "
|
echo "# object uid in range:"
|
||||||
su -fm $uidinrange -c "$command1 || echo good"
|
su -fm $uidinrange -c "if $command1; then echo not ok; else echo ok; fi"
|
||||||
echo -n "object uid out range: "
|
echo "# object uid out range:"
|
||||||
su -fm $uidinrange -c "$command2 && echo good"
|
su -fm $uidinrange -c "if $command2; then echo ok; else echo not ok; fi"
|
||||||
ugidfw set 1 subject object uid $uidrange mode rasx
|
ugidfw set 1 subject object uid $uidrange mode rasx
|
||||||
echo -n "object uid in range (differennt subject): "
|
echo "# object uid in range (differennt subject):"
|
||||||
su -fm $uidoutrange -c "$command1 || echo good"
|
su -fm $uidoutrange -c "if $command1; then echo not ok; else echo ok; fi"
|
||||||
echo -n "object uid out range (differennt subject): "
|
echo "# object uid out range (differennt subject):"
|
||||||
su -fm $uidoutrange -c "$command2 && echo good"
|
su -fm $uidoutrange -c "if $command2; then echo ok; else echo not ok; fi"
|
||||||
|
|
||||||
#
|
#
|
||||||
# Object gid
|
# Object gid
|
||||||
#
|
#
|
||||||
ugidfw set 1 subject object gid $uidrange mode rasx
|
ugidfw set 1 subject object gid $uidrange mode rasx
|
||||||
echo -n "object gid in range: "
|
echo "# object gid in range:"
|
||||||
su -fm $uidinrange -c "$command1 || echo good"
|
su -fm $uidinrange -c "if $command1; then echo not ok; else echo ok; fi"
|
||||||
echo -n "object gid out range: "
|
echo "# object gid out range:"
|
||||||
su -fm $uidinrange -c "$command2 && echo good"
|
su -fm $uidinrange -c "if $command2; then echo ok; else echo not ok; fi"
|
||||||
echo -n "object gid in range (differennt subject): "
|
echo "# object gid in range (different subject):"
|
||||||
su -fm $uidoutrange -c "$command1 || echo good"
|
su -fm $uidoutrange -c "if $command1; then echo not ok; else echo ok; fi"
|
||||||
echo -n "object gid out range (differennt subject): "
|
echo "# object gid out range (different subject):"
|
||||||
su -fm $uidoutrange -c "$command2 && echo good"
|
su -fm $uidoutrange -c "if $command2; then echo ok; else echo not ok; fi"
|
||||||
|
|
||||||
#
|
#
|
||||||
# Object filesys
|
# Object filesys
|
||||||
#
|
#
|
||||||
ugidfw set 1 subject uid $uidrange object filesys / mode rasx
|
ugidfw set 1 subject uid $uidrange object filesys / mode rasx
|
||||||
echo -n "object out of filesys: "
|
echo "# object out of filesys:"
|
||||||
su -fm $uidinrange -c "$command1 && echo good"
|
su -fm $uidinrange -c "if $command1; then echo ok; else echo not ok; fi"
|
||||||
ugidfw set 1 subject uid $uidrange object filesys $playground mode rasx
|
ugidfw set 1 subject uid $uidrange object filesys $playground mode rasx
|
||||||
echo -n "object in filesys: "
|
echo "# object in filesys:"
|
||||||
su -fm $uidinrange -c "$command1 || echo good"
|
su -fm $uidinrange -c "if $command1; then echo not ok; else echo ok; fi"
|
||||||
|
|
||||||
#
|
#
|
||||||
# Object suid
|
# Object suid
|
||||||
#
|
#
|
||||||
ugidfw set 1 subject uid $uidrange object suid mode rasx
|
ugidfw set 1 subject uid $uidrange object suid mode rasx
|
||||||
echo -n "object notsuid: "
|
echo "# object notsuid:"
|
||||||
su -fm $uidinrange -c "$command1 && echo good"
|
su -fm $uidinrange -c "if $command1; then echo ok; else echo not ok; fi"
|
||||||
chmod u+s $file1
|
chmod u+s $file1
|
||||||
echo -n "object suid: "
|
echo "# object suid:"
|
||||||
su -fm $uidinrange -c "$command1 || echo good"
|
su -fm $uidinrange -c "if $command1; then echo not ok; else echo ok; fi"
|
||||||
chmod u-s $file1
|
chmod u-s $file1
|
||||||
|
|
||||||
#
|
#
|
||||||
# Object sgid
|
# Object sgid
|
||||||
#
|
#
|
||||||
ugidfw set 1 subject uid $uidrange object sgid mode rasx
|
ugidfw set 1 subject uid $uidrange object sgid mode rasx
|
||||||
echo -n "object notsgid: "
|
echo "# object notsgid:"
|
||||||
su -fm $uidinrange -c "$command1 && echo good"
|
su -fm $uidinrange -c "if $command1; then echo ok; else echo not ok; fi"
|
||||||
chmod g+s $file1
|
chmod g+s $file1
|
||||||
echo -n "object sgid: "
|
echo "# object sgid:"
|
||||||
su -fm $uidinrange -c "$command1 || echo good"
|
su -fm $uidinrange -c "if $command1; then echo not ok; else echo ok; fi"
|
||||||
chmod g-s $file1
|
chmod g-s $file1
|
||||||
|
|
||||||
#
|
#
|
||||||
# Object uid matches subject
|
# Object uid matches subject
|
||||||
#
|
#
|
||||||
ugidfw set 1 subject uid $uidrange object uid_of_subject mode rasx
|
ugidfw set 1 subject uid $uidrange object uid_of_subject mode rasx
|
||||||
echo -n "object uid notmatches subject: "
|
echo "# object uid notmatches subject:"
|
||||||
su -fm $uidinrange -c "$command2 && echo good"
|
su -fm $uidinrange -c "if $command2; then echo ok; else echo not ok; fi"
|
||||||
echo -n "object uid matches subject: "
|
echo "# object uid matches subject:"
|
||||||
su -fm $uidinrange -c "$command1 || echo good"
|
su -fm $uidinrange -c "if $command1; then echo not ok; else echo ok; fi"
|
||||||
|
|
||||||
#
|
#
|
||||||
# Object gid matches subject
|
# Object gid matches subject
|
||||||
#
|
#
|
||||||
ugidfw set 1 subject uid $uidrange object gid_of_subject mode rasx
|
ugidfw set 1 subject uid $uidrange object gid_of_subject mode rasx
|
||||||
echo -n "object gid notmatches subject: "
|
echo "# object gid notmatches subject:"
|
||||||
su -fm $uidinrange -c "$command2 && echo good"
|
su -fm $uidinrange -c "if $command2; then echo ok; else echo not ok; fi"
|
||||||
echo -n "object gid matches subject: "
|
echo "# object gid matches subject:"
|
||||||
su -fm $uidinrange -c "$command1 || echo good"
|
su -fm $uidinrange -c "if $command1; then echo not ok; else echo ok; fi"
|
||||||
|
|
||||||
#
|
#
|
||||||
# Object type
|
# Object type
|
||||||
#
|
#
|
||||||
ugidfw set 1 subject uid $uidrange object type dbclsp mode rasx
|
ugidfw set 1 subject uid $uidrange object type dbclsp mode rasx
|
||||||
echo -n "object not type: "
|
echo "# object not type:"
|
||||||
su -fm $uidinrange -c "$command1 && echo good"
|
su -fm $uidinrange -c "if $command1; then echo ok; else echo not ok; fi"
|
||||||
ugidfw set 1 subject uid $uidrange object type r mode rasx
|
ugidfw set 1 subject uid $uidrange object type r mode rasx
|
||||||
echo -n "object type: "
|
echo "# object type:"
|
||||||
su -fm $uidinrange -c "$command1 || echo good"
|
su -fm $uidinrange -c "if $command1; then echo not ok; else echo ok; fi"
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user