1 /*
2 * Author: Joshua Brindle <jbrindle@tresys.com>
3 *
4 * Copyright (C) 2006 Tresys Technology, LLC
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
10 *
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15 *
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
19 */
20
21 #include "parse_util.h"
22 #include "helpers.h"
23 #include "test-common.h"
24
25 #include <sepol/policydb/policydb.h>
26 #include <sepol/policydb/link.h>
27
28 #include <CUnit/Basic.h>
29 #include <stdlib.h>
30
31 /* Tests for roles:
32 * Test for each of these for
33 * - role in appropriate symtab (global and decl)
34 * - datum in the decl symtab has correct type_set
35 * - scope datum has correct decl ids
36 * - dominates bitmap is correct
37 * Tests:
38 * - role in base, no modules
39 * - role in base optional, no modules
40 * - role a in base, b in module
41 * - role a in base and module (additive)
42 * - role a in base and 2 module
43 * - role a in base optional, b in module
44 * - role a in base, b in module optional
45 * - role a in base optional, b in module optional
46 * - role a in base optional and module
47 * - role a in base and module optional
48 * - role a in base optional and module optional
49 * - role a in base optional and 2 modules
50 * - role a and b in base, b dom a, are types correct (TODO)
51 */
52
53 /* this simply tests whether the passed in role only has its own
54 * value in its dominates ebitmap */
only_dominates_self(policydb_t * p,role_datum_t * role)55 static void only_dominates_self(policydb_t * p, role_datum_t * role)
56 {
57 ebitmap_node_t *tnode;
58 unsigned int i;
59 int found = 0;
60
61 ebitmap_for_each_positive_bit(&role->dominates, tnode, i) {
62 found++;
63 CU_ASSERT(i == role->s.value - 1);
64 }
65 CU_ASSERT(found == 1);
66 }
67
base_role_tests(policydb_t * base)68 void base_role_tests(policydb_t * base)
69 {
70 avrule_decl_t *decl;
71 role_datum_t *role;
72 unsigned int decls[2];
73 const char *types[2];
74
75 /* These tests look at roles in the base only, the desire is to ensure that
76 * roles are not destroyed or otherwise removed during the link process */
77
78 /**** test for g_b_role_1 in base and decl 1 (global) ****/
79 decls[0] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_g_b"))->decl_id;
80 test_sym_presence(base, "g_b_role_1", SYM_ROLES, SCOPE_DECL, decls, 1);
81 /* make sure it has the correct type set (g_b_type_1, no negset, no flags) */
82 types[0] = "g_b_type_1";
83 role = test_role_type_set(base, "g_b_role_1", NULL, types, 1, 0);
84 /* This role should only dominate itself */
85 only_dominates_self(base, role);
86
87 /**** test for o1_b_role_1 in optional (decl 2) ****/
88 decl = test_find_decl_by_sym(base, SYM_TYPES, "tag_o1_b");
89 decls[0] = decl->decl_id;
90 test_sym_presence(base, "o1_b_role_1", SYM_ROLES, SCOPE_DECL, decls, 1);
91 /* make sure it has the correct type set (o1_b_type_1, no negset, no flags) */
92 types[0] = "o1_b_type_1";
93 role = test_role_type_set(base, "o1_b_role_1", decl, types, 1, 0);
94 /* and only dominates itself */
95 only_dominates_self(base, role);
96 }
97
module_role_tests(policydb_t * base)98 void module_role_tests(policydb_t * base)
99 {
100 role_datum_t *role;
101 avrule_decl_t *decl;
102 unsigned int decls[3];
103 const char *types[3];
104
105 /* These tests are run when the base is linked with 2 modules,
106 * They should test whether the roles get copied correctly from the
107 * modules into the base */
108
109 /**** test for role in module 1 (global) ****/
110 decls[0] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_g_m1"))->decl_id;
111 test_sym_presence(base, "g_m1_role_1", SYM_ROLES, SCOPE_DECL, decls, 1);
112 /* make sure it has the correct type set (g_m1_type_1, no negset, no flags) */
113 types[0] = "g_m1_type_1";
114 role = test_role_type_set(base, "g_m1_role_1", NULL, types, 1, 0);
115 /* and only dominates itself */
116 only_dominates_self(base, role);
117
118 /**** test for role in module 1 (optional) ****/
119 decl = test_find_decl_by_sym(base, SYM_TYPES, "tag_o1_m1");
120 decls[0] = decl->decl_id;
121 test_sym_presence(base, "o1_m1_role_1", SYM_ROLES, SCOPE_DECL, decls, 1);
122 /* make sure it has the correct type set (o1_m1_type_1, no negset, no flags) */
123 types[0] = "o1_m1_type_1";
124 role = test_role_type_set(base, "o1_m1_role_1", decl, types, 1, 0);
125 /* and only dominates itself */
126 only_dominates_self(base, role);
127
128 /* These test whether the type sets are copied to the right place and
129 * correctly unioned when they should be */
130
131 /**** test for type added to base role in module 1 (global) ****/
132 decls[0] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_g_b"))->decl_id;
133 test_sym_presence(base, "g_b_role_2", SYM_ROLES, SCOPE_DECL, decls, 1);
134 /* make sure it has the correct type set (g_m1_type_1, no negset, no flags) */
135 types[0] = "g_b_type_2"; /* added in base when declared */
136 types[1] = "g_m1_type_1"; /* added in module */
137 role = test_role_type_set(base, "g_b_role_2", NULL, types, 2, 0);
138 /* and only dominates itself */
139 only_dominates_self(base, role);
140
141 /**** test for type added to base role in module 1 & 2 (global) ****/
142 decls[0] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_g_b"))->decl_id;
143 decls[1] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_g_m1"))->decl_id;
144 decls[2] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_g_m2"))->decl_id;
145 test_sym_presence(base, "g_b_role_3", SYM_ROLES, SCOPE_DECL, decls, 3);
146 /* make sure it has the correct type set (g_b_type_2, g_m1_type_2, g_m2_type_2, no negset, no flags) */
147 types[0] = "g_b_type_2"; /* added in base when declared */
148 types[1] = "g_m1_type_2"; /* added in module 1 */
149 types[2] = "g_m2_type_2"; /* added in module 2 */
150 role = test_role_type_set(base, "g_b_role_3", NULL, types, 3, 0);
151 /* and only dominates itself */
152 only_dominates_self(base, role);
153
154 /**** test for role in base optional and module 1 (additive) ****/
155 decls[0] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_o1_b"))->decl_id;
156 decls[1] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_g_m1"))->decl_id;
157 test_sym_presence(base, "o1_b_role_2", SYM_ROLES, SCOPE_DECL, decls, 2);
158 /* this one will have 2 type sets, one in the global symtab and one in the base optional 1 */
159 types[0] = "g_m1_type_1";
160 role = test_role_type_set(base, "o1_b_role_2", NULL, types, 1, 0);
161 types[0] = "o1_b_type_1";
162 role = test_role_type_set(base, "o1_b_role_2", test_find_decl_by_sym(base, SYM_TYPES, "tag_o1_b"), types, 1, 0);
163 /* and only dominates itself */
164 only_dominates_self(base, role);
165
166 /**** test for role in base and module 1 optional (additive) ****/
167 decls[0] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_g_b"))->decl_id;
168 decls[1] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_o2_m1"))->decl_id;
169 test_sym_presence(base, "g_b_role_4", SYM_ROLES, SCOPE_DECL, decls, 2);
170 /* this one will have 2 type sets, one in the global symtab and one in the base optional 1 */
171 types[0] = "g_b_type_2";
172 role = test_role_type_set(base, "g_b_role_4", NULL, types, 1, 0);
173 types[0] = "g_m1_type_2";
174 role = test_role_type_set(base, "g_b_role_4", test_find_decl_by_sym(base, SYM_TYPES, "tag_o2_m1"), types, 1, 0);
175 /* and only dominates itself */
176 only_dominates_self(base, role);
177
178 /**** test for role in base and module 1 optional (additive) ****/
179 decls[0] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_o3_b"))->decl_id;
180 decls[1] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_o3_m1"))->decl_id;
181 test_sym_presence(base, "o3_b_role_1", SYM_ROLES, SCOPE_DECL, decls, 2);
182 /* this one will have 2 type sets, one in the 3rd base optional and one in the 3rd module optional */
183 types[0] = "o3_b_type_1";
184 role = test_role_type_set(base, "o3_b_role_1", test_find_decl_by_sym(base, SYM_TYPES, "tag_o3_b"), types, 1, 0);
185 types[0] = "o3_m1_type_1";
186 role = test_role_type_set(base, "o3_b_role_1", test_find_decl_by_sym(base, SYM_TYPES, "tag_o3_m1"), types, 1, 0);
187 /* and only dominates itself */
188 only_dominates_self(base, role);
189
190 /**** test for role in base and module 1 optional (additive) ****/
191 decls[0] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_o4_b"))->decl_id;
192 decls[1] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_g_m1"))->decl_id;
193 decls[2] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_g_m2"))->decl_id;
194 test_sym_presence(base, "o4_b_role_1", SYM_ROLES, SCOPE_DECL, decls, 3);
195 /* this one will have 2 type sets, one in the global symtab (with both module types) and one in the 4th optional of base */
196 types[0] = "g_m1_type_1";
197 role = test_role_type_set(base, "o4_b_role_1", test_find_decl_by_sym(base, SYM_TYPES, "tag_o4_b"), types, 1, 0);
198 types[0] = "g_m2_type_1";
199 types[1] = "g_m1_type_2";
200 role = test_role_type_set(base, "o4_b_role_1", NULL, types, 2, 0);
201 /* and only dominates itself */
202 only_dominates_self(base, role);
203 }
204