Skip to content

Commit 612bf66

Browse files
natibeknatibek
committed
s/apparmor: set the GlobalRootDir in apparmorSuite.SetUpTest and store its value
1 parent 73be3a6 commit 612bf66

2 files changed

Lines changed: 37 additions & 76 deletions

File tree

‎sandbox/apparmor/apparmor_test.go‎

Lines changed: 34 additions & 66 deletions
Original file line numberDiff line numberDiff line change
@@ -44,14 +44,16 @@ func TestApparmor(t *testing.T) {
4444

4545
type apparmorSuite struct {
4646
testutil.BaseTest
47+
fakeroot string
4748
}
4849

4950
var _ = Suite(&apparmorSuite{})
5051

5152
func (s *apparmorSuite) SetUpTest(c *C) {
5253
s.BaseTest.SetUpTest(c)
5354

54-
dirs.SetRootDir(c.MkDir())
55+
s.fakeroot = c.MkDir()
56+
dirs.SetRootDir(s.fakeroot)
5557
s.AddCleanup(func() { dirs.SetRootDir("") })
5658

5759
s.AddCleanup(func() {
@@ -77,9 +79,6 @@ func (*apparmorSuite) TestAppArmorParser(c *C) {
7779
}
7880

7981
func (*apparmorSuite) TestAppArmorInternalAppArmorParserAbi3(c *C) {
80-
fakeroot := c.MkDir()
81-
dirs.SetRootDir(fakeroot)
82-
8382
libSnapdDir := filepath.Join(dirs.SnapMountDir, "/snapd/42/usr/lib/snapd")
8483
parser := filepath.Join(libSnapdDir, "apparmor_parser")
8584
c.Assert(os.MkdirAll(libSnapdDir, 0755), IsNil)
@@ -108,9 +107,6 @@ func (*apparmorSuite) TestAppArmorInternalAppArmorParserAbi3(c *C) {
108107
}
109108

110109
func (*apparmorSuite) TestAppArmorInternalAppArmorParserAbi4(c *C) {
111-
fakeroot := c.MkDir()
112-
dirs.SetRootDir(fakeroot)
113-
114110
libSnapdDir := filepath.Join(dirs.SnapMountDir, "/snapd/42/usr/lib/snapd")
115111
parser := filepath.Join(libSnapdDir, "apparmor_parser")
116112
c.Assert(os.MkdirAll(libSnapdDir, 0755), IsNil)
@@ -268,45 +264,42 @@ func (*apparmorSuite) TestMockAppArmorFeatures(c *C) {
268264
const featuresSysPath = "sys/kernel/security/apparmor/features"
269265

270266
func (s *apparmorSuite) TestProbeAppArmorKernelFeatures(c *C) {
271-
d := c.MkDir()
272-
273267
// Pretend that apparmor kernel features directory doesn't exist.
274-
dirs.SetRootDir(d)
275268
features, err := apparmor.ProbeKernelFeatures()
276269
c.Assert(os.IsNotExist(err), Equals, true)
277270
c.Check(features, DeepEquals, []string{})
278271

279272
// Pretend that apparmor kernel features directory exists but is empty.
280-
c.Assert(os.MkdirAll(filepath.Join(d, featuresSysPath), 0755), IsNil)
273+
c.Assert(os.MkdirAll(filepath.Join(s.fakeroot, featuresSysPath), 0755), IsNil)
281274
features, err = apparmor.ProbeKernelFeatures()
282275
c.Assert(err, IsNil)
283276
c.Check(features, DeepEquals, []string{})
284277

285278
// Pretend that apparmor kernel features directory contains some entries.
286-
c.Assert(os.Mkdir(filepath.Join(d, featuresSysPath, "foo"), 0755), IsNil)
287-
c.Assert(os.Mkdir(filepath.Join(d, featuresSysPath, "bar"), 0755), IsNil)
288-
c.Assert(os.Mkdir(filepath.Join(d, featuresSysPath, "xyz"), 0755), IsNil)
279+
c.Assert(os.Mkdir(filepath.Join(s.fakeroot, featuresSysPath, "foo"), 0755), IsNil)
280+
c.Assert(os.Mkdir(filepath.Join(s.fakeroot, featuresSysPath, "bar"), 0755), IsNil)
281+
c.Assert(os.Mkdir(filepath.Join(s.fakeroot, featuresSysPath, "xyz"), 0755), IsNil)
289282
features, err = apparmor.ProbeKernelFeatures()
290283
c.Assert(err, IsNil)
291284
c.Check(features, DeepEquals, []string{"bar", "foo", "xyz"})
292285

293286
// Also test sub-features features
294-
c.Assert(os.Mkdir(filepath.Join(d, featuresSysPath, "foo", "baz"), 0755), IsNil)
295-
c.Assert(os.Mkdir(filepath.Join(d, featuresSysPath, "foo", "qux"), 0755), IsNil)
287+
c.Assert(os.Mkdir(filepath.Join(s.fakeroot, featuresSysPath, "foo", "baz"), 0755), IsNil)
288+
c.Assert(os.Mkdir(filepath.Join(s.fakeroot, featuresSysPath, "foo", "qux"), 0755), IsNil)
296289
features, err = apparmor.ProbeKernelFeatures()
297290
c.Assert(err, IsNil)
298291
c.Check(features, DeepEquals, []string{"bar", "foo", "foo:baz", "foo:qux", "xyz"})
299292

300293
// But boolean file features are not included
301-
file, err := os.OpenFile(filepath.Join(d, featuresSysPath, "bar", "feat1"), os.O_CREATE, 0o644)
294+
file, err := os.OpenFile(filepath.Join(s.fakeroot, featuresSysPath, "bar", "feat1"), os.O_CREATE, 0o644)
302295
c.Assert(err, IsNil)
303296
c.Assert(file.Close(), IsNil)
304297
features, err = apparmor.ProbeKernelFeatures()
305298
c.Assert(err, IsNil)
306299
c.Check(features, DeepEquals, []string{"bar", "foo", "foo:baz", "foo:qux", "xyz"})
307300

308301
// Also test that prompt feature is read from permstable32 if it exists
309-
c.Assert(os.Mkdir(filepath.Join(d, featuresSysPath, "policy"), 0755), IsNil)
302+
c.Assert(os.Mkdir(filepath.Join(s.fakeroot, featuresSysPath, "policy"), 0755), IsNil)
310303
for _, testCase := range []struct {
311304
permstableContent string
312305
expectedSuffixes []string
@@ -344,7 +337,7 @@ func (s *apparmorSuite) TestProbeAppArmorKernelFeatures(c *C) {
344337
[]string{"prompt"},
345338
},
346339
} {
347-
c.Assert(os.WriteFile(filepath.Join(d, featuresSysPath, "policy", "permstable32"), []byte(testCase.permstableContent), 0644), IsNil)
340+
c.Assert(os.WriteFile(filepath.Join(s.fakeroot, featuresSysPath, "policy", "permstable32"), []byte(testCase.permstableContent), 0644), IsNil)
348341
features, err = apparmor.ProbeKernelFeatures()
349342
c.Assert(err, IsNil)
350343
expected := []string{"bar", "foo", "foo:baz", "foo:qux", "policy"}
@@ -356,9 +349,9 @@ func (s *apparmorSuite) TestProbeAppArmorKernelFeatures(c *C) {
356349
}
357350

358351
// Set permstable32 to good value
359-
c.Assert(os.WriteFile(filepath.Join(d, featuresSysPath, "policy", "permstable32"), []byte("allow deny prompt"), 0644), IsNil)
352+
c.Assert(os.WriteFile(filepath.Join(s.fakeroot, featuresSysPath, "policy", "permstable32"), []byte("allow deny prompt"), 0644), IsNil)
360353
// Create notify directory
361-
c.Assert(os.Mkdir(filepath.Join(d, featuresSysPath, "policy", "notify"), 0755), IsNil)
354+
c.Assert(os.Mkdir(filepath.Join(s.fakeroot, featuresSysPath, "policy", "notify"), 0755), IsNil)
362355
features, err = apparmor.ProbeKernelFeatures()
363356
c.Assert(err, IsNil)
364357
expected := []string{"bar", "foo", "foo:baz", "foo:qux", "policy", "policy:notify", "policy:permstable32:prompt", "xyz"}
@@ -382,7 +375,7 @@ func (s *apparmorSuite) TestProbeAppArmorKernelFeatures(c *C) {
382375
[]string{"dbus", "file", "network"},
383376
},
384377
} {
385-
c.Assert(os.WriteFile(filepath.Join(d, featuresSysPath, "policy", "notify", "user"), []byte(testCase.userContent), 0644), IsNil)
378+
c.Assert(os.WriteFile(filepath.Join(s.fakeroot, featuresSysPath, "policy", "notify", "user"), []byte(testCase.userContent), 0644), IsNil)
386379
features, err = apparmor.ProbeKernelFeatures()
387380
c.Assert(err, IsNil)
388381
expected = []string{"bar", "foo", "foo:baz", "foo:qux", "policy", "policy:notify"}
@@ -395,17 +388,14 @@ func (s *apparmorSuite) TestProbeAppArmorKernelFeatures(c *C) {
395388
}
396389

397390
func (s *apparmorSuite) TestProbeAppArmorKernelFeaturesPermstable32Version(c *C) {
398-
d := c.MkDir()
399-
400391
// Pretend that apparmor kernel features directory doesn't exist.
401-
dirs.SetRootDir(d)
402392
version, err := apparmor.ProbeKernelFeaturesPermstable32Version()
403393
c.Assert(os.IsNotExist(err), Equals, true)
404394
c.Check(version, Equals, int64(0))
405395

406396
// Pretend that the permstable32_version file exists but is malformed.
407-
c.Assert(os.MkdirAll(filepath.Join(d, featuresSysPath, "policy"), 0o755), IsNil)
408-
f, err := os.OpenFile(filepath.Join(d, featuresSysPath, "policy", "permstable32_version"), os.O_CREATE, 0o644)
397+
c.Assert(os.MkdirAll(filepath.Join(s.fakeroot, featuresSysPath, "policy"), 0o755), IsNil)
398+
f, err := os.OpenFile(filepath.Join(s.fakeroot, featuresSysPath, "policy", "permstable32_version"), os.O_CREATE, 0o644)
409399
c.Assert(err, IsNil)
410400
f.Close()
411401
version, err = apparmor.ProbeKernelFeaturesPermstable32Version()
@@ -434,7 +424,7 @@ func (s *apparmorSuite) TestProbeAppArmorKernelFeaturesPermstable32Version(c *C)
434424
0x1234567890abcdef,
435425
},
436426
} {
437-
c.Assert(os.WriteFile(filepath.Join(d, featuresSysPath, "policy", "permstable32_version"), []byte(testCase.str), 0o644), IsNil)
427+
c.Assert(os.WriteFile(filepath.Join(s.fakeroot, featuresSysPath, "policy", "permstable32_version"), []byte(testCase.str), 0o644), IsNil)
438428
version, err = apparmor.ProbeKernelFeaturesPermstable32Version()
439429
c.Check(err, IsNil)
440430
c.Check(version, Equals, testCase.ver)
@@ -487,19 +477,19 @@ func probeOneVersionDependentParserFeature(c *C, known *[]string, parserPath, pa
487477

488478
type parserFeatureTestSuite struct {
489479
testutil.BaseTest
490-
d string
491-
binDir string
480+
fakeroot string
481+
binDir string
492482
}
493483

494484
var _ = Suite(&parserFeatureTestSuite{})
495485

496486
func (s *parserFeatureTestSuite) SetUpTest(c *C) {
497-
s.d = c.MkDir()
487+
s.fakeroot = c.MkDir()
498488
// This is used to find related parser files and isolates us from the host.
499-
dirs.SetRootDir(s.d)
489+
dirs.SetRootDir(s.fakeroot)
500490
s.AddCleanup(func() { dirs.SetRootDir("") })
501491

502-
s.binDir = filepath.Join(s.d, "bin")
492+
s.binDir = filepath.Join(s.fakeroot, "bin")
503493
err := os.Mkdir(s.binDir, 0o755)
504494
c.Assert(err, IsNil)
505495

@@ -613,11 +603,8 @@ func (s *parserFeatureTestSuite) TestInternalParser(c *C) {
613603

614604
func (s *apparmorSuite) TestInterfaceSystemKey(c *C) {
615605
apparmor.FreshAppArmorAssessment()
616-
617-
d := c.MkDir()
618-
dirs.SetRootDir(d)
619-
c.Assert(os.MkdirAll(filepath.Join(d, featuresSysPath, "policy"), 0755), IsNil)
620-
c.Assert(os.MkdirAll(filepath.Join(d, featuresSysPath, "network"), 0755), IsNil)
606+
c.Assert(os.MkdirAll(filepath.Join(s.fakeroot, featuresSysPath, "policy"), 0755), IsNil)
607+
c.Assert(os.MkdirAll(filepath.Join(s.fakeroot, featuresSysPath, "network"), 0755), IsNil)
621608

622609
mockParserCmd := testutil.MockCommand(c, "apparmor_parser", fakeParserScript("4.0.1"))
623610
defer mockParserCmd.Restore()
@@ -655,10 +642,8 @@ func (s *apparmorSuite) TestAppArmorParserMtime(c *C) {
655642
func (s *apparmorSuite) TestFeaturesProbedOnce(c *C) {
656643
apparmor.FreshAppArmorAssessment()
657644

658-
d := c.MkDir()
659-
dirs.SetRootDir(d)
660-
c.Assert(os.MkdirAll(filepath.Join(d, featuresSysPath, "policy"), 0755), IsNil)
661-
c.Assert(os.MkdirAll(filepath.Join(d, featuresSysPath, "network"), 0755), IsNil)
645+
c.Assert(os.MkdirAll(filepath.Join(s.fakeroot, featuresSysPath, "policy"), 0755), IsNil)
646+
c.Assert(os.MkdirAll(filepath.Join(s.fakeroot, featuresSysPath, "network"), 0755), IsNil)
662647

663648
mockParserCmd := testutil.MockCommand(c, "apparmor_parser", fakeParserScript("4.0.1"))
664649
defer mockParserCmd.Restore()
@@ -673,7 +658,7 @@ func (s *apparmorSuite) TestFeaturesProbedOnce(c *C) {
673658
c.Check(features, DeepEquals, []string{"cap-audit-read", "cap-bpf", "include-if-exists", "io-uring", "mqueue", "mqueue-posix", "prompt", "qipcrtr-socket", "tags", "unconfined", "unsafe", "userns", "xdp"})
674659

675660
// this makes probing fails but is not done again
676-
err = os.RemoveAll(d)
661+
err = os.RemoveAll(s.fakeroot)
677662
c.Assert(err, IsNil)
678663

679664
_, err = apparmor.KernelFeatures()
@@ -688,9 +673,6 @@ func (s *apparmorSuite) TestFeaturesProbedOnce(c *C) {
688673
}
689674

690675
func (s *apparmorSuite) TestPromptingSupported(c *C) {
691-
d := c.MkDir()
692-
dirs.SetRootDir(d)
693-
694676
goodKernelFeatures := []string{"policy:permstable32:prompt"}
695677
goodKernelFeaturesWithNotify := []string{"policy:permstable32:prompt", "policy:notify", "policy:notify:user:file"}
696678
goodParserFeatures := []string{"prompt"}
@@ -777,15 +759,15 @@ func (s *apparmorSuite) TestPromptingSupported(c *C) {
777759
c.Check(reason, Equals, "apparmor kernel permissions table version must be at least 2 for prompting to be supported, but version could not be read")
778760

779761
// Create permstable32_version file with a version too early
780-
c.Assert(os.MkdirAll(filepath.Join(d, featuresSysPath, "policy"), 0o755), IsNil)
781-
c.Assert(os.WriteFile(filepath.Join(d, featuresSysPath, "policy", "permstable32_version"), []byte("0x000001"), 0o644), IsNil)
762+
c.Assert(os.MkdirAll(filepath.Join(s.fakeroot, featuresSysPath, "policy"), 0o755), IsNil)
763+
c.Assert(os.WriteFile(filepath.Join(s.fakeroot, featuresSysPath, "policy", "permstable32_version"), []byte("0x000001"), 0o644), IsNil)
782764

783765
supported, reason = apparmor.PromptingSupported()
784766
c.Check(supported, Equals, false)
785767
c.Check(reason, Equals, "apparmor kernel permissions table version must be at least 2 for prompting to be supported, but version is 1")
786768

787769
// Create permstable32_version file with a sufficient version
788-
c.Assert(os.WriteFile(filepath.Join(d, featuresSysPath, "policy", "permstable32_version"), []byte("0x000002"), 0o644), IsNil)
770+
c.Assert(os.WriteFile(filepath.Join(s.fakeroot, featuresSysPath, "policy", "permstable32_version"), []byte("0x000002"), 0o644), IsNil)
789771

790772
for _, kernelFeatures := range [][]string{goodKernelFeatures, goodKernelFeaturesWithNotify} {
791773
restore := apparmor.MockFeatures(kernelFeatures, nil, goodParserFeatures, nil)
@@ -959,9 +941,6 @@ func (s *apparmorSuite) TestUpdateHomedirsTunableWriteFail(c *C) {
959941
}
960942

961943
func (s *apparmorSuite) TestUpdateHomedirsTunableHappy(c *C) {
962-
fakeroot := c.MkDir()
963-
dirs.SetRootDir(fakeroot)
964-
965944
err := apparmor.UpdateHomedirsTunable([]string{"/home/a", "/dir2"})
966945
c.Assert(err, IsNil)
967946
configFile := filepath.Join(dirs.GlobalRootDir, "/etc/apparmor.d/tunables/home.d/snapd")
@@ -979,9 +958,6 @@ func (s *apparmorSuite) TestUpdateHomedirsTunableHappyNoDirs(c *C) {
979958
}
980959

981960
func (s *apparmorSuite) TestSnapdAppArmorSupportsReexecImpl(c *C) {
982-
fakeroot := c.MkDir()
983-
dirs.SetRootDir(fakeroot)
984-
985961
// with no info file should indicate it does not support reexec
986962
c.Check(apparmor.SnapdAppArmorSupportsRexecImpl(), Equals, false)
987963

@@ -1004,9 +980,6 @@ func (s *apparmorSuite) TestSetupConfCacheDirs(c *C) {
1004980
}
1005981

1006982
func (s *apparmorSuite) TestSetupConfCacheDirsWithInternalApparmor(c *C) {
1007-
fakeroot := c.MkDir()
1008-
dirs.SetRootDir(fakeroot)
1009-
1010983
libSnapdDir := filepath.Join(dirs.SnapMountDir, "/snapd/42/usr/lib/snapd")
1011984
parser := filepath.Join(libSnapdDir, "apparmor_parser")
1012985
c.Assert(os.MkdirAll(libSnapdDir, 0755), IsNil)
@@ -1035,9 +1008,7 @@ func (s *apparmorSuite) TestSetupNotifySocketPath(c *C) {
10351008
}
10361009

10371010
func (s *apparmorSuite) TestSystemAppArmorLoadsSnapPolicyErr(c *C) {
1038-
fakeroot := c.MkDir()
1039-
dirs.SetRootDir(fakeroot)
1040-
fakeApparmorFunctionsPath := filepath.Join(fakeroot, "/lib/apparmor/functions")
1011+
fakeApparmorFunctionsPath := filepath.Join(s.fakeroot, "/lib/apparmor/functions")
10411012
err := os.MkdirAll(filepath.Dir(fakeApparmorFunctionsPath), 0750)
10421013
c.Assert(err, IsNil)
10431014

@@ -1063,14 +1034,11 @@ func (s *apparmorSuite) TestSystemAppArmorLoadsSnapPolicyErr(c *C) {
10631034
}
10641035

10651036
func (s *apparmorSuite) TestSystemAppArmorLoadsSnapPolicy(c *C) {
1066-
fakeroot := c.MkDir()
1067-
dirs.SetRootDir(fakeroot)
1068-
10691037
// systemAppArmorLoadsSnapPolicy() will look at this path so it
10701038
// needs to be the real path, not a faked one
1071-
dirs.SnapAppArmorDir = dirs.SnapAppArmorDir[len(fakeroot):]
1039+
dirs.SnapAppArmorDir = dirs.SnapAppArmorDir[len(s.fakeroot):]
10721040

1073-
fakeApparmorFunctionsPath := filepath.Join(fakeroot, "/lib/apparmor/functions")
1041+
fakeApparmorFunctionsPath := filepath.Join(s.fakeroot, "/lib/apparmor/functions")
10741042
err := os.MkdirAll(filepath.Dir(fakeApparmorFunctionsPath), 0755)
10751043
c.Assert(err, IsNil)
10761044

‎sandbox/apparmor/process_test.go‎

Lines changed: 3 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,6 @@ import (
2525

2626
. "gopkg.in/check.v1"
2727

28-
"github.com/snapcore/snapd/dirs"
2928
"github.com/snapcore/snapd/sandbox/apparmor"
3029
"github.com/snapcore/snapd/snap"
3130
)
@@ -58,15 +57,12 @@ func (s *apparmorSuite) TestDecodeLabelUnrecognisedSnapLabel(c *C) {
5857
}
5958

6059
func (s *apparmorSuite) TestSnapAppFromPidNewKernelPath(c *C) {
61-
d := c.MkDir()
62-
dirs.SetRootDir(d)
63-
6460
// when the new file exists we use that one
65-
newProcFile := filepath.Join(d, "proc/42/attr/apparmor/current")
61+
newProcFile := filepath.Join(s.fakeroot, "proc/42/attr/apparmor/current")
6662
c.Assert(os.MkdirAll(filepath.Dir(newProcFile), 0755), IsNil)
6763
c.Assert(os.WriteFile(newProcFile, []byte("snap.foo.app"), 0644), IsNil)
6864

69-
oldProcFile := filepath.Join(d, "proc/42/attr/current")
65+
oldProcFile := filepath.Join(s.fakeroot, "proc/42/attr/current")
7066
c.Assert(os.MkdirAll(filepath.Dir(oldProcFile), 0755), IsNil)
7167
c.Assert(os.WriteFile(oldProcFile, []byte("random-other-unread-data"), 0644), IsNil)
7268

@@ -78,14 +74,11 @@ func (s *apparmorSuite) TestSnapAppFromPidNewKernelPath(c *C) {
7874
}
7975

8076
func (s *apparmorSuite) TestSnapAppFromPid(c *C) {
81-
d := c.MkDir()
82-
dirs.SetRootDir(d)
83-
8477
// When no /proc/$pid/attr/current exists, assume unconfined
8578
_, _, _, err := apparmor.SnapAppFromPid(42)
8679
c.Check(err, ErrorMatches, `security label "unconfined" does not belong to a snap`)
8780

88-
procFile := filepath.Join(d, "proc/42/attr/current")
81+
procFile := filepath.Join(s.fakeroot, "proc/42/attr/current")
8982
c.Assert(os.MkdirAll(filepath.Dir(procFile), 0755), IsNil)
9083

9184
c.Assert(os.WriteFile(procFile, []byte("not-read"), 0000), IsNil)

0 commit comments

Comments
 (0)