tests: add prompting spread test for special character paths

Signed-off-by: Oliver Calder <oliver.calder@canonical.com>

Author: olivercalder

tests/main/apparmor-prompting-integration-tests/special_characters.json

@@ -0,0 +1,44 @@
+{
+  "version": 1,
+  "prompt-filter": {
+    "snap": "prompting-client",
+    "interface": "home",
+    "constraints": {
+      "path": "$BASE_PATH/.*"
+    }
+  },
+  "prompts": [
+    {
+      "prompt-filter": {
+        "constraints": {
+          "path": "${BASE_PATH}/\\\\\\[アニメ\\\\\\]\\\\\\[ゲーム動画\\\\\\].mkv",
+          "requested-permissions": [ "read" ]
+        }
+      },
+      "reply": {
+        "action": "allow",
+        "lifespan": "single",
+        "constraints": {
+          "path-pattern": "${BASE_PATH}/\\[アニメ\\]\\[ゲーム動画\\].mkv",
+          "permissions": [ "read" ]
+        }
+      }
+    },
+    {
+      "prompt-filter": {
+        "constraints": {
+          "path": "${BASE_PATH}/foo\\\\*\\\\?()\\\\[\\\\]\\\\{\\\\}\\\\\\\\",
+          "requested-permissions": [ "read" ]
+        }
+      },
+      "reply": {
+        "action": "allow",
+        "lifespan": "single",
+        "constraints": {
+          "path-pattern": "${BASE_PATH}/foo\\*\\?()\\[\\]\\{\\}\\\\",
+          "permissions": [ "read" ]
+        }
+      }
+    }
+  ]
+}

tests/main/apparmor-prompting-integration-tests/special_characters.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/sh
+
+# Test prompting for filepaths which contain special characters.
+
+TEST_DIR="$1"
+TIMEOUT="$2"
+if [ -z "$TIMEOUT" ] ; then
+	TIMEOUT=10
+fi
+
+FIRST_CONTENT="a file with square brackets and unicode"
+SECOND_CONTENT="a file with all the special characters"
+
+# Prompt sequence prompt-filters are regular expressions, and they're stored as
+# json, so we annoyingly have to escape special characters twice in just the
+# prompt-filter path, with extra complexity for literal '\' characters.
+echo "Prepare the files to be read"
+echo "$FIRST_CONTENT" | tee "${TEST_DIR}/[アニメ][ゲーム動画].mkv"
+echo "$SECOND_CONTENT" | tee "${TEST_DIR}/foo*?()[]{}\\"
+
+echo "Attempt to read the first file"
+FIRST_OUTPUT="$(snap run --shell prompting-client.scripted -c "cat ${TEST_DIR}/'[アニメ][ゲーム動画].mkv'")"
+
+echo "Attempt to read the second file"
+SECOND_OUTPUT="$(snap run --shell prompting-client.scripted -c "cat ${TEST_DIR}/'foo*?()[]{}\\'")"
+
+# Wait for the client to write its result and exit
+timeout "$TIMEOUT" sh -c "while pgrep -f 'prompting-client.scripted.*${TEST_DIR}' > /dev/null; do sleep 0.1; done"
+
+CLIENT_OUTPUT="$(cat "${TEST_DIR}/result")"
+
+if [ "$CLIENT_OUTPUT" != "success" ] ; then
+	echo "test failed"
+	echo "output='$CLIENT_OUTPUT'"
+	exit 1
+fi
+
+if [ "$FIRST_OUTPUT" != "$FIRST_CONTENT" ] ; then
+	echo "test script failed"
+	exit 1
+fi
+
+if [ "$SECOND_OUTPUT" != "$SECOND_CONTENT" ] ; then
+	echo "test script failed"
+	exit 1
+fi

tests/main/apparmor-prompting-integration-tests/task.yaml

@@ -14,23 +14,24 @@ systems:
   - ubuntu-2*
 
 environment:
-    VARIANT/read_single_allow: read_single_allow
-    VARIANT/read_single_deny: read_single_deny
-    VARIANT/write_single_allow: write_single_allow
-    VARIANT/write_single_deny: write_single_deny
+    VARIANT/create_multiple_actioned_by_other_pid_always_allow: create_multiple_actioned_by_other_pid_always_allow
+    VARIANT/create_multiple_actioned_by_other_pid_always_deny: create_multiple_actioned_by_other_pid_always_deny
     VARIANT/create_multiple_allow: create_multiple_allow
     VARIANT/create_multiple_deny: create_multiple_deny
+    VARIANT/create_multiple_not_actioned_by_other_pid_single_allow: create_multiple_not_actioned_by_other_pid_single_allow
+    VARIANT/create_multiple_not_actioned_by_other_pid_single_deny: create_multiple_not_actioned_by_other_pid_single_deny
+    VARIANT/download_file_conflict: download_file_conflict
     VARIANT/download_file_defaults: download_file_defaults
     VARIANT/download_file_safer: download_file_safer
-    VARIANT/download_file_conflict: download_file_conflict
+    VARIANT/read_single_allow: read_single_allow
+    VARIANT/read_single_deny: read_single_deny
+    VARIANT/special_characters: special_characters
     VARIANT/timespan_allow: timespan_allow
     VARIANT/timespan_deny: timespan_deny
-    VARIANT/create_multiple_actioned_by_other_pid_always_allow: create_multiple_actioned_by_other_pid_always_allow
-    VARIANT/create_multiple_actioned_by_other_pid_always_deny: create_multiple_actioned_by_other_pid_always_deny
-    VARIANT/create_multiple_not_actioned_by_other_pid_single_allow: create_multiple_not_actioned_by_other_pid_single_allow
-    VARIANT/create_multiple_not_actioned_by_other_pid_single_deny: create_multiple_not_actioned_by_other_pid_single_deny
     VARIANT/write_read_multiple_actioned_by_other_pid_allow_deny: write_read_multiple_actioned_by_other_pid_allow_deny
     VARIANT/write_read_multiple_actioned_by_other_pid_deny_allow: write_read_multiple_actioned_by_other_pid_deny_allow
+    VARIANT/write_single_allow: write_single_allow
+    VARIANT/write_single_deny: write_single_deny
 
     TIMEOUT: "30" # Define common timeout which can be modified as needed