tst_security.sh 3.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133
  1. #!/bin/sh
  2. # SPDX-License-Identifier: GPL-2.0-or-later
  3. # Copyright (c) 2018 Petr Vorel <pvorel@suse.cz>
  4. if [ -z "$TST_LIB_LOADED" ]; then
  5. echo "please load tst_test.sh first" >&2
  6. exit 1
  7. fi
  8. [ -n "$TST_SECURITY_LOADED" ] && return 0
  9. TST_SECURITY_LOADED=1
  10. _tst_check_security_modules()
  11. {
  12. local cmd
  13. local profiles
  14. if tst_apparmor_enabled; then
  15. tst_res TINFO "AppArmor enabled, this may affect test results"
  16. [ "$TST_DISABLE_APPARMOR" = 1 ] || \
  17. tst_res TINFO "it can be disabled with TST_DISABLE_APPARMOR=1 (requires super/root)"
  18. profiles=
  19. for cmd in $TST_NEEDS_CMDS; do
  20. tst_apparmor_used_profile $cmd && profiles="$cmd $profiles"
  21. done
  22. [ -z "$profiles" ] && profiles="none"
  23. tst_res TINFO "loaded AppArmor profiles: $profiles"
  24. fi
  25. if tst_selinux_enabled; then
  26. tst_res TINFO "SELinux enabled in enforcing mode, this may affect test results"
  27. [ "$TST_DISABLE_SELINUX" = 1 ] || \
  28. tst_res TINFO "it can be disabled with TST_DISABLE_SELINUX=1 (requires super/root)"
  29. profiles=
  30. for cmd in $TST_NEEDS_CMDS; do
  31. tst_selinux_used_profile $cmd && profiles="$cmd $profiles"
  32. done
  33. [ -z "$profiles" ] && profiles="none"
  34. tst_res TINFO "loaded SELinux profiles: $profiles"
  35. fi
  36. }
  37. # Detect whether AppArmor profiles are loaded
  38. # Return 0: profiles loaded, 1: none profile loaded or AppArmor disabled
  39. tst_apparmor_enabled()
  40. {
  41. local f="/sys/module/apparmor/parameters/enabled"
  42. [ -f "$f" ] && [ "$(cat $f)" = "Y" ]
  43. }
  44. # Detect whether AppArmor profile for command is enforced
  45. # tst_apparmor_used_profile CMD
  46. # Return 0: loaded profile for CMD
  47. # Return 1: no profile CMD
  48. tst_apparmor_used_profile()
  49. {
  50. [ $# -eq 1 ] || tst_brk TCONF "usage tst_apparmor_used_profile CMD"
  51. local cmd="$1"
  52. grep -q "$cmd .*(enforce)" /sys/kernel/security/apparmor/profiles 2>/dev/null
  53. }
  54. # Detect whether SELinux is enabled in enforcing mode
  55. # Return 0: enabled in enforcing mode
  56. # Return 1: enabled in permissive mode or disabled
  57. tst_selinux_enabled()
  58. {
  59. local f="$(_tst_get_enforce)"
  60. [ -f "$f" ] && [ "$(cat $f)" = "1" ]
  61. }
  62. # Detect whether SELinux profile for command is enforced
  63. # tst_selinux_used_profile CMD
  64. # Return 0: loaded profile for CMD
  65. # Return 1: profile for CMD not loaded or seinfo not available
  66. tst_selinux_used_profile()
  67. {
  68. [ $# -eq 1 ] || tst_brk TCONF "usage tst_selinux_used_profile CMD"
  69. local cmd="$1"
  70. if ! tst_cmd_available seinfo; then
  71. if [ -z "$seinfo_warn_printed" ]; then
  72. tst_res TINFO "install seinfo to find used SELinux profiles"
  73. export seinfo_warn_printed=1
  74. fi
  75. return 1
  76. fi
  77. seinfo -t 2>/dev/null | grep -q $cmd
  78. }
  79. # Try disable AppArmor
  80. # Return 0: AppArmor disabled
  81. # Return > 0: failed to disable AppArmor
  82. tst_disable_apparmor()
  83. {
  84. tst_res TINFO "trying to disable AppArmor (requires super/root)"
  85. tst_require_root
  86. local f="aa-teardown"
  87. local action
  88. tst_cmd_available $f && { $f >/dev/null; return; }
  89. f="/etc/init.d/apparmor"
  90. if [ -f "$f" ]; then
  91. for action in teardown kill stop; do
  92. $f $action >/dev/null 2>&1 && return
  93. done
  94. fi
  95. }
  96. # Try disable SELinux
  97. # Return 0: SELinux disabled
  98. # Return > 0: failed to disable SELinux
  99. tst_disable_selinux()
  100. {
  101. tst_res TINFO "trying to disable SELinux (requires super/root)"
  102. tst_require_root
  103. local f="$(_tst_get_enforce)"
  104. [ -f "$f" ] && cat 0 > $f
  105. }
  106. # Get SELinux enforce file path
  107. _tst_get_enforce()
  108. {
  109. local dir="/sys/fs/selinux"
  110. [ -d "$dir" ] || dir="/selinux"
  111. local f="$dir/enforce"
  112. [ -f "$f" ] && echo "$f"
  113. }