apparmor test

3 files changed, 66 insertions, 2 deletions

diff --git a/test/filters/apparmor.exp b/test/filters/apparmor.exp
new file mode 100755
index 000000000..acc42a117
--- /dev/null
+++ b/test/filters/apparmor.exp
@@ -0,0 +1,59 @@
+#!/usr/bin/expect -f
+# This file is part of Firejail project
+# Copyright (C) 2014-2018 Firejail Authors
+# License GPL v2
+
+set timeout 10
+spawn $env(SHELL)
+match_max 100000
+
+send --  "firejail --name=test1 --apparmor\r"
+expect {
+        timeout {puts "TESTING ERROR 0\n";exit}
+        "Child process initialized"
+}
+sleep 1
+
+spawn $env(SHELL)
+send --  "firejail --name=test2 --apparmor\r"
+expect {
+        timeout {puts "TESTING ERROR 1\n";exit}
+        "Child process initialized"
+}
+sleep 1
+
+spawn $env(SHELL)
+send --  "firemon --apparmor\r"
+expect {
+        timeout {puts "TESTING ERROR 2\n";exit}
+        "test1:firejail --name=test1 --apparmor"
+}
+expect {
+        timeout {puts "TESTING ERROR 3\n";exit}
+        "AppArmor: firejail-default enforce"
+}
+expect {
+        timeout {puts "TESTING ERROR 4\n";exit}
+        "test2:firejail --name=test2 --apparmor"
+}
+expect {
+        timeout {puts "TESTING ERROR 5\n";exit}
+        "AppArmor: firejail-default enforce"
+}
+after 100
+
+send -- "firejail --apparmor.print=test1\r"
+expect {
+        timeout {puts "TESTING ERROR 6\n";exit}
+        "AppArmor: firejail-default enforce"
+}
+after 100
+
+send -- "firejail --apparmor.print=test2\r"
+expect {
+        timeout {puts "TESTING ERROR 7\n";exit}
+        "AppArmor: firejail-default enforce"
+}
+after 100
+
+puts "\nall done\n"
diff --git a/test/filters/filters.sh b/test/filters/filters.sh
index febc53ac7..3d1211b8e 100755
--- a/test/filters/filters.sh
+++ b/test/filters/filters.sh
@@ -13,6 +13,13 @@ fi
 export PATH="$PATH:/usr/lib/firejail:/usr/lib64/firejail"
 
 
+if [ -f /sys/kernel/security/apparmor/profiles ]; then
+        echo "TESTING: apparmor (test/filters/apparmor.exp)"
+        ./apparmor.exp
+else
+        echo "TESTING SKIP: no apparmor support in Linux kernel (test/filters/apparmor.exp)"
+fi
+
 if [ "$(uname -m)" = "x86_64" ]; then
     echo "TESTING: memory-deny-write-execute (test/filters/memwrexe.exp)"
     ./memwrexe.exp
diff --git a/test/utils/utils.sh b/test/utils/utils.sh
index 18873dc65..1b59c535a 100755
--- a/test/utils/utils.sh
+++ b/test/utils/utils.sh
@@ -95,7 +95,6 @@ echo "TESTING: join profile (test/utils/join-profile.exp)"
 echo "TESTING: top (test/utils/top.exp)"
 ./top.exp
 
-echo "TESTING: firemon seccomp (test/utils/firemon-seccomp.exp)"
 if grep -q "^Seccomp.*0" /proc/self/status; then
         echo "TESTING: firemon seccomp (test/utils/firemon-seccomp.exp)"
         ./firemon-seccomp.exp
@@ -103,7 +102,6 @@ else
         echo "TESTING SKIP: seccomp already active (test/utils/firemon-seccomp.exp)"
 fi
 
-echo "TESTING: firemon caps (test/utils/firemon-caps.exp)"
 if grep -q "^CapBnd:\\s0000003fffffffff" /proc/self/status; then
         echo "TESTING: firemon caps (test/utils/firemon-caps.exp)"
         ./firemon-caps.exp