apparmor test

2 files changed, 65 insertions, 0 deletions

diff --git a/test/filters/apparmor.exp b/test/filters/apparmor.exp
new file mode 100755
index 000000000..acc42a117
--- /dev/null
+++ b/test/filters/apparmor.exp
@@ -0,0 +1,59 @@
+#!/usr/bin/expect -f
+# This file is part of Firejail project
+# Copyright (C) 2014-2018 Firejail Authors
+# License GPL v2
+
+set timeout 10
+spawn $env(SHELL)
+match_max 100000
+
+send --  "firejail --name=test1 --apparmor\r"
+expect {
+        timeout {puts "TESTING ERROR 0\n";exit}
+        "Child process initialized"
+}
+sleep 1
+
+spawn $env(SHELL)
+send --  "firejail --name=test2 --apparmor\r"
+expect {
+        timeout {puts "TESTING ERROR 1\n";exit}
+        "Child process initialized"
+}
+sleep 1
+
+spawn $env(SHELL)
+send --  "firemon --apparmor\r"
+expect {
+        timeout {puts "TESTING ERROR 2\n";exit}
+        "test1:firejail --name=test1 --apparmor"
+}
+expect {
+        timeout {puts "TESTING ERROR 3\n";exit}
+        "AppArmor: firejail-default enforce"
+}
+expect {
+        timeout {puts "TESTING ERROR 4\n";exit}
+        "test2:firejail --name=test2 --apparmor"
+}
+expect {
+        timeout {puts "TESTING ERROR 5\n";exit}
+        "AppArmor: firejail-default enforce"
+}
+after 100
+
+send -- "firejail --apparmor.print=test1\r"
+expect {
+        timeout {puts "TESTING ERROR 6\n";exit}
+        "AppArmor: firejail-default enforce"
+}
+after 100
+
+send -- "firejail --apparmor.print=test2\r"
+expect {
+        timeout {puts "TESTING ERROR 7\n";exit}
+        "AppArmor: firejail-default enforce"
+}
+after 100
+
+puts "\nall done\n"
diff --git a/test/filters/filters.sh b/test/filters/filters.sh
index 72d699415..917aa93b6 100755
--- a/test/filters/filters.sh
+++ b/test/filters/filters.sh
@@ -12,6 +12,12 @@ if [ -f /etc/debian_version ]; then
 fi
 export PATH="$PATH:/usr/lib/firejail:/usr/lib64/firejail"
 
+if [ -f /sys/kernel/security/apparmor/profiles ]; then
+        echo "TESTING: apparmor (test/filters/apparmor.exp)"
+        ./apparmor.exp
+else
+        echo "TESTING SKIP: no apparmor support in Linux kernel (test/filters/apparmor.exp)"
+fi
 
 if [ "$(uname -m)" = "x86_64" ]; then
     echo "TESTING: memory-deny-write-execute (test/filters/memwrexe.exp)"