test apparmor

5 files changed, 92 insertions, 1 deletions

diff --git a/test/apparmor/apparmor-norun.exp b/test/apparmor/apparmor-norun.exp
new file mode 100755
index 000000000..625d4b4e0
--- /dev/null
+++ b/test/apparmor/apparmor-norun.exp
@@ -0,0 +1,26 @@
+#!/usr/bin/expect -f
+# This file is part of Firejail project
+# Copyright (C) 2014-2023 Firejail Authors
+# License GPL v2
+
+set timeout 10
+spawn $env(SHELL)
+match_max 100000
+
+# start a bash session
+send --  "firejail --apparmor\r"
+expect {
+        timeout {puts "TESTING ERROR 0\n";exit}
+        -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms"
+}
+sleep 1
+
+# ... and try to run a local program
+send --  "./a.out --help\r"
+expect {
+        timeout {puts "TESTING ERROR 1\n";exit}
+        "Usage: ./a.out" {puts "TESTING ERROR 2\n";exit}
+        "denied"
+}
+after 500
+puts "\nall done\n"
diff --git a/test/apparmor/apparmor-run.exp b/test/apparmor/apparmor-run.exp
new file mode 100755
index 000000000..c11b50151
--- /dev/null
+++ b/test/apparmor/apparmor-run.exp
@@ -0,0 +1,26 @@
+#!/usr/bin/expect -f
+# This file is part of Firejail project
+# Copyright (C) 2014-2023 Firejail Authors
+# License GPL v2
+
+set timeout 10
+spawn $env(SHELL)
+match_max 100000
+
+# start a bash session
+send --  "firejail --apparmor=test-profile\r"
+expect {
+        timeout {puts "TESTING ERROR 0\n";exit}
+        -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms"
+}
+sleep 1
+
+# ... and try to run a local program
+send --  "./a.out --help\r"
+expect {
+        timeout {puts "TESTING ERROR 1\n";exit}
+        "denied" {puts "TESTING ERROR 2\n";exit}
+        "Usage: ./a.out"
+}
+after 500
+puts "\nall done\n"
diff --git a/test/apparmor/apparmor.exp b/test/apparmor/apparmor.exp
index a8f73c797..4498fadd9 100755
--- a/test/apparmor/apparmor.exp
+++ b/test/apparmor/apparmor.exp
@@ -54,6 +54,6 @@ expect {
         timeout {puts "TESTING ERROR 7\n";exit}
         "AppArmor: firejail-default//&unconfined enforce"
 }
-after 100
+after 500
 
 puts "\nall done\n"
diff --git a/test/apparmor/apparmor.sh b/test/apparmor/apparmor.sh
new file mode 100755
index 000000000..84076fc96
--- /dev/null
+++ b/test/apparmor/apparmor.sh
@@ -0,0 +1,36 @@
+#!/bin/bash
+# This file is part of Firejail project
+# Copyright (C) 2014-2023 Firejail Authors
+# License GPL v2
+
+export MALLOC_CHECK_=3
+export MALLOC_PERTURB_=$(($RANDOM % 255 + 1))
+export LC_ALL=C
+
+
+#       sudo /usr/sbin/apparmor_parser -r /etc/apparmor.d/firejail-default
+
+
+if [[ -f /sys/kernel/security/apparmor/profiles ]]; then
+        # setup
+        cp test-profile /tmp/.
+        sudo /usr/sbin/apparmor_parser -r /tmp/test-profile
+        cp /usr/bin/pwd a.out
+
+        echo "TESTING: apparmor firemon (test/filters/apparmor.exp)"
+        ./apparmor.exp
+
+        echo "TESTING: apparmor norun test (test/filters/apparmor-norun.exp)"
+        ./apparmor-norun.exp
+
+        echo "TESTING: apparmor run test (test/filters/apparmor-run.exp)"
+        ./apparmor-run.exp
+
+        # cleanup
+        rm -f a.out
+        sudo /usr/sbin/apparmor_parser -R /tmp/test-profile
+
+else
+        echo "TESTING SKIP: no apparmor support in Linux kernel (test/filters/apparmor.exp)"
+fi
+
diff --git a/test/apparmor/test-profile b/test/apparmor/test-profile
new file mode 100644
index 000000000..082ec3dc0
--- /dev/null
+++ b/test/apparmor/test-profile
@@ -0,0 +1,3 @@
+profile test-profile flags=(attach_disconnected,mediate_deleted) {
+        /{,**} rklmwix,
+}