Commit b11e51dd authored by Rae Moar's avatar Rae Moar Committed by Shuah Khan
Browse files

apparmor: test: make static symbols visible during kunit testing 



Use macros, VISIBLE_IF_KUNIT and EXPORT_SYMBOL_IF_KUNIT, to allow
static symbols to be conditionally set to be visible during
apparmor_policy_unpack_test, which removes the need to include the testing
file in the implementation file.

Change the namespace of the symbols that are now conditionally visible (by
adding the prefix aa_) to avoid confusion with symbols of the same name.

Allow the test to be built as a module and namespace the module name from
policy_unpack_test to apparmor_policy_unpack_test to improve clarity of
the module name.

Provide an example of how static symbols can be dealt with in testing.

Signed-off-by: default avatarRae Moar <rmoar@google.com>
Reviewed-by: default avatarDavid Gow <davidgow@google.com>
Acked-by: default avatarJohn Johansen <john.johansen@canonical.com>
Signed-off-by: default avatarShuah Khan <skhan@linuxfoundation.org>
parent 9c988fae

security/apparmor/Kconfig

+2 −2
Original line number Diff line number Diff line
@@ -106,8 +106,8 @@ config SECURITY_APPARMOR_PARANOID_LOAD 
	  Disabling the check will speed up policy loads.



config SECURITY_APPARMOR_KUNIT_TEST

	bool "Build KUnit tests for policy_unpack.c" if !KUNIT_ALL_TESTS

	depends on KUNIT=y && SECURITY_APPARMOR

	tristate "Build KUnit tests for policy_unpack.c" if !KUNIT_ALL_TESTS

	depends on KUNIT && SECURITY_APPARMOR

	default KUNIT_ALL_TESTS

	help

	  This builds the AppArmor KUnit tests.

security/apparmor/Makefile

+3 −0
Original line number Diff line number Diff line
@@ -8,6 +8,9 @@ apparmor-y := apparmorfs.o audit.o capability.o task.o ipc.o lib.o match.o \ 
              resource.o secid.o file.o policy_ns.o label.o mount.o net.o

apparmor-$(CONFIG_SECURITY_APPARMOR_HASH) += crypto.o



obj-$(CONFIG_SECURITY_APPARMOR_KUNIT_TEST) += apparmor_policy_unpack_test.o

apparmor_policy_unpack_test-objs += policy_unpack_test.o



clean-files := capability_names.h rlim_names.h net_names.h



# Build a lower case string table of address family names

security/apparmor/include/policy_unpack.h

+50 −0
Original line number Diff line number Diff line
@@ -48,6 +48,43 @@ enum { 
	AAFS_LOADDATA_NDENTS		/* count of entries */

};



/*

 * The AppArmor interface treats data as a type byte followed by the

 * actual data.  The interface has the notion of a named entry

 * which has a name (AA_NAME typecode followed by name string) followed by

 * the entries typecode and data.  Named types allow for optional

 * elements and extensions to be added and tested for without breaking

 * backwards compatibility.

 */



enum aa_code {

	AA_U8,

	AA_U16,

	AA_U32,

	AA_U64,

	AA_NAME,		/* same as string except it is items name */

	AA_STRING,

	AA_BLOB,

	AA_STRUCT,

	AA_STRUCTEND,

	AA_LIST,

	AA_LISTEND,

	AA_ARRAY,

	AA_ARRAYEND,

};



/*

 * aa_ext is the read of the buffer containing the serialized profile.  The

 * data is copied into a kernel buffer in apparmorfs and then handed off to

 * the unpack routines.

 */

struct aa_ext {

	void *start;

	void *end;

	void *pos;		/* pointer to current position in the buffer */

	u32 version;

};



/*

 * struct aa_loaddata - buffer of policy raw_data set

 *
@@ -126,4 +163,17 @@ static inline void aa_put_loaddata(struct aa_loaddata *data) 
		kref_put(&data->count, aa_loaddata_kref);

}



#if IS_ENABLED(CONFIG_KUNIT)

bool aa_inbounds(struct aa_ext *e, size_t size);

size_t aa_unpack_u16_chunk(struct aa_ext *e, char **chunk);

bool aa_unpack_X(struct aa_ext *e, enum aa_code code);

bool aa_unpack_nameX(struct aa_ext *e, enum aa_code code, const char *name);

bool aa_unpack_u32(struct aa_ext *e, u32 *data, const char *name);

bool aa_unpack_u64(struct aa_ext *e, u64 *data, const char *name);

size_t aa_unpack_array(struct aa_ext *e, const char *name);

size_t aa_unpack_blob(struct aa_ext *e, char **blob, const char *name);

int aa_unpack_str(struct aa_ext *e, const char **string, const char *name);

int aa_unpack_strdup(struct aa_ext *e, char **string, const char *name);

#endif



#endif /* __POLICY_INTERFACE_H */

security/apparmor/policy_unpack.c

+104 −134

File changed.

Preview size limit exceeded, changes collapsed.

security/apparmor/policy_unpack_test.c

+37 −32

File changed.

Preview size limit exceeded, changes collapsed.