From owner-p4-projects@FreeBSD.ORG Wed Oct 31 02:53:47 2007 Return-Path: Delivered-To: p4-projects@freebsd.org Received: by hub.freebsd.org (Postfix, from userid 32767) id 0CCF616A477; Wed, 31 Oct 2007 02:53:47 +0000 (UTC) Delivered-To: perforce@FreeBSD.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id B507016A475 for ; Wed, 31 Oct 2007 02:53:46 +0000 (UTC) (envelope-from zhouzhouyi@FreeBSD.org) Received: from repoman.freebsd.org (repoman.freebsd.org [IPv6:2001:4f8:fff6::29]) by mx1.freebsd.org (Postfix) with ESMTP id A6CF813C4B3 for ; Wed, 31 Oct 2007 02:53:46 +0000 (UTC) (envelope-from zhouzhouyi@FreeBSD.org) Received: from repoman.freebsd.org (localhost [127.0.0.1]) by repoman.freebsd.org (8.14.1/8.14.1) with ESMTP id l9V2rkrN084110 for ; Wed, 31 Oct 2007 02:53:46 GMT (envelope-from zhouzhouyi@FreeBSD.org) Received: (from perforce@localhost) by repoman.freebsd.org (8.14.1/8.14.1/Submit) id l9V2rkgs084107 for perforce@freebsd.org; Wed, 31 Oct 2007 02:53:46 GMT (envelope-from zhouzhouyi@FreeBSD.org) Date: Wed, 31 Oct 2007 02:53:46 GMT Message-Id: <200710310253.l9V2rkgs084107@repoman.freebsd.org> X-Authentication-Warning: repoman.freebsd.org: perforce set sender to zhouzhouyi@FreeBSD.org using -f From: Zhouyi ZHOU To: Perforce Change Reviews Cc: Subject: PERFORCE change 128384 for review X-BeenThere: p4-projects@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: p4 projects tree changes List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Oct 2007 02:53:47 -0000 http://perforce.freebsd.org/chv.cgi?CH=128384 Change 128384 by zhouzhouyi@zhouzhouyi_mactest on 2007/10/31 02:53:18 Code stylize for mandatory access control tests for link Affected files ... .. //depot/projects/soc2007/zhouzhouyi_mactest_soc/regression/mactest/tests/link/00.t#6 edit .. //depot/projects/soc2007/zhouzhouyi_mactest_soc/regression/mactest/tests/link/01.t#6 add Differences ... ==== //depot/projects/soc2007/zhouzhouyi_mactest_soc/regression/mactest/tests/link/00.t#6 (text+ko) ==== @@ -12,62 +12,80 @@ n2=`namegen` n3=`namegen` -mac_mls_support=`sysctl -n security.mac.mls.enabled 2>/dev/null` -mac_biba_support=`sysctl -n security.mac.biba.enabled 2>/dev/null` +case "${os}:${fs}" in +FreeBSD:UFS) + + mac_mls_support=`sysctl -n security.mac.mls.enabled 2>/dev/null` + mac_biba_support=`sysctl -n security.mac.biba.enabled 2>/dev/null` -if [ "${mac_mls_support}" != "" ] && [ "${mac_biba_support}" != "" ] ; then + if [ "${mac_mls_support}" != "" ] && [ "${mac_biba_support}" != "" ] ; then - echo "1..10" + echo "1..10" #turn off all the switches first - for i in `sysctl security.mac | grep "\.enabled"| - sed 's/\([a-z\.]*\.enabled\)\(:\ \)\([01]\)/\1/`; do - sysctl ${i}=0 >/dev/null - done + for i in `sysctl security.mac | grep "\.enabled"| + sed 's/\([a-z\.]*\.enabled\)\(:\ \)\([01]\)/\1/`; do + sysctl ${i}=0 >/dev/null + done + + dvplabel=`getfmac ".."| sed 's/\(\.\.:\ \)\([a-z\,\/]*\)/\2/`; - dvplabel=`getfmac ".."| sed 's/\(\.\.:\ \)\([a-z\,\/]*\)/\2/`; + if [ -f ${mactest_conf} ]; then + rm ${mactest_conf} + fi + touch ${mactest_conf} -#first make working dir, the hook checks are already done in open: - if [ -f ${mactest_conf} ]; then - rm ${mactest_conf} - fi - touch ${mactest_conf} - sysctl security.mac.mls.enabled=1 >/dev/null + sysctl security.mac.mls.enabled=1 >/dev/null #case 1: mkdir - mactestexpect "" 0 -m "mls/low(low-high)" -f ${mactest_conf} mkdir ${n3} 0755 + mactestexpect "" 0 -m "mls/low(low-high)" -f ${mactest_conf} mkdir ${n3} \ + 0755 #case 2: setfmac - mactestexpect "" "" -m "mls/low(low-high)" -f ${mactest_conf} system setfmac "mls/6" ${n3} + mactestexpect "" "" -m "mls/low(low-high)" -f ${mactest_conf} system setfmac \ + "mls/6" ${n3} #case 3: create - mactestexpect "" 0 -m "mls/6(low-high)" -f ${mactest_conf} create ${n3}/${n2} 0644 + mactestexpect "" 0 -m "mls/6(low-high)" -f ${mactest_conf} create ${n3}/${n2}\ + 0644 #case 4: setfmac - mactestexpect "" "" -m "mls/6(low-high)" -f ${mactest_conf} system setfmac "mls/5" ${n3}/${n2} + mactestexpect "" "" -m "mls/6(low-high)" -f ${mactest_conf} system setfmac \ + "mls/5" ${n3}/${n2} #case 5: link - echo -n "pid = -1 mac_test_check_vnode_link:" > ${mactest_conf} - echo "biba/high(low-high),mls/6(low-high) biba/high,mls/6 biba/high,mls/5" >> ${mactest_conf} - mactestexpect "" EACCES -m "mls/6(low-high)" -f ${mactest_conf} link ${n3}/${n2} ${n3}/${n1} - sysctl security.mac.mls.enabled=0 >/dev/null + echo -n "pid = -1 mac_test_check_vnode_link:" > ${mactest_conf} + echo "biba/high(low-high),mls/6(low-high) biba/high,mls/6 biba/high,mls/5" >> ${mactest_conf} + mactestexpect "" EACCES -m "mls/6(low-high)" -f ${mactest_conf} link ${n3}/${n2} ${n3}/${n1} + sysctl security.mac.mls.enabled=0 >/dev/null #case 6: link success - truncate -s 0 ${mactest_conf} - mactestexpect "" 0 -m "mls/5(low-high)" -f ${mactest_conf} link ${n3}/${n2} ${n3}/${n1} - sysctl security.mac.mls.enabled=1 >/dev/null + truncate -s 0 ${mactest_conf} + mactestexpect "" 0 -m "mls/5(low-high)" -f ${mactest_conf} link ${n3}/${n2} \ + ${n3}/${n1} + sysctl security.mac.mls.enabled=1 >/dev/null #case 7: unlink - truncate -s 0 ${mactest_conf} - mactestexpect "" EACCES -m "mls/6(low-high)" -f ${mactest_conf} unlink ${n3}/${n1} + truncate -s 0 ${mactest_conf} + mactestexpect "" EACCES -m "mls/6(low-high)" -f ${mactest_conf} unlink ${n3}/${n1} #case 8: setfmac fail, old vnode not in range - echo -n "pid = -2 mac_test_check_vnode_relabel:" > ${mactest_conf} - echo "biba/high(low-high),mls/6(6-6) biba/high,mls/5 biba/,mls/6" >> ${mactest_conf} - mactestexpect "setfmac:.mac_set_link.${n3}.${n1},.biba.,mls.6.:.Operation.not.permitted" "" -m "mls/6(6-6)" -f ${mactest_conf} system setfmac "biba/,mls/6" ${n3}/${n1} + echo -n "pid = -2 mac_test_check_vnode_relabel:" > ${mactest_conf} + echo "biba/high(low-high),mls/6(6-6) biba/high,mls/5 biba/,mls/6" >> \ + ${mactest_conf} + mactestexpect \ + "setfmac:.mac_set_link.${n3}.${n1},.biba.,mls.6.:.Operation.not.permitted" ""\ + -m "mls/6(6-6)" -f ${mactest_conf} \ + system setfmac "biba/,mls/6" ${n3}/${n1} #case 9: setfmac success - echo -n "pid = -2 mac_test_check_vnode_relabel:" > ${mactest_conf} - echo "biba/high(low-high),mls/6(4-6) biba/high,mls/5 biba/,mls/6" >> ${mactest_conf} - mactestexpect "" "" -m "mls/6(4-6)" -f ${mactest_conf} system setfmac "biba/,mls/6" ${n3}/${n1} + echo -n "pid = -2 mac_test_check_vnode_relabel:" > ${mactest_conf} + echo "biba/high(low-high),mls/6(4-6) biba/high,mls/5 biba/,mls/6" >> ${mactest_conf} + mactestexpect "" "" -m "mls/6(4-6)" -f ${mactest_conf} \ + system setfmac "biba/,mls/6" ${n3}/${n1} #case 10: unlink - rm ${mactest_conf} - touch ${mactest_conf} - mactestexpect "" 0 -m "mls/6(low-high)" -f ${mactest_conf} unlink ${n3}/${n1} + rm ${mactest_conf} + touch ${mactest_conf} + mactestexpect "" 0 -m "mls/6(low-high)" -f ${mactest_conf} unlink ${n3}/${n1} #cleanup: - sysctl security.mac.mls.enabled=0 >/dev/null - rm -fr ${n3} - rm ${mactest_conf} + sysctl security.mac.mls.enabled=0 >/dev/null + rm -fr ${n3} + rm ${mactest_conf} fi + ;; +*) + quick_exit + ;; +esac