QA Regression Testing

Merge ~georgiag/qa-regression-testing:unpriv_userns_transition into qa-regression-testing:master

  1. Git
  2. lp:~georgiag/qa-regression-testing
  3. unpriv_userns_transition
  4. Merge into master
Proposed by Georgia Garcia
Status: Merged
Approved by: Georgia Garcia
Approved revision: 35f294b9a9bea9cb577ef3842b29544c56f0e3d0
Merged at revision: 35f294b9a9bea9cb577ef3842b29544c56f0e3d0
Proposed branch: ~georgiag/qa-regression-testing:unpriv_userns_transition
Merge into: qa-regression-testing:master
Diff against target: 52 lines (+27/-0)
1 file modified
scripts/test-apparmor.py (+27/-0)
Reviewer Review Type Date Requested Status
Alex Murray Approve
Review via email: mp+460050@code.launchpad.net
To post a comment you must log in.
Revision history for this message
Alex Murray (alexmurray) wrote :

LGTM - tested with apparmor 4.0.0~alpha4-0ubuntu1 for noble.

review: Approve

Preview Diff

[H/L] Next/Prev Comment, [J/K] Next/Prev File, [N/P] Next/Prev Hunk
1diff --git a/scripts/test-apparmor.py b/scripts/test-apparmor.py
2index 3636f7a..f15491d 100755
3--- a/scripts/test-apparmor.py
4+++ b/scripts/test-apparmor.py
5@@ -115,6 +115,8 @@ class ApparmorTest(testlib.TestlibCase, PrivateApparmorTest):
6 self.assertEqual(expected, rc, result + report)
7 self.cache_dir = report.rstrip()
8
9+ self.restore_unprivileged_userns = False
10+
11 def tearDown(self):
12 '''Clean up after each test_* function'''
13 self.user = None
14@@ -140,6 +142,11 @@ class ApparmorTest(testlib.TestlibCase, PrivateApparmorTest):
15 shutil.move(bak, p)
16 testlib.cmd(['apparmor_parser', '-R', "/etc/apparmor.d/%s" % os.path.basename(p)])
17
18+ if self.restore_unprivileged_userns:
19+ self.restore_unprivileged_userns = False
20+ if os.path.exists('/etc/apparmor.d/unprivileged_userns'):
21+ testlib.cmd(['apparmor_parser', '-a', '/etc/apparmor.d/unprivileged_userns'])
22+
23 testlib.config_restore(self.repository_conf)
24
25 def _add_profile(self, profile=None, complain=False):
26@@ -1529,6 +1536,26 @@ int __attribute__((constructor)) testlib_func(){
27 result = 'Got exit code %d, expected %d\n' % (rc, expected)
28 self.assertEqual(expected, rc, result + report)
29
30+ # check if transition to unconfined to unprivileged_userns is available
31+ if os.path.isfile('/sys/kernel/security/apparmor/features/namespaces/userns_create'):
32+ with open('/sys/kernel/security/apparmor/profiles') as fprofiles:
33+ loaded_profiles = fprofiles.read();
34+ if 'unprivileged_userns' in loaded_profiles:
35+ self.announce("checking unshare transitions to unprivileged_userns")
36+ rc, report = testlib.cmd(['sudo', '-u', self.user.login, '/usr/bin/unshare', '-U', 'true'])
37+ expected = 0
38+ result = 'Got exit code %d, expected %d\n' % (rc, expected)
39+ self.assertEqual(expected, rc, result + report)
40+
41+ # unload unprivileged_userns profile, let tearDown reload
42+ self.announce("remove unprivileged_userns profile")
43+ if os.path.exists('/etc/apparmor.d/unprivileged_userns'):
44+ self.restore_unprivileged_userns=True
45+ testlib.cmd(['apparmor_parser', '-R', '/etc/apparmor.d/unprivileged_userns'])
46+ expected = 0
47+ result = 'Got exit code %d, expected %d\n' % (rc, expected)
48+ self.assertEqual(expected, rc, result + report)
49+
50 self.announce("checking unshare fails")
51 rc, report = testlib.cmd(['sudo', '-u', self.user.login, '/usr/bin/unshare', '-U', 'true'])
52 expected = 1

Subscribers

People subscribed via source and target branches