1# Authors: Karl MacMillan <[email protected]> 2# 3# Copyright (C) 2006 Red Hat 4# see file 'COPYING' for use and warranty information 5# 6# This program is free software; you can redistribute it and/or 7# modify it under the terms of the GNU General Public License as 8# published by the Free Software Foundation; version 2 only 9# 10# This program is distributed in the hope that it will be useful, 11# but WITHOUT ANY WARRANTY; without even the implied warranty of 12# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 13# GNU General Public License for more details. 14# 15# You should have received a copy of the GNU General Public License 16# along with this program; if not, write to the Free Software 17# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 18# 19 20import unittest 21import sepolgen.audit 22import sepolgen.refpolicy 23 24# syslog message 25audit1 = """Sep 12 08:26:43 dhcp83-5 kernel: audit(1158064002.046:4): avc: denied { read } for pid=2 496 comm="bluez-pin" name=".gdm1K3IFT" dev=dm-0 ino=3601333 scontext=user_u:system_r:bluetooth_helper_t:s0-s0:c0 tcontext=system_u:object_r:xdm_tmp_t:s0 tclass=file""" 26 27# audit daemon messages 28audit2 = """type=AVC msg=audit(1158584779.745:708): avc: denied { dac_read_search } for pid=8132 comm="sh" capability=2 scontext=user_u:system_r:vpnc_t:s0 tcontext=user_u:system_r:vpnc_t:s0 tclass=capability""" 29 30log1 = """type=AVC msg=audit(1158584779.745:708): avc: denied { dac_read_search } for pid=8132 comm="sh" capability=2 scontext=user_u:system_r:vpnc_t:s0 tcontext=user_u:system_r:vpnc_t:s0 tclass=capability 31type=SYSCALL msg=audit(1158584779.745:708): arch=40000003 syscall=195 success=no exit=-13 a0=80d2437 a1=bf9132f8 a2=4c56cff4 a3=0 items=0 ppid=8131 pid=8132 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="sh" exe="/bin/bash" subj=user_u:system_r:vpnc_t:s0 key=(null) 32type=AVC msg=audit(1158584779.753:709): avc: denied { dac_override } for pid=8133 comm="vpnc-script" capability=1 scontext=user_u:system_r:vpnc_t:s0 tcontext=user_u:system_r:vpnc_t:s0 tclass=capability 33type=AVC msg=audit(1158584779.753:709): avc: denied { dac_read_search } for pid=8133 comm="vpnc-script" capability=2 scontext=user_u:system_r:vpnc_t:s0 tcontext=user_u:system_r:vpnc_t:s0 tclass=capability 34type=SYSCALL msg=audit(1158584779.753:709): arch=40000003 syscall=195 success=no exit=-13 a0=80d2437 a1=bf910a48 a2=4c56cff4 a3=0 items=0 ppid=8132 pid=8133 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="vpnc-script" exe="/bin/bash" subj=user_u:system_r:vpnc_t:s0 key=(null) 35type=AVC msg=audit(1158584779.825:710): avc: denied { dac_override } for pid=8134 comm="vpnc-script" capability=1 scontext=user_u:system_r:vpnc_t:s0 tcontext=user_u:system_r:vpnc_t:s0 tclass=capability 36type=AVC msg=audit(1158584779.825:710): avc: denied { dac_read_search } for pid=8134 comm="vpnc-script" capability=2 scontext=user_u:system_r:vpnc_t:s0 tcontext=user_u:system_r:vpnc_t:s0 tclass=capability 37type=SYSCALL msg=audit(1158584779.825:710): arch=40000003 syscall=195 success=no exit=-13 a0=80d2437 a1=bf910a48 a2=4c56cff4 a3=0 items=0 ppid=8132 pid=8134 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="vpnc-script" exe="/bin/bash" subj=user_u:system_r:vpnc_t:s0 key=(null) 38type=AVC msg=audit(1158584780.793:711): avc: denied { dac_override } for pid=8144 comm="sh" capability=1 scontext=user_u:system_r:vpnc_t:s0 tcontext=user_u:system_r:vpnc_t:s0 tclass=capability 39type=AVC msg=audit(1158584780.793:711): avc: denied { dac_read_search } for pid=8144 comm="sh" capability=2 scontext=user_u:system_r:vpnc_t:s0 tcontext=user_u:system_r:vpnc_t:s0 tclass=capability 40type=SYSCALL msg=audit(1158584780.793:711): arch=40000003 syscall=195 success=no exit=-13 a0=80d2437 a1=bfc0ba38 a2=4c56cff4 a3=0 items=0 ppid=8131 pid=8144 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="sh" exe="/bin/bash" subj=user_u:system_r:vpnc_t:s0 key=(null) 41type=AVC msg=audit(1158584780.797:712): avc: denied { dac_override } for pid=8145 comm="vpnc-script" capability=1 scontext=user_u:system_r:vpnc_t:s0 tcontext=user_u:system_r:vpnc_t:s0 tclass=capability 42type=AVC msg=audit(1158584780.797:712): avc: denied { dac_read_search } for pid=8145 comm="vpnc-script" capability=2 scontext=user_u:system_r:vpnc_t:s0 tcontext=user_u:system_r:vpnc_t:s0 tclass=capability 43type=SYSCALL msg=audit(1158584780.797:712): arch=40000003 syscall=195 success=no exit=-13 a0=80d2437 a1=bfc0b188 a2=4c56cff4 a3=0 items=0 ppid=8144 pid=8145 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="vpnc-script" exe="/bin/bash" subj=user_u:system_r:vpnc_t:s0 key=(null) 44type=AVC msg=audit(1158584780.801:713): avc: denied { dac_override } for pid=8146 comm="vpnc-script" capability=1 scontext=user_u:system_r:vpnc_t:s0 tcontext=user_u:system_r:vpnc_t:s0 tclass=capability 45type=AVC msg=audit(1158584780.801:713): avc: denied { dac_read_search } for pid=8146 comm="vpnc-script" capability=2 scontext=user_u:system_r:vpnc_t:s0 tcontext=user_u:system_r:vpnc_t:s0 tclass=capability 46type=AVC_PATH msg=audit(1162850461.778:1113): path="/etc/rc.d/init.d/innd" 47""" 48 49granted1 = """type=AVC msg=audit(1188833848.190:34): avc: granted { getattr } for pid=4310 comm="ls" name="foo.pp" dev=sda5 ino=295171 scontext=user_u:system_r:unconfined_t:s0 tcontext=user_u:object_r:user_home_t:s0 tclass=file""" 50 51path1 = """type=AVC_PATH msg=audit(1162852201.019:1225): path="/usr/lib/sa/sa1" 52""" 53 54log2 = """type=AVC_PATH msg=audit(1162852201.019:1225): path="/usr/lib/sa/sa1" 55type=SYSCALL msg=audit(1162852201.019:1225): arch=40000003 syscall=11 success=yes exit=0 a0=87271b0 a1=8727358 a2=8727290 a3=8727008 items=0 ppid=6973 pid=6974 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="sa1" exe="/bin/bash" subj=system_u:system_r:crond_t:s0-s0:c0.c1023 key=(null) 56type=AVC msg=audit(1162852201.019:1225): avc: denied { execute_no_trans } for pid=6974 comm="sh" name="sa1" dev=dm-0 ino=13061698 scontext=system_u:system_r:crond_t:s0-s0:c0.c1023 tcontext=system_u:object_r:lib_t:s0 tclass=file 57type=AVC msg=audit(1162852201.019:1225): avc: denied { execute } for pid=6974 comm="sh" name="sa1" dev=dm-0 ino=13061698 scontext=system_u:system_r:crond_t:s0-s0:c0.c1023 tcontext=system_u:object_r:lib_t:s0 tclass=file""" 58 59xperms1 = """type=AVC msg=audit(1516626657.910:4461): avc: denied { ioctl } for pid=4310 comm="test" path="/root/test" ino=8619937 ioctlcmd=0x42 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:test_file_t:s0 tclass=file permissive=0 60""" 61xperms2 = """type=AVC msg=audit(1516626657.910:4461): avc: denied { ioctl } for pid=4310 comm="test" path="/root/test" ino=8619937 ioctlcmd=0x42 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:test_file_t:s0 tclass=file permissive=0 62type=AVC msg=audit(1516626657.910:4461): avc: denied { ioctl } for pid=4310 comm="test" path="/root/test" ino=8619937 ioctlcmd=0x1234 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:test_file_t:s0 tclass=file permissive=0 63type=AVC msg=audit(1516626657.910:4461): avc: denied { ioctl } for pid=4310 comm="test" path="/root/test" ino=8619937 ioctlcmd=0xdead scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:test_file_t:s0 tclass=file permissive=0 64type=AVC msg=audit(1516626657.910:4461): avc: denied { getattr } for pid=4310 comm="test" path="/root/test" ino=8619937 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:test_file_t:s0 tclass=dir permissive=0 65""" 66xperms_invalid = """type=AVC msg=audit(1516626657.910:4461): avc: denied { ioctl } for pid=4310 comm="test" path="/root/test" ino=8619937 ioctlcmd=asdf scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:test_file_t:s0 tclass=file permissive=0 67""" 68xperms_without = """type=AVC msg=audit(1516626657.910:4461): avc: denied { ioctl } for pid=4310 comm="test" path="/root/test" ino=8619937 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:test_file_t:s0 tclass=file permissive=0 69""" 70 71class TestAVCMessage(unittest.TestCase): 72 def test_defs(self): 73 avc = sepolgen.audit.AVCMessage(audit1) 74 sc = sepolgen.refpolicy.SecurityContext() 75 self.assertEqual(avc.scontext, sc) 76 self.assertEqual(avc.tcontext, sc) 77 self.assertEqual(avc.tclass, "") 78 self.assertEqual(avc.accesses, []) 79 self.assertEqual(avc.ioctlcmd, None) 80 81 def test_granted(self): 82 avc = sepolgen.audit.AVCMessage(granted1) 83 avc.from_split_string(granted1.split()) 84 85 self.assertEqual(avc.scontext.user, "user_u") 86 self.assertEqual(avc.scontext.role, "system_r") 87 self.assertEqual(avc.scontext.type, "unconfined_t") 88 self.assertEqual(avc.scontext.level, "s0") 89 90 self.assertEqual(avc.tcontext.user, "user_u") 91 self.assertEqual(avc.tcontext.role, "object_r") 92 self.assertEqual(avc.tcontext.type, "user_home_t") 93 self.assertEqual(avc.tcontext.level, "s0") 94 95 self.assertEqual(avc.tclass, "file") 96 self.assertEqual(avc.accesses, ["getattr"]) 97 98 self.assertEqual(avc.denial, False) 99 100 def test_xperms(self): 101 """Test that the ioctlcmd field is parsed""" 102 avc = sepolgen.audit.AVCMessage(xperms1) 103 recs = xperms1.split() 104 avc.from_split_string(recs) 105 106 self.assertEqual(avc.ioctlcmd, 66) 107 108 def test_xperms_invalid(self): 109 """Test message with invalid value in the ioctlcmd field""" 110 avc = sepolgen.audit.AVCMessage(xperms_invalid) 111 recs = xperms_invalid.split() 112 avc.from_split_string(recs) 113 114 self.assertIsNone(avc.ioctlcmd) 115 116 def test_xperms_without(self): 117 """Test message without the ioctlcmd field""" 118 avc = sepolgen.audit.AVCMessage(xperms_without) 119 recs = xperms_without.split() 120 avc.from_split_string(recs) 121 122 self.assertIsNone(avc.ioctlcmd) 123 124 def test_from_split_string(self): 125 # syslog message 126 avc = sepolgen.audit.AVCMessage(audit1) 127 recs = audit1.split() 128 avc.from_split_string(recs) 129 130 self.assertEqual(avc.header, "audit(1158064002.046:4):") 131 self.assertEqual(avc.scontext.user, "user_u") 132 self.assertEqual(avc.scontext.role, "system_r") 133 self.assertEqual(avc.scontext.type, "bluetooth_helper_t") 134 self.assertEqual(avc.scontext.level, "s0-s0:c0") 135 136 self.assertEqual(avc.tcontext.user, "system_u") 137 self.assertEqual(avc.tcontext.role, "object_r") 138 self.assertEqual(avc.tcontext.type, "xdm_tmp_t") 139 self.assertEqual(avc.tcontext.level, "s0") 140 141 self.assertEqual(avc.tclass, "file") 142 self.assertEqual(avc.accesses, ["read"]) 143 144 self.assertEqual(avc.comm, "bluez-pin") 145 146 147 self.assertEqual(avc.denial, True) 148 149 # audit daemon message 150 avc = sepolgen.audit.AVCMessage(audit2) 151 recs = audit2.split() 152 avc.from_split_string(recs) 153 154 self.assertEqual(avc.header, "audit(1158584779.745:708):") 155 self.assertEqual(avc.scontext.user, "user_u") 156 self.assertEqual(avc.scontext.role, "system_r") 157 self.assertEqual(avc.scontext.type, "vpnc_t") 158 self.assertEqual(avc.scontext.level, "s0") 159 160 self.assertEqual(avc.tcontext.user, "user_u") 161 self.assertEqual(avc.tcontext.role, "system_r") 162 self.assertEqual(avc.tcontext.type, "vpnc_t") 163 self.assertEqual(avc.tcontext.level, "s0") 164 165 self.assertEqual(avc.tclass, "capability") 166 self.assertEqual(avc.accesses, ["dac_read_search"]) 167 168 self.assertEqual(avc.comm, "sh") 169 170 self.assertEqual(avc.denial, True) 171 172class TestPathMessage(unittest.TestCase): 173 def test_from_split_string(self): 174 path = sepolgen.audit.PathMessage(path1) 175 recs = path1.split() 176 path.from_split_string(recs) 177 self.assertEqual(path.path, "/usr/lib/sa/sa1") 178 179# TODO - add tests for the other message types 180 181 182# TODO - these tests need a lot of expansion and more examples of 183# different types of log files 184class TestAuditParser(unittest.TestCase): 185 def test_parse_string(self): 186 a = sepolgen.audit.AuditParser() 187 a.parse_string(log1) 188 self.assertEqual(len(a.avc_msgs), 11) 189 self.assertEqual(len(a.compute_sid_msgs), 0) 190 self.assertEqual(len(a.invalid_msgs), 0) 191 self.assertEqual(len(a.policy_load_msgs), 0) 192 self.assertEqual(len(a.path_msgs), 1) 193 194 def test_post_process(self): 195 a = sepolgen.audit.AuditParser() 196 a.parse_string(log2) 197 self.assertEqual(len(a.avc_msgs), 2) 198 self.assertEqual(a.avc_msgs[0].path, "/usr/lib/sa/sa1") 199 self.assertEqual(a.avc_msgs[1].path, "/usr/lib/sa/sa1") 200 201 def test_parse_file(self): 202 f = open("audit.txt") 203 a = sepolgen.audit.AuditParser() 204 a.parse_file(f) 205 f.close() 206 self.assertEqual(len(a.avc_msgs), 21) 207 self.assertEqual(len(a.compute_sid_msgs), 0) 208 self.assertEqual(len(a.invalid_msgs), 0) 209 self.assertEqual(len(a.policy_load_msgs), 0) 210 211 def test_parse_xperms(self): 212 """ Test that correct access vectors are generated from a set of AVC 213 denial messages. """ 214 a = sepolgen.audit.AuditParser() 215 a.parse_string(xperms2) 216 av_set = a.to_access() 217 218 self.assertEqual(len(av_set), 2) 219 av_list = list(sorted(av_set)) 220 self.assertEqual(av_list[0].xperms, {}) 221 self.assertEqual(list(av_list[1].xperms), ["ioctl"]) 222 self.assertEqual(av_list[1].xperms["ioctl"].ranges, [(66,66), 223 (4660,4660), (57005,57005)]) 224 225class TestGeneration(unittest.TestCase): 226 def test_generation(self): 227 parser = sepolgen.audit.AuditParser() 228 parser.parse_string(log1) 229 avs = parser.to_access() 230 231 self.assertEqual(len(avs), 1) 232 233 def test_generation_granted(self): 234 parser = sepolgen.audit.AuditParser() 235 parser.parse_string(granted1) 236 avs = parser.to_access() 237 238 self.assertEqual(len(avs), 0) 239 240 avs = parser.to_access(only_denials=False) 241 242 self.assertEqual(len(avs), 1) 243 244