diff --git a/apparmor/session-lockdown/no-deny b/apparmor/session-lockdown/no-deny index 3eb4bd16248b667a10ed3872e906b5d1fcfddb14..70b43323f0add8231b2ddf724365a72941679b65 100755 --- a/apparmor/session-lockdown/no-deny +++ b/apparmor/session-lockdown/no-deny @@ -31,6 +31,11 @@ def ok(details): test_number += 1 print('ok {} - {}'.format(test_number, details)) +def skip(details): + global test_number + test_number += 1 + print('ok {} # SKIP - {}'.format(test_number, details)) + def not_ok(details): global test_number global failures @@ -213,18 +218,57 @@ def after_reboot(): complain_processes = filter_processes(processes, 'complain') complain_process_profiles = [x[1] for x in complain_processes] - # These processes should (currently) be in complain mode - assert '/usr/sbin/connmand' in complain_process_profiles - - # We might not have Xorg if we are on a Wayland image - if os.path.exists('/usr/bin/Xorg'): - assert '/usr/bin/Xorg' in complain_process_profiles - - # These processes should (currently) be in enforce mode - assert '/usr/bin/pulseaudio' in enforce_process_profiles - assert '/usr/lib/tracker/tracker-miner-fs' in enforce_process_profiles - assert '/usr/lib/tracker/tracker-store' in enforce_process_profiles - assert '/usr/sbin/ofonod' in enforce_process_profiles + # The set of profiles represented by at least one process. + profiles_running = set() + for pid, data in processes.items(): + profiles_running.add(data['profile']) + + # Processes that are currently meant to be in complain mode, and + # if they aren't running it's a problem (either because we started + # them explicitly or they are meant to run on boot) + for profile in ( + '/usr/sbin/connmand', + ): + if profile in complain_process_profiles: + ok('{} in complain mode'.format(profile)) + else: + not_ok('{} should be in complain mode'.format(profile)) + + # Processes that are currently meant to be in complain mode, and + # might not be running at all + for profile in ( + '/usr/bin/Xorg', + ): + if profile not in profiles_running: + skip('{} not running'.format(profile)) + elif profile in complain_process_profiles: + ok('{} in complain mode'.format(profile)) + else: + not_ok('{} should be in complain mode'.format(profile)) + + # Processes that are currently meant to be in complain mode, and + # if they aren't running it's a problem + for profile in ( + '/usr/bin/pulseaudio', + '/usr/sbin/ofonod', + ): + if profile in enforce_process_profiles: + ok('{} in enforce mode'.format(profile)) + else: + not_ok('{} should be in enforce mode'.format(profile)) + + # Processes that are currently meant to be in enforce mode, and + # might not be running at all + for profile in ( + '/usr/lib/tracker/tracker-miner-fs', + '/usr/lib/tracker/tracker-store', + ): + if profile not in profiles_running: + skip('{} not running'.format(profile)) + elif profile in enforce_process_profiles: + ok('{} in enforce mode'.format(profile)) + else: + not_ok('{} should be in enforce mode'.format(profile)) saw_denial = False