There's no point in providing both.

Reviewed-by: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3635

The more files we use from the $srcdir, the more likely it is that
test fixes can be deployed to LAVA without waiting for a package
rebuild.

Reviewed-by: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3634

This makes it easier to use uninstalled with

    make -C apparmor/libreoffice
    apparmor/libreoffice/libreoffice normal

Reviewed-by: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3633

Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>

Tests that suppress debug output are user-hostile, and we should
stop doing that.

Reviewed-by: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3636

This means we don't have to worry about whether the ${TESTDIR}
is allowed by its AppArmor profile (it shouldn't really be).

Reviewed-by: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3632

Closes: https://phabricator.apertis.org/T2059



Reviewed-by: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3561

Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>

This should hopefully catch failures like T2040, where the launcher
crashed on boot. It checks for ANOM_ABEND lines in the audit log.

Signed-off-by: Philip Withnall <philip.withnall@collabora.co.uk>

Differential Revision: https://phabricator.apertis.org/D3540

This avoids mistakes.

Reviewed-by: Philip Withnall <philip.withnall@collabora.co.uk>
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3490

This was installed but not packaged.

Reviewed-by: Philip Withnall <philip.withnall@collabora.co.uk>
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3489

This lets us run it from /usr/lib/apertis-tests/tumbler if desired.

Reviewed-by: Philip Withnall <philip.withnall@collabora.co.uk>
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3488

This test is run from the source tree, so there's no guarantee
that this query will return anything.

Reviewed-by: Philip Withnall <philip.withnall@collabora.co.uk>
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3487

Reviewed-by: Philip Withnall <philip.withnall@collabora.co.uk>
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3480

This typically makes logs from automated tests more useful.

Reviewed-by: Philip Withnall <philip.withnall@collabora.co.uk>
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3479

Debian Policy §10.4 says "Every script should use set -e or check
the exit status of every command", which is just generally good
advice.

Reviewed-by: Philip Withnall <philip.withnall@collabora.co.uk>
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3478

We need the compiled LD_PRELOAD hack from the installed tree, but
the rest can come from the source, allowing for quicker test/fix
cycles.

Reviewed-by: Philip Withnall <philip.withnall@collabora.co.uk>
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3477

Reviewed-by: Philip Withnall <philip.withnall@collabora.co.uk>
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3476

If we have apertis-tests checked out in ~/apertis-tests or something,
it's nice to be able to run the test uninstalled.

Reviewed-by: Philip Withnall <philip.withnall@collabora.co.uk>
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3475

We use systemd-run to schedule the pactl process to be run under
a vaguely realistic user-session. However, there's a chicken-and-egg
problem here: systemd-run uses either D-Bus or a private socket in
XDG_RUNTIME_DIR to communicate with systemd, and without setting some
environment variables we can't know either of those.

This is similar to the implementation of the same concept in
common/run-test-in-systemd. Unfortunately, the AppArmor tests
need to reinvent that bit, because they run as root (to be able to
manipulate AppArmor, which is a highly privileged action).

Bug-Apertis: https://phabricator.apertis.org/T1859



Reviewed-by: Philip Withnall <philip.withnall@collabora.co.uk>
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3449

The list of profiles and processes isn't all that long. If we're
going to make assertions about this information, we should
probably show it first.

Reviewed-by: Philip Withnall <philip.withnall@collabora.co.uk>
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3448

We were running commands like "pactl stat" and then ignoring their
nonzero exit status.

I've included support for ignoring failures, but in fact we never
actually run anything in this test that can legitimately fail, so
it's unused.

Reviewed-by: Philip Withnall <philip.withnall@collabora.co.uk>
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3447

As this test is not valid anymore for Wayland images, just move
it to be executed in SDK images.

Reviewed-by: Héctor Orón Martínez <hector.oron@collabora.co.uk>
Signed-off-by: Luis Araujo <luis.araujo@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3377

The bundle_stream variable will allow to easily set the
bundle stream from the profile file for the different
job templates.

This commit also sets the value of such a variable to
the new stream: /public/personal/apertis-validator/

Reviewed-by: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
Signed-off-by: Luis Araujo <luis.araujo@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D2684

Reviewed-by: Luis Araujo <luis.araujo@collabora.co.uk>
Signed-off-by: Héctor Orón Martínez <hector.oron@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D2625

When raising an exception, it’s generally a good idea to actually
include the exception value — otherwise Python will re-raise the ‘last
exception which was active in the current scope’, which is not so
useful, especially when you want to print that exception.

Reviewed-by: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
Signed-off-by: Philip Withnall <philip.withnall@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D1296

This introduces no behavioural changes.

Reviewed-by: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
Signed-off-by: Philip Withnall <philip.withnall@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D2310

Signed-off-by: Philip Withnall <philip.withnall@collabora.co.uk>

The regexp is not bound to either end of the process name, so despite
the fact that the test script changed its effective process name to
‘ofonod_’, the regexp ‘ofonod’ still matches that, and hence the script
was killing itself, which was causing the systemd unit it was running as
to fail, and hence the overall test to fail.

Tighten the pkill regexp to match at the end of the process name to
avoid this.

Bug-Apertis: https://bugs.apertis.org/show_bug.cgi?id=681



Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Signed-off-by: Philip Withnall <philip.withnall@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D2284

If an AppArmor malicious test is run as a systemd system job (using
`run-test-in-systemd --system`), $HOME will explicitly not be set, which
results in the program trying to read (null)/.bash_history, rather than
the expected /home/user/.bash_history.

Fix that by hard-coding it to use /home/user/.bash_history if $HOME is
not set. If the username changes in future, the tests should start
failing, which will allow us to update it again.

Bug-Apertis: https://bugs.apertis.org/show_bug.cgi?id=681



Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Signed-off-by: Philip Withnall <philip.withnall@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D2283

This matches the command used in ofono.service (minus the --nodetach,
because we want the process to detach so we can do other things in the
test). This eliminates some spurious AppArmor failures caused by the RIL
code, and allows ofono to work (the RIL plugin does not work on the
i.MX6).

Bug-Apertis: https://bugs.apertis.org/show_bug.cgi?id=681



Reviewed-by: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
Signed-off-by: Philip Withnall <philip.withnall@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D2278

As explained in the new comment in the Tumbler mixin, it is possible for
the Error and Ready signals from tumblerd to race if one thumbnailer
fails fast while another succeeds (for the same URI) slowly. This
happened for me with the cover and gst thumbnailers on
big_buck_bunny_smaller.ogv — the cover thumbnailer failed fast because
the search terms ‘big buck bunny smaller’ return nothing on omdbapi.com,
while the gst thumbnailer eventually succeeded by grabbing a frame from
the video.

Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D1299

We can't to anything with bluetooth until its enabled via connman
(otherwise everything else will blocked/soft rfkilled).

Enable it explicitely in the agent so the user doesn't have to first use
connmanctl.

Reviewed-by: Philip Withnall <philip.withnall@collabora.co.uk>
Signed-off-by: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D2209

object_set_properties sets the properties one by one, but the bluez
interface doesn't allow setting Discoverable or Pairable unless the
adaptor is powered. So before setting those, power it on first.

Reviewed-by: Philip Withnall <philip.withnall@collabora.co.uk>
Signed-off-by: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D2208

The simple-agent command line arguments were a bit weird, it can just
act as an agent by giving no arugments or the adaptor to use. However to
pair a specific device a adaptor was mandatory (which is pointless on
most systems with just one adaptor). And for extra fun adding a third
argument which (could be whatever).

Sanitize things by making the device an optional argument rather then a
positional one. Drop the recgonition of the third positional argument
(bluetoothctl can be used instead to remove pairings).

On top of that switch to argparse (The recommended argument parser in
python 3), fix outgoing pairings (with bluez5 you can only trigger a
pairing with devices found during scanning it seems) and add a --yes
argument to accept all incoming connection making it more convenient to
use in testing.

Reviewed-by: Philip Withnall <philip.withnall@collabora.co.uk>
Signed-off-by: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D2207

This variable can be used to specify a base url for the
images url link, which will allow to set http credentials
for those profile requiring so.

Signed-off-by: Luis Araujo <luis.araujo@collabora.co.uk>

Set the main adaptor to be discoverable when starting the simple agent
for incoming pairing requests.

Also set the agent to be the default to prevent an already running
system agent interfering with the test.

Reviewed-by: Philip Withnall <philip.withnall@collabora.co.uk>
Signed-off-by: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D2203

Sometimes just setting the adaptor to be pairable and/or discoverable
as a one-shot action without change notifications is enough. Support
this.

Reviewed-by: Philip Withnall <philip.withnall@collabora.co.uk>
Signed-off-by: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D2202