Reviewed-by: Mathieu Duponchelle <mathieu.duponchelle@opencreed.com>
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3638

In practice, the regex should always match: AppArmor "confinement
strings" appear to always contain a label and mode, except in the
special case "unconfined". However, if this is untrue for whatever
reason, we should log it as an error, not carry on blindly.

Reviewed-by: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3637

The manual test instructions at
<https://wiki.apertis.org/QA/Test_Cases/apparmor-tracker

> call for
all of these (plus python3, but that's already pulled in by
dh_python3), and the scripts used for the tests do need them.

Reviewed-by: Philip Withnall <philip.withnall@collabora.co.uk>
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3641

Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>

This corresponds to the change made in iptables_1.6.0-2ubuntu3co2.

Bug: https://phabricator.apertis.org/T2214



Reviewed-by: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3767

As with many previous commits, there's no point in installing this
simple script; running it from the git directory gives us faster
fix/test cycles.

Reviewed-by: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3766

Real Apertis images have ~/Documents already, but the Documents
directory isn't created when the filesystem image is picked apart
and reassembled by LAVA. This causes `mktemp`, and hence the
apparmor-libreoffice test, to fail on LAVA.

Relevant to T2104, but does not close it.

Reviewed-by: Luis Araujo <luis.araujo@collabora.co.uk>
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3765

Regression in e562c672 (D3663).

Bug: https://phabricator.apertis.org/T2215



Reviewed-by: Luis Araujo <luis.araujo@collabora.co.uk>
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3764

Our test should be using the session environment as setup by the system
(in lava specifically by run-in-systemd). So remove the hardcoding of
DISPLAY (deprecated on wayland targets anyway), XDG_RUNTIME_DIR (setup
by the environment in all cases) and DBUS_SESSION_BUS_ADDRESS (should be
inferred by XDG_RUNTIME_DIR by all supported dbus libraries)

Reviewed-by: Luis Araujo <luis.araujo@collabora.co.uk>
Signed-off-by: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3664

As soon as there is a dbus user session a session bus should be
available. Only verify that this exists (failling if it doesn't) rather
then trying to workaround things by autolaunching a new bus.

Reviewed-by: Luis Araujo <luis.araujo@collabora.co.uk>
Signed-off-by: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3663

There is a session bus setup by systemd for the normal user, which is
the one all tests should use. Use that by simply running the test as
user user.

Fixes: https://phabricator.apertis.org/T1906



Reviewed-by: Luis Araujo <luis.araujo@collabora.co.uk>
Signed-off-by: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3662

Signed-off-by: Sjoerd Simons <sjoerd.simons@collabora.co.uk>

Configure gbp dch according to
https://phabricator.apertis.org/w/packages/git_flow/



Signed-off-by: Sjoerd Simons <sjoerd.simons@collabora.co.uk>

Simon McVittie authored 8 years ago and Sjoerd Simons committed 8 years ago

Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3651

Simon McVittie authored 8 years ago and Sjoerd Simons committed 8 years ago

NAME was fixed (in T133). Unfortunately, ID wasn't fixed (opens: T2117).

Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3650

Simon McVittie authored 8 years ago and Sjoerd Simons committed 8 years ago

Otherwise it's just a pointless duplicate of system-id.

Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3649

Simon McVittie authored 8 years ago and Sjoerd Simons committed 8 years ago

This should help to debug situations where a process has been
started the wrong way, for example in T1984.

Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3648

Simon McVittie authored 8 years ago and Sjoerd Simons committed 8 years ago

This makes it easier to run outside LAVA.

No functional changes intended, even where the checks I'm copying
are wrong (which will be fixed in subsequent commits).

Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3647

There's no point in providing both.

Reviewed-by: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3635

The more files we use from the $srcdir, the more likely it is that
test fixes can be deployed to LAVA without waiting for a package
rebuild.

Reviewed-by: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3634

This makes it easier to use uninstalled with

    make -C apparmor/libreoffice
    apparmor/libreoffice/libreoffice normal

Reviewed-by: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3633

Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>

Tests that suppress debug output are user-hostile, and we should
stop doing that.

Reviewed-by: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3636

This means we don't have to worry about whether the ${TESTDIR}
is allowed by its AppArmor profile (it shouldn't really be).

Reviewed-by: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3632

Closes: https://phabricator.apertis.org/T2059



Reviewed-by: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3561

Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>

This should hopefully catch failures like T2040, where the launcher
crashed on boot. It checks for ANOM_ABEND lines in the audit log.

Signed-off-by: Philip Withnall <philip.withnall@collabora.co.uk>

Differential Revision: https://phabricator.apertis.org/D3540

This avoids mistakes.

Reviewed-by: Philip Withnall <philip.withnall@collabora.co.uk>
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3490

This was installed but not packaged.

Reviewed-by: Philip Withnall <philip.withnall@collabora.co.uk>
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3489

This lets us run it from /usr/lib/apertis-tests/tumbler if desired.

Reviewed-by: Philip Withnall <philip.withnall@collabora.co.uk>
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3488

This test is run from the source tree, so there's no guarantee
that this query will return anything.

Reviewed-by: Philip Withnall <philip.withnall@collabora.co.uk>
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3487

Reviewed-by: Philip Withnall <philip.withnall@collabora.co.uk>
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3480

This typically makes logs from automated tests more useful.

Reviewed-by: Philip Withnall <philip.withnall@collabora.co.uk>
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3479

Debian Policy §10.4 says "Every script should use set -e or check
the exit status of every command", which is just generally good
advice.

Reviewed-by: Philip Withnall <philip.withnall@collabora.co.uk>
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3478

We need the compiled LD_PRELOAD hack from the installed tree, but
the rest can come from the source, allowing for quicker test/fix
cycles.

Reviewed-by: Philip Withnall <philip.withnall@collabora.co.uk>
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3477

Reviewed-by: Philip Withnall <philip.withnall@collabora.co.uk>
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3476

If we have apertis-tests checked out in ~/apertis-tests or something,
it's nice to be able to run the test uninstalled.

Reviewed-by: Philip Withnall <philip.withnall@collabora.co.uk>
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3475

We use systemd-run to schedule the pactl process to be run under
a vaguely realistic user-session. However, there's a chicken-and-egg
problem here: systemd-run uses either D-Bus or a private socket in
XDG_RUNTIME_DIR to communicate with systemd, and without setting some
environment variables we can't know either of those.

This is similar to the implementation of the same concept in
common/run-test-in-systemd. Unfortunately, the AppArmor tests
need to reinvent that bit, because they run as root (to be able to
manipulate AppArmor, which is a highly privileged action).

Bug-Apertis: https://phabricator.apertis.org/T1859



Reviewed-by: Philip Withnall <philip.withnall@collabora.co.uk>
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3449

The list of profiles and processes isn't all that long. If we're
going to make assertions about this information, we should
probably show it first.

Reviewed-by: Philip Withnall <philip.withnall@collabora.co.uk>
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3448